akersten
akersten on Hacker News
Maybe for enterprise box-checking. I'm sure that can be outsourced to some separate liability-shield or narrow consulting service instead. For a lot of companies, the software bit is actually all we need. I hope the current shakeout lays bare the "SaaS" whose only reason to exist as a SaaS is gluttony. ArtCraft is doing a great job illustrating that for one particular company.
Oh, it can. In fact there's an entire official tome of documentation describing how to carefully do Unicode-in-URLs to reduce the risk[0]. Browsers also have some mitigations to avoid the most common issues like homoglyph attacks where they show the domain in punycode if it doesn't match some local heuristic (like if you're in en-US, it's unlikely you're actually trying to visit a site with Cyrillic letter "a" instead of ASCII "a").
It's implemented because we have thousands of writing systems and we decided, for better or worse, we want to reflect those in URLs. Solving the subsequent security issues is likely easier than getting everyone to agree to read and write the same language.
[0]: https://www.unicode.org/reports/tr36/tr36-10.html
This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.
Makes me want to have like 5 separate computers:
- one for banking only
- one for development only
- one for web browsing only
- one for gaming only
- one for socials only
How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
Glad to now have some hard evidence I can reference whenever I bring up my strongly held intuitive opinion of "Microsoft repackaging someone else's browser and adding some extra stuff to it can only make Edge strictly worse"
> I can't use "else" as a conjunction in normal speech, only in computer programs.
sure you can. who's going to stop you?
> If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.
shouldn't they tag a new version instead of re-releasing a fixed 19.3.6, if earlier 19.3.6 are vulnerable?
Do you really think Apple would make a product advertising a touch screen where you aren't able to actually touch buttons on the screen?
The marketing material shows a person playing a virtual piano with their fingers..
I'm not sure what the point being made is. No one is forcing anyone to come up with anti-LLM scripts...?
Well, the very coarse filters that are tripping on this are before the model even loads the text into VRAM, so hopefully it is less sickening to you to know that it's very likely a "if str.contains(`suicide`) { refuseAndSuggestHotline(); }" is thinking about your message on the CPU instead of a chain of `fuzzyWeightAddMulX` commands on the GPU.
> we really need browser developers to shut this shit down. Why are you even able to silently run all of these commands on my computer
???
This is a very strange understanding of the purpose of a browser you've installed on your computer does. It requests resources from other places and displays & runs those resources on your computer. Where else would they run? Or are you saying you don't actually want your browser to do what you've instructed it to do ("navigate to example.com and run it").
Or you only want to run certain pieces of what's delivered? (You have the power, and should exercise it, to do so, with ad blockers, script blockers, etc.)
They don't, if GP's does the FCC would be very interested in knowing his location
probably un learn it, it's cap
Color me unconvinced that the dev team that sat on the 2024 security audit leading to today's CVE successfully explored the ramifications of a new memory bug in an hour
I read their quip about mitigation as more of a defeatist "this is fine" meme than actual advice that it's a nothingburger, but I'm pretty cynical on PHP as a whole. We'll have to wait and see if today's a hat trick day or just a double header.
People keep defending PHP (as they have been for ages) saying things like "oh, it could happen to any platform, this one's just so popular so the odds are higher" but then you take a peek at the diff for this fix and realize that nothing has changed since Fractal of Bad Design was published a decade ago. PHP is a scourge and unfortunately a still too popular one. The best time to realize the only safe option is to stop using it was in 2010, the 2nd best time is now ..
No way to prevent this, says only language where this regularly happens
> You want no CVEs, make software engineering into a real gate-kept engineering professions with accountability chains, government regulations, formal education, etc.
This will not only not prevent CVEs, it will also make everything a giant pain in the ass
> in a video game instead of real life.
Yeah, that's the argument. I'm kind of getting at something deeper though, like when you say this:
> At the same time it's a pretty unfair game if it has no indication you're walking into a PVP area other than scenery objects nobody pays attention to
Unfair by a comparison to contemporary game design practices maybe, but my point is that it was more fun before (and paying attention to scenery is a valuable lesson to learn as well).
Anyway the point isn't that I think Scamming is Good, Actually. The point is that Modern Game Design is Boring, and bringing back some of the discovered elements of gameplay rather than having everything explained in a dialog box or bright yellow safety paint would serve the industry well.
The author did a great job capturing the essence of what made RS such a great game, and the soul that Jagex has totally lost over the years with updates to make the game a softer place.
This formative moment could never happen today, because the wilderness is behind 3 confirmation screens instead of just being something you get to discover in the game:
> You have to know that [items] are worth something in order to not get taken advantage of. And it goes to kind of extreme levels too because not only will people, try to give you a bad price, but the game is just really well known for the scamming and the lying and stealing your password. And it's really the wild west out there.
> And so, and really this is true. My very first memory of the very first time that I entered the world of RuneScape, I was asking somebody for help. I said like I was trying to make bread and I was like, "Where can I find a mill so I can make some bread?" And a guy was like, "Follow me. I'm going to show you." And I followed him like into these woods. And you know, you can imagine he turned around. He started to attack me. And I realized what was happening. I was probably 11 years old. I realized what was happening. And I made a break for it. I ran back south for cover and I got away. I didn't die. And I remember like, you know, closing the game.
> I think that my parents hadn't been home, so I had time to think about this. And I was like, that was the coolest thing that's ever happened to me. And I think that this is kind of the beauty and the magic of this game is that it's a little bit of like a rough and tumble world where you have to look out for yourself. And as a kid, it's like that's actually really great practice to be out in the world with real people and have to understand what's going on and learn things like, oh yeah, if somebody offers you a really great deal, maybe be careful.
Cheers to this kind of game design. Wish we'd see it again some day.
Interesting that the title chooses to editorialize and call out the glasses specifically then. Kind of enragement bait imo
What about filming them with a regular smartphone?
I clicked "Show metadata chunks" and I don't understand the Critical vs Ancillary distinction. The Gamma, Color Space Information, Physical Dimensions, and Background Color sections all have a lowercase letter for their header. Aren't those critical to displaying the image properly? Meanwhile the Trailer IEND has an uppercase letter, indicating the zero-length outro byte is somehow more essential than all the color info?
Same question for safe/unsafe to copy. "Do programs that modify the PNG data need to understand this chunk?" Somehow, they need to understand the Last Modification Date before modifying the image, but no, they don't need to understand the Physical Dimensions(?)
At minimum we don't have access to "Claude thoughts" like the ones the article highlighted, right? That's part of the hidden reasoning?
What baby? Oh boy, a new authentication method just as secure as my unique per-site random password that I keep in my password manager already anyway, except I also completely lose access to it if I ever get locked out of my Google devices. The future is truly revolutionary.
what is the difference between "ripoff" and "fairly feature-comparable alternative"?
Of course, the implication by comparison to the building code example, that text absent some homeopathic suggestion of provenance causes harm, is absurd at best.
Sent from my iPhone (harm prevention watermark)
> perhaps c should get a __UNSAFE { } block,
I think the convention for this is at the filesystem level and most programmers use the `.c` suffix to indicate it
"How do I replace my social security card" with the guy metal detecting the beach, ostensibly searching for it, is pretty great too.
Xcancel before it got cancelled and I doubt anyone would have paid for it anyway