b1temy

I completely agree with climbing gyms!

I'm lucky enough that I live in a city that has a newbie-friendly group that climbs every week and goes for dinner and board games afterwards.

I consider myself an introvert, but after going for a while, I got to figure out who are regulars, and they recognise me as a new regular too, at which point they're more open to socialising more, even outside the weekly meetups.

Even when I'm bouldering alone, I've had random people cheer for me when I'm about to send, or show me the beta for a route I'm struggling with, or ask for help with a problem. It just provides a very natural conversation starter, at which point you can pivot to other topics, provided they seem open to talking more.

It's obvious in hindsight but to me its really interesting you can collect data points on the community just by chatting with them. Maybe you could guess, by appearance or behaviour or something, whether most people at the gym are university students, or gym bros, or something else.

But by chatting with them, the world seems a bit bigger. And even if you don't see them again often, or don't chat again, its just nice that you have some level of familiarity and learn new things you wouldn't know unless you chatted with them. And although sometimes you have that awkward uncomfortable short conversation, every once in a while, you make a new friend. That is life, I suppose.

...stored in the global StorageDatabaseNameHashtable. This mapping: - Is keyed only by the database name string ... - Is shared across all origins

Why is this global keyed only by the database name string in the first place?

The post mentions a generated UUID, why not use that instead, and have a per-origin mapping of database names to UUID somewhere? Or even just have separate hash-tables for each origin? Seems like a cleaner fix to me compared to sorting (imo, though admittedly, more of a complex fix with architectural changes)

Seems to me that having a global hashtable that shares information from all origins is asking for trouble, though I'm sure there is a good explanation for this (performance, historical reasons, some benefits of this architecture I'm not aware of, etc.).

Someone from my high school added me on LinkedIn and works at Palantir.

What I find interesting, is that a few months after joining, he scrubbed all posts, descriptions, and mentions of the word "Palantir" in his profile, and replaced it by saying he works at an unnamed company as "a Forward Deployed Engineer". Judging by his activity reacting to other posts, it seems he coworkers also use the same term and removed mentions of "Palantir".

I find it interesting, I suppose it was to avoid backlash from others, or perhaps other companies would be hesitant to hire someone from Palantir (?). Or perhaps just a company policy to avoid scammers from finding employees.

But in any case, the hiding of the word is something I find interesting.

Back when I was in university, one of the units touching Assembly[0] required students to use subtraction to zero out the register instead of using the move instruction (which also worked), as it used fewer cycles.

I looked it up afterwards and xor was also a valid instruction in that architecture to zero out a register, and used even fewer cycles than the subtraction method; but it was not listed in the subset of the assembly language instructions we were allowed to use for that unit. I suspect that it was deemed a bit off-topic, since you would need to explain what the mathematical XOR operation was (if you didn't already learn about it in other units), when the unit was about something else entirely- but everyone knows what subtraction is, and that subtracting a number by itself leads to zero.

[0] Not x86, I do not recall the exact architecture.

Also wondering how it compares to https://pikimov.com , another browser-based video editor I've seen making the rounds.

What are the security implications this raises

It increases attack surface area on the browser. Even if you do need to "accept" a connection for a device, this isn't foolproof. I imagine adding WebUSB is a non-insignificant amount of code, who's to say there isn't a bug/exploit introduced there somewhere, or a bypass for accepting device connections?

This would still be better than downloading random native programs since it's under the browser's sandbox, but not everyone would _ever_ need to do something that requires WebUSB/USB, so this is just adding attack surface area for a feature only a small percentage of people would ever use.

The solution is to use a smaller separate _trusted_ native program instead of bloating the web with everything just for convenience. But I understand that most are proprietary.

I say all this, but a part of me does think it's pretty cool I can distribute a web-app to people and communicate via WebUSB without having the user go through the process of downloading a native app. I felt the same way when I made a page on my website using WebBluetooth to connect to my fitness watch and make a graph of my heart rate solely with HTML and Javascript (and no Electron).

I'm just not too happy about the implications. Or maybe I'm just a cynic, and this is all fine.

I do not understand the appeal of the workflow of working on separate things in parallel, then splitting it off into branches/commits. imo, isn't it better to fully focus on one thing at a time, even if it is "simple"?

I imagine if I follow this workflow, I might accidentally split it off in a way that branch A is dependent on some code changes in branch B, and/or vice versa. Or I might accidentally split it off in a way that makes it uncompilable (or introduce a subtle bug) in one commit/branch because I accidentally forgot there was a dependency on some code that was split off somewhere else. Of course, the CI/CD pipeline/reviewers/self-testing can catch this, but this all seems to introduce a lot of extra work when I could have just been working on things one at a time.

I'm open to changing my mind, I'm sure there are lots of benefits to this approach, since it is popular. What am I missing here?

