bijoo

Footnote on website is quite confusing > For safety investigations, we also run Clio on a subset of first-party API traffic, keeping results restricted to authorized staff. Certain accounts are excluded from analysis, including trusted organizations with zero retention agreements. For more information about our policies, see Appendix F in the research paper.

They clarify API's excluded > "Because we focus on studying patterns in individual usage, the results shared in this paper exclude activity from business customers (i.e. Team, Enterprise, and all API customers)."

Submitted multiple times in past few days. Here's a link to the most upvoted one as of now: https://news.ycombinator.com/item?id=39865340 VoiceCraft: Zero-Shot Speech Editing and Text-to-Speech in the Wild (jasonppy.github.io)

My results: uptime: 7:44 score: 259513 mode: easy

How did yours compare?

uptime 0:07:44 - 259513

I see a description for why webrtc-rs was picked and it seems to center around the impact to build time and size. It would be helpful to know what other factors were considered.

Why webrtc-rs as the WebRTC library?

WebRTC has many libraries that we could have used. The first one we evaluated was Google’s implementation known as libwebrtc. The time required to fetch+download would have been too much of a burden for the OBS code base. These metrics come from a Macbook M1 with a 400 Mb/s connection.

It looks like the project became inactive for a bit and there are alternatives such as htmlq, etc. https://github.com/ericchiang/pup/issues/150

My point is about that you have no way to isolate a cloud based build bot. No way to detect a threat, because AWS doesn't offer any APIs or pcap streams or anything. It's literally a black box from the perspective of an SOC.

It turns out there is a Gateway Load Balancer that "can be used for security inspection, compliance, policy controls, and other networking services."

Source: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpo...

it looks like submitting the form gets stuck now

nice writeup - adding a test should also help increase confidence here

Interesting, is the site on a particular type of EC2 instance, e.g. bare metal? I see c4.xlarge is doing fine in us-east-1.

I see started EC2 instances are doing fine. However, starting offline instances cannot be done through AWS SDK due to the HTTP 500 error, even for Ec2 service. The CLI should be getting the HTTP 500 error too since likely the same API as the SDK.

How would you let users know about this proxy without letting their government know about it?

From the blog post, "A more discrete approach would be to only send the link via a DM or a non-public message."

how about randomly giving out random proxies in some header that the app could query on cloudflare or google or akamai

That would "..increases the chance that Iranian censors will simply add those IPs to their block list"

It looks like the solution provided in the blog post is limited to helping folks run their own proxy for people they know.

For example, Matomo... larger list here https://github.com/onurakpolat/awesome-analytics