chocolatkey

Here's what an email from metabase looks like for those affected:

  On Monday, August 3, we discovered  that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability. We notified law enforcement, and we have engaged with a third party forensics firm to conduct an independent investigation.

  Your instance of Metabase was vulnerable to this 0-day. Therefore, to protect your company, we recommend you:

  Rotate the credentials for every database connected to your instance; and
   Review the admin accounts on your instance and remove anything you don't recognize.
   We also discovered that the attacker was able to gain access to your instance.  We created a report on the actions we believe the attacker took on your instance, which includes log files, and which you can get from the Metabase Store at https://store.metabase.com.

  (If you do not have access to the Metabase Store, are having issues accessing the report, or do not want to click on a link in an unexpected email, you can log into your instance directly and reach us at Help > Get help in the grid menu in the upper right hand corner. We'll confirm this message is from us and email you the report.)

  This report is based on our own application logs. We did not query or read the data in your connected databases.

  Depending on the jurisdictions in which you operate and kinds of data your instance connects to, you may have notification obligations under applicable laws. If you have concerns in this regard, we recommend you assess potential notification obligations with your company’s legal or compliance experts.

  We regret any inconvenience this incident may cause you, and we are here to support you. If you have questions, please reply to this email or email us at eventresponse@metabase.com, and we'll get back to you as quickly as we can.

  Sameer Al-Sakran
  Founder and CEO
  Metabase

Based on what they shared in terms of logs and summary, the attacker was scanning tables for valuable data. They took the first N rows from various tables in connected DBs, kind of at random it seems. Possibly some kind of regexing. Here's an example timeline:

  | Time | Event |
  | --- | --- |
  | 13:00 | Access gained and authenticated as the administrator account |
  | 13:01 – 13:12 | 54 queries were run through that session |
  | 13:14 | API key was created (key ID `1`) tied to a service account |
  | 13:14 – 13:17 | 19 further queries were run through the API key |
  | 13:17 | API key was deleted |

Linux does though?

  cat /etc/machine-id

I’m not in the EU so I have not, this is based on the technical changes mentioned, and what I’ve heard from people. Feel free to try if you are in the EU: kobo.com/update

Which startech product did you end up getting? One of the hubs or chargers? I have a similar issue with various USB-C rack devices

Kobo is actually in the process of completely rewriting their e-reader software (you can download the beta in the EU), and I’m pretty sure it’s no longer based on RMSDK. Adobe basically handed the EPUB DRM market to LCP on a silver platter by being a poor maintainer and then selling off to a third party that had botched the migration and further angered end users and platforms, that are switching off Adobe faster than ever

That “compact JSON” format reminds me if the special protobufs JSON format that Google uses in their APIs that has very little public documentation. Does anyone happen to know why Google uses that, and to OP, were you inspired by that format?

A nonprofit I help out just moved from Slack to Discord for a very simple reason: Slack pricing was too expensive, and as the amount of people increased, the price continues to climb. Discord is free

That’s incorrect, it’s trying to load an asset (hardcoded unique per-extension path) for each extension, there is a huge list of these in the source code: https://raw.githubusercontent.com/mdp/linkedin-extension-fin...

Note that Threema has had a recent change in ownership to a German investment firm. Supposedly nothing will change but I can’t help but be wary

Where can I learn more about hardware acceleration of WebP on mobile OSes? I haven’t yet come across a resource that confirms this is actually the case. I know it should theoretically be possible using the VP8 hardware decoders but I thought those were expensive to warm up just for images

I was able to use the (free) app “ReadID Me” to decode passport information months ago

Google’s Tink crypto library had a slightly technical page to help with that: https://developers.google.com/tink/choose-primitive

It's somewhat popular for piracy, when you know that your site could never pass the Apple/Google store reviews. I've seen it with, for example, manga aggregators

I disagree regarding the choice of codec. Currently, I have no issues receiving, saving, and viewing H265 streams. Any modern CPU/GPU can handle them natively (I use a 2018 Intel CPU w/ QSV), any modern desktop or mobile device (I use both Android and iOS) can stream it, and the recorded video takes up less space. What are you using that requires transcoding?

