Colossal Order hasn’t given us an indication of what level of performance these specs will guarantee. Although, considering how old the hardware is, we believe this will place you firmly in the ...

Cities Skylines 2 system requirements

Our solar system is made up of a star—the Sun—eight planets, 146 moons, a bunch of comets, asteroids and space rocks, ice, and several dwarf planets, such as Pluto. The eight planets are Mercury, Venus, Earth, Mars, Jupiter, Saturn, Uranus, and Neptune.

Our Solar System

An automated Veterans Affairs system meant to help accelerate claims decisions actually helped contribute to inaccurate ratings on 27% of high blood pressure claims. A VA Office of the Inspector ...

Veterans plagued by errors in health benefit system due to computer mishap

Read on to see if it’s right for you. A cloud-based phone system, or cloud phone, is a phone service that allows you to make calls over the internet rather than over a traditional analog phone ...

Should You Get A Cloud-Based Business Phone System?

The controls are bolstered by Meris's stunning menu screen graphics, with parameters that can be controlled by the C1 and C2 knobs beneath. This becomes the gateway to deep-dive editing with your reverb sounds, in addition to scrolling through presets and your own favourite sounds with the C3 control to the right of the screen.

Meris aims to shake up the ambient reverb pedal market with its MercuryX Modular Reverb System

For people who smoke cannabis once a day or more, tests may detect it in their system for 30 days or longer. Detection windows also depend on the kind of test a person undertakes. The most common ...

How long can you detect cannabis (marijuana) in the body?

President Biden promises Israel will get all the missile interceptors it needs. President Joe Biden has announced that the United States is "surging" additional military assistance to Israel ...

What is Israel's Iron Dome air defense system -- and was it overwhelmed?

Sick New World is returning in 2024 to the Las Vegas Festival Grounds on April 27th, and the one-day music extravaganza once again boasts a stacked lineup System of a Down are reprising their role as festival headliners, and are joined this year by Slipknot.

Sick New World 2024 Lineup: System of a Down, Slipknot, and More

Staples, Minn.-based Lakewood Health System is acquiring a local pharmacy. Lakewood, which has 12 senior care and health clinic locations, will assume management and operations of Longbella Drug ...

