bmitch3020

Not just making it seem like a new idea, but a shiny and trendy one.

The important data being handed over was the IP address of the admin. If you self-host the server, that skips the first step to discover who is running the server, your own IP address is in the web site's DNS entry.

The downside of offline cameras is they are mysteriously missing the SD card after the vehicle gets impounded.

Extending the length of the stop to wait for a drug dog isn't legal. The key phrases include "am I being detained", "am I free to go", "what is your reasonable articulable suspicion of a crime", and "what is your name and badge number". Record everything.

Of course they'll be more than happy to break the law themselves. They'll investigate themselves and find no wrongdoing. And I'm sure the officer will claim they smelled something giving them reasonable suspicion.

CVE-2026-111497 is not limited to nodejs. The brotli decoder is also included in other projects, including curl[0] and git[1].

[0] https://infosec.exchange/@harrysintonen/117489564359709891

[1] https://infosec.exchange/@harrysintonen/117489801970908776

CVE-2026-111497 is not limited to nodejs. The brotli decoder is also included in other projects, including curl[0] and git[1].

[0] https://infosec.exchange/@harrysintonen/117489564359709891

[1] https://infosec.exchange/@harrysintonen/117489801970908776

CVE-2026-111497 is not limited to nodejs. The brotli decoder is also included in other projects, including curl[0] and git[1].

[0] https://infosec.exchange/@harrysintonen/117489564359709891

[1] https://infosec.exchange/@harrysintonen/117489801970908776

I've yet to voluntarily enable passkeys, for the main reason that I want portability, and not to be tied to any single device that can be lost. I want to be able to backup and lock my credentials in a safe. I also want to control the strength of my credentials for different services, and I don't consider my thumbprint used to unlock my phone to be as strong as a long password in a password manager.

The first time I was forced to use a passkey implemented within the vendor's app (3rd party password managers were not an option). I quickly closed that account.

The second time was an app that popped up a passkey opt-in in the middle of a bunch of transaction screens. I quickly realized the error, but there was no easy undo. The opt in was one green button in the middle of the screen. Turning it back off required digging through settings to find the security option to disable, and then confirm my choice multiple times. That process also signed out all my other devices.

The fact that companies are resorting to dark patterns and forced requirements, where my money is held hostage, should be pretty good evidence of how poorly the passkey rollout is going.

Compared to the current state, where multiple "security researchers" independently send unsolicited identical reports, this feels like the right solution:

1. It's opt-in, anyone that doesn't want to receive these reports, or has reasons to not want AI used on their project gets that by default.

2. It's free for OSS projects, many of us won't spend money for a hobby we work on in our spare time and give away.

3. The reports go back to the maintainer, and not to potential attackers.

I would like to see more locally run models in this space, breaking the dependency on SaaS vendors. Even though those local models can't be controlled and would therefore be used by attackers. At some point, we'll get past this wave of newly discovered issues that have been lurking in the code for years, and the scans should run like any other linter or dependency checking tool.

For me to believe this is not a bubble, I'd want to see that revenues exceed expenses by a large enough factor to sustain the business (often a 10% or greater profit margin). Right now, every one of these companies is following the Uber business model: give the product away at below market prices to hopefully capture the market and force their competitors to go bankrupt first. They're also speed running the bubble with massive data center builds that will increase their debt and future interest payments on that debt.

The question for me isn't "is this a bubble", it's "how many of these companies will be left after it pops". The few companies that remain are likely worth their current inflated value. But I'd want to see the back of the envelope math showing that all of the companies together will be able to earn the necessary profit to justify their valuations, how much revenue would that require, and how does that compare to the current tech purchasing today.

They're targeting 9 5s of uptime now. 55.5555555%.

I can't imagine they'd ever get enough people to opt-in to mouse tracking to generate enough data for their model training. It's either a DOA AI project, employees will be pressured into accepting it (making it part of their review), or their managers will accept the monitoring on their behalf.

There are two things keeping me using "Big Map".

1. Address lookups. Many of the buildings in OSM have yet to get street addresses added, so navigating to an address is a bit hit or miss. This gets fixed with time as people update the maps and wouldn't be a show stopper.

2. Real time traffic and detour navigation. This is really needed when navigating around busy cities where a wreck on a major highway can result in significant delays. This needs a combination of an external service (separate from OSM) but also one that has enough adoption to have usable data.

The OSS tool for nautical charts is OpenCPN.

