bink

I've had the same problem for the last few days, just repeated CAPTCHAs.

Back in the day we would've just added our IP to the .rhosts file and no password would be required at all!

It does have me thinking about what versions of SSH would run on such an old OS. I'm sure there were versions available at one time... and since it's vulnerable to remote exploit anyways the version wouldn't really matter.

I've only seen it on TV. You can see it about 20 seconds into this video:

https://www.cnn.com/world/video/video-appears-to-show-us-str...

The story is because these are precision strikes and the US is feigning ignorace. Satellite photos show that each building on that block was hit dead-center and destroyed, yet the US is refusing to admit responsibility. Sure, mistakes are made during war, but this one was particularly egregious. That building hadn't been used as a military barracks in over a decade. Israel immediately said they were not operating in that area. Iran said none of their missiles were in the area. The US has said for a week now that it was "investigating" despite knowing it targeted that facility. That's yet another lie. They know they accidentally killed over a hundred little girls and as usual would rather lie than admit a mistake.

Imagine a world where in order to do business in the US you must grant the government control of your company. This sounds worse than even the most alarmist China takes.

donations to an inauguration fund.

Thanks. I wasn't looking forward to browsing all those pages in the hopes of finding the source. Did they never put it up on GitHub?

I hope this is better than their competitors products. So far I've been underwhelmed. They basically just find stuff that's already identified by static analysis tooling and toss in a bunch of false positives from the AI scans.

Even if you could delete comments, in this day and age it's not a real deletion. They'd just put a "deleted" flag on the comment in the DB.

What I found interesting about this is that on several occasions I've seen Waymos get confused and block intersections (and once Muni tracks). Each time they've sat there for at least 10-15 mins until a police officer showed up and tapped on the window. Then it was another 10-15 mins before the vehicle started to move again. What are these agents doing?

Wire fraud is more than just lying to someone over the Internet. It requires a financial gain.

Yes. As a security researcher this always annoys me.

It doesn't automatically update, that's true. But I think the typical way to deal with this is to have a nebula subdomain. www.nebula.example.com instead of www.example.com.

Sun and NeXT also sold 68k Unix workstations at the time. IMHO, The thing about Amiga was that it was not seen as a business machine. Commodore in general was seen as a home computer, and really one aimed at gaming first. AFAIK they didn't even have computers with the specs to compete with what Sun, SGI, HP, and others were doing.

Nebula uses lighthouses instead of DNS for finding other nodes.

https://github.com/slackhq/nebula?tab=readme-ov-file#2-optio...

There definitely won't be boots on the ground and that's kinda the point. Even if we had boots on the ground there's no guarantee that the US getting involved will make things better for the people of the region. We couldn't deliver democracy for Afghanistan after two decades but there are still people who think we'll be greeted as liberators in Iran and we'll be able to claim "mission accomplished" after a few months.

There's no doubt what's happening in Iran is a massacre by a dictatorial regime, but good grief the parallels between the rhetoric now and that of 2003 are impossible to ignore. I thought we had moved past the idea that the US could just bomb a country into a better future.

The purpose of the paper isn't to act as a "get out of jail free" card. It's to (hopefully) prevent the handcuffs from coming out while they verify the information. They're expected to contact the appropriate people before letting anyone go. Usually the emergency contact would be nearby and come to the site to discuss the project with their security team.

I wasn't trying to suggest they did or didn't have the right documentation. I honestly don't know. I was just explaining how we normally operated. The idea that the emergency contact wouldn't answer, or even worse deny we had authority seems impossible to me... At least if you're doing things the way we did.

I completely agree. Hiding from the cops puts everyone in danger. But to be clear I wouldn't be hiding from the security guards either once they had found evidence of our test. It was really only if they were nearby and unaware anything was happening that we found it OK to hide from them.

The whole point is to test security. Ideally you want to be found because that means that they have reasonable security in place and you can attest to that.

I performed these types of physical pen tests years ago. If we were testing security for something like a courthouse we would've had a card on each of us with the personal cell phone number of the county clerk along with a statement of work that described exactly what we were authorized to do, with signatures. In some cases we'd have a backup contact number for more dangerous stuff. The idea that the emergency contact would not answer the phone would've seemed ludicrous. They were always aware of where we were and what we were doing at all times.

Damaging property was never approved. Drinking alcohol before a test would never happen. The insurance risk alone would've been nuts, not to mention the reputational damage if someone smelled it on your breath. Hiding from law enforcement? I'd need to know more about that. If a cop shows up with a gun you absolutely do not hide. If it's a security guard on rounds and you're waiting for them to move on... sure.

It was often dangerous though. Some security and law enforcement types take it personally that they're being "tested" and do not react well. We always tried to have some former law enforcement or military with us because they were less likely to be targeted for abuse than us hackers/nerds.

It's amazing how many people on HN didn't bother to actually read the article.

As a security dude I spend way too much of my time fixing missing anchors or unescaped wildcards in regex. The good news is that it's trivial to detect with static analysis tooling. The bad news is that broken regex is often used for security checks.

I think it comes down to what you do with the access. Since this is a public repo I don't think I'd be too upset at the addition of a new admin so long as they didn't do anything with that access. It's a good way to prove the impact. If it were a private repo I might feel differently.

There are several groups out there that train journalists (and others) about digital security.

https://freedom.press/digisec/

https://tcij.org/initiative/journalist-security-training/

https://ssd.eff.org/playlist/journalist-move

Underfunded and constantly side-tracked by cargo bots.

I swear this happens to me almost every time I fly.

Their contracts prohibit it for certain classes of users, but if you're really worried about it Anthropic also offers a "bring your own cloud" version where the data supposedly never leaves your infrastructure.

The government also doesn't let people conduct sensitive or classified conversations over un-certified protocols or devices. Unless the NSA was participating in the bluetooth encryption standards decisions they aren't going to allow those devices to be used by the President or VP. IMHO though, it's probably more that there were security trade-offs made when developing the standards and the government isn't OK with those types of trade-offs. It doesn't mean they're horrible, just that they aren't verified to be secure enough for sensitive governmental purposes.

Are you suggesting Ukraine and Russia don't also have occasional outages caused by equipment failures or bad decisions unrelated to the war?