Minnesota system buys independent pharmacy

LVX System

lvxsystem

I’m a heavy user and also a code contributor to Apache Superset. Running Superset on my MacBook is the only reason to have a Docker(still a VM inside?) installed which I think is too heavy. Superset puts most heavy work onto the database side, I was thinking is there may be some possibility to have a to make it easier to use Superset on my MacBook. Superset.app My technical stack is mainly backend, some keywords like: Python, Golang, C, Backend I have absolutely no experience with Objective-C or Swift and don’t even understand how a macOS App and a UNIX executable are related. But it still deserves a try. Packaging Apache Superset is a Python + React project, to avoiding introduce a new stack,  I think using Python to develop the UI part might be easy. For the backend, everyone using Python knows that the packaging is a really complex problem. Especially with Python packages including dynamically linked shared libraries(*.dylib or *.so). Some people may say what about using to generate a and install them on the first launch. Well, there may be mainly 2 problems: pip freeze requirement.txt It will break the convention of “Dragging into Trash means Uninstall”. The user’s Python environment may also be polluted and cause various problems. After some Googling, I found there are mainly 3 tools I can use to do the packaging: PyInstaller (9.2k stars, Windows/Linux/macOS) cx_Freeze (905 stars, Windows/Linux/macOS) Py2app (189 stars, macOS only but actively developing) PyInstaller is a pretty old project, a lot of Python-based Windows programs are built with it, and not to mention, it has 9.2k stars. Typically the most “stared” tool is the best choice, but not this time. As far as I know, there is no silver bullet to solve these packaging problems. Most of the packaging tools have to keep a bunch of recipes to solve the tricky libs. Superset introduces a lot of database drivers which are hard to deal with. With years of experience solving the problems, I need a relatively simple tool in case of hacking is needed. So my decision is to give py2app a try. *.dylib *.so Dynamic Libs I suffered from the Linux dynamic lineage problems. Linux kernel ABI is quite stable, and Glibc handles the ABI very carefully. Even libs like OpenSSL tried their best to keep a stable ABI. But the upper-level libs shipped with different Linux distributions and pkg management systems constructed a matrix. When it comes to macOS, most libs shipped with the system are quite stable and things in Linux like , , , are merged into . libc libc++ libpthread libm libSystem.B.dylib Although, the command in macOS is not GNU version, you can still see the big difference of dependent libs of between CentOS 8.1 macOS 12.3. ps /bin/ps and Solving the packaging of dynamic libs is quite nasty. But I think the main principles are just two: Keep necessary lib at its lowest version Trim lib to minimal from the upper level The first principle is easy to understand, lower version lib usually means less API required. But AFAIK, macOS doesn’t provide any cross-compiling way to do that. All I have to do is compile SuperChart on a lower version of macOS. To do that I brought a second-hand Mac Mini released in 2009 and installed macOS 10.15 with . macOS Catalina Patcher For the “Trim lib” part, here is an example of how I tried to solve the dependence tree. To upload SuperChart to MAS (Mac App Store), I have to get rid of the dependence of which introduced by . pyarrow Security.framework pyarrow First, I tried to remove pyarrow from SuperChart. Later I found that it may cost a lot because it is not only involved in the parquet reading part but also in the superset serializing part. After some digging, I realized that the seems to be some system-level OpenSSL in macOS. As we usually use pyarrow for serializing/deserializing or parquet reading, I don't think the crypto stuff is not really necessary for pyarrow. Security.framework Easy to know pyarrow is just a Python binding of . So all I need to do is trim libArrow out of the . Thanks to the well-implemented Arrow compiling system, after some flags are set. I got a very clean . Apache Arrow Security.framework libarrow.500.dylib Frontend For the frontend, there are 2 kinds of choices: GUI Frameworks: PyQT, Tkinter, wxPython, Kivy, PySide (So much old and new frameworks)… Web-Based Frameworks: Electron Here are some useful comparisons or lists for “Python GUI Framework” Tkinter/PyQT/PySide/Kivy Comparison with Helloworld Some old but “official” list Yet another “Awesome XXX”, but with 128k stars It seems there are much more options that can cause confusion. So I have to sort my specific needs instead of just Googling “Python GUI Framework” and choosing the most popular one. Here are my needs: Superset is a really big project, I don’t want to rewrite the whole React stuff I just wanna a macOS app, not a Linux, Windows, or any mobile platform The smaller the better Electron.js is really really popular, after simply: ps aux | grep '(Renderer).app' | grep -v "Google Chrome.app" I came across 3 Apps built with Electron.js that are currently running on my MacBook. But as I know, nearly every OS is shipping with an inside to make it easy for the App to open a web page. Why don't I just use that instead of packaging a Chromium which makes my package approximately 100MB larger? XXWebView So I got which let me open and control to emulate an App UI. And also, thanks to my "the smaller the better" choice made it possible to put to MAS. As Chromium uses some deprecated API of macOS which is not allowed for MAS. pywebview WKWebview SuperChart Maybe the title could be "How I put a Python-based App onto Mac App Store". SuperChart in MAS Also published here.

