lillesvin

I just meant the SQLi (which is the basis of the chain), not the full chain.

I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?

As much as I like cross-platform stuff, I also really like native UIs that follow native UX patterns, etc.

That's the claim, yes. Has any proof been made available yet? (Genuinely asking here because I haven't been paying that close attention.)

There have been millions of trivially exploitable vulnerabilities out there for decades — many of which could be easily discovered by using simple scanning tools or manual probing. This is hardly a new situation and LLMs really aren't that impressive at pentesting — even with these simple exploits. Maybe they are if you're not a pentester, but then ZAP, Burp, Nessus, SQLMap, etc. are likely also impressive if you put a little effort into learning how to use them, but many AI-advocates aren't interested in learning skills themselves.

It's the same situation as with vibe coding. Everyone and their grandma can have an LLM spit out a web application without any programming experience, but if you're a programmer, you'll likely quickly see some issues with maintainability and further development of the code base.

[...] for everyday use, it wastes precious seconds [...]

You should probably try the Ian Knot then: https://www.fieggen.com/shoelace/ianknot.htm (good video demo here: https://youtu.be/6cBtqhq5P28

Took me about 5 minutes to learn properly some 15 years ago, and according to this chart: https://xkcd.com/1205/ that's definitely worth it.

Anyone know of a password manager that can encrypte and live in say Google drive?

Can't most of the many KeePass variants do that?

I didn't mean to detract from your tool. Sorry if it came off like that.

More options is more better. :)

If you're not afraid of working in a CLI, ImageMagick is also a very solid tool for editing lots and lots of images in bulk as long as you know what you want done to them.

Indeed it was.

[...] users forked Songbird and created a Windows, Mac, and Linux compatible derivative under the name Nightingale.

[Source: https://en.wikipedia.org/wiki/Songbird_(software)]

Even your fancy guitar is not exempt from harmonics math. TFA has nothing to do with the quality of a guitar and everything to do with 12-Tone Equal Temperament.

The difficult part of language is the fact we can build entirely novel meanings out of a relatively small finite set of words.

So are you saying that we've got e.g. neurolinguistics, psycholinguistics, language acquisition and typology down? Or do you simply mean "interesting to you" when you say "difficult"? Because in my experience, pretty much every subject in linguistics (and most other sciences) is easy if you don't understand it and surprisingly difficult once you start to get a grasp of it.

Bouba kiki has no bearing on the way words are composed.

It literally shows a preference best described by sound-symbolism so it most certainly has a bearing on how words are composed. Just because the relation between sound and meaning _can_ be arbitrary, showing that in some cases it's not entirely so is extremely valuable for evolutionary linguistics.

I obviously don't know your background but out of the linguists that I know and have met while doing my degrees in linguistics, I don't know of anyone who would say that the kiki-bouba effect is not important — anything, in fact, that challenges the notion that sound-meaning relations are completely arbitrary is interesting because it might give us clues about the origins of language, not to mention that it lends support to other, related hypotheses about sound-symbolism.

I'm not sure what you mean by "not necessary parts of language", but I would love to hear what you think the necessary parts of language are. Not to mention, what is "the difficult part of language" then?

But no serious linguist thinks that kiki-bouba is that important to language.

Do you have a source on that? Because I would expect anyone studying sound symbolism to find the bouba-kiki effect extremely important which is probably why it's such a widely cited study, also inside linguistics.

Firefox is not an alternative; audio does not work for me. I could recompile it but compiling firefox is a pain in the ...

Obviously I don't have any data backing me up here, but I'm going to guess that that isn't the main reason why so many people choose Chrome over Firefox.

Aristophanes was such a troll. I can only recommend reading some of his plays, like The Assemblywomen (where this word is from), The Wasps, and The Clouds. They're almost 2500 years old but they've aged incredibly well both thanks to the many amazing translators that have worked on them and because the source material is also solid satire that in many cases is still relevant today.

