News for hackers. Stuff that matters.

pfrench42

In use, I've yet to be hit by a supply attack, but it's definitely discovered that all the AI harnesses freely read each others sessions, claude reads codex history and vice versa.

I ALWAYS have at least dirblock running whenever I do any package updates, I generally don't keep env secrets set in my shells, so nothing to exfil by supply attacks there, but there's been a lot of interest by the CI teams for this.

Again, they're small, user-mode programs with setcap applied to do their work, so they sit in my ~/.local/bin/ directory rather than being a big, blessed install.

Shell snippet:

pfrench@fw:~/proj/system/$$ GH_TOKEN=test_gh_tokenajsdflsadfas env | grep TOKEN

GH_TOKEN=ghp_A3XjNOKg7iDHepAEGBRbz

pfrench@fw:~/proj/system/$ less ~/.ssh/config

/home/pfrench/.ssh/config: Operation not permitted

Show HN: Dirblock+envblock – tiny whitelist guards for dirs and env secrets

https://github.com/roku-oss/dirblock

After I missed getting hit by the LiteLLM attack by 30 minutes, I decided to see what I could do about it and wrote dirblock. It uses fanotify to block access to ~/.ssh, ~/.gpg, etc. with whitelists of trusted programs — everything else is denied.Shortly after, I wrote its spiritual cousin, envblock, which uses eBPF to stop untrusted programs from receiving real values of GH_TOKEN, AWS keys,...

( Read More... | 1 comment | 2 points | on HN )
Re:How to Quiet Your Mind Chatter (2021) on Monday April 25, 2022 @04:29PM (#31160171)
Works for me. So far rock climbing and fly fishing require 100% of my concentration and voice chatter disappears completely. For me they are my meditation.
Re:The predecessor to Google Earth was clumsy, yet powerful on Friday September 24, 2021 @02:35PM (#28646191)
Same here (Keyhole)

Funny story: Back then I was running keyhole with my son who was about five years old. Naturally you want to fly in over your house, so we did that. He saw the house and said "Dad, go run outside!"

Re:The Beauty of Bresenham's Algorithm (2016) on Tuesday April 13, 2021 @12:49PM (#26795207)
I use the algorithm for fast image resizing as well. The error term gives you the blend value for two adjacent pixels.
Re:What happens when AIs are trained with christmas songs on Tuesday December 22, 2020 @01:02AM (#25503412)
Made me ugly cry laugh.
Re:Hi, robot: Why robotics and language need each other on Friday December 11, 2020 @01:33PM (#25388978)
Posting for a friend at knowable as their social media person is on vacation.
Re:Reasonably priced color e-ink display on Monday July 20, 2020 @12:53PM (#23899630)
Is it just me or should this be four color CMYK like a regular printer?
Re:Thousands flock to Wikipedia founder's 'Facebook rival' on Tuesday November 19, 2019 @11:53AM (#21575121)
I'm still considering signing up. I would do it in a heartbeat if, with my subscription, I could "gift" a subscription to a couple people of my choosing
Re:We ‘may’ have discovered a potential remedy for tinnitus on Tuesday November 19, 2019 @11:43AM (#21574982)
For free you can try a (scientifically?) based tinnitus modulator at mynoise.net, it works a little bit for me.

https://mynoise.net/NoiseMachines/neuromodulationTonesGenera...

This is his website. Be warned, naturopaths are a little odd and opinionated. :) http://www.arizonaprolotherapy.com/
You should consider looking into Prolotherapy. I had increasing levels of lower back pain since I was twelve. It had gotten so bad I couldn't roll over in bed without sharp pain.

My neighbor was a naturopath, I helped him photograph some before/after xrays of a 70 year old woman's knee (before was bone on bone; she regrew her meniscus and bone spurs disappeared)

I did three prolotherapy sessions (they're painful) with him over a few months and I have been pain free for over fifteen years now. I actually started playing rugby after my first session.