Making Apache Superset into a macOS App

The past few years have seen a glut of news about cryptocurrencies and distributed ledgers. Beginning with Bitcoin’s startling rise to fame as a sort of ‘digital gold’ with no central authority, to the rapid appearance of new players like Ethereum, Ripple, and IOTA in the following decade, it seemed that the tech world couldn’t get enough of crypto. ( ) Featured Image by Vincent Botta on Unsplash But as with any hype cycle, the sparkle eventually tarnished. Faithful crypto fans hodl on, but the rest of us are starting to tire. So why am I choosing now to talk about a ‘new’ type of cryptocurrency? In a mere six months, the world we knew has dissolved and an unfamiliar one has taken its place. The COVID-19 pandemic has shaken the socioeconomic system, exposing its fragility and dysfunction in the forms of economic recession, systemic injustice, ecological degradation, cascading institutional failures, and political chaos. I believe, along with a choir of voices, that many of these problems are caused or accelerated by the way we’ve designed our currencies and the way they shape our economy. growing Cryptocurrency advocates are veterans of the chorus, but they’re not the only voices and certainly not the oldest. Decentralised digital gold is an interesting idea, but I think it’s merely a minor tweak on the current broken money system. (And it creates of its own.) new problems Read on for an introduction to a radically different, but very old, take on money. Okay, so tell me about this ‘mutual credit’ thing. Not yet! First I’d like to unpack the last few thousand years of human history. I promise it won’t take long. The world’s peoples have taken many different paths from the tribal gift economy to the global capitalist marketplace, but the most popular stories take two forms. Story 1: from gift to barter to metal Economists like give us the standard story: as we became civilised, we started bartering for the goods we needed. Adam Smith This didn’t always work well when Alice had eggs and wanted firewood, but Bob wanted eggs and had blankets. So we turned to universally desirable things to lubricate our exchanges—commodities like grain at first, and eventually pieces of metal. Services popped up—granaries, banks—offering to store your wealth in exchange for a fee. But hard money had problems of its own. First of all, you could only spend as much as you actually had. So we moved away from hard money to promises—tokens of debt. Banks stepped in once again to mediate these promises, offering immediate money to the seller and credit (with interest) to the buyer. Now everyone had access to a lot more money, which resulted in an explosion of prosperity in the 19th and 20th centuries. Now, in the 21st century, banks are the dominant player in the governance of currencies, making the most important decisions about how much money there is, who gets it, and at what cost. Some say that this is a great idea (mostly the banks), and others say it’s created an absolute mess. Story 2: from gift to promise to metal Anthropologists like David Graeber . They claim that as societies grew, humans used IOUs, not seeds, shells, and silver, as their first currencies. In other words, if Bob wanted eggs but didn’t have any firewood yet, he’d just ask Alice nicely for eggs and promise to pay her back later when he found a tree to cut down. say that Story 1 has it all backwards Money emerged later as a way of paying debts that couldn’t be repaid by settling an IOU. Maybe the debt was a symbolic one (such as tithes and dowries), or because the parties were too far away from each other (such as international trade). It was especially popular with states and state-backed religions, who used it to pay for projects and wars, then expected it back later as tax and tribute. It was only afterwards that people decided it was a decent unit of general exchange too. From then on, this story converges with the standard story; metal is slowly replaced by bank-issued credit. See above re: mess. Where we are now I’m not smart enough to know which of these stories holds the most truth. And I have a feeling that none of the experts were around 5000 years ago, so they don’t know either. But I find it interesting that they agree on a few points: The gift economy worked quite well for small groups. As groups grew larger and networks of trust were stretched thinner, we started creating currencies as a substitute for relationships. Credit/debt/IOUs play an important part in an economy no matter what other currencies are being used. Currencies tend to be used as tools to centralise power and concentrate wealth in fewer and fewer hands. Okay, now can we talk about your mutual credit thing? Yes please! Let’s return to Alice the farmer and Bob the weaver. You’ll remember that Alice has given Bob some eggs on his promise of a future delivery of firewood. They’ve solved the problem together—they no longer had to wait until they both had something the other wanted. coincidence of wants But let’s say Bob isn’t the wood-chopping type. Now Alice isn’t so sure she wants to give him any eggs. Not that she doesn’t trust him; she just doesn’t think she’ll ever see that firewood. Enter Bob’s neighbour Charlie. He’s a woodcutter who spends a lot of time outside in the winter. And we already know Bob makes superb blankets. Charlie knows that too, and he’s had his eye on a fetching red one. I think you can see where this is going—Bob can use his social connections to underwrite his promise. Now Alice has more confidence in this deal. Bob still gets his eggs on a promise, Charlie gives Bob some firewood in exchange for a nice new blanket, and Alice gets her firewood. Everyone’s warm and well-fed this winter. This is great, but it’s a little fiddly. Why does Bob have to be in the middle? He could just promise Alice a blanket, she could trade that promise with Charlie for some firewood, and Charlie could redeem Bob’s promise himself. Goods flow one way, the promise flow the other way, until the obligation is settled. If you like, you can write these promises down on a piece of paper. That makes it easier for everyone to keep track of them. And you can make them even more versatile by tying their value to some sort of reference unit. Now you don’t need to worry about how many eggs a blanket is worth; you just price each thing against the general unit. Suddenly, those promises are starting to look a lot like… money. Bob dollars, if you will. (And Alice and Charlie dollars too.) Now we’re well on our way to creating a general-purpose currency. But here’s the odd thing: now