js2

Gift link: https://www.nytimes.com/2026/07/16/magazine/counterfeit-doll...

Archive link: http://archive.today/UyksP

Even in case (1), isn't it possible that Hide My Email bounces happen differently from regular @icloud.com bounces despite being on the same domain?

I don't think so because when I examine the headers of an HME delivered message to my real@icloud.com address there's only a single MTA involved.

We've also been wondering whether Hide My Email was ever responsible for generating the messages with meant-to-be-hidden addresses or whether it was only passing them along and failing to hide them. I don't think we have enough information to tell.

The full headers of the bounce message will tell you.

So what I'm trying to clarify here is whether this worked when the final address was an icloud.com address. i.e. there are two scenarios:

1. hello_world_0a@icloud.com -> real@icloud.com

2. hello_world_0a@icloud.com -> real@example.com where example.com is not any of icloud.com, me.com, mac.com (such as in your example, gmail.com)

HME can be configured for either of setups.

I really want to establish whether you were able to unmask a real address under (1), since in this case any bounce message should occur too early to disclose the real address.

Under (2), the bounce message can occur after rewriting and I can totally see how it was leaking the real address.

(For the purposes of the exploit, it doesn't matter that you used Mailgun to send the email, but I appreciate that detail.)

And just to clarify: this occurred ever when HME was setup to forward to an icloud.com address? I'd love to see the full headers of a bounced message to understand the MTAs that were involved in disclosing the address.

I tested on July 2 when the original submission was made: https://news.ycombinator.com/item?id=48767855

Now Apple says it has been fixed, we can add that, in simple terms, it required sending a target Hide My Email user a message that got rejected as spam.

Frustratingly vague. I was unable to reproduce when the original article was posted. I did not test exhaustively, but I was able to get HME to reject messages in various ways (mostly by sending oversize messages) and none disclosed my real address because they were rejected before any rewriting to the final address occurred. And in looking at messages that were delivered, I didn't see any additional SMTP servers in the path that would reject the message.

The most I was able to leak was a DMARC header showing my real domain, but even that only occurred when I replied to an HME email from my real (non-icloud.com) domain. When I updated HME to use my icloud.com address, even that leak went away (but it did make it clear that HME was not sanitizing message headers).

Maybe if you have HME setup to forward to a non-icloud.com domain and that domain's SMTP servers rejected the message as spam, I can see how this could occur. But if forwarding to an icloud.com address, no way this should've been able to happen in the first place.

I wish they'd included a sample message including full headers to see the vulnerability in action. Where in the delivery path was the bounce being generated?

I want more details.

Huh, in my experience audiobooks are more expensive and/or harder to find than ebooks. Out of curiosity, can you give an example of one such audiobook you transcribed?

I thought I knew every nook and cranny of bash, but somehow never noticed the globstar option added in bash 4.0.

https://www.linuxjournal.com/content/globstar-new-bash-globb...

https://www.gnu.org/software/bash/manual/bash.html#Pattern-M...

Why would you go from audiobook to text? Is there no epub available?

Watch him do it here:

https://www.youtube.com/watch?v=eYi2f4ONEDg&t=180

What an incredible performance. I've seen a sub-4 mile in person. These guys are absolutely flying. All of them. And he beats the pants off that field.

Splits (400m):

  400m: 55.3
  800m: 1:51.1 (56.8 second lap)
  1200m: 2:46.5 (55.4 second lap)
  1600m: 3:41.4 (54.9 third lap)
  Mile: 3:42.66

  100m: 13.8
  200m: 27.5 (13.7)
  300m: 41.0 (13.5)
  400m: 55.3 (14.3)
  500m: 1:09.3 (14.0)
  600m: 1:23.2 (13.9)
  700m: 1:37.0 (13.8)
  800m: 1:51.1 (14.1)
  900m: 2:05.1 (14.0)
  1000m: 2:18.8 (13.7)
  1100m: 2:32.6 (13.8)
  1200m: 2:46.5 (13.9)
  1300m: 3:00.3 (13.8)
  1400m: 3:14.0 (13.7)
  1500m: 3:27.7 (13.7)
  1600m: 3:41.4 (13.7)
  Mile: 3:42.66 (1.2 for the final 9.34m)

Official results at https://london.diamondleague.com/programme-results/

Unfortunately you can't link directly to the 1 mile results. Scroll down to the table, select "1 Mile Men", then select "Reports", then "Race Analysis" and/or "Race Analysis Graphical". That leads to these two PDFs (not sure these links are stable):

https://ps-cache.web.swisstiming.com/node/binaryData/ATH_PRO...

https://ps-cache.web.swisstiming.com/node/binaryData/ATH_PRO...

