e28eta

They delivered before you ordered? That’s amazing!

I’m guessing that’s supposed to be 8th and 17th, or 18th and 27th?

It, at the very least, adds additional complexity to exploit your service by putting another layer between attackers and secrets / capabilities held by the application.

And in a case like this, with so many exploitable PHP boxes out there for attackers to choose from instead, certainly buys you some additional protection.

I wouldn’t choose to roll my own on the day I needed it though.

The press release claims “eMudhra will complete its remaining commitments to the browser root programs, including a full root-cause report.”

Someone answering “questions for emudhra” also say the keys were intended to be exported to US and EU data centers. I don’t know if that would have precluded inspection (hopefully it’s encrypted some way, but why not have the destination HSM generate the CSR?)

Edit: I see the below paragraph is quoted extensively below. I hadn’t seen those comments yet. Oh well

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

Content:

We have done some preliminary assessment, there appears to be a flaw in the KGC script that was used on that specific day to create these ECC issuers. As for these ECC keys, our review of the KGC, assessment of the code and view of HSM keys so far indicate that a) a set of original ECC keys were created onboard as expected b) an approved deviation to our usual KGC to test a wrap/unwrap was introduced as these keys were meant for export for this instance c) a flaw in the code resulted in the second pair of keys being created onboard which were weaker d) these second pair of weaker keys were used by mistake to create the csr (because the key labels were similar) and signed by our root e) the CSR from these weaker keys were also sent over to Sectigo for cross signing (we verified the files sent over to Sectigo)

The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted. Some additional context - these issuers created were meant for export to our US and European data centers to solve data sovereignty issues for some of our customers (but never ended up operationally in production except for one).

Love this quote:

Inclusion in the Chrome Root Store requires that a CA Owner continuously demonstrate the technical competence and operational rigor necessary to protect Chrome users. Due to the seriousness of this incident, the Chrome Root Program is conducting a thorough evaluation regarding the status of eMudhra’s remaining CA certificate to ensure these standards continue to be met. We will share further updates as our review progresses.

from a post on https://groups.google.com/a/mozilla.org/g/dev-security-polic...

Does WhatsApp have an obligation to avoid prompt injection on other chat bots?

I don’t think it’s unreasonable for them to include instructions to all chat bots, so that the WhatsApp user on the other end gets the experience they’ve chosen.

It wouldn’t surprise me if the help content including information about regulators makes any chat bots highly likely to suggest contacting the regulators to resolve an issue.

It also seems reasonable for them to want users to actually work with lawyers, instead of chat bots, for legal issues based on the content from their site.

I wonder what apple does when confronted with software that auto-approves the TCC prompt via a VNC connection to localhost.

If there’s some protections that prevent it from happening via localhost, it feels like the next step is to proxy through another host on the LAN.

Heck, I wonder if someone’s already written an app that’ll connect to VNC, look for any permission prompts, and approve. His agent software could just poke it anytime it thinks it’s blocked.

What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced?

I could see it going either way.

I don't think this was the original source, but this paper matches your (& my) recollection: https://gwern.net/doc/cs/cryptography/2006-arkin.pdf

google surfaces a couple of HN posts, but the source (cigital.com) seems to be a dead domain at this point:

https://news.ycombinator.com/item?id=288138

https://news.ycombinator.com/item?id=9914607

It's a bad shuffle implementation + using time of day as seed (reducing search space). Using the player's 2 cards and the 3 flop cards, it finds the RNG seed in real time, and then future hands (on the same server) are solved in "under one second!"

> some reason over signing metadata on-device

After my brief read, one of the main reasons they’re using PCC to produce the signed JPEGs, instead of doing everything on device, is that it maintains your privacy.

If you were signing with the iPhone, an attacker could then correlate photos taken with the same device.

Apple certainly has the data that “this sensor, in this device, took this exact photo” in PCC at the time of signing, but they discard that data.

One of the options was always on, or always on while in work mode.

I’m curious if the lack of speaker identification is a privacy thing, or a technical limitation.

It looks like it uses PCC, so it may run into usage limits

As someone on a google workspace plan, where the monthly price went up to include AI features, I’m disappointed that google won’t let me sign up for antigravity development plans with my workspace google ID. To the best of my knowledge, as of last week, the recommendation is to sign up with a different, personal google id.

It feels like such a stereotypical big corp misstep, but based on the reputation that google’s AI products have, I guess I’m not _that_ heartbroken. It’s mostly frustration that they forced the price increase on everyone, and I’m definitely not receiving the benefit.

I have a similar machine, and briefly poked at running a local LLM, but got discouraged after a couple days. The quality, responsiveness, and impact on the rest of the system didn’t seem worth it to me.

What sorts of things are you doing with the local LLM? Anything interactive? Should I take another look?

I’ve casually used Draw Things a couple of times (great tool!), and I did not find it beginner friendly. I remember feeling a lot of doubt, confusion, and frustration.

Am I getting these results because I picked the wrong model? Or I need to improve my prompt? Or the tool just can’t do what I’m trying to do? How current are these model recommendations? Have they been superseded by something newer?

As a true beginner to AI at the time, even the sizes and bits were meaningless to me. And I don’t remember having any context as to what I should be attempting to run on my mac.

So I think you need to include steps 4, 5, and 6 of swapping between different models, quants, and prompts. And step 7 is probably wading through the complicated UI, full of jargon that most people don’t know.