that these promises are tradeable, it doesn’t make much sense to say that Bob is obligated to Alice. He’s obligated to the economy at large. We can drop terms like ‘debtor’ and ‘creditor’ which speak of individual relationships. This removes the danger of Bob falling into to Alice. And it also spreads the cost of across the entire economy, rather than forcing Alice to take on all the risk. debt bondage defaulted promises And that’s the basis for mutual credit. In a typical implementation, instead of circulating paper promises, each person has their own ledger that records all the promises made and received. It’s really just massively multiplayer double-entry accounting (sexy, right?) When Bob gives a promise to Alice, he records it as a negative number in his ledger and she records it as a positive number in hers. When that promise makes it back to Bob, his negative balance is erased. Because every promise made is matched by a promise received, the net money supply across all participants’ ledgers is always zero. The circulating money supply, however, equals all the outstanding promises. But wait—is credit a good thing? Isn’t this just how banks from thin air? create money Well, sort of. I’m still trying to understand just how banks work—I suspect . It’s bloody complicated, probably intentionally so. What I do understand is that new money enters circulation when banks issue loans, and it disappears as those loans are repaid. And, just like mutual credit, it happens through a on various ledgers. I’m not alone series of debit and credit records Here’s the big difference, as I see it. With the bank-led credit system, banks have outsized power in the creation and distribution of money. Whereas with mutual credit, the entire economy gets involved. Each transaction is an agreement between two parties to create, honour, or destroy money. The other difference is that banks lend out their money at interest, and I’ve never seen a mutual credit system that does that. Interest seems to create a vicious cycle of wealth drainage, causing borrowers to borrow more money or extract wealth from elsewhere in order to pay the rent on the money borrowed. It’d be nice to move away from that. When it’s designed well, mutual credit can help match the money supply to the economy. It , expanding and contracting with the creation and settlement of promises as goods and services are exchanged. When Bob gives Charlie that blanket, the money just disappears—no interest due, no runaway inflation or deflation. ‘breathes’ Money ceases to be a thing unto itself; it’s just a medium of exchange, a way of measuring the flow of the things that really mean something to us. And maybe that’s a good thing—when we say we want more money, maybe what we really mean is that we’re feeling squeezed and we wish we felt better equipped to take care of ourselves and maybe even indulge in a few nice-to-haves. Money isn’t the point; is. deep wealth Is this safe? I know some people whose promises aren’t worth the energy it takes to shake their hand. You might be right; if people go around making promises they can’t keep, this could result in something like inflation—there’s too much being promised with not enough real value to back it up. You might end up with a pile of credits and nothing to spend them on. There are ways to design a currency to discourage freeloading, credit limits being the most popular. We’ll look at these and other important design choices in a later article. So, does this thing work? Is anyone actually doing it? Absolutely! There are lots of good examples of mutual credit in the wild. , created by Michael Linton when the major employer in his small town shut down, is perhaps the original example of community mutual credit and a model for . LETSystems typically use federal currency as a unit. People tend to set them up when there’s not enough ‘real’ money to go around. LETS in the 1980s many others around the world share a philosophical heritage with LETSystems, but use people’s time as a unit. The idea was and further promoted by , who explains that it had its roots in a time when money for social programmes had dried up. Time-based community currencies received strong support from the United Nations in their 2000 . Timebanks invented by Teruko Mizushima in 1973 Edgar S Cahn Millennium Declaration Report , while mutual credit, is still an entirely , similar to when Bob acted as a trusted intermediary between Alice and Charlie. (The XRP cryptocurrency is there just to pay the central intermediary nodes for their services.) Ripple not strictly credit-based network , a business-to-business mutual credit network in Sardinia, Italy, was born in the wreckage of the 2008 credit default crisis when the Sardinian economy went into a deep depression. Sardex allowed businesses to keep transacting with each other even if they didn’t have enough euros, and has in the past 11 years. Sardex facilitated €31.3m in transactions among 2900 businesses , which describe themselves as business-to-business barter networks, aren’t really barter at all—they’re really just mutual credit. IRTA, the International Reciprocal Trade Association, that 400,000 businesses participated in $14 billion of trade exchange transactions in 2019. Trade exchanges estimates Intermission Here we are at the end of part 1. You’ve travelled a long way—about five thousand years—and I’m proud of you. We’ve started at the early days of human culture with the gift economy, seen it evolve into the promise economy, and learned how the promise economy never really went away amidst all of our other monetary experiments. Finally we explored mutual credit, a way to turn promises into a general-purpose currency. I get excited about mutual credit because I see it as a bridge—compatible with our current economic practices, yet inviting in a different way of doing business that just might help us move beyond our current degenerative, extractive, exploitative reality. But this is Hacker Noon, and you’re here for the tech. Radical innovations in money deserve radical tech, so in the next article I’ll introduce Holochain, a framework for building distributed applications, and explain how you can use it to build mutual credit currencies. I think it’s a nearly perfect match; compared to client/server and blockchain, Holochain gets us a lot closer to the ideal of self-sovereign peer-to-peer interactions. And I think that’s a necessary requisite for building a liberating, people-powered, regenerative economy. Previously published at https://blog.holochain.org/mutual-credit-part-1-a-new-type-of-cryptocurrency-as-old-as-civilisation/

