plorntus

I think one of the problems is that AI has no sense of laziness or time. Unless it's in their training data or prompted they're not going to bother automating something

I suppose yes they should be liable if they were testing it in the middle of the street?

Heh these ones gzipped and base64'd the content funnily enough.

> (diff) OAIIPEDSMay16Map3 14:36 [research 1781872609.9049127] . . . . . 20.245.63.167 > (diff) OAIIPEDSMay16Map2 14:36 [research 1781872606.4374833] . . . . . 20.168.34.226 > (diff) OAIIPEDSMay16Map1 14:36 [research 1781872602.8819065] . . . . . 20.165.156.57 > (diff) OAIIPEDSMay16Map0 14:36 [research 1781872599.4020474] . . . . . 20.80.12.72

Weird, at the top of the issue it says "fixed by <link to random pr in other repo>" in a pill.

Depends what its used by, if I recall theres an `/insights` command/skill built in whatever you want to call it that generates a HTML file. I believe it gives you stats on when you're frustrated with it and (useless) suggestions on how to "use claude better".

Additionally after looking at the source it looks like a lot of Anthropics own internal test tooling/debug (ie. stuff stripped out at build time) is in this source mapping. Theres one part that prompts their own users (or whatever) to use a report issue command whenever frustration is detected. It's possible its using it for this.

Fairly certain it'l also just allow them to pick up any cookies right as well as serve literally any content on your domain...

To be honest the responses sounded copy and pasted straight from ChatGPT, it seemed like there was fake feigned interest into their non-existent youtube channel.

> Overall simple security design flaws but it's good to see a company that cares to fix them, even if they didn't take security seriously from the start

I don't think that should give anyone a free pass though. It was such a simple flaw that realistically speaking they shouldn't ever be trusted again. If it had been a non-obvious flaw that required going through lots of hoops then fair enough but they straight up had zero authentication. That isn't a 'flaw' you need an external researcher to tell you about.

I personally believe companies should not be praised for responding to such a blatant disregard for quality, standards, privacy and security. No matter where they are from.

Honestly tried it out, I wanted to like it but in its current form I found myself frustrated enough to just end the 'call' and close the app. Been learning Spanish for quite some time now so wasn't put off by the 'it always talks in X language' thing people are talking about.

The thing that put me off was the speech recognition. I am not in a loud environment and I wasn't even talking and it was picking up responses and responding to it before I even opened my mouth. It blazed through the 'preferences' set up itself making up responses. Then when I did get to talk it just simply got my answers wrong. It would often interject too at random during my sentences.

I recall not too long ago a startup advertising exactly this idea for farms. It was some box with various sensors (and output lines) that you could configure to do a multitude of tasks

To be fair it's only kinda clickbait on HN. On their actual site the thumbnail is very clearly not a real rabbit and is visible before you access the article.

Out of interest how did you get the rights to stream the music? Cool game just curious if itl stick around.

I would definitely like some sort of “decade” option if at all possible so you can stick to films of a certain era. Some of the older ones I had no ability to guess (which is fine, just would like to weed those out for my own fun).

Also as others stated, some made for the movie tracks would be nice!

Check out Photopea, it has a ton of features and is fairly performant in the browser. It also seemingly copies the UI of Photoshop but impressive nonetheless.

I suppose so, I just find it funny really that my bank has less password requirements than most (if not all) online services I use

Spains banks (I’ve used two so far) simply use your ID number which is used in a lot of places and not considered secret and enforces a 4 digit password.

It’s an absolute joke.

I guess you'd get better results if you knew the font the site uses (which in many cases you could figure it out pretty quickly) or even just override every font with your own.

Certain browser features/apis are only available when in a secure context https://www.digicert.com/blog/https-only-features-in-browser... so I imagine this might be a reason you would want it.

That being said I don't know why you would pay for an application that does this but I guess I'm not the target market.

Am I missing something? The article doesn’t state that at all. The lab was used for creating covid 19 tests

I don't think thats true, what jokes are you talking about specifically?

I always used Ryan Air a while back when I didn't have much money and needed to get somewhere. I dislike them now because of the removal of hand luggage by default. Additionally I find they're not even that much cheaper than alternatives nowadays which makes it harder to put up with their smaller seats and in general worse service.

I had it reappear 3 times when I was trying it out moving between pages. First time was before I created an account though in the sandbox. Not sure exactly the replication steps for the second and third time it showed up.

Right but then you just connect your phone to the wifi? The following methods I have had for the 3DS card payments are (ultimately depends on the bank):

- Bank sends you a tiny card reader that you enter your PIN and it gives you a one time code. If you want to make payments that require 3DS (online only ofc) you have to have this card reader on you but it doesn't actually require an app or internet connectivity.

- You have an app on your phone, you drag a code from a notification onto another area of the app itself which does something (somehow - no idea the purpose) and verifies the transaction. Certificate is stored on device only.

- You open an app and it'l notify of the purchase amount, location, merchant and you just tap allow

- You receive a code in the mail that is renewed once a year which is then combined with a SMS message (or app notification). The payment flow asks you for some characters from both codes.

You do not require cell service for any that I have used and wifi is enough.

Further Edit: Just to clarify though, all of these are ONLY for online purchases. Purchases in shops you just use your pin if it requires authorisation.

Reddit used to show how much users donated vs the server cost (and running costs). It was always maxed out. Reddit grew and simply got greedy. Typical enterprise company woes where a much smaller company could cover most if not all what your typical user actually wants without losing money.

Reddit didn't need to be a video and image host as you allude to. They didn't need to bloat their stack with 'hot' technology. They didn't need to even make an app, the third parties were basically doing that for free.

They want to be an ad and data platform because they know that this will in the long run net them more money. To get there though they will have to alienate their entire user base.

I also had difficulty getting it to understand me. Theres a couple solutions I can think of that may make this more usable:

1) Speech to text into an input field, allow the user to modify

2) I presume this is uses an LLM to generate the responses, submit the new text and give it the entire convo as context but initially ask it to "correct" the text to what would make sense in context based on similar sounding words.

Edit: Hah oh it's not too great right now at all. Tried it again and it ended up writing Cyrillic as my response despite me speaking Spanish.

I was actually wondering if you could use this as another form of authentication (ignoring that WebAuthN and other such standards exists). For example create a font dynamically that when printing a specific string just outputs some form of data (eg. JWT encoded in a font glyph) that can be drawn to a canvas and read by the page.

Could be some form of incredibly sticky authentication, unless the user removes the font will never go away. Nefarious and not sure there would ever be a legitimate usecase but sounds doable.

True, definitely depends on where you live although I also meant that in a more broad 'moral' sense. As in, giving the reason that they /may/ release 'secretive' information without any indication that it would actually occur is ridiculous to me.

As far as I am aware though (and it depends on their contract/rules etc of course) that is completely fine and allowed?

Salaries are only secret if the person receiving it wants it to be. People should be able to say how much they earn without retribution. There is literally nothing wrong with it and it doesn't mean that they are going to broadcast actual company secrets.

If its a big deal for the employer then they should have put it in their contract/NDA and made that clear prior to employing them (but as I understand it that is illegal in a lot of places for good reason).

Fire if that happens then? You can’t preemptively fire someone for something they haven’t done nor even attempted/planned to do.

Telling others your salary is allowed and should be encouraged, it is not a security concern at all nor does it imply you are going to release any actual confidential information.

I feel like a lot of the comments here are written after only taking the test and many are not reading the rest of the article.

The authors of the website are stating that they believe the study is wrong. The below/above 60 answer is showing you it’s incorrect half of the time along with data backing up the claim.