dotty-

For those unaware: CTRL+R in terminal will also change your prompt to search your command history. After typing, CTRL+R again to cycle through matches.

Odd stance. SafeBrowsing does not _ban_ you from viewing content if you really want to. It only warns you before serving you the content.

I understand maybe wanting "total control" over your own devices, but to just completely reject security warnings seems like a net negative overall.

Funny how this article points that Okta was notified by a third-party of suspicious tenant activity, Okta did not find evidence of the breach, and only after some persistence from BeyondTrust did Okta re-investigate and identify the breach.

Okta published a blog post here: https://sec.okta.com/harfiles and kicks it off with

> Okta Security has identified adversarial activity

and no mention of the notification from the third-party. Nice transparency!

Atlassian mentions in their original advisory[0] that Cloud is not vulnerable. But Atlassian usually just... leaves it at that. No clarification on if Cloud was ever vulnerable in the past or whether there was any evidence of exploitation attempts on Cloud customers. Something I wish they would provide more details on as my company is also an Atlassian customer.

[0]: https://confluence.atlassian.com/security/cve-2023-22515-pri...

> Google Workspace makes it very easy to set up "Advanced Protection" on accounts, in which case it requires using a hardware key as a second factor, instead of a phishable security code.

This isn't immediately actionable for every company. I agree Retool should have hardware keys given their business, but at my company with 170 users we just haven't gotten around to figuring out the distribution and adoption of hardware keys internationally. We're also a Google Workspace customer. I think it's stupid for a company like Google, the company designing these widely used security apps for millions of users, to allow for cloud syncing without allowing administrators the ability to simply turn off the feature on a managed account. Google Workspace actually lacks a lot of granular security features, something I wish they did better.

What is a company like mine meant to do here to counter this problem?

edit: changed "viable" for "immediately actionable". It's easy for Google to change their apps. Not for every company to change their practices.

> How is this a supply chain attack?

It's a supply-chain attack because the article has a section about how the official website for "Free Download Manager" was serving malware to a percentage of people.

> While checking videos on Free Download Manager that are hosted on YouTube, we identified several tutorials demonstrating how to install this software on Linux machines. We observed the following actions that happen in all these videos:

> - The video makers opened the legitimate website of Free Download Manager (freedownloadmanager[.]org) in the browser;

> - They afterwards clicked on the Download button for the Linux version of the software;

> - They were redirected to the malicious https://deb.fdmpkg[.]org/freedownloadmanager.deb URL that hosts the infected version of Free Download Manager.

What are you trying to say by this comment? Odd comparison.

This article references 4 Reddit posts, and for three of them, it seems pretty obvious that the driver themselves were involved in either the pulling of the video from the Amazon van, or were involved in posting the footage online. The only one that is not immediately clear is the dog attack video. The article also says that drivers themselves have the ability to pull video from the van.

It feels like the article is written in a way that assumes the drivers in the videos did not consent and were not aware their videos were being posted online. Skimming the article again, it doesn't seem to mention at all that the Reddit posts appear to be made by Amazon drivers themselves. :/

CMD+R (or ctrl) to refresh the page is faster than scrolling all the way back up. Ha.

It sucks that all this talk about scraping HTML will only push Reddit to deprecate Old Reddit even faster so users are forced to use a Javascript-heavy experience, complete with random HTML IDs. What then?

100% agree. Reddit is propped up by its name recognition at this point. In my local city subreddit, I wrote a comment on a political thread. My comment appeared for me -- and clearly did for other users temporarily since it was being voted on. After a few minutes, when viewing the thread not logged in, it revealed my comment was removed by a moderator. The post continued to appear like it was visible to other users when I was viewing it from my account.

It completely killed my spirit for wanting to engage with my local subreddit. This wasn't an isolated incident. I had submitted local news articles previously to the city subreddit only for it to be instantly "shadow banned" (appeared for me, not for others) due to keywords used in the article title. When messaging the moderators asking why the thread wasn't appearing, I never received a response.

No recourse. No accountability.

I don't think Apple recurringly hounds you to sign in when you hit "Do it later" though. I read "Do it later" here as a subtle reminder that "the option is not gone. You can do it later on your own in your system settings if you want", as opposed to "ok we'll ask you again later unprompted :)"

I never understood how companies worth billions can fumble having the most basic features across all of their platforms. For example, Spotify's desktop UI for podcasts: on mobile, I'm able to look at my liked podcasts and have a chronological list of the newest episodes across all of them. On the desktop app, that entire feature is missing. I have to check each individual podcast on the desktop app to find new episodes. It's such a frustrating experience and it's been like this for years.

Also, my understanding is that you cannot purchase podcast subscriptions on Spotify. One of my favorite podcasts "Serious Trouble" (previously All the Presidents' Lawyers) moved to a subscription model to unlock longer episodes, and it seems crazy to me that I cannot just pay to subscribe through Spotify. Instead, they publish those podcasts through Substack, which seems like such a missed opportunity for Spotify.