A Cryptocurrency, As Old As Civilisation: Mutual Credit - Part I

Bypassing SSL Pinning with LLDB on AppStore iOS apps [A Step by Step Guide]

The Alibaba tech team’s OS jailbreak internals (Article by Zheng Min郑旻 and Bai Xiaolong白小龙 from the ) Alibaba Security Lab Sandbox Apple’s sandbox was introduced as “SeatBelt” in macOS 10.5 which provided the first full-fledged implementation of the MACF policy. After a successful trial on macOS, Apple applied sandbox mechanism to iOS 6. In its implementation, the policy hooked dozens of operations. The number of hooks has been growing steadily when new system calls or newly discovered threats appeared. The following table shows the hook count of sandbox in different XNU versions: From *OS internals In the beginning, Apple’s sandbox used a black list approach which means Apple originally concentrated on the known dangerous APIs and blocked them, allowing all others by default. However, with the evolution of Apple’s sandbox, it applies a white list approach that denies all APIs and only allows secure ones that Apple trusts. In macOS, profiles are visible and stored in /System/Library/Sandbox/Profiles. In iOS, the profiles were hard-compiled into /usr/libexec/sandboxd. It’s hard for us to decode the sandbox profiles, but we can traverse all Mach services to get the mach-lookup list according to the return value (e.g., through JL’s sbtool). In order to find vulnerabilities, we need to disassemble and analyze the binaries which contain the handler functions of related Mach services. Luckily, /System/Library/LaunchDaemons contains the configuration plist of most Mach services. In the plist files, “ProgramArguments” shows the path of the binary and “MachServices” shows the related Mach services. Therefore, by combining the LaunchDaemons plist files with mach-lookup list, we can get all the Mach services and related binaries which can be accessed inside the sandbox. iOS IPC: Mach, XPC and NSXPC There are a rich set of IPC mechanisms (e.g., URL schemes, Mach, pipes) on iOS and most of them are available to third-party apps. In this paper, we focus on Mach IPC, which provides a message-oriented and capability-based IPC facility. Mach IPC represents an evolution of similar approaches used by its precursors, namely, Accent and RIG. The low-level IPC implementation of Mach leverages the VM subsystem to efficiently transfer large amounts of data with the help of copy-on-write optimizations. In addition, Mach messages contain typed data, which can include port rights and references to large regions of memory. Based on Mach message, Apple developed XPC which is a lightweight mechanism for basic inter process communication integrated with GCD and launchd. Compared with raw Mach message, XPC is safer and easier to use. But, the cost of XPC service maintaining is very heavy. NSXPC message is built on top of XPC message which allows the abstraction of XPC connections and remote objects. Through Mach message, XPC message, and NSXPC message, sandboxed app can communicate with unsandboxed Mach services, XPC services and NSXPC services. Therefore, if the services don’t handle the message in expected ways, they may be corrupted by sandboxed apps. From Old Bugs to 0-day Bugs In iOS 11.2.5, Apple fixed a session hijack vulnerability in bluetoothd (CVE-2018–4087 by @raniXCH). There are 132 functions in the “com.apple.server.bluetooth” Mach service of bluetoothd. And the vulnerability existed in the BTLocalDeviceAddCallbacks() function. A sandboxed app can use BTSessionAttach to create a session_token for bluetoothd and then use BTLocalDeviceAddCallbacks() to register a callback for event notification. However, Bluetoothd only uses the session token to identify the process which means we can use a sandboxed app to hijack a communication between bluetoothd and unsandboxed processes through the session token, then control the PC pointer of unsandboxed processes. In addition, the session token is too easy to be brute forced because it only has 0x10000 (0x0000 -0xFFFF) possible values. In iOS 11.2.5, Apple fixed this problem by adding a user_id (=arc4random()) to each session. Only the process knows the user_id and bluetoothd will check the map of ses_token with user_id. However, after analyzing other functions, we found two new zero-day bugs. The first bug exists in BTAccessoryManagerAddCallbacks(). Same as BTLocalDeviceAddCallbacks(), BTAccessoryManagerAddCallbacks() will register a callback for BTAccessoryManger but the attacker doesn’t need to provide a user_id. However, the callback event can be triggered only when the iOS device connects to a new device. It