lillesvin
lillesvin on Hacker News
I don't use either myself but I'm in a position where I get to see what it produces for other people. Here's a recent (2-3 months old) example: A zsh script that immediately invoked a Python interpreter that immediately invoked a shell command and iterated over each line of output looking for one of a few strings to match... So, `<cmd> | grep "(stringA|stringB|stringC)"`, but a whole lot dumber.
Thanks, but no thanks, I don't need that kind of code in anything I'm working with.
Don't they keep a local copy like Bitwarden does?
Last thing I saw before my Proton Mail stopped responding was the "how are we doing?" survey modal, which I dismissed because I just wanted to get to my email.
Hope it's nothing too bad.
I had a throwaway Reddit account get banned from a local subreddit because I used an em-dash when asking: "Do you have an alternative to Facebook — e.g. a mailing list?" The mods' full response when I asked about it was: "AI".
And it really couldn't have been anything other than the em-dash because I've been deleting the account's comments when they were about a week old so there were no previous comments to draw any conclusions from.
I don't care though, I've been using em-dashes since the late '90s making me partly responsible (along with all the other em-dashers) for LLMs being so fond of them, so I'm not going to stop just because of them.
I just meant the SQLi (which is the basis of the chain), not the full chain.
I feel like I've seen plenty of non-AI, pre-2020 SAST tools catch SQLis like the one mentioned here, and if nothing else, then a code review ought to catch it. Is WordPress not using code reviews and/or SAST?
As much as I like cross-platform stuff, I also really like native UIs that follow native UX patterns, etc.
That's the claim, yes. Has any proof been made available yet? (Genuinely asking here because I haven't been paying that close attention.)
There have been millions of trivially exploitable vulnerabilities out there for decades — many of which could be easily discovered by using simple scanning tools or manual probing. This is hardly a new situation and LLMs really aren't that impressive at pentesting — even with these simple exploits. Maybe they are if you're not a pentester, but then ZAP, Burp, Nessus, SQLMap, etc. are likely also impressive if you put a little effort into learning how to use them, but many AI-advocates aren't interested in learning skills themselves.
It's the same situation as with vibe coding. Everyone and their grandma can have an LLM spit out a web application without any programming experience, but if you're a programmer, you'll likely quickly see some issues with maintainability and further development of the code base.
> Anyone know of a password manager that can encrypte and live in say Google drive?
Can't most of the many KeePass variants do that?
I didn't mean to detract from your tool. Sorry if it came off like that.
More options is more better. :)
If you're not afraid of working in a CLI, ImageMagick is also a very solid tool for editing lots and lots of images in bulk as long as you know what you want done to them.
Even your fancy guitar is not exempt from harmonics math. TFA has nothing to do with the quality of a guitar and everything to do with 12-Tone Equal Temperament.
> The difficult part of language is the fact we can build entirely novel meanings out of a relatively small finite set of words.
So are you saying that we've got e.g. neurolinguistics, psycholinguistics, language acquisition and typology down? Or do you simply mean "interesting to you" when you say "difficult"? Because in my experience, pretty much every subject in linguistics (and most other sciences) is easy if you don't understand it and surprisingly difficult once you start to get a grasp of it.
> Bouba kiki has no bearing on the way words are composed.
It literally shows a preference best described by sound-symbolism so it most certainly has a bearing on how words are composed. Just because the relation between sound and meaning _can_ be arbitrary, showing that in some cases it's not entirely so is extremely valuable for evolutionary linguistics.
I obviously don't know your background but out of the linguists that I know and have met while doing my degrees in linguistics, I don't know of anyone who would say that the kiki-bouba effect is not important — anything, in fact, that challenges the notion that sound-meaning relations are completely arbitrary is interesting because it might give us clues about the origins of language, not to mention that it lends support to other, related hypotheses about sound-symbolism.
I'm not sure what you mean by "not necessary parts of language", but I would love to hear what you think the necessary parts of language are. Not to mention, what is "the difficult part of language" then?
> But no serious linguist thinks that kiki-bouba is that important to language.
Do you have a source on that? Because I would expect anyone studying sound symbolism to find the bouba-kiki effect extremely important which is probably why it's such a widely cited study, also inside linguistics.
> Firefox is not an alternative; audio does not work for me. I could recompile it but compiling firefox is a pain in the ...
Obviously I don't have any data backing me up here, but I'm going to guess that that isn't the main reason why so many people choose Chrome over Firefox.
Aristophanes was such a troll. I can only recommend reading some of his plays, like The Assemblywomen (where this word is from), The Wasps, and The Clouds. They're almost 2500 years old but they've aged incredibly well both thanks to the many amazing translators that have worked on them and because the source material is also solid satire that in many cases is still relevant today.
Plato argued that The Clouds (which is sharp satire of Socrates and his school) was in part what got Socrates convicted and killed. This is obviously debatable but Aristophanes certainly didn't self-censor or mince words.
Searchable snapshots in Elasticsearch can be backed by S3 and they perform very well. No need to store the data on hot nodes any longer than it takes for the index to do a rollover, and from then it's all S3.
What kind of storage do you have backing your Elasticsearch? And how have you configured sharding and phase rollover in your indices?
I work with a cluster that holds 500+ TB logs (where most are stored for a year and some for 5 years because of regulations) in searchable snapshots backed by a locally hosted S3 solution. I can do filtering across most of the data in less than 10 seconds.
Some especially gnarly searches may take around 60-90 seconds on the first run as the searchable snapshots are mounted and cached, but subsequent searches in the cached dataset are obviously as fast as any other search in hot data.
Obviously Elasticsearch isn't without its quirks and drawbacks, but I have yet to come across anything that performs better and is more flexible for logs — especially in terms of architectural freedom and bang-for-the-buck.
Do I read it right, that ARTEMIS required a not insignificant amount of hints in order to identify the same vulnerabilities that the human testers found? (P. 7 of the PDF.)
Just to mention an alternative option, ZAP (aka. Zed Attack Proxy) covers much of the same ground as Burp and is entirely free and Open Source.
But neither does the actual server. HMAC only verifies that the message is from whoever it claims to be from and that it is intact. It won't know what you intended the body of the request to look like.
Ah, my bad. Sorry.
But couldn't you then just make the call to an echo service (like HTTPbin) or simply dump the request when you send it?
But the returned signed string will be an HMAC-SHA256 hash, won't it? Then there's not going to be any '\n' or '\\n's in there. Only thing you'll be able to tell is if it matches your hash or not, in which case 'OK' or 'not OK' will work just as well.
Or am I misunderstanding you?
Given that you can't infer the error from simply looking at the signature string, I don't see how having the expected string rather than a simple "OK" or "mismatched signature" (as you get now) would make a difference?
I know it's kinda besides the point and I don't know what language this was being done in, but I don't personally know any language where
String signature = "POST" + "\n" + "/api/v1/..."
and
String signature = "POST\n/api/v1/..."
don't result in identical variables, so I'm a bit puzzled why that would result in an error.
However, there's a quoting error in the failing example where the double quotes in the JSON body aren't properly escaped:
String signature = "POST" + "\n" + "/api/v1/query" + "\n" + token + "\n" + timestamp + "\n" + "{"body":"content"}"
It may just be the example that's not correctly formatted, but the other (working) example does in fact escape the double quotes in the JSON. I guess, depending on how forgiving the used language is with quoting, that could also be the source of the error?