The video in question:-

https://youtu.be/_mL1uaOgGvc

Although the channel is indeed called SWEet, I should have given the YouTube channel handle, SWEetOverflows.

Very cool!

I wonder if someone more creative than me would be able to push this to do things it was not designed to do. I recently found a video where someone exploited some properties of certain transcript file formats to be able to make a primitive simple drawing app with Youtube's video player's closed captions.[0]

Since a brush's code can see the state of the canvas and draw on it, perhaps there can be a brush that does the opposite here, and instead renders a simple "video" when you hold down the mouse? Or even a simple game, like Tic-Tac-Toe.

I understand that obviously isn't the purpose of the brush programs, but I think it is an interesting challenge, just for fun.

[0] The video I am thinking of is by a channel named Firama, but they did not explain how they accomplished it. Another channel, SWEet, made their own attempt, which wasn't as full-featured as the original, but they did document how they did it.

Never follow a shortened link without expanding it using a utility like Link Unshortener from the App Store,

I am unfamiliar with the Apple ecosystem, but is there anything special about this specific app that makes it trustworthy (e.g: reputable dev, made by Apple, etc.)? Looking it up, it seems like an $8 app for a link unshortener app.

In any case, there have been malicious sites that return different results based on the headers (e.g: user agent. If it is downloaded via a user-agent of a web browser, return a benign script, if it is curl, return the malicious script). But I suppose this wouldn't be a problem if you directly inspect and use the unshortened link.

Terminal isn’t intended to be a place for the innocent to paste obfuscated commands

Tale as old as time. Isn't there an attack that was starting to get popular last year on Windows of a "captcha" asking you to hit Super + R, and pasting a command to "verify" your captcha? But I suppose this type of attack has been going on for a long, long, time. I remember Facebook and some other websites used to have a big warning in the developer console, asking not to paste scripts users found online there, as they are likely scams and will not do what they claim the script would do.

---

Side-Note: Is the layout of the website confusing for anyone else? Without borders on the image, (and the image being the same width of the paragraph text) it seemed like part of the page, and I found myself trying to select text on the image, and briefly wondering why I could not do so. Turning on my Dark Reader extension helped a little bit, since the screenshots were on a white background, but it still felt a bit jarring.

Except every big server has to run an anticheat. Some servers required clients with client side anticheats even.

I am fine with anticheat on the server-side to help volunteers/moderators find issues, since it does not force the user to install any sketchy kernel-level software. As for the servers that require client-side anticheats, I was unaware there are Minecraft servers that do this (though I do not doubt you, and believe you when you say they exist), and can't speak to it.

Some servers required you to screen share with a moderator and they would go through the files on your computer to look for cheats.

I was not aware this is a practice that some servers do. It is beyond ridiculous to ask to screen share just to verify no cheats were involved imo, and is a major invasion of privacy. The only scenario I can see this being okay, is in a physically hosted event, where players are playing on devices provided by the event organisers, so there would be no expectation of privacy in any case, in the same way you do not have an expectation of privacy on a work device.

In both cases, you could always find a different server that does not run anticheat, or even start your own server (if you were willing to do that). This isn't something that can even be done in other modern games that employ anticheat drivers and only allow connecting to their single official server.

Re: exploiting people for free labor to moderate servers

Nobody is forcing them to do it, I imagine they do it because they enjoy it and want to give back to the community, the same way someone would contribute to open source or moderate a forum in their spare time. In any case, is it always "free labor"? I have heard of paid-transactions and/or donations, sponsors, or servers being hosted by streamers who have other sources of income to pay for moderators. Though admittedly, I am not familiar with Minecraft in particular and if this is actually the case in most servers.

Because game studios these days are all about global matchmaking

Why not have moderation then? When participating in an online forum, you are essentially "matchmaking" to a topic or corner of the internet with similar interests. Have some moderators (be it members of the community, or staff) ban players on obvious hacking/cheating or rule-breaking behaviour, and allow members to report any instances of this (I believe this is already a thing in modern video games, I have seen videos of "influencers" getting enraged when losing and reporting players for "stream sniping").

Sure, this might cause the usual issues of creating an echo chamber where mods and admins might unfairly ban members of the community. But you could always just join a different server in that case.

I believe Minecraft has a system similar to what I described; you enter the URL of a server to join, each hosted on its own independent instance (not necessarily hosted by Mojang, the studio behind Minecraft) each with their own unique sets of rules and culture, and being banned in one server does not ban you from every other server. Incidentally, Minecraft also does not have kernel level anticheat, and still very successfully manages to be one of the most popular games around (By some accounts, the top-selling game of all time).

I miss the days of Tribes 2 or CS1.6 when games had server browsers

I do too.

they should provide built-in anti-cheat support in the OS.

