JaggedJax

Was PHP not correct that as of the embargo there were no confirmed valid uses of the exploit, even with the embargo being broken and people rushing to try to exploit it early?

Maybe we are arguing that they should have release early because of the possibility of it being exploited, but I do believe PHP (and others who backed it up) when they said they reviewed the exploits flying around on Twitter and verified those would not be able to successfully perform this exploit.

And again, Amazon is not saying they saw this being probed on Oct 17th. They are saying that today, in hindsight, they see this in logs from the 17th (unknown if it would have been successful either). If Amazon clarifies that they saw this in the wild at the time, then I agree with you. They just didn't say that.

This doesn't really change anything, other than check your logs back through the 17th. Amazon is not claiming they knew about this being exploited before the 21st. No one appears to be claiming that. Their wording could easily mean they went back through logs and found it later. I haven't seen clear evidence yet that any of the thousands of early attempts were successful. They appear to just be people sniffing/guessing around to try and figure it out, at most sometimes getting something to work in one specific environment.

Yes, we live in a new world now and need to handle disclosures differently by learning from this experience. The first major RCE disclosure that came with 3rd party leaks of this era was bound to cause these issues no matter who it affected. Let's hope the next one is better.

The major mistake I see in this incident on the disclosure side that kicked this all off was Calif posting their video early because they took vibe coders on X at their word. Maybe the early notice by PHP of an upcoming release was a mistake in hindsight given how people reacted.

[] Is this standard in the security researcher world? Let's beat embargo by a few hours and cause extra panic by putting more people at risk?

All I can say is it's the only editor I've ever used with this type of issue and unfortunately it's a deal breaker for me. I can get by with any other editor even if they aren't my favorite, but only Zed made me realize that the most important thing an editor can do for me is accurately show me files.

I had to stop using Zed because of this issue (which persists despite being closed): https://github.com/zed-industries/zed/issues/38109

I can't use an editor where the file contents I'm being shown don't match the reality of the file. I guess this issue doesn't affect most people somehow, but in the age of CLI agents I'm not sure how more people aren't running into it.

I was really enjoying Zed for a short while before I ran into this fundamental issue.

I don't understand why this would change any opinion on Bitwarden. Bitwarden offers an API and OneCLI calls the Bitwarden API. How does a 3rd party calling Bitwarden's API say anything about Bitwarden?

Edit: I can see on Bitwarden's site they also call out their support for OneCLI, so I suppose that looks like Bitwarden saying they approve of and recommend OneCLI. But I see recommending an open source solution as a lot less problematic than recommending any other random private startup solution.

How? Reading this it seems like only verified developers can skip this process. Most Fdroid developers won't be verified. I don't see where it says Fdroid would be exempt from this requirement. Would Fdroid be a verified developer?

The turfing with this topic is strong and needs to be called out. Reliable sources are crucial now more than ever. We cannot tolerate and promote botnets once they are uncovered.

I would recommend the Wayback machine archive instead: https://web.archive.org/web/20260306172113/https://community...

Given that archive.is is known to DDOS and alter archives (See all the recent HN posts about them)

Found that this is a Firefox setting, maybe it's not (no longer) defaulted to on.

"Search for text when you start typing"

I have to say, I do like this setting enabled, but can see how it conflicts with the page. And let's be fair, how much time and I saving over having to press Ctrl+F when I want to search a page?

Love it, what a great throwback, especially with the OST.

In Firefox is there a way to play this without FF popping up the search box on every key press? Maybe there's a way for the JS to override the default FF search functionality?

Analytical systems. I see a lot of add-on services that will add intelligence/analytics/etc and companies try them out to solve some issue they have and bounce off them frequently due to growing costs. I can only assume as mentioned that over time these are also easier for companies to in-house vibe-code as well, I just haven't seen a ton of that yet, but people are definitely trying which still shrinks the available pie.