means we need to click the bluetooth device in the setting manually in order to trigger the callback event. Luckily, we found another bug existed in the discovery agent of bluetooth. A sandboxed app can use BTDiscoveryAgentCreate() to create a discovery agent callback for other processes and then use BTDiscoveryAgentStartScan() to trigger the callback event without manual click. Update: these two “zero-day”bugs were reported to Apple on June 7, Apple fixed them in iOS 11.4.1 as well as iOS 12 beta with CVE-2018–4330 and CVE-2018–4327. Please update your iOS to the latest iOS 11.4.1 to defend against potential attacks. From PC control to ROP The goal of our exploit is to control not only the PC pointer but the whole process as well. Therefore, we need to create a ROP chain and do a heap spray for the target process. In this case, we use MACH_MSGH_BITS_COMPLEX Mach msg with MACH_MSG_OOL_DESCRIPTOR memory to do the heap spray. If we send this kind of msg to the target process and don’t receive the msg, the ROP chain will stay in the target’s memory space persistently. In addition, we could use a magic address (0x105400000) to set the callback address for the PC to jump. In order to control the program flow easily, we need to control the stack register. Therefore, we need to find a gadget to do the stack pivot. A great stack pivot gadget can be found at libsystem_platform.dylib. By using this gadget, we can control the SP register through the X0 register. After that, we could set X30 register and then use ``ret’’ gadget to execute arbitrary ROP chains. From ROP to task port In iOS/macOS, a port provides an endpoint for IPC. Messages can be sent to a port or received from it. In addition, ports can contain rights and port rights can be passed in messages. The most important port for one process is its task port which can be obtained by mach_task_self(). One can control the memory and all registers of a process through its task port. For example, mach_vm_allocate(target_task_port, &remote_addr, remote_size, 1) can be used to allocate memory in a remote process and mach_vm_write(target_task_port, remote_address, local_address, length) can be used to copy data into a remote process. Therefore, if we can get one process’s task port, we can easily control the whole process through Mach msg. Some tricks learned from Mach_portal: a user mode exploit technique is to execute ROP in the remote process and send the remote process’s task port back to the attack app. Firstly, We use mach_port_allocate() to allocate 0x1000 ports in the attack app and then use mach_port_insert_right() to insert a send right to these ports. After that, we can send these ports to the remote process through OOL Mach messages with MACH_MSG_PORT_DESCRIPTOR type. The next step is to do a heap spray in order to send the ROP chain to the remote process and then use the bluetoothd bug to control the PC. In order to send the task port back to our attack app through the ROP chain, we need to know the port number of our attack app. However we cannot use launchd to help us. Luckily, the port number can be guessed by brute force (0x103+0x100*N). That’s why we send 0x1000 ports to the remote process (in order to increase the successful rate) and use the ROP chain to call mach_msg() 0x100 times to guess the port number. After getting the task port of the unsandboxed process, we can fully control of it. However, iOS 11 (not in macOS10.13) extended the limit to the use of all task ports for sandboxed app processes, we cannot get the task port using previous method: Plan B Even we cannot get the task port, we can still use ROP. A generic primitive for function calls with arbitrary parameters can be found in CoreFoundation: By using these ROP gadgets, we could control unsandboxed system services and further attack the kernel through more attack surfaces. References 1. MacOS and *OS Internals http://newosxbook.com/ 2. Pangu 9 Internals https://www.blackhat.com/docs/us-16/materials/us-16-Wang-Pangu-9-Internals.pdf 3. triple_fetch https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 4. https://blog.zimperium.com/cve-2018-4087-poc-escaping-sandbox-misleading-bluetoothd/ 5. Mach portal https://bugs.chromium.org/p/project-zero/issues/detail?id=965 Update These two “zero-day”bugs were reported to Apple on June 7, Apple fixed them in iOS 11.4.1 as well as iOS 12 beta with CVE-2018–4330 and CVE-2018–4327. Please update your iOS to the latest iOS 11.4.1 to defend against potential attacks. Alibaba Tech First hand and in-depth information about Alibaba’s latest technology → Facebook: . Twitter: . “Alibaba Tech” “AlibabaTech”

