News for hackers. Stuff that matters.

pepve

Re:Post Mortem: axios NPM supply chain compromise on Friday April 03, 2026 @07:54AM (#47625653)
Someone in the linked Github thread describes an attack where the attackers waited for the victim to use their Yubikey for an AWS login, giving the attackers access to AWS as well. I don't think hardware 2FA is safe against a RAT.
I'm not sure you are right. Take a look at this map: https://en.wikipedia.org/wiki/International_Criminal_Court . I don't think "overwhelmingly reliant on the US" is an accurate description of the green countries on that map. Partially reliant sure. But not overwhelmingly.
Can I offer you a prize of some sort for not thinking this is weird? Surely this accomplishment should be celebrated!

There are only facts and misunderstandings. Surprise and fun have no place in this world.

Re:Thunderbird for Android Now Available on Wednesday October 30, 2024 @04:51PM (#42000142)
> Fastmail also has different actions for marking as spam and reporting phishing; I'm not sure how effective the latter is, but of course Thunderbird doesn't support it, as presumably that's a Fastmail-proprietary thing.

I don't think there's anything proprietary going on, so I did a quick search. Fastmail supports JMAP [0], and JMAP [1] supports setting special keywords [2] for a message to mark it as spam of phishing. It may be possible to get this to work.

[0] https://www.fastmail.com/dev/

[1] https://www.rfc-editor.org/rfc/rfc8621.html

[2] https://www.iana.org/assignments/imap-jmap-keywords/imap-jma...

Re:DeskPad – A virtual monitor for screen sharing on Thursday October 10, 2024 @05:18PM (#41803695)
I use `xrandr --setmonitor` to create a fake monitor that only covers part of my screen. And I have some window manager setup to easily move my windows there (with awesomewm).
Did a rough calculation, it would be more like Edinburgh.

There's easily a century between the earliest accurate map of Edinburgh and the earliest accurate map of the world. And even at present, the accuracy of maps of Edinburgh is much greater than the accuracy of maps of the world.

So yeah, the whole world could be next. But the person you're replying to has a point when they say significant improvements are needed.

Re:Is My Blue Your Blue? on Tuesday September 03, 2024 @08:21AM (#41434237)
I'm not gonna fight you on that.
Re:How to Start Google on Tuesday March 19, 2024 @04:43PM (#39760002)
> You don't need to be upset that this isn't for you.

The person you're responding to does not seem upset to me.

You add an interesting perspective that some people want to find encouragement in these types of essays. And the personal jab just isn't necessary.

Re:How to Be a Good Listener on Monday March 04, 2024 @05:44PM (#39597148)
I was trying to compliment you! When you talk about your friend, about what you might ask him, and what he might answer, I think you have insight there. I think that's valuable.

And I should have stopped there. But I went on to try to make a point about the quick mental model you proposed about "talking at" vs "talking with". Which I think leads to arguing about semantics (with others or yourself).

What you're saying about the difference between the distribution of behaviors and utterances sounds reasonable to me (if a bit abstract). I just think the specific insight into your friend's behavior is a lot more valuable.

Re:How to Be a Good Listener on Monday March 04, 2024 @01:55PM (#39594401)
> When I imagine asking him, "What don't you ask questions about my life?" I assume I'd get a response something like, "You can tell me anything," or "I'm open to hearing what you want to talk about," or "You're free to talk about anything."

I think this is the insight!

> If I had to devise a quick mental model, it might seem like the difference between talking at someone vs talking with someone?

(And I think this is semantics.)

sponge buffers the whole input before writing the output. Its utility would be in reading from a file, working on it with other tools, and writing the result back to the original file, all in one line.
"[...] where adversaries can exploit American communications systems, cell phones and the electromagnetic spectrum." (emphasis mine)

Wait, what?

Another example of unique human intelligence: drown in existential dread.

I can do that, you can do that, but will a computer be able to do it?

Re: "all of humanness"

https://xkcd.com/1875/

(If you don't want to click the link, there's a joke there that machines may have a hard time "being to cool to care about stuff.")

Re:People with Depression Use Language Differently on Monday December 31, 2018 @03:13PM (#18796691)
EQ isn't a real thing. https://news.ycombinator.com/item?id=14940184

And you by the way seem very apt in considering other people's emotions. This dilemma you're posing would be hard on anyone to navigate.

Re:Linux kernel: multiple vulnerabilities in the USB subsystem on Tuesday November 07, 2017 @01:25PM (#15646018)
Consider the bugs a workaround for laptops with a fixed battery. ;-)
Re:Redis 4.0 on Friday July 14, 2017 @11:39AM (#14770621)
"outside the US cultural influence"

Where is this magical place you speak of?

Re:How to make a friend fast on Sunday July 09, 2017 @05:59PM (#14731945)
Both "extrovert" and "extravert" are correct. Contemporary language use does not always care about latin, however sorry I am for that.

But the author of this post goes even further, and uses both spellings in the same sentence!

In extravert-introvert pairs, extroverts report on greater closeness than introverts

That can't be right...

Re:Why is cycling so popular in the Netherlands? on Monday June 19, 2017 @04:02PM (#14589952)
Have you seen this one: https://www.youtube.com/watch?v=9xjTJUCMTZg

Video is in The Hague, I've seen it in Amsterdam though, a couple of times.

Ahem, the next president?
Re:Keybase is out for iPhone, Android on Thursday May 11, 2017 @06:32PM (#14320052)
I'm so glad this arrived. Thanks Keybase! Finally we have proper identity backed secure chat! (Which is going to be my main use case.)
Sure, you're totally right. Except where you started your post with "This makes no sense." We all have different social requirements. For some people and in some situations it's awesome to be able to change things ad hoc, for other people and for other situations that just causes stress and discomfort.
Re:Escalation of Privilege Advisory on Monday May 01, 2017 @06:19PM (#14242245)
Well, if there is a vulnerability for Nginx on Linux, you wouldn't say Linux had a vulnerability right? I think this situation might be similar.
I think you mean gender instead of sexuality. Gender is who you are, sexuality is who you like. (I'm replying to try to help, not to nitpick.)
To be fair, this thread started with someone describing the killing of maggots as "disturbing". It was never going to be a productive argument.
Re:Keeping track of technical debt in source code on Friday April 14, 2017 @06:31AM (#14113628)
I think you're both right. It's okay to have them locally or on feature branches for communication and note taking purposes. But they should never live for any prolonged time in your production code.
Re:Machine learning without centralized training data on Friday April 07, 2017 @08:33AM (#14059097)
In the secure aggregation paper (linked in the post: http://eprint.iacr.org/2017/281 ) they indeed hint at the possibility of extracting information from the diffs. So the protocol they propose cryptographically ensures that the individual diffs can not be learned. They do this by having each pair of clients generate a secret the size of the diff, and have one add it to their diff and the other subtract it. The clients then send that result to the server where they are summed, which cancels out all the secrets. The bulk of the protocol then deals with setting up the secrets and dealing with client drop outs, which appears to be the real challenge.

Well, that's my fallible summary anyway, go read the paper. :-)

Re:Machine learning without centralized training data on Friday April 07, 2017 @07:56AM (#14058920)
I just skimmed their secure aggregation paper (linked in the post), and while I'm no expert, I believe they can actually guarantee privacy. At least for the strong version they describe (there's also a weak one which requires trust in the server).

Edit, link to the paper: http://eprint.iacr.org/2017/281

So what you're saying is that the Streisand Effect is not a myth, it's just a rare occurence.

Older »