greysteil

Is $2,300 the going rate for an RCE with a totally believable attack vector these days?

I dunno, I’m still pretty surprised the MCP server auth process could pop a calculator on widely adopted clients. The protocol isn’t perfect but that’s totally unnecessary unsafe. Glad it’s fixed!

PM at Figma here (for dev tools, not slides).

What happened to Allen here sucks. I've messaged the team so we can dig into this specific case. More generally, we know that Slides needs to be bulletproof when presenting, and nothing less than that is acceptable.

As an FYI, we _do_ use Figma Slides internally for pretty much everything, from internal meetings to major events. As a PM I use it every week, and our internal feedback channel for Slides is super active with folks like me requesting improvements. Figma is also a pretty unique place, where it's more likely our senior leadership request quality improvements than chase for deadlines - we know how critical the user experience is. We don't always get it right, but when we don't we're committed to fixing it.

I did most of this too! It was great.

Do you have recommendations for folks who can only do a shorter trip (say, a long weekend, or a week)?

Thanks! I haven't used Pulsar, but the general answer is that mentions.us is focussed on sending you alerts for notifications, whereas more sophisticated social listening tools provide a lot more analytics (e.g., sentiment analysis).

If your company just wants alerts when their keywords are mentioned on social media then mentions.us should work great for them. If you work for Coca Cola then you likely need something very different from your social listening tool!

For now we use the LinkedIn voyager API's search endpoint

I put more details in a reply to another comment, but basically I think the number of people willing to pay for email alerts is small, so I’ve made the service free for them. It’s only teams who want Slack notifications who have paid plans.

I’m not optimising to extract every possible $ from the market with that pricing strategy. Instead I hope it will maximise the number of users whilst breaking even on costs.

We’re hooking up to the APIs - the goal is to alert you of mentions as quickly as possible, so waiting for Google to index results would introduce (much) too much lag.

Interesting feature request! I’ll have a think on it.

Thanks for the feedback! For saved terms we show you the number of matches we’ve notified you about, which always starts at zero, whereas during creating we show you how many you would have matched. That’s a confusing UI and I should improve it

Hey Julien! I’ve seen you advertising KWatch in lots of places, assume you’re connected to it / know the founder?

For LinkedIn monitoring we use the voyager APIs. It’s not perfect because it gets posts but not comments, but it’s pretty good.

I think most of the people who sign up for email alerts would never pay. Lots of them are indie hackers or folks with a side project - I've been there, and know how price sensitive those communities are. I'd rather they use the service for free than not at all - I get valuable feedback from that, a marketing boost if they tell others about it, and the validation of having built something other people use.

I do have a paid plan for people who want Slack notifications, and I think those folks ought to be happy to pay. My hope is that I'll eventually get a few paid signups and that those will cover the costs of the service (which are minimal).

I know I lose a bit of revenue with the above approach, but it's a tradeoff I'm happy to make.

:D

Through the API - in particular the info endpoint[1], combined with the fact that Reddit IDs are base36 encoded sequentially increasing integers[2]. You can get 100 objects at a time, so if you make ~3 requests a second it's enough to get all of the new posts and comments.

[1] https://www.reddit.com/dev/api/#GET_api_info

[2] https://www.reddit.com/dev/api/#fullnames

I've been building mentions.us[1] - it sends you alerts when your keywords are mentioned on Hacker News, Reddit, Bluesky, LinkedIn and a few other places. For anyone who uses F5Bot, it's similar but with some extra data sources and a Slack integration.

It's been a fun project. Dealing with the scale of Reddit (~300 posts/second) creates some interesting technical challenges. It's also let me polish up my frontend development skills.

I don't think it will ever be a money spinner - it has ~70 folks using it buy they're all on the free tier. It's felt really good to build something useful, though.

[1] https://mentions.us

Can we take a moment to appreciate how good the disclosure and coordination process on this were?

* Reported to the maintainers privately

* Patch published and CVE issued before wider disclosure

* Automated fix PRs created within minutes of public disclosure (and for folks doing proactive updates, before)

The above is _really_ excellent. Compare that to Log4j, which no CVE and no patch at the time it became public knowledge, and it's clear we've come a long way.

Supply chain security isn't a solved problem - there's lots we can still improve, and not everything here was perfect. But hats off to @leerob and everyone else involved in handling a tough situation really well.

I'm a bootstrapped solopreneur at the moment. I would maybe use this, but I generally DIY everything. For contracts, for example, I'd probably just dust off the YC template, make a few tweaks, and not sweat it. For my T&Cs I took another company's terms and made edits where I thought it was important. Definitely not legally watertight, but good enough for my purposes.

Solopreneurs are amongst the most resourceful folks out there, and also the most price sensitive, so we're a tricky market to go after.

I'm building mentions.us. It's a simple idea - alerts for keyword mentions on Hacker News, Reddit, Bluesky, etc., but has been a fun project. I wanted to build something that had broader coverage than F5Bot (which is excellent) and supported sending notifications to Slack.

Right now I'm working on adding LinkedIn support now (trawling through private APIs).

Yeah, it's on my list. When you're scanning sites with high volume (Reddit has ~300 posts per second, Bluesky has ~100) you have to keep things fast and cheap, so I think keywords still have a role, but I think they can become an implementation detail.

My plan over the next couple of months is to build the option for users to enter the kind of things they want to scan for, have AI convert that to keywords, use the keywords for the (fast) scanning, and then apply additional filtering using AI to the small number of posts that match.