Escaping Sandbox Using Callbacks on iOS 11.4

The roaring popularity of blockchain technology owes a great deal to the brilliance of smart contracts. Conceptualized by computer scientist in 1994, a smart contract can be considered to be a set of instructions (usually in the form of a computer program) which automatically execute when the terms of a ‘contract’ are fulfilled. Nick Szabo Fast forward to 2013, when introduced smart contracts to the world of blockchain through ‘Ethereum’. An open-source, blockchain-based, distributed computing platform which supports smart contracts, quickly turned out to be a game-changer. Vitalik Buterin Ethereum Smart contracts paved the way for a variety of trustless distributed applications ( ) and encouraged a host of blockchain projects, each trying to bring about a paradigm shift in its own way. DApps (Vitalik Buterin - the man who introduced smart contracts to blockchain) As blockchain technology continues to spread its wings, smart contracts continue to be the wind underneath. A host of articles are readily available on the Internet which talk about how smart contracts are revolutionizing the world today. In this article, we’ll take a slightly different route – we’ll look at different types of smart contracts in existence, and glance at projects which are implementing them. Time-Lock Contract Time-lock contracts are one of the simplest and most common forms of smart contracts. As the name suggests, digital assets deposited to these contracts are ‘locked’ for a pre-defined period of time, before the assets can be retrieved by the sender. Such contracts typically come with a ‘time-lock’ function, which sets a numerical timestamp for each deposit address. Tokens can be withdrawn to a certain address only after the associated timestamp has expired; prior to that, the lock contract only accepts deposits. Time-lock contracts are ubiquitous in applications. DeFi Services such as and , which let users loan their digital assets for a certain amount of time (and earn interest), make use of lock contracts to automatically allow users to retrieve their funds on expiry of the loan period. Compound Aave A special form of time-lock Contract, known as Hashed Time-Lock Contract ( ), is used in payment channels to eliminate the risk of counterfeit. In case of a HTLC transaction, the recipient of funds has to acknowledge the payment by submitting a cryptographic proof within a specified timeframe, otherwise the funds are returned to the original sender. HTLC Apart from the time-lock function, a HTLC also contains a hash-lock – a function that prevents the recipient from spending the funds until a certain cryptographic proof is publicly broadcasted. , a scaling solution for Bitcoin transactions, is one of the most use cases of HTLCs. Lightning Network popular Funds can be between two users in a trustless manner user through interconnected payment channels (more on that later), even when they are not directly connected. HTLCs are also used in , where users can ‘swap’ cryptocurrency from one type to another, without the need of any centralized intermediaries. transferred atomic swaps (Lightning Network is using HTLCs to ensure faster and secure transaction settlements) Portal Payment Channel Contract Payment channels are an important aspect of off-chain scaling solutions in blockchain networks. Any blockchain transaction has to be verified, included in a block, and publicly broadcast to all the nodes. Each transaction also involves a mining fee, which might end up being a significant portion of the actual amount being transferred. For cases which involve multiple small-value transactions, the entire process becomes extremely costly and time-consuming. use a smart contract to enable users to transact multiple times, without recording every single transaction on the blockchain. Payment channels Intermediate transactions are recorded off-chain, and on completion, when the payment channel is closed, the final state of the participants is published on the blockchain. Irrespective of the number of transactions, only one block has to be mined when payment channels are used. As already mentioned in the context of Lightning Network, by creating a mesh of payment channels, a secure and distributed network connecting multiple users can be created. However, simple time-lock or hash-lock features might be insufficient for payment channel smart contracts, and additional features might be necessary to make them robust. For example, the (check lock-time verify) feature was introduced to such smart contracts to avoid . Other upgrades include time-locking transactions in a manner such that the last state of the channel always has the lowest time-lock, and is the first one that can be broadcast on the blockchain. CLTV malleability attacks , an open-source blockchain platform project, has recently implemented payment channel smart contracts in their version . V Systems 2.0 upgrade These smart contracts consider 3 variables – the accumulated load that the sender loads into the channel, the accumulated payment that the sender has already paid, and the expiration timestamp beyond which the receiver can no longer accept funds. These three variables can only increase, which ensures the presence of a certain amount of funds in the channel for the receiver, and enables the recipient to withdraw the collected funds without waiting for the channel to terminate. (Off-chain settlement techniques frequently use payment channel smart contracts) Application Logic Contract Like blockchain, is another upcoming technology which has captured the collective imagination of the technological world. Inter-connecting billions of devices and enabling them to exchange information literally opens the doors to limitless opportunities. However, such practices also raise concerns about data security and privacy. IoT Traditional IoT systems have a centralized architecture, where information is sent from an IoT device to the cloud for data processing, and then sent back to the device. Such a centralized system has very limited scalability, and a single point of failure when it comes to network security. This becomes even more critical in those scenarios where devices are expected to have the to initiate payments on their own. capability This is where blockchain enters the picture. Smart contracts in blockchain networks, as Application Logic Contracts (ALCs), allow devices to function securely and autonomously, ensuring greater automation, scalability, and cheaper transactions. known ALCs contain application specific code, which can work in conjunction with other smart contracts and programs on the blockchain. They aid in communicating with and validating communication between different IoT devices. Since there is no third-party required to oversee transactions, these smart contracts can effectively oversee micro-payments between different IoT nodes. is one of the premier blockchain projects working in this field. Technically, it wouldn’t be correct to term it ‘blockchain’, as their data structure is termed Tangle, but let’s not get into these technicalities here. Iota In a recent , Iota stated that they would be developing their ALCs off-chain, outside the core protocol of the tangle. announcement For on-chain smart contracts, every network node has to keep a copy of each contract’s program code and state, and execute the code when the smart contract is triggered. By transferring them off the tangle, Iota’s ALCs can be executed in a localized manner, greatly improving the network scalability. (The growing importance of IoT and blockchain brings ALCs sharply into focus) Non-Fungible Contract A non-fungible token ( ) is a cryptographic token that represents a unique digital asset. Fungibility is the property of an entity whereby the individual units are interchangeable and indistinguishable from each other. NFT The most common example used to explain fungibility is fiat currencies, where a valid note of any denomination is virtually indistinguishable from any other such note for all intents and purposes. On the other hand, each NFT is unique and cannot be replaced by another of its kind. In the digital world, NFTs are usually used to represent collectibles, art items, memorabilia, and the like. NFTs are being increasingly used in blockchain-based , to represent the ownership of unique items which are of value within the gaming ecosystem. Exchange of such items across different games is also possible through these smart contracts. games These NFTs are created using smart contracts. What sets non-fungible contracts apart from other smart contracts is that each such contract represents only one unique token. non-fungible When a non-fungible token contract is initialized, its constant is set to zero. Once the token has been issued and it begins to exist, its supply is permanently fixed to 1.  This guarantees the stability and security of every operation performed in the contract, and ensures that the token is provably unique. is one of the most prominent blockchain projects which make use of non-fungible smart contracts. Decentraland In Decentraland's virtual environment, players can explore, create scenes and artworks, and own and exchange in-game NFT items, in a decentralized virtual reality world. Other games like and (the infamous) also issue in-game characters and items through non-fungible smart contracts. Gods Unchained CryptoKitties (Non-fungible contracts are one of the driving vectors in the crypto-collectible market place) PS – Being from a non-blockchain background, searching for different varieties of smart contracts on the Internet turned out to be a notoriously difficult task. Thank god for Binance Academy and the announcement posts of blockchain projects upgrading their smart contracts! If you know of any that’s worth a read, please do leave a comment here.

Stories, News & Mentions about LVXSYSTEM

Lvxsystem’s Stories on HackerNoon

Lvxsystem's News & Mentions