Hacker News Reader

Benderon One week on the APNIC honeynet: 99,000 IP addresses and 173M events

Are all the captured IP's distributed weekly to the assorted blocklists such as FireHOL [1]?

Benderon Stalwart v1.0: The Fastest Mail Server on the Planet

Nice. Curious if they will also let Mythos and related LLM's also take a pass at it.

Benderon Stalwart v1.0: The Fastest Mail Server on the Planet

Have there been independent third party code and network penetration tests performed on Stalwart and what were the findings?

Benderon Solar power is becoming bigger than nuclear

Agreed adding more panels would work around the limitation. The reason I ask is that in theory there is room to reach upwards of 48%, the max being reached right now is around 32% and all the panels I can find that are mass produced are between 20% and 22% assuming one can even find the numbers, some companies are making the numbers hard to find. Anything above 22% appear to climb in cost exponentially.

With more panels my setup will be more of an eye-sore, require more and longer cables, combiner boxes and the setup becomes a bigger project. So I am just being a selfish ass but I had to ask where we are.

Benderon Solar power is becoming bigger than nuclear

The price coming down is great, more accessibility to more people. Have there been any significant breakthroughs in overall average efficiency/conversion? e.g. 30%+ Asking for my own selfish needs as I am in a place with reduce sunlight availability.

Benderon Ask HN: Find Vulns with Claude in OSS?

Too much of that, especially with Opus 5.5 and expect to get the Anthropic Shock collar that will pause your session. You will be upsold Mythos which requires going through their verification program. [1] I can't make it more than 4 hours on Opus 5.5 without getting my session paused for the day and having to start a new one (strictly defensive coding). Apparently their leadership must believe that secure code is a value-add and not a mandatory part of software development.

They have recently enabled it on Opus 4.8 but it takes longer to trip. I get my sessions paused for [cyber] and [bio] all the time which is pushing me towards the Abliterated (uncensored) models Llama-3-70B-Abliterated or Hermes 3 70B, Dolphin, R1-Abliterated.

[1] - https://support.claude.com/en/articles/14604842-cyber-verifi...

Benderon Root shell on Samsung TV

Why don't politicians care about this?

Because there have not yet been any high profile cases involving the collected data used to embarrass or convict a politician. It just takes one embarrassed congress critter to get a giant red sticker on all these devices, their boxes and ads: "This Device Transcribes and Reports Your Conversations" and that is before including those that upload camera screenshots of what you are watching and video of the viewers doing something untoward.

Benderon DNS: A Replacement for Finger

What pulled me to DNS as a replacement was mostly that DNS is distributed, DNS servers get patched quickly as they are expected to be on the internet and people are just connecting to their local resolver vs. connecting to a port on someones workstation or server. Even if the idea never takes off I could see using it as a niche status update for myself even if nobody ever sees it.

Something ironic about pure text, status info, cgi-bin being replaced

The site I hosted this article on is a CGI script. One day small sites devoid of a CDN could make a come-back but that's a bigger topic that may depend on some societal screws to be tightened a bit more.

Benderon DNS: A Replacement for Finger

iCloud private relay was a blind spot. Working out how to let those proxy ranges in. (I blocked all the CDN's but this is more of a surgical carve-out for specific Apple designated ranges) Extracting those carve-outs now.

Edit: Applied carve-outs for Apple's iCloud private relay proxies. (I think)

If anyone is curious why I have to block CDN's, they permit abusive behavior, abuse of their workers (apps) and other layers of their networks. Maybe in a few decades they will get on it.

Benderon DNS: A Replacement for Finger

Entirely possible. Which countries do you think would be the first to demand censorship?

Benderon DNS: A Replacement for Finger

what ttl would you use for this?

Something low like 60 to 90 seconds should be fine unless they are an influencer, then we could monitor their live stream.

Benderon DNS: A Replacement for Finger

I too am using Firefox on Linux. Are you by chance using a VPN hosted in AWS? I normally let VPS through but AWS has some special abusers that got my attention. I moved that out of the way for now. Thus far 2795 real people and 8888 bots. I have some room for improvement on false positives but we are getting there.

Benderon DNS: A Replacement for Finger

Old versions of Safari could get that. I am being an opinionated ass and practicing hostile security paternalism because the safety and bot-filtering benefits outweigh the cost of supporting old clients. I do even stranger things.

Benderon DNS: A Replacement for Finger

Indeed. For what it's worth the spoofing aspect got better for a while then plateaued. [1] bcp84 / bcp38 adoption has pretty much stalled out. No idea what to do with the remaining ISP's.

[1] - https://spoofer.caida.org/summary.php

Benderon DNS: A Replacement for Finger

I guess I could delegate a zone to another provider who does.

That's a good idea. One could delegate to a stand alone instance for instant updates.

Benderon DNS: A Replacement for Finger

If a site has a large set of TXT records, they can be used by clients that spoof packets to request large volumes of answers by DNS servers. This is called an amplification attack. Many tiny spoofed requests in, many large answers out.

Benderon DNS: A Replacement for Finger

I will leave writing an app to someone else. I've watched others go through all the challenges of getting into app stores and it's just not for me.

Benderon DNS: A Replacement for Finger

It's just a shell function so in this case if one had a terminal app that has a shell one could add the function. No idea how feasible that is on a phone.