As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo editor, word processor, or anything else? It's _your_ software that you bought.) something similar is already happening with, e.g, Widevine bundled in browsers for DRM-ed video streaming.

I agree that having some first-party or reputable anti-cheat driver or system, is probably preferable than having different studios roll out their own anticheat drivers. (I am aware there are studio-level or common third party common anti-cheat solutions already, such as Denuvo or Vanguard. But I would prefer something better)

The phrasing of your first two sentences in your first post makes it sound like you're dismissing the security issue.

Genuine question, How does it sound like I'm dismissing it? My first sentence begins with the the phrase

I don't like that the executable's update URL is using just plain HTTP

And my second sentence

Whether you agree with whether this rule should be out-of-scope or not is a separate issue.

which, with context that AMD reported MITM as out-of-scope, clearly indicates that I think of it as an issue, albeit, a separate one from the one the author already reported.

You misunderstand.

I already said I do not like that it is just using HTTP, and yes, it is problematic.

What I am saying is that the issue the author reported and the issue that AMD considers man-in-the-middle attacks as out-of-scope, are two separate issues.

If someone reports that a homeowner has the keys visibly on top of their mat in front of their front-door, and the homeowner replies that they do not consider intruders entering their home as a problem, these are two separate issues, with the latter having wider ramifications (since it would determine whether other methods and vectors of mitm attacks, besides the one the author of the post reported, are declared out-of-scope as well). But that doesn't mean the former issue is unimportant, it just means that it was already acknowledged, and the latter issue is what should be focused on (At least on AMD's side. It still presents a problem for users who disagree with AMD of it being out-of-scope).

While I don't like that the executable's update URL is using just plain HTTP, AMD does explicitly state that in their program that attacks requiring man-in-the-middle or physical access is out-of-scope.

Whether you agree with whether this rule should be out-of-scope or not is a separate issue.

What I'm more curious about is the presence of both a Development and Production URL for their XML files, and their use of a Development URL in production. While like the author said, even though the URL is using TLS/SSL so it's "safe", I would be curious to know if the executable URLs are the same in both XML files, and if not, I would perform binary diffing between those two executables.

I imagine there might be some interesting differential there that might lead to a bug bounty. For example, maybe some developer debug tooling that is only present only in the development version but is not safe to use for production and could lead to exploitation, and since they seemed to use the Development URL in production for some reason...

The bots will quite possibly have no extensions at all

I imagine most users will also not have extensions at all, so this would not be a reliable metric to track bots. Maybe it might be hard to imagine for someone whose first thing to do after installing a web browser is to install some extensions that they absolutely can't live without (ublock origin, privacy badger, dark mode reader, noscript, vimium c, whatever). But I imagine the majority of casual users do not install any extensions or even know of its existence (Maybe besides some people using something like Grammarly, or Honey, since they aggressively advertise on Youtube).

I do agree with the rest of your reasons though, like if bots used a specific exact combinations of extensions, or if there was an extension specifically for linkedin scraping/automation they want to detect, and of course, user tracking.

the idea being that the platform is "someone else's computer"

I have a vague memory of once having a userscript or browser extension that replaced every instance of the word "cloud" with "other peoples' computers". (iirc while funny, it was not practical, and I removed it).

fwiw I agree and I do not believe using "the cloud" for everything is a good idea either, I've just never heard of the word "clown" being used in this way before now.

the characters ’n’ and ‘o’ differ by only one bit; an unpredictable error that sets that bit could change GenuineIntel to GenuineIotel.

On a QWERTY keyboard, the O key is also next to the I key. It's also possible someone accidentally fat-fingered "GenuineIontel" , noticed something was off, and moved their cursor between the "o" and "n", and accidentally hit Delete instead of Backspace.

Maybe an unlikely set of circumstances, but I imagine a random bit flip caused at the hardware-level is rare since it might cause other problems, if something more important was bit-flipped.

Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent?

Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private network, the name itself is sensitive information.).

In that case, I would personally replace the operating system of the NAS with one that is free/open source that I trust and does not phone home. I suppose some form of adblocking ala PiHole or some other DNS configuration that blocks sentry calls would work too, but I would just go with using an operating system I trust.

What are your thoughts on the usefulness of tribal knowledge when older (age-wise) employees change jobs? [0]

Then, the tribal knowledge they had at their previous place of employment won't be as useful somewhere else. Though I suppose you can make an argument that they might have similar workflows, or tools, or they might just have general experience that would be useful.

But I suppose your comment was more on the under-appreciation by management of existing tribal knowledge in a team.

[0] Perhaps out of necessity, e.g: company went under, or maybe they want a change of pace.

most tech debt isn’t actually created in the code, it’s created in product meetings. Deadlines. Scope cuts.

When asked what would help most, two themes dominated

Reducing ambiguity upstream so engineers aren’t blocked...

