The rules for what locations/checks can be reached in what situations and with what items are painstakingly encoded in a machine readable format: https://github.com/OoTRandomizer/OoT-Randomizer/tree/Dev/dat...

I don't know the specifics of the OoTR algorithm but in general they work by considering a set of items which are currently "available", and then progressively picking a random item to place only in locations which are reachable with that current set of available items (which is expanded with each placement).

Ironically, testosterone in theory is harder to get. Since it is widely used for sports doping, it's considered an anabolic steroid, and is a scheduled substance in the US, and so has a bit more oversight to prescribe and dispense. (But I imagine there's probably also a larger black market for it for the same reasons.)

There are a billion TRT clinics that will prescribe you testosterone with basically zero oversight and at dosages that are supraphysiological.

And yes, the black market is huge - anyone with google and the ability to purchase crypto can get it easily delivered, either domestically, or from china.

Not only TRT but also Tren and other anabolic steroids that work in tandem with Testosterone to boost lean mass and reduce fat.

It sounds like the main motivation for the conversion was to simplify builds and reduce the chance of security issues. Old parts of protocols that no one pays much attention to anymore does seem to be a common place where those pop up. The performance gain looks more like just a nice side effect of the rewrite, I imagine they were at most targeting performance parity.

Exactly, even if we can't remove "that one dependency" (https://xkcd.com/2347/), we can reinforce everything that uses it.

The context I usually saw this used in is that people would put the link on their online status or profile bio, as a signal and to inform anyone looking to contact them that it's ok and encouraged to just go straight to asking their business. I've never heard of someone sending it to explicitly "chide" someone for violating that etiquette.

In case someone's wondering about the video (which is broken due to them hotlinking it): https://www.reddit.com/r/Volvo/comments/1ke98nv/never_film_t...

Another bonus of wearing ear protection in concerts: The music will actually sound way better when it's not saturating your eardrums. I got a decent pair of silicone plugs and it's a huge difference, everything sounds clearer and there's none of the sibilance and distortion I hear without them on, which I previously had always just attributed to the speakers/bad venue acoustics.

Which part of that architecture is impossible in Rust? Actually an honest question, I'm wondering if I'm missing something.

From what I remember from my Unity days (which granted, were a long time ago), GameObjects had their own lifecycle system separate from the C# runtime and had to be created and deleted using Destroy and Create calls in the Unity API. Similarly, components and references to them had to be created and retrieved using the GetComponent calls, which internally used handles, rather than being raw GC pointers. Runtime allocation of objects frequently caused GC issues, so you were practically required to pre-allocate them in an object pool anyway.

I don't see how any of those things would be impossible or even difficult to implement in Rust. In fact, this model is almost exactly what I used to see evangelized all the time for C++ engines (using safe handles and allocator pools) in GDC presentations back then.

In my view, as someone who has not really interacted or explored Rust gamedev much, the issue is more that Bevy has been attempting to present an overtly ambitious API, as opposed to focusing on a simpler, less idealistic one, and since it is the poster child for Rust game engines, people keep tripping over those problems.

The repo has had 3 commits in the last 4 years or so. I don't think it's going to get developed from alpha unless something suddenly changes.

A well-trending publicization via HN is a good help.

The intro document mentions

> Here's the thing - the big vendors encrypt and sign their updates so that you cannot run your own microcode. A big discovery recently means that the authentication scheme is a lot weaker than intended, and you can now effectively "jailbreak" your CPU!

But there's no further details. I'd love to know about the specifics too!

They accidentally used the example key from AES-CMAC RFC, the full details are in the accompanying blog post: https://bughunters.google.com/blog/5424842357473280/zen-and-...

Yikes! One would have expected a little more code review or a design review from a hardware manufacturer, especially of security system. A system that people have been worried about since the Pentium FDIV bug.

I guess this one just slipped through the cracks?

Taking "never roll your own" too far.

I feel like using the example key isn’t really the big failure here.

They didn’t need a keyed hash at all, they needed a collision resistant hash.

SHA256 would have eliminated this vuln and it has a hardcoded “key” built into it.

Using a secret key for CMAC would not have been more secure, it would have just meant sophisticated hardware extraction of the key was required before this attack could be mounted.

I suppose the reuse wasn't accidental, but they mistakenly thought the key doesn't matter for CMAC.

I believe lobste.rs is one site that's going to geoblock the UK as a precautionary measure at least

You’re missing the point. The law is so vague and broad that it could be interpreted as covering even far more innocuous content than the few extreme examples you listed here.

The 'if they have nothing to hide' argument? Really?

I look forward to reading your fully compliant risk assessment before interacting with this comment, lest it be judged to contain offensive, inappropriate, or pornographic content.