HN user
Security tester at https://redpenetration.com
Do they include expiring credit in that figure?
Most of the time they have a buried clause that says that you forfeit all of your credit or get charged an inactivity fee if there have been no account transactions or no credit added for 12 or 18 months. Same reason why you should never buy gift cards.
I bought a large format e-reader for the opposite reason - being able to read and study from large format textbooks while on long train journeys or in hotel rooms (or even camping). It handles stuff from arxiv fine too.
I really like my Boox Max, as it means that I can read textbooks at a good size without reflowing. It still holds charge for several weeks at a time after about 7 years
I wish I had it at university instead of 1000+ page hardback calculus textbooks.
If you are wasting time wording communication then are you doing it wrong?
I imagine the response would be looking at it briefly, seeing if it looks dangerous or reproducible and getting an AI to return a templated "PoC or GTFO" response.
The mere existence of a CVE doesn't tell anyone whether a bug is valid or not, and the security reports should be handled in the same way regardless of whether one does exist. For some odd reason people have attached value to having your name logged beside CVEs, despite it not telling you anything,
Is that not a problem with how people are using CVEs, scoring them and attaching value to them rather than whether a CVE should be assigned itself. A CVE is simply a number and some data on a vulnerability so that the community knows they are all talking about the same issue
Even if you need to be root to edit the files, it still is a deviation from the design or reasonably expected behaviour of that interface, so is still a bug and should still get a CVE. It should either be fixed or failing that documented as 'wont fix' and on the radar of anyone building an application. Someone building the next plesk or cpanel or similar management system should at least know about filtering their input and not allowing it to get to the dangerous config file.
Re: Harassment - Can't the project release a statement saying that the bug writeup is low quality and unable to be reproduced? Anyone ignoring that without question and using it as evidence that the project is bad without proof is putting way too much value in CVEs and the fault is their own
From memory, online and offline transactions are usually split out by BIN number (first six digits)
The BIN will tell you which bank was the issuer and which class of card you have, like standard or premium, though most readers probably don't take that into account beyond the card scheme and card type associated with the range that the individual BIN is in. Many banks will have multiple BINs for the same card type if they are large.
Credit / online debit / offline debit usually get different ranges. The reader gets a list of the ranges when it updates and they don't change super often. Offline readers can be configured to reject cards with a number in an online only range.
I last used a carbon imprinter in the UK in 2013. We hired out car roof boxes / cycle carriers at a summer job I had.
I am not sure how valid it was, though they would take a deposit and a card imprint until we got the car accessories back.
I used to have an online maestro card (was solo and now known as debit mastercard) and an offline card (was switch, now also known as debit mastercard) from a UK bank, due to having two current accounts there.
The offline card was from a current account with an overdraft and also worked as a cheque guarantee card, for cheques up to £250 under the (discontinued ~2011) cheque guarantee scheme[0] and had a special hologram on the back. The retailer would watch you sign the cheque and write details about you, the card and any CCTV etc. on the back of the cheque. I imagine the offline behavior of the card was similar, and was a carry over from that.
The online card was from a basic account with no overdraft facility and acted a bit like a prepaid debit card.
Assume 40 inches rather than 40ft
Adding 12 meters to an aircraft is quite a big change.
There are services like vast.ai that act as marketplaces.
You don't know who owns the GPUs / if or when your job will complete and if the owner is sniffing what you are processing though
Often you will obtain a vulnerability in some software and then search for companies using it. You can often use Google or Shodan to do the searching, but perhaps ingested LLM data could also work.
In the simplest case if you get remote code execution in SuperServer9000 (made up product) and that has a banner on error / status pages that reads "Powered with pride by SuperServer9000 version 2.1", then you could just search for that string (or part of it) and use your remote code execution bug against any sites that come up.
It can get behavior based or more complicated than that though, or rely on information that an LLM has ingested about a company from public sources.
Then either grab data and sell it or sell your access to a broker or whatever else.
Would it even be possible to enumerate all edge cases and test all the permutations of them in non-trivial codebases or interconnected systems? How do you know when you have all of the edge cases?
With fuzzing you can randomly generate bad input that passes all of your test cases that were written using by whatever method you have already been using but still causes the application to crash or behave badly. This may mean that there are more tests that you could write that would catch the issue related to the fuzz case, or the fuzz case itself could be used as a test.
Using probability you can get to 90 or 99% or 99.999% or whatever confidence level you need that the software is unaffected by bugs based on the input size / number of fuzz test cases. In many non-critical situations the goal may not be 100% but 'statistically very unlikely with a known probability and error'
It is highly recommended to configure two or more DNS servers incase one is down.
I would count not configuring at least two as 'user error'. Many systems require you to enter a primary and alternate server in order to save a configuration.
Private DNS on Android refers to 'DNS over HTTPS' and would normally only accept a hostname.
Normal DNS can normally be changed in your connection settings for a given connection on most flavours of Android.
Sometimes devs rely on Chrome specific quirks, or are shipping broken apps that Chrome manages to make the correct guesses for it to be functional.
Many see 'it works on Chrome and mobile Safari' as 'it works' and they can get project signoff / ship / get paid / whatever and don't care about other users
The company that has the application may not know until a few users complain (if they complain) and by that point it could be too late due to the contract, or they may not understand what a different browser is or care either.
Devs, particularly those with pressure to ship or who don't know better, unfortunately see 'it works in Chrome' as 'it works', even if it is a quirk of Chrome that causes it to work, or if they use Chrome related hacks that break compatibility with other browsers to get it to work in Chrome.
- Sometimes the standards don't define some exact behavior and it is left for the browser implementer to come up with. Chrome implements it one way and other browsers implement it the other way. Both are compatible with the standards.