It's that way so that you can grep multiple files with a single pattern. It would be odd for the pattern to come after the file arguments. It also allows the files to be optional so that it can grep stdin.

Yes, it does, and it's in the submission guidelines too:

If the title contains a gratuitous number or number + adjective, we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is meaningful, e.g. "The 5 Platonic Solids."

My family owned a Mac Portable (the backlit model). Running Word for Mac 5.1, it was a fantastic writing machine.

notarytool authenticates using a stored keychain profile that you create once, interactively — it prompts for an app-specific password, and there’s no way around the prompt.

You can use `--password <password>` (yeah, yeah, passwords on the command line are bad; I'm just challenging "there's no way around the prompt.")

Later (contradicting itself):

The one step that stays interactive is notarytool store-credentials, and that’s a choice rather than a limitation: you could pass --password and script it, but that means putting an app-specific password in your shell history.

You can configure your shell to ignore history when needed.

https://stackoverflow.com/questions/6475524/how-do-i-prevent...

https://superuser.com/questions/352788/how-to-prevent-a-comm...

(And if it's in a script, it won't be in your history anyway.)

These passwords go stale silently whenever you change your Apple ID password

You can use an ASC API key instead. This can be either a team key ("developer" access level) or an individual key.

https://developer.apple.com/documentation/appstoreconnectapi...

https://en.wikipedia.org/wiki/Emily_Eden

Her book, Portraits of the Princes and People of India, was published in 1844. It contained 24 lithographs that were drawn from her sketches of important Indian subjects such as Dost Mahomed Khan and Ranjit Singh.

https://www.rct.uk/collection/1070252/portraits-of-the-princ...

https://archive.org/details/Eden30538

In the U.S., the second dose was added in 1989 so around then. You might've also gotten a booster in the U.S. if you were born earlier but lived in a college dormitory.

If you're not sure, get tested. It's a simple blood draw.

I'm not trying to argue with you at all. I feel like you think I made some claim about women being stronger or faster than men, when I very specifically did not.

My only point was that women can sometimes win and/or set records at prestigious endurance events when factors other than strength/speed are relatively more likely to influence the outcome. Such as this record right here: rowing from CA to HI.

Obviously the more elite men in the competition, the less likely this is to occur. But I'm not talking about a small local 10K where a sub-elite woman happens to show up and there's no comparably competitive men and the woman wins overall. I mean events where men and women of comparable competitiveness show up, but a woman just outlasts a man that day due to grit or better preparation or better planning or whatever the factors happen to be. All I'm saying is: the longer events give women more opportunity to win those races, regardless of event size.

I have an acquaintance I've raced with a few times. I've got the better marathon time, but she's got the better 24-hour distance. It's cool that we can both have those wins. That's all.

On the topic of vaccines, if you were vaccinated against measles before it switched to the two-dose schedule (1989 in the US), you might want to have your titers measured.

I was vaccinated in the early 70s when it was a single dose. With measles in the news recently, I asked my doc to add a measles antibodies test to my blood draw. Came back negative. No immunity. I went to the local pharmacy and got an MMR booster the next day.

https://www.health.harvard.edu/diseases-and-conditions/some-...

I don't know why you brought up records, especially sub-ultra. I admitted that: "Women semi-regularly win multi-day and 100+ mile races, even if women don't have course records at these times/distances."

I've run dozens of marathons, multiple 100 milers, and several 12-hour and 24-hour events. You can be the strongest, most prepared person in the world, and it very much might not matter because of how many things can go south in such an event compared to shorter races.

Yes, these events have fewer participants, but nonetheless, even at the most of elite of these events, sometimes women win, and it's not always because the best man didn't show up that day. Big's Backyard Ultra attracts the best in the world, but it was won by a woman in 2019 and 2020.