This would break way too many websites to be feasible. And if implemented, would be something requested on so many sites that users would learn to automatically say yes which would weaken the power of permission prompts in general.

For example, almost every major Japanese book/comic site uses canvas in their e-reader

Stripe also has a version of this called “Link”, which uses SMS authentication. Based on Stripe data on multiple platforms I have access to, quite a high percentage of people use it, probably due to how hard it’s pushed by the UI when adding a payment method

What I preferred recently when buying a used car over Craigslist was that I was able to vet the seller more easily because this was their Facebook profile. Like many other people on the older side, their profile was completely public, and I was able to scroll through over a decade of pictures, education, family etc. This was a very useful check against scams and lies.

I agree that AI translations are not close to the standards many people would expect, but there is a significant, growing population of readers (many with EN as a second language) that are fine with reading MTL using extensions such as this or fan-translated MTL with human assistance, and it is what many new fan translators are opting for as old groups retire. The “speed translators” using MTL also demotivate the slower, better translators, as many people will no longer be as interested in their release. I don’t think human translation will cease for a long time, but in the meantime, MTL as a percentage of new fan translations will continue to grow

You have much competition in this space with for example https://ichigoreader.com https://ismanga.com and many more (just search the chrome extension store for examples). What is your plan to stand out and remain competitive?

On a side note, if anyone’s been watching the fan translation community, it’s clear this is the end game.

What is wrong with frequent changing of jobs? It’s one of the easiest tools for increasing my compensation. The job market ideally should be so flexible you can switch to another company any time you want, no noncompetes.

It’s actually still a bit tedious on the Apple ecosystem. On the web (Safari) you have to wrap it in a WEBM or CAF container, and on iOS it’s similar. That’s a lossless process, but it’s still not the OPUS container

It’s funny, I have a somewhat opposite setup - Surface Pro 7+ (Windows) as a thin client, M4 Mac Mini as the beefy machine, using mainly VS Code Remote over SSH. It works great for development, builds etc, and for gaming I can still use the Surface. Then again, it’s not like I have much choice because builds involve an iOS app

I think you posted the wrong youtube link

When reading https://github.com/WICG/direct-sockets/blob/main/docs%2Fexpl..., it's noted this is part of the "isolated web apps" proposal: https://github.com/WICG/isolated-web-apps/blob/main/README.m... , which is important context because the obvious reaction to this is the security nightmare

J-Novel Club LLC | Contract & Full-time | REMOTE (Worldwide)

J-Novel Club is a subsidiary of Kadokawa Corporation, focusing on the publication of Japanese light novels and manga. We are assembling a small, talented team of developers (and designers) to build a global e-book platform capable of scaling to meet the needs of our large userbase. Here are the roles we're seeking for:

- UI Designer - Website and mobile app design/layout - Frontend Developer - Next.JS on Cloudflare Pages - Backend Developer - Typescript/Cloudflare Workers

Any experience as a frequent user or developer of Japanese/Korean/Chinese novel/manga/webtoon platforms is a huge plus!

Technologies: Typescript, Next.JS, Cloudflare Workers, Planetscale (MySQL) w/ Drizzle, Clickhouse Cloud, ConnectRPC, Golang, Flutter, Fly.io, Hetzner Cloud

Contact chocolatkey@j-novel.club if you're interested, and feel free to mention this post

Just a sidenote, in my experience, over the part year or so, Hetzner has finally switched to more modern KVMs with good HTML5 consoles. The Java applet was indeed a pain.

Here are the original posts themselves, probably more interesting to people here:

https://blog.smithsecurity.biz/hacking-the-scammers

https://blog.smithsecurity.biz/systematic-destruction-hackin...

One possible reason I can think of is that phone camera apps will not proactively read PDF417 barcodes like they will QR codes, thus discouraging people from thinking they can scan and decode them.

Wheb I implemented an in-house analytics system, I had to revert to using a normal fetch request, as by default any usage of the beacon API was blocked. I don't think it really makes a difference for big providers with well-known blacklisted domains, but for custom implementations, it does

The real problem I saw with Chromebooks used in educational settings was not Google, but the extensions from sketchy third-parties forced on students by IT policy with unlimited permissions to vaccum up their data and sell to the highest bidder