Plato argued that The Clouds (which is sharp satire of Socrates and his school) was in part what got Socrates convicted and killed. This is obviously debatable but Aristophanes certainly didn't self-censor or mince words.

Searchable snapshots in Elasticsearch can be backed by S3 and they perform very well. No need to store the data on hot nodes any longer than it takes for the index to do a rollover, and from then it's all S3.

What kind of storage do you have backing your Elasticsearch? And how have you configured sharding and phase rollover in your indices?

I work with a cluster that holds 500+ TB logs (where most are stored for a year and some for 5 years because of regulations) in searchable snapshots backed by a locally hosted S3 solution. I can do filtering across most of the data in less than 10 seconds.

Some especially gnarly searches may take around 60-90 seconds on the first run as the searchable snapshots are mounted and cached, but subsequent searches in the cached dataset are obviously as fast as any other search in hot data.

Obviously Elasticsearch isn't without its quirks and drawbacks, but I have yet to come across anything that performs better and is more flexible for logs — especially in terms of architectural freedom and bang-for-the-buck.

Do I read it right, that ARTEMIS required a not insignificant amount of hints in order to identify the same vulnerabilities that the human testers found? (P. 7 of the PDF.)

Just to mention an alternative option, ZAP (aka. Zed Attack Proxy) covers much of the same ground as Burp and is entirely free and Open Source.

Come on, just stop. "They" have been used to refer to singular antecedents since the 14th century. (Source: https://www.oed.com/discover/a-brief-history-of-singular-the...)

But neither does the actual server. HMAC only verifies that the message is from whoever it claims to be from and that it is intact. It won't know what you intended the body of the request to look like.

Ah, my bad. Sorry.

But couldn't you then just make the call to an echo service (like HTTPbin) or simply dump the request when you send it?

But the returned signed string will be an HMAC-SHA256 hash, won't it? Then there's not going to be any '\n' or '\\n's in there. Only thing you'll be able to tell is if it matches your hash or not, in which case 'OK' or 'not OK' will work just as well.

Or am I misunderstanding you?

Given that you can't infer the error from simply looking at the signature string, I don't see how having the expected string rather than a simple "OK" or "mismatched signature" (as you get now) would make a difference?

I know it's kinda besides the point and I don't know what language this was being done in, but I don't personally know any language where

    String signature = "POST" + "\n" + "/api/v1/..."

    String signature = "POST\n/api/v1/..."

However, there's a quoting error in the failing example where the double quotes in the JSON body aren't properly escaped:

    String signature = "POST" + "\n" + "/api/v1/query" + "\n" + token + "\n" + timestamp + "\n" + "{"body":"content"}"

I use screen sharing from the official web client in Firefox on both Debian and Fedora without any issues. What issue(s) do you encounter?

Sure, in competent hands. Problem is that most people don't seem to realize that in order to use AI for something, you have to be pretty good at that thing already.

I've always seen AI as Brandolini's Law as a Service. I'm spending an unreasonable amount of time debunking false claims and crap research from colleagues who aren't experts in my field but suddenly feel like they need to give all those good ideas and solutions, that ChatGPT and friends gave them, to management. Then I suddenly have 2-4 people that demand to know why X, Y and Z are bad ideas and won't make our team more efficient or our security better.

It's very much like that article from Daniel Stenberg (curl developer): The I in LLM Stands for Intelligence: https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-f...

Obviously, to each their own, but to me, this is an overwhelming amount of commands to remember on top of all the ones they are composed of that you will likely need to know anyway — regardless if all the custom ones exist.

Like, I'd have to remember both `prettypath` and `sed`, and given that there's hardly any chance I'll not need `sed` in other situations, I now need to remember two commands instead of one.

On top of that `prettypath` only does s/:/\\n/ on my path, not on other strings, making its use extremely narrow. But generally doing search and replace in a string is incredibly useful, so I'd personally rather just use `sed` directly and become more comfortable with it. (Or `perl`, but the point is the same.)

As I said, that's obviously just my opinion, if loads of custom scripts/commands works for you, all the more power to you!