jtchang

Article mentions the passwords were hashed with sha256 plus a salt. For a long password more than say 12 characters this would take a very long time to brute force. My guess is a lot of these were dictionary attacks ?

Confused as to the actual root cause. Don't all hard drives provide SMART diagnostics these days? Was it really bad sectors?

Fantastic write up. It's mind blowing how much complexity there is to keep flights going day in and day out.

My guess is all airline NOCs operate 24/7 as flights happen around the clock. Also planes typically don't have much downtime as that loses money so everything has to be a continuous operation.

Cool looking at the pictures of the dashboards. It's nutty to think how much has to be tracked when doing airplane maintenance.

Correct me if I am wrong but I thought the primary appeal of LoRa was range? Also isn't the primary factor in making long range radio go through things is the frequency? So 2.4ghz is the same frequency as consumer wifi right and thus would propagate about the same right?

It doesn't seem like this would be that useful except that the protocol is LoRa so you can have higher bandwidth between two devices if they happen to be close enough together.

How does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?

I remember reading slashdot but what is their system? Is there a separate set of mods that moderate the moderators?

How is this mode not a standard part of their disaster recovery plan? Especially in sf and the bay area they need to assume an earthquake is going to take out a lot of infrastructure. Did they not take into account this would happen?

Fundamentally is there anything you can't write in rust and must write in C? With AI languages should mostly be transposable even though right now they are not.

Great video on how the public is getting screwed on energy deals.

Basically large tech companies have the deep pockets to push up prices at electricity auctions. But why bid in public when you can do those deals in private. That's the first problem. All that needs to be out in the open.

What really irks me is that the market is so manipulated that we can't do anything about it. Think about NEM 3.0 vs 2.0. Putting data centers in their own rate class does make sense as the first step.

A number of years back I got bored during covid and decided to reverse engineer as much of the Wyze Cam V2 camera I could and make some custom firmware for it. Right now that lives at https://github.com/openmiko/openmiko

That said it's really hard to make long term supportable open source camera software/firmware. And when picking cameras it is even harder because the market as it stands now does not let you have it all. You need to pick what facets you really care about.

Also keep in mind even the above code is not really opensource all the way: I still had to load the driver binaries. Not sure that source will ever be released. The kernel is also old as heck.

What I do feel good about though is saving these old cameras from the dumpster if Wyze ever stops supporting them. The firmware works for simple cases: just load it up and you can start curl'ing frames. I used it in scripts to put together timelapse videos with ffmpeg. No need to screw around with authentication, phones apps, email, etc.

So basically you trust something because you have a long chain of assurances that you trusted it before? Kinda like certificate pinning.

Is the send function considered non-blocking?

Visiting the site it is easy to see why they got demoted. It's all fluff and no substance. Almost all the links I clicked through could have been generated by a LLM.

Lots of ads. I might be old school but I still hold quality to something like anandtech back in the day. Something that a real human spent time on because they were genuinely interested in the topic and decided to write about it. The bar is so low these days not sure if there even is a bar.

This site is suppose to be a men's lifestyle magazine but it barely has any content that isn't just filler and fluff.

I love it. Could definitely see more features where you can see the results of the jury questions.

It's so dumb to assign it a CVSS score of 10.

Unless you are blindly accepting parquet formatted files this really doesn't seem that bad.

A vulnerability in parsing images, xml, json, html, css would be way more detrimental.

I can't think of many services that accept parquet files directly. And of those usually you are calling it directly via a backend service.

Thank you for providing this.

He mentions right after that "empathy is good but you need to think it through and not just be programmed like a robot".

That quote is clearly taken out of context and is specifically chosen as click/rage bait.

Like all things, nuance and context is always key.

Funny how this popped up as I was just talking to a friend about some of the challenges I've had with logging. Would definitely be interested in contributing to a project like this. Hit me up (email in profile).

This is using elixir right?

Is the documentation for AI chat bots or for humans?

The PR is now closed but seems like we should be striving to do better.

Such a great story. Something like this could have only been pulled off in that era.

Are you saying you think the Canadian government should pay more toward fertility and less toward LGBTQ procedures such as gender reassignment? I wonder how much money the latter costs. Seems like it wouldn't be as big a cost vs fertility treatments being covered.

What switches enterprise or consumer tend to support this LLDP? My guess is maybe almost none on the consumer side. I.e. Netgear, to link. Cisco probably does. How about ubiquti?

Long term this is good for the software ecosystem as a whole. Especially open source options like proxmox. I think Broadcom is making a strategic business mistake not willing to negotiate in good faith. However this is the true cost of using closed source solutions. The more this happens the more it gets factored into business decisions.

The July 2022 outage was not the result of a design flaw in the Rogers core network architecture.

Talk about some grade A gaslighting here. Reading the post mortem they first tell you it wasn't a design flaw then say they routed all their data through one core router ( including a lack of a management network). Then they say they are going to fix things by separating out the wireless and wired traffic.

Why would you fix things if it wasn't a design flaw?

Out of band access is like resilient architecture 101. Hell even homelabs generally have some way to do it. It's appalling that Rogers didn't have a way to access the core IP routers out of band. Yes it might mean having to use a competitors infrastructure but they ended up having to do it anyway. And with the failure of the service now all the infrastructure providers are under additional scrutiny. Rogers should be striking some agreements with other providers to carry core traffic in case of an outage such as in this DR situation. For example Visa, MC, Amex all have agreements in place to process each others auth data in case the other party goes down. The thinking here being an outage for credit cards makes everyone look bad.

If you take a look here you can see how this type of tiering system works out:

https://usa.visa.com/content/dam/VCOM/download/merchants/vis...

Some of the tiers for Visa cards:

Visa Infinite Spend Qualified Visa Infinite Spend Not Qualified Visa Signature Preferred Visa Signature Traditional Rewards All Other Products

So this basically means to scan for this exploit remotely we'd need the private key of the attacker which we don't have. Only other option is to run detection scripts locally. Yikes.

“Any sufficiently advanced technology is indistinguishable from magic.”

Absolutely insane the level of wizardry being applied here to turn a lump of blackened, charred scrolls into readable text.

Having only cursory knowledge with machine learning are some of the techniques used in the article only recently discovered or have they been around for a while?

Is it due to us having reached an inflection point with these types of algorithms that they have become more popular and thus we are seeing new ways to apply them to old problems?

For me it's basically summed up as "we didn't test turning the power off" and making sure things worked the way we planned.

Yes it is hard and very expensive to do these types of tests. And doing it regularly is even more $$$ and time.

As most customers we seem to be okay with a cheap price hidden behind a facade of "high availability" since I don't really want to pay for true HA. Because if I knew the real cost it would be too expensive.

I don't think the issue is bad accounting. I think it comes down to software being uniquely different than a factory or piece of equipment. Amortization schedules that are even don't make any sense. Neither does anything measure in years. It's because we make improvement to software on a day by day basis. We don't necessarily add on to a factory every day.

we broke up 2 months ago

Let's talk how that actually works in a business sense. Did you leave the company? Relinquish all control? Did you boot the cofounder out or did you buy out their portion?

What type of arrangement is this? Partnership? LLC? How did you register the entity?

"Broke up" doesn't really say anything.

Assuming you were in a partnership and you both have authority to make decisions on behalf of the company then you are free to just pay the contractors. So is your cofounder. Unless your governance documents indicate otherwise this is 100% valid.