News for hackers. Stuff that matters.

spicykraken

> > and heavy handed punishment is the best way to deter it.

> That sounds like an empirical statement. Evidence?

Singapore and Japan.

Being strungout and shitting on the streets is a crime though, so I'd take it if they enforced that one...
How did we get here? I don't know any sane citizen that would want this.
We could also, ya know... enforce our drug laws and punish folks in possession of fentanyl. But no, lets enable warrant-less spying on American citizens instead.
Re:Fighting cookie theft using device bound sessions on Wednesday April 03, 2024 @01:04PM (#39919988)
Not all applications provide users with the option to log out of all sessions.

Web Applications today, could do several things without the help of Google to make cookies more difficult to be stolen but they don't.

Graphic novels and short comics are a finite medium, they have a beginning and an end. There's not a very practical way to doom scroll away your entire weekend with comic books. You will eventually run out of comic books or run out of places to put them.
Children aren't allowed to play slot machines either and that's what TikTok (and Youtube Shorts, etc) sure feels like to me.
Re:Ask HN: What to do about random email sign-up attacks? on Tuesday March 26, 2024 @04:03PM (#39832210)
I hear ya. We hold similar sentiments and also don't use CAPTCHA, we find MaxMind (and a few custom heuristics) to do good enough of a job at filtering out bad actors. A few get in every great once in a while but we have secondary controls that limit the money they can cost us.
<insert meme here where it's just one fader like their older mice with one button>
Re:Ask HN: What to do about random email sign-up attacks? on Monday March 25, 2024 @10:58AM (#39817138)
A captcha might add enough friction to at least slow them down if they're doing this at scale.

Also adding some fraud detection on top might help (e.g. MaxMind) you can tell if the requests are coming from a proxy, hosting service, etc and block those requests or present them with additional challenges.

Re:Ask HN: Using Git for all internal company documents on Tuesday February 27, 2024 @10:54AM (#39525541)
You can use separate repos for sensitive documents instead of one big repo.

The biggest challenges will be:

- Teaching git to non-technical folks, the HR lady doesn't know how to resolve a merge conflict and probably doesn't want to

- They also don't want to learn markdown or latex

With a small enough company though, this could work.

Re:Freenginx: Core Nginx developer announces fork on Wednesday February 14, 2024 @05:43PM (#39376608)
Gotta pay the bills somehow
Re:Freenginx: Core Nginx developer announces fork on Wednesday February 14, 2024 @05:41PM (#39376583)
I've actually seen CVEs like that before, I agree that's bonkers but I have seen it...
Re:Ask HN: Does anyone care about OpenPOWER? on Friday February 09, 2024 @10:31AM (#39315774)
Unfortunately so, native modules for Node are starting to be written more and more in rust rollup and parcel are two examples. Unlike previous modules written in C++ if there's no prebuilt binary for your platform, they won't even try to build locally, just flat-out wont install despite building fine if you do it all manually.
Re:OpenIndiana Illumos Distro on Tuesday January 02, 2024 @08:18PM (#38849509)
SmartOS is still going strong with bi-weekly releases: https://us-central.manta.mnx.io/Joyent_Dev/public/SmartOS/sm...
I use Firefox across Windows, Mac, OpenBSD, and Ubuntu. I've not seen any specific issues with Google sites at all. I only really use Docs, Maps, and Youtube with any regularity but I've not really seen any of these issues.
Re:Cloudflare API Down on Thursday November 02, 2023 @10:17AM (#38113834)
> Cloudflare is assessing a loss of power impacting data centres while simultaneously failing over services.

Oh, no! The lava lamps are off, there's not enough entropy!

https://www.cloudflare.com/learning/ssl/lava-lamp-encryption...

Seems reasonable
Re:Goodbye, Node.js Buffer on Tuesday October 24, 2023 @12:56PM (#38001910)
Ah thanks, I thought "realms" sounded familiar and that helps clear things up a bit. Also Lavamoat and SES look really interesting thanks for the link.
I think it's fair to say a lot of people bought "too much car" but I completely agree we need better public infrastructure and not be forced to pay the US car tax.

Having experienced the public transit systems in Tokyo, Seoul, Singapore, and the midwest US. It's entirely obvious who is failing.

Though, despite our short comings, in a lot of cities it _is_ possible to use public transit, I did for years and it sucked and I had to compensate with Uber more often then I would have liked but at least I didn't have a car payment (in hindsight I should have just bought a car, but it was a humbling experience that I don't regret.)

Re:Goodbye, Node.js Buffer on Tuesday October 24, 2023 @11:42AM (#38000732)
What do you mean by "across realms"?

Is that just another way of saying `Uint8Array.prototype.isPrototypeOf` and `instanceof Uint8Array` are not available in all JS environments?

I guess what I'm asking is the definition of a "Javascript Realm" in case I'm thinking it's something different.