- Sometimes the app contains errors, but certain permissive behaviors of Chrome mean it works ok and the app is shipped. The developers work around the guesses that Chrome makes and cobble the app together. (there may be a load of warnings in the console). Other browsers don't make the same guesses so the app is shipped in a state that it will only work on Chrome.
- Sometimes Chrome (or mobile Safari) specific APIs or functions are used as people don't know any better.
- Some security / WAF / anti-bot software relies on Chrome specific JavaScript quirks (that there may be no standards for) and thinks that the user using Firefox or another browser that isn't Chrome or iOS safari is a bot and blocks them.
In many ways, Chrome is the new IE, through no fault of Google or the authors of other browsers.
I'm also surprised that no one would have thought to use a stone crucible before pottery, or some sort of concave piece of stone
Or cooked something in a natural hot spring or natural outlet where boiling/near-boiling water forces its way to the surface.
Maybe I read it differently from you, but it states
"You can use resources (e.g. publications on Google Scholar, Wikipedia articles, interactions with LLMs and/or human experts without sharing the paper submissions) to enhance your understanding of certain concepts and to check the grammaticality and phrasing of your written review. Please exercise caution in these cases so you do not accidentally leak confidential information in the process."
From my reading then that would prohibit putting the paper into an openAI service, but how an interaction with a local LLM that doesn't involve sharing anything is treated is unclear. If you had an airgapped GPU rig running a local model and you formatted all storage on it after you were done, then no information would be shared, as you are just doing a bunch of math operations on it on your own machine.
Could AI still be a useful tool if the reviewer performs a manual review first and then queries the LLM with:
1) Here is a new academic paper. Point out any inconsistencies, gaps or flaws in the research, and any contradictions with previous research in the field.
2) Here is a new academic paper and a journal submission policy. Does the paper meet the journal submission policy?
3) Here is a new academic paper, the review policy of the journal and a review of the paper. Does the review appear to have been conducted correctly.
4) Here is a new academic paper and a review of it. Has the review missed anything?
With the above, the reviewer could review the paper themselves, and then get the AI agent to proof read or double check everything, treating it like an editor / reviewer / secretary / grad student that they had asked to read the material. As long as the AI output was treated as potentially flawed feedback or a prompt from a third party to look deeper into something then that seems fine...
I'm surprised we are still using in-band signalling after the captain crunch whistle / blue-boxes have been around for that long
Counterexample: Storing the bcrypt hash by appending it to a CSV file containing the usernames and hashes of all users then having a login process where that CSV file is downloaded to the client and the password is verified locally against that CSV file using client-side JavaScript would probably be very bad.
Cryptography part is fine but storage or the auth process isn't.
You would like to think that no-one would write their app that way, but there are plenty of slightly less worse things that happen in practice and vibe coding probably introduces all sorts of new silliness.
I have seen it posed as 'This site has bot protection. Confirm that you are not a bot by clicking yes', trying to mimic the modern Cloudflare / Google captchas.
I am not technically an employee - I get given a project and agree to complete milestones for payment. I supply my own tools and take on any risks that it won't be delivered or stuff will break. I carry my own insurance. I could hire other people to do the work if they passed my client's background check requirements and signed the NDAs.
I have a few different clients who I do work for and actively market my services.
I 'work' remotely for a US company from abroad regularly. I have no connection to the US.
I own a corporation and it is a B2B outsourcing arrangement rather than an employee though.
I don't get the same rights as an employee, but am fine with that as they are paying me and I am voluntarily providing the work.
I am surprised more people don't try that arrangement as I have seen nothing to suggest there are problems with it so far. I just needed to get an EIN, file 8832 as I have a single member foreign corporation then fill in a W-8BEN-E and protectively file 1120-F and 8833 every year.
Thanks! - I am now aware of those two lists
Agree about the lack of info
Thanks! - I wasn't sure where the definitive list was, or if they could be using some other brand name that wasn't their company name on the list.
Posting here to see if anyone else had encountered them before seemed a reasonable first step.
I have considered that, though I was not sure that letting a spammer know that your address is active and being read by a human was the best strategy, so thought I could make a HN thread to get suggestions / discuss how to act first.
People here seem to be relatively smart and clued up on the whole, and could suggest some things that I hadn't considered yet / create an interesting discussion for others to read.
Thanks
From a whois, it seems they are hosted by cloudflare and namecheap too, so I may write to them incase the site goes against any of their content / usage policies
It used to be much harder to get a bare UK domain. Restrictions were loosened in the early 2010s, with priority given to those who already owned a domain that was second level .co.uk etc.
From working in China a bit (though could be wrong, n=1 anecdotes etc.), the majority of IT people are probably the lucky ones who mostly had a middle class upbringing, could live in a reasonable city and studied hard at school or had well connected parents. Life growing up with parents who were a rural rice farmer or metal scrapper or something would be way different. It is very hard to get a job after a certain age compared to the west, and there is pressure in some areas for women to quit once they have children.
It was common to see people working from 7 or 8 am to 8 or 10pm in my office, though with a 2 hour lunch break where most people slept.
On average, people tended to look way healthier (at least superficially) on average compared to places I have been in the US. Maybe due to diet and activity level.
RS is similar though was better in the past
example: https://uk.rs-online.com/web/c/?searchTerm=zync+7010
Cheap and recycled cookware or cooking oil would be up there on the list of interesting things to check imho
- https://www.bbc.com/news/articles/cml2kr9wkdzo
- https://en.wikipedia.org/wiki/Gutter_oil
- https://www.nature.com/articles/s41370-024-00686-7
Anywhere in the supply chain to a streetfood stall, or mom and pop restaurant or cornershop/bodega equivalent could have substitutions made that other people in the chain may not notice