Separate from podcasts but another Spotify annoyance: Spotify (recently?) added 'enhanced playlists' that auto-adds songs to your Liked Songs. I actually like this feature. But those auto-added songs do not appear on the Desktop app, so I can only use this feature if I exclusively use my phone to stream music. I can't imagine what the internal justification for not prioritizing having the same features across platforms.

Discussion for original blog post detailing how the leak occurred: https://news.ycombinator.com/item?id=34446673

Definitely not. Wordpress plugins are the source of exploits in the Wordpress ecosystem -- it's very very rarely the Wordpress core itself.

LastPass storing the URLs unencrypted is so mind boggling. What could possibly be the justification for that? Also -- LastPass is being intentionally unclear when they write

>stored in a proprietary binary format that contains both unencrypted data, *such as* website URLs,

What do you mean such as?? What else is unencrypted? Now is not the time for tip-toeing around this kind of stuff.

You will not see a warning label if you have "Display media that may contain sensitive content" checked.

https://twitter.com/settings/content_you_see

I've been following https://www.shopware.com/en/ for a couple years. Awesome to see how they've grown in the space. Since it's written in PHP, I feel like it's a great replacement for Magento, especially as Adobe's catered more towards enterprise customers.

I see it very often when using VPNs, both including needing to select pictures and it just letting me through immediately. I find it happens less when you are actually logged into a Google account. It doesn't completely prevent them, but Google will "trust" you more.

I have mixed feelings about JP's ban from Twitter -- I lean more on the side that it was an unjust ban; but I can't help but cringe listening to him speak about the ban. I get a very pompous vibe from him, and I think his almost needlessly complex speech pattern can really put listeners off to empathizing with him here.

The argument is about whether it's "morally" ("ethically"?) right for Cloudflare to terminate services after their public stance. Yeah, I get Cloudflare can do whatever they want, but I want to know if I can trust Cloudflare to not go back on their public positions.

Even as someone who never visited KF before this saga, you must admit that this campaign against KF is coordinated and that you can't expect either side to be completely honest. It's already been documented that Keffal's side has been either dishonest or has strongly exaggerated details during parts of the campaign and her origin story really doesn't help her case. I've also seen some of the rhetoric coming from KF, and it's incredibly toxic and understandable why someone wouldn't want it online.

Cloudflare originally voiced their support (albeit not mentioning KF by name) for offering security services to _any_ customer -- a stance I can understand and can support. But it's difficult for me to keep supporting CF because it took less than 1 week for them to go back on their public stance. It also doesn't help that CF was not more specific about the threat made that made them change their mind. It would help me be more on their side instead of it just looking like a copout.

If I had to choose a bucket, I'd lean more into the neutral category, because this situation is just so incredibly complicated and nuanced if you've looked deeper than the news stories. I don't think a coordinated social media campaign started by a leader with an incredibly dubious history should win outright, and I can completely understand CF's position of not wanting to be affiliated with KF anymore.

Truly, I don't think you left anything out. It seems like every controversy involving KF is incredibly complicated and nuanced. I was not there in real time, and from the KYM page, it looks like Null lacked pretty much any compassion during this saga and was more concerned about his user's ability to have "free speech". The KF response, including the link to the entire e-mail exchange, really highlights that lack of compassion.

I can see now how the "both sides to every story" implied KF had a moral leg to stand on. Not my intention. I think people almost intentionally avoid visiting the KF site out of some sort of fear, but people shouldn't be afraid to see what's going on over there.

When reading the KYM page, don't forget to read the KF response. It's always important to read both sides to every story.

No one is arguing about the legal merits, so these kinds of comments are just noise. Like the room is having a discussion and you are not engaging in the actual discussion and just telling everyone "It doesn't matter because Cloudflare can do whatever they want anyway ¯\_(ツ)_/¯"

Yeah sure -- you're right, but you're avoiding the real topic.

The whole "Refer header and IP intact" thing seems a bit too "boogeyman" to me. You are one of hundreds of thousands, maybe millions of IPs that are visiting this site. I feel like the audience here generally understands what kind of info an IP address gives up (like broad geo info) and that it can't really be attributed to an identity -- I guess unless you're NSA? or the ISP? Do you think the site operator is monitoring all the IPs visiting the site and picking "targets"?

I still support an archive link for availability reasons; I just wouldn't worry about being attacked or something just because you visited the site.

Related submission: https://news.ycombinator.com/item?id=32592671

Cool dashboard page. Thanks for sharing.

Just using up-to-date Chrome. I see the network request where I get redirected to "https://digs.fm/users/auth/spotify/callback" with a code and state. It returns a `Set-Cookie`, but I see my next request to the digs.fm homepage has another `Set-Cookie`. Unsure if you are just re-generating session IDs on every request or if the session data from the callback is being overwritten when I hit the homepage again.

Seems cool. This project gives me some last.fm vibes. Do people still use last.fm? I used to be a big user of Last.fm back in the day, but just slowly lost my interest to make sure my Last.fm "scrobbler" was always running. Havent thought about that site in years.

I tried signing up with Spotify, but after accepting the authorization on Spotify's side, I was redirected back to digs.fm but not signed in. Now when I click "Continue with Spotify", the page just refreshes without logging me in because I've already accepted the Spotify authorization.