anilakar

Joke's on you, my busybox only supports generating MD5 hashes so I'm safe.

Nowadays the same folks employ anti-devtools tricks such as the debugger; statement in their code.

I remember an old niche website I saw some 20 years ago. The whole content was dynamically loaded. If you disabled javascript, you were greeted with a static page that accused you of theft. Attempting to select and copy text or right click resulted in a popup window saying the same.

Nowadays you can just slap your site behind Cloudflare, I guess.

When will generic AI compute capability trickle down to us plebeians?

Alt-tabbing from browser to terminal and back has always felt exhausting. Nice.

The refrigeration business does not really overlap with infosec or IT in general.

Luckily I'm safe because I'm too busy to sit down and watch anything.

> no supply chain trouble

In other words, you are the supply chain. You're responsible for the bugs you create, but at least they are your bugs not caused by upstream's upstream's upstream's maintainer installing an infected JS library.

Shall we call this "vertically-integrated programming" then? :-)

This sounds like someone (or someone's AI agent) saw the CVE and did a one-off drive-by attack instead of systematically targeting refrigreration systems and trying to find vulnerabilities.

The article is dated August 2026. Synacktiv (a different company) reported the very same vulnerability for older system managers/controllers already in 2023. Their report[1] says Danfoss told the products are EOL and should be upgraded. At no point did Danfoss fix the same issue in 800A. Typical.

Back in 2016 when we were integrating their 850 series system managers we encountered an issue with the HTTP API returning 400 series errors over slow links. We sent them PoC code written in Python 3. One month later they sent us an email, complaining that they first had to backport the PoC code to Python 2.7 as that was the newest version they could install. They also attached a "fixed" PoC code snipped where they had removed the artificial delays that did not trigger the issue. Danfoss never did anything to actively fix the issue.

One year later I browsed changelogs for the commercial RTOS that Danfoss used and realized the issue was fixed upstream in 2010 or 2011. That means their AK-SM 850 had at least six years worth of unfixed bugs.

[1] https://www.synacktiv.com/sites/default/files/2023-10/synack... (despite saying SM800, the firmware in question is for AK-SM 850)

Edit: The parent commenter seems to work at Danfoss on their Leanheat platform.

Our company makes IIoT gateway devices that log parameters from the system and push them to a read-only location. I've personally reverse engineered a dozen or so management protocols to get the data out because pretty much no vendor supports pushing temperature data to a centralized place. Those that have monitoring cloud software only support their own devices.

Every now and then our customers ask if we can add remote control for specific parameters but we've always turned them down, citing liability reasons.

Re: legacy Danfoss systems such as AKM, 720 and 850 there is no way to have read-only access (for different reasons in each case). I haven't been able to find weaknesses in the new 800A yet, but that's only because I have not had to try yet.

> cyberattack, which has hit Danfoss-made refrigeration controls

Danfoss AK-SM 720 or 850? Pull the ethernet cord, now.

The latter can be flashed with the new 800A series firmware which is safer, but I still would not put it on the public internet under any circumstances.

> I was forced to use a passkey implemented within the vendor's app

Sigh. It's OpenID (the original one) all over again? Everyone wants to be the auth provider, nobody wants to accept other auth providers.

This one was probably planted up to 60 years ago after the previous felling. The biodiversity requirements surely were not any better back then.

Didn't know backspace is called delete on Apple products. Explains why one commercial vibecoded project management product used it to delete the whole item I was working on when I missed a text box.

OS-specific abstractions should not leak to web apps under any circumstances.

I accidentally stumbled upon malware disguised as Roblox hacks some three hours after the repo was created. It took Github 25 days to take it down. Granted, the initial automatic reply admitted they were "experiencing high volumes".

There's no point in using PlatformIO for ESP32 MCUs. The native ESP-IDF extension works much better.

I would only recommend using it instead of the standard Arduino Processing IDE.

> A library with hidden state, surprising defaults, or incomplete docs produces a pile of patches and failures.

Sigh.

Write a C or C++ API that works with pointers. Make it handle null pointers and errors elegantly so that the API user can safely chain calls and only check the final result. Claude decides it's better to be safe than sorry and peppers its code with intermediate nullptr and return value checks anyway.

I wonder how that would work here with horribly inaccurate elevation data. I often ride a specific flat straightaway and Strava and other tracking apps always show me pedaling up and down 20-meter pine trunks next to the bike path.

> To keep the published record anonymous, ballot scanners shuffle the electronic records randomly before releasing them

So they were never secret in the first place.

I have never understood the desire to have voting machines when a paper ballot works just fine. We tried electronic voting in three municipal elections in 2008 and courts ended up invalidating the results due to horrible usability issues.

> big data breaches are inconsequential for an average person

A relative killed herself after her therapist was hacked[1] and the data was leaked. If that is inconsequential, I do not know what isn't.

[1] https://en.wikipedia.org/wiki/Vastaamo_data_breach

If I type exact document identifiers, the LLM either tells me that I have either mistyped something or that I am searching for a specific document. Hell yeah, I am doing exactly that! Give me the link instead of babbling about it!

> Isn't that accusation, if true

Trying to insult someone by calling them gay and nazi[1] is straight out of the Russian online troll playbook. Nobody except people who personally drink that Kool-Aid would resort to such boring insults.

> just a case of FAFO?

Who fucked around and what did they find out?

[1] https://archive-is.tumblr.com/post/807369905134518272/the-fi...

> Everyone who fears immigration is going to take their job should read this and realize that fear is not only false

This is only because immigrants are willing to do jobs at wages and working conditions that locals do not accept. Employers in the Finnish berry industry were just jailed for human trafficking. Meanwhile the same companies have been loudly complaining that no Finn wants to work for them.

We have had end users scammed because Android QR code readers show scammy "pay now" ads. We do not support online payment but that does not prevent non-technical people from clicking large UI element-like ads and entering their credit card information on nondescript online payment pages.

worktree clone: Basically git clone that initializes a worktree root according to this guide: https://dev.to/metal3d/git-worktree-like-a-boss-2j1b

worktree add: `git worktree add` that creates a local new branch and a directory with the same name and sets upstream to match; alternatively checks out an existing remote branch.

worktree rm: Removes worktree directory, first checking it is in porcelain state. Then prunes them and removes local branch pointers if they match the remote ones.

These all are handwritten and probably buggy, but still less prone to errors than typing out `git worktree add -b foo-123-fix-missing-semicolon foo-123-fix-missing-semicolon origin/develop` manually every time. One pass with Claude or Codex would probably do wonders.

Worktrees are a must if you work with monorepos or just multiple branches in general. Lack of conventions (or rather the braindead defaults) and having to explicitly type out everything is what hinders adoption the most.

I've solved this by running thin bash script wrappers that keep the workflow SVN-like with a root directory that contains per-branch directories and a hidden bare repo).

Probably nine out of ten Wordpress sites do not need active content. Why are we not rendering static copies and serving them to customers?

I was looking for some CNATRA (US naval aviation) unclassified, non-distribution-controlled training manuals and noticed that the newest ones had been deindexed when they were put behind authentication.

Stop hiding public data and I might reconsider.

Will Gemini refuse to work like Claude when it hits modulo 11 calculation on a number string or finds a variable named CVV?

> ensure consistent placement of condensers

You can install one on the balcony below the railing level.

The housing company is responsible for the exterior surfaces and thus also responsible for whatever happens to fall on bystanders when it will inevitably happen.

AC installers are also notoriously bad at following placement guidelines.