I do wonder how much LLMs would help here, this seems to me at least, to be a uniquely human problem. Humans (Managers, leads, owners, what have you) are the ones who interpret requirements, decide deadlines, features and scope cuts and are the ones liable for it.

What could an LLM do to reduce ambiguity upstream? If it was trained with information on requirements, this same information could be documented somewhere for engineers to refer to. If it were to hallucinate or "guess" an answer without talking to a person for clarification, and which might turn out to not be correct, who would be responsible for it? imo, the bureaucracy and waiting for clarification mid-implementation is a necessary evil. Clever engineers, through experience, might try implement things in an open way that can be easily changed for future changes they predict might happen.

As for the second point,

A clearer picture of affected services and edge cases

three categories stood out: state machine gaps (unhandled states caused by user interaction sequences), data flow gaps, and downstream service impacts.

I'd agree. Perhaps when a system is complex enough, and a developer is laser focused on a single component of it, it is easy to miss gaps when other parts of the system are used in conjunction with it. I remember a while ago, it used to be a popular take that LLMs were a useful tool for generating unit tests, because of their usual repetitive nature and because LLMs were usually good at finding edge cases to test, some of which a developer might have missed.

---

I will say, it is refreshing to see a take on coding assistants being used on other aspects instead of just writing code, which as the article pointed out, came with its own set of problems (increase Inefficiencies in other parts of the development lifecycle, potential AI-introduced security vulnerabilities, etc.)

the faded colors, limited palette along with the dithering really grew on me

I wonder if the similarity of a faded photo (like a faded polaroid) might have helped with this, especially if already has memories and some similar photos.

I have not used a e-ink tablet in a long time (since the Kobo Glo), but since I've stopped reading fiction, I do not really see the allure of devices for myself. They're far too expensive to use as an alternative to a notebook, screens as usually too small to read technical non-fiction textbooks (Think, PDFs instead of EPUBs), and if I wanted to look at media with colors, I do not think most current color e-ink displays are good enough for a pleasing experience. I think, like the author said, it is nice to use a digital photo frame that does not need to be recharged often and can easily swap out the photos.

ten years from now, people will look back at 2024-2025 as the moment Apple had a clear shot at owning the agent layer and chose not to take it

I don't pretend to know the future (nor do I believe anyone else who claims to be able to), but I think the opposite has a good chance of happening too, and hype would die down over "AI" and the bubble bursts, and the current overvaluation (imo at least. I still think it is useful as a tool, but overhyped by many who don't understand it.) will be corrected by the market; and people will look back and see it as the moment that Apple dodged a bullet. (Or more realistically, won't think about it at all).

I know you can't directly compare different situations, but I wonder if comparisons can be made with dot-com bubble. There was such hype some 20-30 years ago, with claims of just being a year or two away from, "being able to watch TV over the internet" or "do your shopping on the web" or "have real-time video calls online", which did eventually come true, but only much, much, later, after a crash from inflated expectations and a slower steady growth.*

* Not that I think some claims about "AI" will ever come true though, especially the more outlandish ones such as full-length movies made by a prompt of the same quality made by a Hollywood director.

I don't know what a potential "breaking point" would be for "AI". Perhaps a major security breach, even _worse_ prices for computer hardware than it is now, politics, a major international incident, environmental impact being made more apparent, companies starting to more aggressively monetize their "AI", consumers realising the limits of "AI", I have no idea. And perhaps I'm just wrong, and this is the age we live in now for the foreseeable future. After all, more than one of the things I have listed have already happened, and nothing happened.

I'd suggest going through one of the relevant reverse engineering courses (all free) in either pwn[.]college or/and OpenSecurityTraining2 .

I'd be curious to see if there were any discoveries of any cut features left on the cutting room floor still present in the code [0] (aside from the demo teaser code mentioned still being present). I always find software archaelogy fascinating, as we get scraps of unused content or code, and can only guess as to the decisions made that led to it being scrapped, or why certain custom file formats were used, or code was structured a certain way.

[0] I am aware that such a wiki exists exactly for this purpose.

This article reminds me of some of the stories in the "The Hardware Hacker" book by Andrew Huang [0], which went a bit about the author's experience in Shenzhen manufacturing some hardware.

There are a bit over similarities with the article, like miscommunications occurring or needing to specify in exact terms what is required. But I think it is slightly different now, the stories in the book was from a while ago and in shenzhen instead of zhongsan, so I am sure things have changed, and this article is more up to date.

[0] Despite the title, it is not entirely solely about hacking in the security sense. But also the traditional use of the word "hacker".

Yes, I meant to say "spare no expense" (though it isn't a drop in replacement, the sentence would need to be restructured slightly).

You are right. Not sure how I missed/forgot that. In fact, I think the entire reason I was reminded of the algorithm was because I saw the words "3 multiplications" in the article in the first place. Perhaps I need more coffee...