HN user

anemic

296 karma
Posts0
Comments60
View on HN
No posts found.

I too recently discovered this workflow and I'm blown by it. The key IMHO is first to give claude as low requirements as possible and let it's plan mode roam freely. Writing a reporting for sales metrics? "Ultrathink relevant sales metrics" and it will give you a lot to start ranking which you want, maybe add some that are missing. Then create a new directory for this feature and ask it to write the plan to a file. Then proceed to create an implementation plan, ask it to find all the relevant data from the database and write how to query it. Then finally let it implement it and write tests and end user documentation. And send it to QA.

Need sales forecasting? This used to be an enterprise feature that 10 years ago would have needed a large team to implement correctly. Claude implements a docker container in one afternoon.

It really changes how I see software now. Before there were NDAs and intellectual property and companies too great care not to leak their source code.

Now things have changed, have a complex ERP system that took 20 years to develop? Well, claude can re-implement it in a flash. And write documentation and tests for it. Maybe it doesn't work quite that well yet, but things are moving fast.

I once had the (dis)pleasure of working with these Yomani terminals. I got a development unit (with red text "DO NOT PAY" on the side). I plugged it in my home internet which has a public ip with dhcp just to get it quickly online and keep it out of my internal home network. The next day I got a call from my ISP saying I had a compromised machine in my network with malware. I was like WTF?! and they gave me the mac address and it was the Yomani terminal! I promptply unplugged it from the network and started investigating. Indeed, this development unit had a telnet(!) port open and root login without password was possible. So, having a wide open telnet port on a public ip and it's just a matter of minutes until someone uploads a generic arm malware onto it. I returned the terminal to the vendor with explanation but never got a followup. Lesson learned: never attach anything to public internet, even if it looks secure.

I guess Atos Worldline really doesn't like root passwords.

How about donating to charity? If you don't need the money, there are people in the world who are struggling to get clean water.

Spend some time to verify that your money goes to a good cause and not to scammers.

You could start by donating to a local sports team to buy equipment to those who can't afford if, for example. Then go see their games to see what you've accomplished.

GitHub was down 6 years ago

Protip:

Always have an extra customer, like the flowershop downstairs. Let her borrow your wifi in exchange for some office flowers. Now she is technically your customer.

When your shit goes down and nothing works you can still write "some of our customers are experiencing issues" in the statuspage as the flowershop still has wifi (hopefully).

My personal belief is that they dont. Best they could achieve is trapping the ISP's sending mail server in Norway before the mail is encrypted but there is no capability to decrypt SSL without obtaining the keys.

They could still store metadata like sending IP address, timestamp etc.

Using foreign webmail via HTTPS would not be intercepted in any possible way. Unless they get support from the service provider in question. I think the service providers you mention will comply with law enforcement and give out your data. But those are isolated cases and mass data required by intelligence services is a different thing. National security letters are only for US Govt use and other governments have no access.

I also think legislation like this is years late now that about every protocol has encrypted variants and they don't get any meaningful results compared to the money spent.

Also the type of the malicious content (rm -fr /*) is "easy" to spot in which I mean there are no rootkits or remote exploitable flaws added.

Not very nice to be a victim of that but at least there is no doubt whether you're vulnerable or not.

The timeline also suggests that the malicious content was made after the break-in and not planned beforehand?

Gas Pump Skimmers 9 years ago

Most interesting part is that they managed to get the hex dump of the software. Quick glance shows there are no copyright texts in it, bummer!

I'm not an expert in PIC assembly but it seems there is very little code and there are no obvious code paths, like a switch..case like construct for processing the serial commands. Lots of I/O and not much more. Most likely they are not decoding the magstripe data in PIC but just get the decoded data and store it.

I just made a switch from Kube to Kontena last week. I had constant trouble with etcd cluster and so far Kontena seems solid and was much faster to set up for production. I'm running 6-8 nodes so kube always felt like it was a little too much for me.

I noticed the same thing about FAQ, I had all those working in my kubernetes setup.

Spot on! Once you get everything running you're so exhausted documenting it by writing a blog post is not on your mind, sleeping for a week is...

That is perfectly fine if it suits your use case! I have to deal with industry certifications and unfortunately using a ad-hoc certificate authority is not an option or running in insecure ports.

Also I was setting it up on coreos and baremetal servers. It should be possible to run pods in google container engine or similar very easily, but would there be any fun in that?

Lots of good information here but it is still not enough for a production setup IMHO.

There is a great need of good source of production setups. In open source software this seems to be the secret that no one is willing to reveal. I tried to setup a kubernetes cluster from scratch a while ago and soon I was browsing the source code for answers. Openstack is the same, you need to understand a lot about the inner workings before you can even attempt to setup something for production.

There is always a simple "this shell script starts your own <name your tech here> cluster in vagrant" but it is still not a production setup.

And even if this article is the "hard way" it describes:

This is being done for ease of use. In production you should strongly consider generating individual TLS certificates for each component."

And it does not mention that the crucial part is the common name field in the certificate maps to the user name that is the magic information that I once needed.

I sincerely appreciate this article but production setup is still a long learning experience away.

After talking with several managers who tend to micromanage I've noticed that they like to play strategy games on their free time where it's also possible to micromanage. Good example is Civilization where they always like to manage every single detail of their cities whereas I just want to leave that to the computer AI.

advertising becomes scary when this service tries to suggest responses like "Yes, let's have a meeting tomorrow and why not enjoy a refreshing glass of ice-cold Dr.Pepper together!". But if not, I'm not that worried about the ad revenue aspect.

It's an amazing find to discover multiple different redacted versions of a single document and to reconstruct the original from these parts.

Very similar to encrypting different data with same key multiple times giving the messages 'depth' that can be exploited.