Benderon DNS: A Replacement for Finger

What is this altchan.org place? Looks very new. Where's the reply button?

Its just a private fork of an open source anonymous image board. I had a static blog for it but I got bored and moved all my blog posts to the image board. Probably a rather unorthodox experiment. The reply button is at the bottom right. I might change that.

And why do we want finger to exist?

There were discussions in the past about the finger service and how hardly anyone runs it any more and even less likely to be found on the open internet. DNS seemed like a good replacement for it to me as more and more people have domains now and authoritative DNS servers are likely to be more secure and distributed I think. Maybe one day specific groups of people do something like this in place of sites like X. half kidding

Now instead of having a special purpose client, one need only query a DNS record. In this case I use "dig" as the example but there are other DNS tools people might prefer to use.

Benderon Brotli vulnerability affects curl and Git

The nginx brotli module compresses outbound traffic. How would someone exploit brotli on nginx in this scenario? Is there PoC code that could be used against an nginx server that has the Brotli module enabled?

Benderon OpenSSL 4.1.0

I looked into this and was tempted as there is less read locking and better RNG performance but they stripped the SSL_get1_curves() API which I depend on for bot detection plus I would have to recompile nginx and all its modules everywhere so in the end it was not tempting enough for me. Perhaps I am just lazier in my older age.

Benderon Quad9 (DNS Resolver) to Exit France

The only thing I know of that operates somewhat like you are asking is Unbound itself, when it is not the server doing the root/tld lookups. One can configure Unbound with a series of Upstream DoT servers and it can retry each of them and cache which ones answered, answered fastest, so if the upstream just refused to answer that would cause it to move to another upstream resolver and eventually retry the one that refused but once it gets another refusal it would avoid that one again for some time. Clunky but it would sortof work.

Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

Benderon Quad9 (DNS Resolver) to Exit France

DNS needs a way to say “unavailable for legal reasons” so your system just picks a different resolver or resolves recursively.

As far as I know there is no way to reliably:

- let the user see this error. The client would need to surface the DNS EDE error. Stub resolvers and browsers overwhelmingly ignore EDE.

- geo-fence the client. Unbound does not have native Geo support and will not let one set custom per-zone EDE text even if that was a thing AFAIK.

This might be possible by putting dnsdist in front of Unbound with client IP rules + Lua + MaxMind but there again the client won't know what to do with this.

- custom views only trigger off client IP's and only control resolution views, not error messages.

I think it's probably best that if people wish to run their own DNS instances, they do not geo-block anything. France has no jurisdiction in other countries and can't really do anything to "Alice and Bob's Public DNS". It's up to the people in France to find a way to tunnel their traffic out of their country to bypass any border filters should that ever become a thing. I am still waiting for a lawyer to challenge my thinking on this part.

Benderon Quad9 to exit France

I am curious if a large number of people stood up their own DoH/DoT servers:

- Would France go after each one, even if they were not operating servers physically in France? It only takes a few minutes to configure Unbound+LetsEncrypt to accept DoH+DoT internet traffic. A few minutes longer to compile support for DoQ.

- Could they realistically expect individual operators of small DoH/DoT/DoQ open servers to block domains at their behest?

Benderon OpenAI says its AI agents disabled their own safety monitors

OpenAI says its AI agents disabled their own safety monitors

I cant reach the article but if a tool can disable its own controls or monitors then the controls and monitors were not designed and/or implemented correctly. A bot will do what a bot can do. This will always remain true.

Benderon Ask HN: How do you prevent PII leaks in multi-tenant systems?

Either a DLP appliance or write DLP logic into the application to look for and validate the types of at-risk data one wishes to prevent leaking and decide how to handle/quarantine/sanitize/hold/reject it. There are pros and cons to each direction.

If this were for the financial sector I personally would lean towards an appliance for audit and checkbox reasons. Talk to your auditors and compliance team, get their requirements and if those requirements come with a price tag, make them meet with the person in your org that has the purchasing authority to sort that out. The price should include some professional service time from the vendor to assist integrating their appliance with your code in a manor that does not violate your customer SLA.

Benderon Ask HN: How do you sandbox your AI agent so it can't delete your files?

How do you sandbox your AI agent so it can't delete your files?

Assuming the agent does not have sudo/doas (because why would it), back up all files to multiple devices / locations, then ensure the files are owned by root and only readable by the agent. Same as how Claude works when one uploads files into a project, they are exposed read-only to Claude's sandbox in a read-only mount.

If the agent needs to modify the files, make the agent clone your read-only mount into a scratch / temporary working directory and then give you a date-version based export for each patch set.

Anything an agent is working with should be a snapshot/clone copy of your files in a disposable container/VM in the event "something goes wrong". Periodically back up its work.

Benderon Ofcom concedes defeat in 4chan case

They will never stop trying. [1]

[1] - https://www.youtube.com/watch?v=0vf2citudDA

Benderon Ofcom concedes defeat in 4chan case

The infrastructure is already in place for a global great firewall. One need only to compel Google and Cloudflare to block a site in their DNS and most of the planet will not be able to reach it.

Benderon Ofcom concedes defeat in 4chan case

Did any of them move to a .onion? I would expect commercial sites to cave and some small sites to just move to Tor which probably accomplishes the same thing as far fewer people use the Tor Browser or Brave. I could also be delusional.