In endurance running, the longer races become, the more competitive they are for women. Women semi-regularly win multi-day and 100+ mile races, even if women don't have course records at these times/distances. In an event of sufficient time/distance, factors besides strength dominate the outcome.

So, (and knowing very little about rowing), I am not surprised that a woman could take the record here. You can only row so fast. Other factors like weather, currents, nutrition, mental fortitude, navigation, and boat design overcome muscle strength.

All that said: props to Kelsey Pfendler! She definitely knows how to embrace the suck.

Here's a nice diary of her trip:

https://www.kcra.com/article/kelsey-pfendler-record-breaking...

Love these updates:

Day 21: Kelsey gave an update on a lesson learned about her mental state, saying she had beaten herself up for sleeping in. But she realized that wasn't productive thinking. "When you're out here, you're not in control," she said. "You are in control of you." She said she realized that the way to respond to problems is much more important than the problem itself.

Day 44: Kelsey could see O'ahu as she closed in on her goal. "If any part of this made at least one person feel a little bit more powerful in their own skin, I couldn't ask for anything else and I'm happy," she said. "Think about trying to find your own big, hard, scary thing. You might not think that you are strong enough to finish it right now, but you're definitely strong enough to start it and you'll find everything else along the way."

More details:

https://old.reddit.com/r/VisionPro/comments/1tq34lj/created_...

There are parts of the U.S. that do this already. Ambulance rides are already subsidized by taxpayers in most places, thanks to public funding for fire departments; and a growing number of places have taken this further.

Indeed, in my county that's the case along with a $60/year subscription program to indemnify yourself against further costs:

https://www.wake.gov/departments-government/emergency-medica...

Can't remember the last time I read a DI article, but I've definitely read them before and value the non-AI content[^1]. Donated.

(Good golly, GoFundMe defaulted to a 17.5% tip. WTF?)

This fundraiser is entirely separate from our Give a Damn donation system, which aims to cover Damn Interesting monthly expenses —web hosting, subscriptions, usage licenses, link curation, and that sort of thing. An amazing array of donors support us through that system, and those lovely people are the reason we survive to this day. This new experiment is specifically so I myself can afford to spend more time writing and running the site.

I'm left confused...

Why you don't run this experiment through that same system?

Why you don't pay yourself out of that system?

What will happen if this experiment fails?

[^1]: "Rider on the Storm" is very memorable - https://www.damninteresting.com/rider-on-the-storm/

Every now and then, I know you'll never be the boy you always wanted to be. But every now and then, I know you'll always be the only boy who wanted me the way that I am. Every now and then, I know there's no one in the universe as magical and wondrous as you. Every now and then, I know there's nothing any better. There's nothing that I just wouldn't do.

Well, I never knew this till now:

With 'Total Eclipse of the Heart', I was trying to come up with a love song and I remembered I actually wrote that to be a vampire love song. Its original title was 'Vampires in Love' because I was working on a musical of Nosferatu, the other great vampire story. If anyone listens to the lyrics, they're really like vampire lines. It's all about the darkness, the power of darkness and love's place in the dark.

https://genius.com/Bonnie-tyler-total-eclipse-of-the-heart-l...

https://en.wikipedia.org/wiki/Total_Eclipse_of_the_Heart

Why did an action running in the context of public repo even have access to the private repo? Looking at the workflow, it seems to use the github token which should not normally grant rights to a private repo.

Or was it the agent itself that somehow had elevated permissions? If that's the case, you've misconfigured the agent... we know that agents cannot be trusted to enforce anything.

Thanks. I double checked for alternate spelling but whichever dictionary I used didn't have the U.K. alternative. Good to know.

From the submitted link:

we distil what it does

FYI, "distill".

Maybe you're just taking the piss from over the pond, but the differing names/spellings aren't just a typo by us dumb, arrogant Americans:

https://en.wikipedia.org/wiki/Aluminium#Naming_and_spelling_...

Cheers. :-)

Can we update the link to https://xkcd.com/3266/

Anyone who wants the large image can click/tap the image, but the revere is harder to do.

In the other direction, Mt. Everest is 8,848.86 meters above sea level. I guess we don't include Lake Tahoe and/or Crater Lake because even though they're deep(ish), their bottoms are above way sea level?

Were you able to unmask an HME address via SMTP or not? If so, was the real address an iCloud.com address?

Why don't you give it a try and report back.