There's a massive difference between "big open source" and "small open source". LF has been doing a great job at representing their member companies, each of which has a significant investment in big open source projects, most of which are well funded and staffed. Presumably there's some transitive support given to their dependencies too.

But then there is the very long tail of small open source projects, maintained by a single developer in their spare time, which collectively support the entire software ecosystem. And in every one of these announcements, there's rarely anything being done for this group.

Changing this wouldn't be difficult. AI based vulnerability scanning of projects could be opt-in, where reports are only sent to the security contact listed in the project. This would avoid the risk of malicious actors scanning open source projects with the tool, and avoid sending reports to those projects that don't want them, while supporting the OSS software that doesn't make the "critical" threshold in LFs current criteria.

Unfortunately that would also mean spending LF member funds on projects that may not directly benefit those LF members, so I'm not holding my breath.

I appreciate what GitHub is trying to fix here, but this feels like the wrong approach.

The direction I'd take is to integrate community maintained allow and block lists to prevent people from creating new issues or PRs.

Another option would be a limit on the total number of open issues and PRs on the repo (not just per user) so that someone wanting to open a new one may be forced to work on issues and PRs from others first if they want to be able to submit anything of their own. And then have different limits for those on an allow list, or those that are financial sponsors.

As much as I wanted to see another browser alternative succeed, Ladybird has lost my trust. Using LLMs to rewrite the entire codebase was already extreme. But eliminating external contributors is a precursor to a rug pull. And rewriting the entire codebase can now be seen as another step in a rug pull.

> How do you know he didn't buy the car from the thief?

If you're caught with stolen property, particularly a vehicle that has a title, I think the burden is on you to prove you thought you bought the car legitimately. Show a bill-of-sale, signed title, or any other evidence of a transaction. Particularly when that evidence includes identifying information of the seller.

The settlement agreement was linked from the original post from FIRE: https://www.fire.org/research-learn/settlement-agreement-and...

The sheriff isn't paying the settlement, the local government is (just about always does). The settlement comes with the agreement to drop the lawsuit.

There's more than one Perry High School, and the claim is that someone thought this was a reference to a future school shooting at their local school. The fact that the police knew that it wasn't, but arrested him anyway, and held him with a ridiculous bond, all weighed into the lawsuit.

20+ years ago, it was the backend for the business rules engine that processed various logging and monitoring events. The concept was interesting, the performance was terrible, and businesses mostly didn't want to touch it. After I setup clients with a generic set of rules that worked on Prolog facts, most all of my clients were happy to limit their changes to only those fact files.

I'm not sure there's a lot to capitalize on, considering the state of hosting OSS development. But this really is a case study on watching your biggest competitor face plant into a wall, and responding by breaking into a head first sprint.

They know exactly how to handle it, which is why it's such an effective business model. The crew do what they can to avoid being boarded, then get to the safest location possible.

Once the ship is captured, it's held for ransom, the insurance company gets their negotiators to minimize the price, they eventually pay the negotiated ransom, and insurance rates go up.

If you're expecting someone to prevent piracy, you need to first run the financial cost/benefit analysis. How much would need to be spent on a military operation, and what's the return that would be seen from the country sending their military to rescue a private ship registered to a foreign country, staffed by foreign crew, with cargo destined for a foreign country?

In direct combat, you're absolutely right. Most of my point is that they aren't hired to defend most ships if companies do the math and assume the risk isn't worth the cost. The crew that's left are trained to fix the engine, cook some food, and control the auto pilot, not to fire guns.

That said, when mercenaries are defending a ship, it's often trying to stop a small runaway boat loaded with explosives. It's a very small moving target they have to hit with little time. Meanwhile the small boat just needs to be pointed somewhere in the direction of the oil tanker.

Considering Saudi Arabia was bypassing the blockade of the Hormuz Strait by piping as much oil as they could to the Red Sea, this is going to cut that off (or significantly increase the insurance costs). Things just keep getting worse in the oil supply chain. It's a shame we didn't focus more on increasing the supply from renewable alternatives.

The response will need to come from the country where the tanker is registered/flagged. Liberia and Panama aren't exactly known for their Navy fleets. Without that, it's up to the ship's commercial owner to resolve, or more likely, their insurance company.

The crew are rarely trained and equip to respond to an armed attack. If they have anyone to defend the ship, at most it's a handful of mercenaries hired for the high risk part of the trip.

It's a shame that a disputed charge doesn't result in the credit card company reviewing how the charge was processed, invalidating only the single saved token with a single merchant. That would save everyone a lot of time and money.