cobertos

Packet capture and analysis. It's not that complicated

I have a few Traefik instances that request wildcards independently of each other. Each with the same config, per server.

Leaking is an issue but we're talking about internal services too.

Why not just map the domain to an internal IP and call it a day? Then the only way it can be accessed is through a VPN. Then use a wildcard so none of leaks into cert transparency logs

Are there any music festivals for chiptune? Something like Bonaroo but computer music, or the closest thing because I don't think something like this actually exists

Doesn't USPS also play a key role in a lot of other services?

* ID verification

* Vacant home notifications

* Registered mail

I have a hard time seeing a private company scrupulously handling these operations when the incentives to manipulate them could be very large.

I love the fit and finish on the case. Neat to just one shot little control panels like that. Have you thought about making more? Context sensitive based on the room or activity in that area?

Any chance you have or could post pics of those custom HA controllers? Seeing custom interactables and how they integrate with ppl's environments are always suuuuper interesting

Those are limited to $25k/day for my current bank. Are those not limited elsewhere?

Related question, is there a web-based self-hosted git replacement that's _light-weight_ (i.e. resilient to scraping)? Should have things like file view, file browser, etc but is not taxing on the server.

I think so too. The restrictions of offline software means it has less ability to nag you or pull you in a specific direction. The software you have at any given time is what you've got.

Same sort of theme I've being going for in my personal intranet. It's calmer offline.

What was deleted from this version?

> Why wouldn't it be except question begging priors assuming it couldn't be?

A multitude of reasons? A change in maintainer. A change in the mental state of a maintainer. A sudden focus by the community on a given undesirable behavior. Someone else here suggested use of Claude AI before it was disclosured. The framing implies that it was human-produced coding error, but my point is it could be _any other human error_ or even just some odd benign human behavior (a stampede of bug submitters), affecting the data. Which does not lead to the conclusion that AI code > human code. Not looking at these potentials is so unsatisfying.

> My original metrics which didn't filter out feature requests...

It still feels like a lot of weight of the phrase "If that doesn't look like a red flag to you, you'd be right." hinges on the fact that one of the versions has 0 bugs and it really killed the weight of that statement for me, because the oddity of there being 0 bugs just wasn't explained.

---

Could you please post the duckdb file that has the raw bug -> severity + version mapping to the GitHub repo? I have a desire to dig into this myself

This post just gives me more questions than answers and I'm unable to form a decision:

* Why was v3.4.1 the most buggy, right before the Claude commits? Why did "nobody notice"? It's way to strange to just say welp, it must be human error. * Why does v3.4.2 have 0 bugs, or 0 bug score. And why was such an outlier (no other commit seemingly has this??) allowed to mix into aggregate statistics and bring all the "is Claude buggy?" scores down. Tbh idk how that _wasn't_ a red flag in the author's analysis...

This article feels like half of an analysis presented as a highly complex finished product due all the advanced stats they're running.

Would be nice to see something referral based. If you don't like X, block them. If X invited Y and Z and their invites behave poorly, you can block the whole tree. Kinda like lobste.rs referrals but for wider internet

I guess the correlary would be like how you can block an entire ASN if you find a lot of abuse from it, but at the human-network level.

And then suspiciously the .xxx registry jacks up the prices to herd everyone back

Just be careful, if you host your DNS at Cloudflare (maybe others?), they will rewrite your CAA record[0] if you use TLS with them. This is in the name of convenience but it was surprising when I first learned.

[0]: https://developers.cloudflare.com/ssl/edge-certificates/caa-...

Is this the new norm for trying to make software projects in the wild?

The 14000 sends over 3 hours (< 1/s) makes it sound more-than-human speed. E.g. automated.

Wondering if LLM-assisted vulnerability hunting will lead to the same gains in scale for bad actors wanting to find spammable channels in applications. The barrier to entry becomes so much greater because any small project, once found, can be wrung dry of all its trust signals by third parties

What was the job like? That's quite the thing to move past and then still get the job on

I've never had a reliability issue with Vaultwarden. Hosted it 5+ years now. Even with random off/on of the server and other bumps in the road in life, the Docker container I run has had no issues with hosting. The user interface is friendly but can be just a little slow.

Mine is not exposed to the public internet, though some friends of mine do. I use a VPN when I need to access fresh data from the home server, otherwise both the Firefox client and Android client will generally keep a cache of the last data pull when they had connection (so it wasn't an issue the 4 or so years I didn't have a VPN yet).

They sold it a while ago

They're better than US 7 eleven imo. They have a section with baked breads and rolls for cheap.

Won't the supply-side incentives misalign with demand-side's desires in this case?

If you choose a specific company's free tier, you can rely on reputation and switch if they misbehave (e.g. they exfiltrate your secrets, log all your activities, build a profile on your workload behavior, etc). But if you don't know where your workload being deployed, the operator has less incentive to treat your compute with respect.

Means this is really only useful for nearly-public workloads, where tampering is not a critical failure mode.

Huh? This is how it already works, cell companies themselves have this data. And they sell it.

The "strict guardrails" don't work. Never did.

Backups software written by Claude? No thanks.

I've used enough Claude coded applications that I wouldn't trust that with a backup, unless it had extensive tests along with it.

Facebook app does the same. All exported photos do not have any EXIF, but you'd be damn well sure they are using that EXIF for themselves.

Does OpenRouter perform better than LiteLLM on integration though? I found using Anthropic's models through a LiteLLM-laundered OpenAI-style API to perform noticably worse than using Anthropic's API directly. So I've scrapped considering LiteLLM as an option. It's also just a buggy mess from trying to use their MCP server. The errors it puts out are meaningless, and the UI behaves oddly even in the happy path (error message colored green with Success: prepended).

But if OpenRouter does better (even though it's the same sort of API layer) maybe it's worth it?

> Why would you target something as shitty as markdown if you have a specialized editor?

Your at-rest format allows you to use any tool to edit it. The specialized editor becomes a preferred tool, but not the only tool nor the most important one. Markdown and it's ecosystem came before the editor.

OceanGate was Logitech not MadCatz

Why does reddit end up deleting so many of the threads that end up receiving any attention? It's so hard to follow anything now when you go to the site and all there is is [removed]

I'm pretty sure it's based off of the configuration in the green gear in the top right of the iframe. You can inspect the ways it's calculated from karma, comments, etc etc