Not built yet, but I think there's a bunch of promise to using AI to find relevant conversations online.

Re: APIs, yep, all APIs. I'm not doing any web scraping at the moment

I've been building https://mentions.us for the last couple of months. It's a little web app that monitors Reddit, Bluesky, Mastodon, Hacker News and a bunch of other sites for keyword mentions. Not an original idea (F5Bot has existed for at least 8 years) but a fun project, and I think it can make a contribution by monitoring more sources and having a free tier that includes sending Slack messages.

It has taken a couple of months to go from idea to a product that's polished enough for other people to use, and I've been full time on it. It has a couple of dozen companies using it now, almost all from the last couple of weeks. That's been a big boost!

I’ve found that everyone learns in different ways, and if having mentors / seniors to absorb knowledge from is how you learn best then I’d agree with the comments suggesting you change roles.

However, if you learn well by doing, or by reading, there are loads of other great ways to improve technically. I’ve made big leaps forward in my skills by building (relatively large) side projects, where I can safely experiment with different design decisions and see the consequences over time. I’ve also got a huge amount out of just sitting down and reading the docs for tech I’m interested in - some frameworks (like React) have fantastic resources that can take you from good to great.

Good luck!

Pincites | Software Engineers | ONSITE (NYC) | Full-time

Pincites is automating contract review with AI. We integrate with Microsoft Word to help in-house legal teams review and redline contracts faster. You can read more at pincites.com.

We're early stage (YC S23), growing fast, and are looking for engineers who are excited about building the next generation of legal tooling. We write a lot of Go and TypeScript (with React) and are currently looking for an experienced frontend developer.

* https://www.workatastartup.com/jobs/65814

Same goal, different strengths / weaknesses.

GitHub has really focussed on preventing credential leaks. It's particularly good at scanning for highly identifiable patterns and preventing pushes that include them. That makes sense for GitHub: they're in the best position to prevent leaks (by rolling out push protection to all users) and they're big enough to influence the industry to switch to using highly identifiable patterns for API keys. However, it's at the expense of scanning for unstructured secrets (like passwords) where GitHub isn't as deep yet.

TruffleHog has focussed on scanning for credentials _after_ they've leaked. They scan for a broader range of things (including unstructured secrets like passwords). That naturally has a higher false positive rate, which they combat by automatically verifying some of their findings (by making requests to the corresponding services). GitHub does that too (for patterns it can't push protect) but it hasn't gone as deep on it yet. The delta is relatively small, though - as you can imagine, it's a long tail of patterns / credential types.

Right now there's space for both solutions - you want prevention when you can get it (without creating a bad developer experience with false positives), but you also want breadth. In the long run, though, GitHub is probably better positioned to offer both.

It’s a bespoke scanning setup designed to deal with GitHub’s scale, minimise false positives, and scan fast enough to be in the `git push` request/response cycle. Under the hood it’s using Intel’s hyperscan as the regex engine.

https://github.com/intel/hyperscan

I worked on this before leaving GitHub a couple of months ago. It’s awesome. This release is a repo-level setting, which is nice, but it will be even more useful when the team releases a user-level setting in June/July. That will allow you to configure GitHub to (softly) prevent you from pushing any easily identifiable secrets to any public repo. The plan is for it to be on by default.

For context, about 200 new GitHub personal access tokens (PATs) are exposed in public repos every day, together with many more tokens from other providers. GitHub automatically revokes the PATs it finds, and notifies many partners if/when keys to their services are found, but we always felt it would be better to prevent the leaks from happening in the first place.

Have hope. There are structural differences between spammy accounts and real ones, because their incentives are different. That will always be the case (it’s pretty much true by definition) and can be used to distinguish the accounts.

AI has definitely made it easier to generate more plausible-looking spam, and removed one way to easily identify bad accounts, but it hasn’t changed the underlying behaviour differences that put a lower bound on how bad the problem can become (as long as GitHub has the team and tools in place to use them in defence).

Not just that, though? I thought the comparison with the cost of sponsoring Citi Field was instructive - compared to that it does look like the advertising benefits to Citi from the deal are outsized, and there is a competitive market for this kind of sponsorship that should allow the dept of transport to extract more value.

If it’s the same as NYC then the steam you see is generally from water evaporating off the outside of the pipes (not steam escaping from the pipes). The pipes are very hot, so any outside water that touches them quickly turns to steam.

https://web.archive.org/web/20160811170408/http://www.coned....

+1 for this approach (and thanks for all your work on PyPI William!).

FWIW, I think it's worth clarifying that PyPI is already involved in malware detection and takedowns (as are almost all the package registries). The curation that commercial vendors offer is a little more nuanced than excluding known malware (for example, allowing users to restrict their downloads to a "known good" set of packages, rather than "only" excluding "known bad" ones).

https://warehouse.pypa.io/development/malware-checks.html

GitHub PM here, just confirming that that's correct (re: us sending detected secrets to the relevant service provider, who take action automatically). There's more detail here: https://docs.github.com/en/code-security/secret-scanning/abo....

GitHub PM here. Right now we scan code, commit metadata, issues, and issue comments. We're expanding to other content types over time, with support for pull request bodies and comments coming in early 2023. Actions logs are on our list too, but will take a little longer.

(It's worth noting that any secrets in your Actions secret store will already be redacted in any Actions logs, so those won't leak there.)