outloudvi

Went through the comment page and found this comment that explains well on most of the popular opinions. Thank you, hennell!

I agree cooldown is not harmful in general. What I intended to say is that people (mostly) only know a security company is not trustable because they once failed to detect a malware package, and the reason people know a package is malware is that it has caused damaged to at least someone.

I agree that LLM does not (and believe it never) fully replace researchers, but it produces artifacts (e.g. writeups, PoCs) at a cheaper price.

That makes me think LLM impacts human researchers' rewards, but now I realized the result might actually go in the opposite direction according to Jevons paradox. People still need experienced and professional human security researchers after all.

After reading the comments I now agree a short-length cooldown (maybe 1 or 3 days) is beneficial, given the following assumptions:

- Independent security companies are scanning the packages (be careful if the project is depending on some no-so-popular packages)

- Maintainers react promptly (it would be nonsense if people need to cooldown for 21 days because people may have 21-day vacations)

Sorry! That's 100% on me failing to make the analogy understood.

Shall have thought about that... but I'm playing too many Unity games recently.

Thanks for your explanation on the definition of "security theater"!

But if it turns out they can’t serve as the cooldown vanguard, then we have great evidence that they shouldn’t be trusted at all.

If they cannot serve as the cooldown vanguard, we are indeed going to realize they are not trustable, but by the time the damage has already been done. Therefore, if companies want to prevent the damage as much as possible, I believe they should do the scan by themselves.

I applaud you if you do setup automated security scanners, without counting on external security groups or individuals (that doesn't have a security contract with your company).

This post is based on an assumption from what I see (I would be very happy if it's wrong) that most companies do not event bother to do these scans. They are merely waiting for the free kindness.

The idea of not moving quickly to new software versions has been around for decades.

There are COBOL users and CentOS 6 users. They aren't affected by this issue.

They might need to face another set of issues like vulnerability backporting and so on. People not worrying about cooldowns might still need to patch their log4j libraries, but that's another thing. This post is not for them.

There are always early adopters and researchers looking at new, publicly available software.

I agree with that. These hacks are very unlikely to go unnoticed, especially for popular packages (although they do happen; `chalk` has 3M downloads per week when it was hacked).

The observation that "if everyone in production has a cooldown, the benefit is gone" is an absolutist opinion.

Yes. However, I think this is eventually becoming some type of pointless arms race, as cooldown does not act actively towards reducing ecosystem attacks.

To add a somehow random example, pnpm's default cooldown time is 1 day. Yarn's 7 days. I'm not sure whether one day pnpm would also change it to 7 days because of people asking.

I think it's great if people actually use LLM for the analysis. I did mention it in the solution part in the post:

Run LLM-assisted audit on vendored code.

I also believe sandboxing will get more and more important. There might be some trade-off on user experience or convenience, but given the security enhancement and (LLM agent's) freedom I think it will be well worth it.

I do appreciate these security companies a lot (for example, Snyk), but I feel it hard to believe this is sustainable. Especially in the current world where LLM is devaluing security researchers' work. If they cannot get enough fiat or credit, this will eventually turn to some incident like OpenSSL heartbleed or so.

May I put some contents against GCP's AUP in my repo, wait for Grok Build to upload them, and report the bucket to Google?

Sadly, the RDS kernel module this requires is only default on Arch Linux among the common distributions we tested.

Sir, what do you mean by "Sadly"? I know your write-ups are mostly for marketing, but please don't expose your malicious intent so early.

The article speaks well but the situation for coding is more severe.

Shells are not needed once they are not in needed. Code does not: customer need is always there.

Before forgotting how to code, The West will first get round up by their own Monsanto, voluntarily.

These companys don't care about the reputation of their domains anymore at the moment they start to send spams. However, email senders (SendGrid, Mailgun etc.) care about the reputation of their IP addresses.

I usually check the "Received" header and report to the email service provider. Once in a while I receive a response saying the case is properly handled.

These providers are the only ones that care about their reputation and thus may take some action. Investors? Nope.

Is there good public discussion on root expiration?

Haven't seen a specific one but I guess the most relavant public discussion on root CA-led device bricking issues might have occurred around the time when DST Root CA X3 (naturally) expired - that's around September '24: https://letsencrypt.org/2023/07/10/cross-sign-expiration.htm...

I personally believe most issues blocking old device reuse can be solved by manufacturers returning the root permission back to users, so that users can install modded systems with up-to-date stuffs. However, it's a pity that manufacturers aren't willing to do it, as it hurts their interest on selling new devices. Will laws on "right to repair" work? Time will tell.

While the style and headline seems like Hacker News, the usernames seem increasingly alike Slashdot.

I'm worried about the situation when Dark Patterns are not widely recognized enough as a malicious practice for users.

Half a month ago I see someone on Twitter defending its own product design as "transparent and nothing hidden" - the "$0 now, then $15/month in 14 days" description where all text after "$0" are small and in grey. I don't think it maintains trust between the product and users, and thus it doesn't seem like a good thing.

Vercel has a fairly generous free quota and a non-negligible high pricing scheme - I think people still remember https://service-markup.vercel.app/ .

For the crawl problem, I want to wait and see whether robots.txt is proved enough to stop GenAI bots from crawling since I confidently believe these GenAI companies are too "well-behaved" to respect robots.txt.

The reveal.js slide itself probably isn't the best way for readers. The reveal.js project actually provides a PDF export feature which can be more helpful.

Anyway, it's an asahilina.net page, not a cve.mitre.org page. That domain is for the Virtual YouTuber Lina-chan, so I would not expect it to be the most friendly for developers.

As a VTuber follower, I do really like the style :D

Isn't it against at least the law somewhere?

1. Anything beyond control may cause problems. For the security part: add SRI to whatever you care about, please. 2. Could we, in 2022, get rid of the troublesome Referer?

Would a double SHA256 hash make it securer?

Have tried Kagi for a while as a beta user. It generally works fine, but I am just reminded every time when I try to do a search via Private Browsing - and Kagi, a subscription service, will apparently ask me to login - that each of my search history will be able to be linked to an individual.

Then it's definitely not what I want.

Unfortunately Twitter still remains as a major information source.

Since Twitter does not care about UX for unregistered users (so do Facebook, Instagram, Medium, Reddit on mobile and so on), users can switch to Nitter instances or using some extensions to block it.

It would be also somehow helpful to disable Cookie on twitter.com.

I guess the same idea also applies to QWAC.

https://www.eff.org/deeplinks/2022/02/what-duck-why-eu-propo...

Sure. No place to hide. Everyone. Probably several careless criminals and definitely every well-being citizen.

The problem is particularly common in China, where almost all services require a mobile number to register an account per the regulation.

Recently, a service has been established in some cities that allow a mobile number owner to delete the accounts related to the number at multiple services. [1]

1. https://www.ithome.com/0/600/098.htm (Chinese)

Well... it's a game, not a service with fixed features, so everything will make little sense if it brings no fun.