asjfkdlf

It’s crazy to read all the comments basically dismissing everything. It’s either complete regulatory capture or no regulation at all. How about at least some reasonable regulation? Fine, assume the CEOs don’t care about safety and want regulatory capture.

We can ignore that and push for something reasonable. In other industries such as housing construction we have building codes without making housing construction a monopoly. We don’t just let random people build nuclear power plants and then go “if you think it’s dangerous, stop doing it.” People are going to do dangerous things even when they know it’s dangerous. They also know it’s dangerous.

It states that it doesn’t require major changes because it all happens under the SSH protocol. A new program is needed on the client to sign in and you can already run a custom program on the server to authorize the key.

I bought these and they are great. They strike a balance of programmable, but have a kit. Relatively simple for a novice

I am looking for a similar service that turns any document (PNG, PDf, DocX) into JSON (preserving the field relationships). I tried with ChatGPT, but hallucinations are common. Does anything exist?

Aren’t they using a NoSQL store? They migrated from Casandra to Scylla DB

The prize is very underwhelming. If they really want people to spend effort on it, they need to make the prize worth it.

How does this compare to other GCM alternatives such as AES-SIV and AES GCM-SIV?

To be a deterrent, it just needs to curb some percentage of behavior. Not stop it completely. Do you think people are murdering at the same rate as if there was no punishment? It could be, but I would bet the numbers would go up significantly.

There are some really good findings about TikTok APK used in many apps. In addition I agree that better privacy laws that would affect all companies, even US ones, would be the ideal.

The statement that this ban won't help is completely wrong though. Passing universal privacy laws will take years, if ever. Banning TikTok has bipartisan appeal. Don't let perfect be the enemy of good. Tiktok can still influence people through the feed and collect even more data through the app itself.

Obviously we should work towards a privacy law around this, but this is a reasonable first step to address the most dangerous actor.

I envy your experiences. I personally have had the opposite experience. It’s important to remember that your personal experience may not be the same as others. As this movement is very popular in the general public, my guess is many others have had bad experiences with trying to repair their device (i.e. $500+ for a simple repair from the manufacturer).

I personally don’t care for Louis and he may be a jerk as you suggested, but I try to look at ideas instead of people. Some really bad people have had good ideas. If you follow ideas instead of people, it’s not an issue if you agree with someone on one topic and disagree with almost everything else they have said.

Don’t attribute to malice what can be equally be explained by stupidity

This is a horrible abuse of the DMCA. HackerRank does not own the copyright to independent solutions.

There is some useful information here, but saying docs are more secure than introspection makes no sense. The person can learn about your file upload endpoint through docs. Security through obscurity is not a reasonable security strategy.

Had this exact thing happen in production when we turned off an audit DB replication slot. We got lucky and caught it before our entire app went down. It’s one of the many foot-guns we have found with Postgres.

I have implemented something similar, but used 12 characters. 6 is way too few for a secure URL

It looks like the code is running in iframes, so yes it would do hard navigation, but it would not change the domain the user sees.

"There is no universal solution for the Year 2038 problem"

No, that is not possible. Extensions in Chrome run in a different execution context than the website. The website's document.creatElement is different from the extension's.

If the website could override extension functions, attacks would already be possible by overriding Regex functions.

You can do it with google apps too, but it's a little more difficult. Login into an account and setup an alias.

There is a limit to the number of aliases, but you can just create more accounts with aliases that forward to your email.

I am not sure what you are getting at. Those don't occur on the web and are not an issue with desktop apps you install. If a desktop app wants to run a bash command, it can do it. It doesn't need to find a bash injection.

There isn't easily exploitable issues like XSS on the desktop. Meaning, if you run a desktop app you generally don't have to worry that some rogue code is injected into the app, unless the developers keys are stolen which is rare.

That would be a good first step. It would have to be a subset of CSP. Don't allow inline scripts or eval.. Only on https is another step I see as very important.

I am not sure I agree "browsers generally have a better permission model than desktop apps". Yes, browsers ask the user if they would like to allow, but do desktops apps have rampant XSS vulnerabilities? If you allow a site to use USB, you have to be worried that any XSS vulnerability will compromise your USB devices.

I strongly disagree. People don't appreciate unwanted email to their personal accounts. That is why we don't put our email places where bots, recruiters, etc can easily access it. You generally only want to give your email out to sources that you want contacting you.

If you think people should only use an email address that they want to be contacted with, that is where I am saying the issue lies. People signup to Github, commit some code without knowing Github is giving their email out to the world. You are arguing that is by design, but I am saying most people don't understand it works that way. It's an education thing or change of defaults.

This isn't about contacting people or communicating the status of a Github project. Github issues are fine way to communicate. If the repo owner isn't responding to issues, I don't think sending email to someone's personal email found through GIT commits is a good option. There is a reason we don't just have everyone's personal email on their Github profile. People don't want spam from people they don't know.

Yes, it is a GIT feature/issue. Github does nothing to protect users (by default) from using their personal email in commits. It is definitely not well known though because almost everyone is using their private email address. Go to any big repo and you can see everyone's email.

This is more about education and changing a default.

Where does it say anything about encryption?