Don’t get me wrong, I recognize that it’s a powerful tool, and the steep learning curve exists because it exposes quite a few power-user features. But for someone graduating from commercial AI image generators that take a text prompt and maybe a choice of couple models, it’s not easy.

The sentence you’ve quoted actually links to a list of ways to corrupt SQLite, which I think is interesting in its own right: https://www.sqlite.org/howtocorrupt.html

I believe your flaky SD card is category 4, Disk Drive and Flash Memory Failures.

I was just reading about candy bars for a trivia night, and the internet tells me the UK Milky Way is the same as the US 3 Musketeers bar. As in, it omits the caramel.

Also, the 3 Musketeers candy bars used to come with 3 flavors in the package: chocolate, strawberry, and vanilla. Cost cutting led to eliminating the 2 less popular flavors.

Every year when DST transitions out, I say “next time we should move the cats’ dinner time gradually leading up to it”, but never remember. I now have reminders for the 5 days leading up to move it later by 10 minutes a day. I don’t know if it will actually make a difference

I’ve thought it’d be fun to find the chip used in those clocks, and integrate it into an offline microcontroller driven clock, but haven’t found the will to do so yet. I haven’t even looked for prior art, which I’m certain exists.

Ah, but that’s something different. “Agentic commerce”: using agents to buy things. I suspect there’s a different team working on monetization via affiliate programs, and it’d be early to let people just buy their way into it at CPM/CPC rates.

Servers make it easier to keep & maintain duplicate data in separate locations, which’ll be unlikely to be affected by the same fire.

Nope, I’ve never needed to know, sorry. AFAIK the amount of the “+” is dependent on payment volume, which is why the quoted page says that it can be lower cost for merchants with higher volume. It might even be possible that every business is eligible, but that IC+ is more expensive than the blended rate at very low volumes. I don’t know.

"1% to Stripe and 2% to card companies" is the grandparent estimating how the Stripe fees that you're quoting are divided up.

Stripe isn't keeping all of that "1.5% - 3.25% + 20p", they're paying the network some portion.

Additionally, instead of using the blended pricing model you quote, they do offer IC+ pricing to (at least some) businesses. I don't know the criteria. On IC+, you're explicitly paying "whatever the network costs" + "fixed Stripe fees"

https://stripe.com/resources/more/interchange-plus-pricing-e...

> Larger and fast-growing businesses often choose interchange plus pricing because it passes through the true cost of each transaction. At high volumes, its net cost is often lower than that of blended pricing. It also gives finance teams true oversight because it shows where all the money goes. That makes it easier to forecast costs, spot inefficiencies, and negotiate or shop around for the processor markup.

Awesome project. The video moves a little fast to fully appreciate it, but I did like how it was short & to the point.

It could be fun to implement a scientific notation result display for answers that would otherwise overflow, although off the top of my head I'm not sure what the cleanest way to do that is.

And, if YC is paying attention, this question might make a good filter for the unethical folks who’re willing to admit to their misdeeds.

> Then, when it was time to review or merge something, we spent even more time digging through the code just to understand what the commit or PR was supposed to do.

> Now I delegate that work to AI.

> […]

> If one day passes and nobody on the team reviews the PR, we merge it

It’s not clear to me whether or not the author is reviewing the code their agent is committing on their behalf, so maybe I shouldn’t be surprised that they don’t seem to care whether or not their team is reviewing it either.

But I am surprised. The author says they used to spend quite a lot of time writing developer guides, hopefully by building consensus among their peers. It seems to me like a big shift if it’s now a workplace where they might not even read each other’s code changes.

Or maybe the dev guides were top-down directions on the way they want the team to do things, and now AI is super compliant and they’re living the dream.

It’s certainly not a new phenomenon. I appreciate this XKCD [1], with a chart of “How long can you work on making a routine task more efficient before you’re spending more time than you save”

It’s not the final word, since automation has other benefits: documenting the procedure’s steps, reducing human errors, increasing consistency, etc.

1: https://xkcd.com/1205/

They’re also very toxic to cats, which is why dogs & cats have different flea & tick medicines.

>> physical menus are hard to update

> How often does a restaurant update a menu? Those that need to update frequently already solved that by having a chalk board.

One advantage of a digital ordering system: it can track inventory and mark a dish as unavailable after N have been ordered.

Some restaurants might have menu updates in the middle of service quite frequently, if they have a daily special with a fixed quantity. Most restaurants probably have an unavailable dish occasionally. Or if a beverage choice becomes unavailable, or a new beer is put on tap.

I don’t think ease of menu updates would be the deciding factor for any restaurant, I think it’s more likely to be based on the experience they want their customers to have

It also reduces the DDoS effect of telling all your customers to repeatedly hit your web servers at a specific day & time.

> I’m sure there’s a technical Unicode word for this process of matching codepoints for e.g. search and uniqueness of rendering

That’d be Unicode Normalization. I don’t have an opinion on the best source for more details, so here’s a link from unicode.org https://www.unicode.org/reports/tr15/

I don’t know enough to know whether or not there are still Arabic-specific issues, either in the spec or the implementations.

The example in the article of copy/paste/search is interesting. I think it’s equally likely to be a RtL issue as a normalization bug, but I haven’t done anything significant with either topic.