Maybe it's mostly from AI, maybe it's mostly general economic cutbacks. I also feel like these "wrapper" style SaaS products are the first ones companies are dropping when they are looking to cut costs, and I think a lot of companies are looking to cut costs. I do agree with the overall conclusion either way, that System of Record products/companies are the most likely to survive. There are a lot of SaaS companies with questionable long-term businesses who are getting hit, but that was bound to happen.

I'm not sure when this policy was introduced, but fairly recently Jellyfin released a pretty major update that introduced a lot of bugs and performance issues. I've been watching their issue tracker as they work through them and have noticed it's flooded with LLM generated PRs and obviously LLM generated PR comments/descriptions/replies. A lot of the LLM generated PRs are a mishmash of 2-8 different issues all jumbled into a single PR.

I can see how frustrating it is to wade through those and they are distracting and taking time away from them actually getting things fixed up.

They want access to the index. They will perform their own sorting to determine the best results to show from that index.

There are plans available where that is the case. So the solution would be to switch plans or carriers to one that doesn't bundle the phone price in.

KISS looks nice and I'll give it a try. This reminds me a lot of Kvaesitso launcher also on F-Droid, although KISS looks a little more minimal. They seem to have a similar focus though. If KISS is a little too bare-bones, but you want something still fairly minimal, I found Kvaesitso to be a good balance.

The main purpose of these launchers for me is to avoid using my phone mindlessly. I won't just see an app and open it for no reason. I need to make a decision that I want to use an app on my phone.

It's probably fair to assume that most of their other camera models are affected by the same or similar issues. It looks like they pump out quite a few models that I image have similar firmware.

This page[1] lists the C200 as last having a firmware update in October, but also lists the latest version as 1.4.4 while the article lists 1.4.2. It seems like they have pushed other updated in this time, but not these security fixes.

[1]https://community.tp-link.com/us/smart-home/kb/detail/412852

I've been noticing this happen more lately. Intuit QuickBooks did this exact same thing for GET calls this year as well.

My theory is they see POST/PUT calls as adding value and are actions that customer need to perform and help the platform (adding products, inventory, etc). But GET calls they see as leaching off them and not core requirements.

The huge gap in this theory are things like Seller Fulfilled orders which you have to GET, but for Amazon they have always pushed hard for Amazon Fulfilled instead.

In the end I think this is all mostly to keep things/control in-house as much as possible. Some apps will shut down, others will pass the cost along the sellers. Sellers always lose.

These are pretty steep API fees for a company already taking a hefty cut on every order flowing through this API.

This is one of two things I require when looking at a smart device:

1. Must work offline on my local network (like Matter through Home Assistant)

2. Must have a physical button for operation when there is no network available or someone doesn't want/have a phone.

Corrected link: https://www.youtube.com/watch?v=wncRFPd69rg&t=1110

I ended up going this route too and really like it. There are lots of guides out there with different solutions, all really easy to implement.

Not affiliated, but Immich (https://immich.app/) is a great self-hosted alternative to iCloud Photos.

To be fair, it's about 3 very easy steps.

Thank you for the link. I didn't realize Fakespot is also getting shut down. I guess these acquisitions didn't work out so well profit-wise, but it's good to see more focus on their core browser.

A small side project of mine got found by scammers who loved to use stolen credit cards on it :-(. It made me need to prioritize some extra safety and consider whether it was worth keeping the project live with so little real usage. So apparently I'm better at getting the wrong kind of attention.

I feel like your game could fit into a similar bracket format where everything is displayed on one page. I don't know how the UI of selecting emojis would work there though.

It took me longer than it should have to realize the last puzzle was made up of all my previous answers.

Spoiler: I also failed miserably at the last puzzle since I was thinking watergun and not gun so I thought it was a firefighter. I also couldn't tell that one emoji was a jail so just sort of ignored it. So that's mostly on me for having trouble understanding some of the emojis.

Surely it's so they can feed error messages like "PC LOAD LETTER" into the model and get a sometimes semi-accurate explanation.