ian_d

The author is aware of that, the PoC requires interaction from the creator using the studio AI:

> When the creator clicked the link, I received a request with the video title in the URL parameter.

Evergreen advice from the design side: https://www.youtube.com/watch?v=jVkLVRt6c1U (Mike Monteiro: F*ck You, Pay Me)

The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8

GCP, however, has does this to itself multiple times because they rely so heavily on project-id, most recently just this February: https://www.sentinelone.com/vulnerability-database/cve-2026-...

Mountain View recently turned off their Flock installs after they discovered Flock had enabled data sharing without notice and other agencies were searching through MV data.

https://www.malwarebytes.com/blog/privacy/2026/02/flock-came... > A separate “statewide lookup” feature had also been active on 29 of the city’s 30 cameras since the initial installation, running for 17 straight months until Mountain View found and disabled it on January 5. Through that tool, more than 250 agencies that had never signed any data agreement with Mountain View ran an estimated 600,000 searches over a single year, according to local paper the Mountain View Voice, which first uncovered the issue after filing a public records request.

A different town (Staunton, VA) also turned of their Flock installs after their CEO sent out an email claming:

https://www.aclu.org/news/privacy-technology/flock-ceo-goes-... > The attacks aren't new. You've been dealing with this for forever, and we've been dealing with this since our founding, from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness. Now, they're producing YouTube videos with misleading headlines.

If you don't remember, Daniel Penny is the ex-Marine that killed a homeless man on the NYC subway then was found not guilty of criminally negligent homicide.

There was actually a good DC31 talk called "Snoop On To Them, As They Snoop On To Us" kinda in this vein, but with Bluetooth devices that are part of a lot of cop's gear.

https://www.youtube.com/watch?v=cO1JSzAdPM8

Elon is also now claiming to have "deleted" 18F (https://18f.gsa.gov/): https://x.com/elonmusk/status/1886498750052327520

I'd go check the YNAB forums, there's a lot of v4 users who really hate the cloud version. I tried to switch and gave it up for two reasons:

- Import from v4 is super broken for credit card accounts and I ended up with weird positive balances that don't add up based on any combination of transactions. Forum advice was "start over".

- You cannot tag income as "available for next month", instead all income must be immediately budgeted. Which is different than the old YNAB advice of being a month ahead. Forum advice is to earmark it a special category then fix it when the next month lands (https://support.youneedabudget.com/t/63pgpp/budget-using-onl...).

- No side-by-side month view. You can only view one month at a time.

The differences were too much for me and the import was so borked that I immediately gave up and stuck with v4.

Since ECS is missing k8s configMap/secrets style integrations for SSM and KMS I wrote this small tool to help get secrets into place without a bunch of ECS-specific custom entrypoint code. Scratches a particular itch I've encountered a number of times working with ECS and thought it might be useful to anyone else running AWS ECS services.

I could really see something like France's "tickets restos" / meal voucher system benefitting everyone. Fitting for smaller companies who want to provide a perk w/out an on-site cafeteria, puts some money into the local economy, a little tax relief for employees who are normally buying food for lunch...

The DHS Press Secretary's response is particularly infuriating.

https://twitter.com/SpoxDHS/status/1009502457058201600

It's Record Store Day again and I thought I'd share the site that I've been running for a few years now. It collects vinyl auctions and sales daily (with sound clips), and is at >10M items and >500k sound clips.

I've killed hours just clicking through sound clips to find 45s and LPs that probably otherwise would have slipped past me. This is especially nice for "deep" genres like:

Afrobeat: https://goo.gl/UG6kZm

Reggae: https://goo.gl/tHvJyA

Garage: https://goo.gl/51cJpQ

Northern Soul: https://goo.gl/Jj88Bd

etc,etc

Or you can just watch RSD2018 get out of hand: https://goo.gl/VXN8w8

Missing the real-life seller grades:

  EX- / VG++(+)  
  M+  
  Skip on A2, otherwise MINT  
  SOLID PLAY COPY

(Kidding, nice tool!) Goldmine does have a bit of a no-man's-land between NM and VG+, though.

Nice tool, thank you for releasing it.

Unfortunately, in my experience it's a pretty normal strategy to over provision EBS gp2 volumes to get the IOPS since they scale linearly up to ~10k. I think that's the break-even point where it's actually cheaper to switch over to provisioned IOPS volumes.

So we'd have a number of little-utilized (in terms of data actually stored) 3TB drives just to avoid paying for provisioned IOPS.

I like Carlin's cadence, but I really wish they would run everything through some compression. The volume range between his "speaking" voice and when he's quoting someone is HUGE and sometimes requires mucking around with the volume to keep it listenable.

Yeah, here in the slums of higher-ed dev/IT just having a github repos of any original code makes an applicant novel. We never really discussed an applicant's github code with them, but we absolutely read through and took it as a very positive hiring signal.

You don't have to have a huge contribution history or a project with a ton of stars, just having something out there matters to some places.

Pressing a one-off record isn't worth the cost because of the requirement of creating a pressing mother. (Mastering, creating a lacquer, a mother, a stamper, then finally pressing.) However, for one-offs your options are basically an acetate (which'll wear quickly with play) or a lathe-cut dubplate (which can be a bit lo-fi depending on process).

There's a bunch of lathe services available: http://carverycuts.com/home/dubplates-order.html http://www.audiogeography.com/records/ http://vinylcarvers.com/ https://www.cutadub.com/

I'm in higher-ed infosys and we see a number of automated registration sniping hacks in our monitoring / metrics. We usually don't run it up the chain unless it's malicious or impacting the service for other students. Otherwise we just investigate it a little bit and share it on Slack with the group if it's clever. The only time we've ever reached out to a student is to ask him to stop sharing it with others (and fix it) because it was performing some really aggressive polling.

Some other schools in our system are really reactionary, though, and consider any automation a ToS violation and will freak out.

e: And if you know the URL pattern / platform of your Uni's registration system, there's probably already a couple of examples on github of a registration bot.

I've been using terraform for a couple of months now (love it), but honestly our biggest pain was just project organization. It looks like a lot of people make a file per-resource type (elb.tf, ec2.tf, rds.tf) but we thought that would be a lot of bloat. We opted to have a file per system (dev_db.tf, dev_ecs_asg.tf, dev_haproxy.tf, etc) and everything related to that particular system is contained in a single file (security groups, dns entries, roles/profiles, etc). But it's still in one flat directory per environment. (I know tf has introduced environments, but we haven't switched over yet.)

I know you can hack this together with modules, but it seems like environment/project organization would be easier if terraform just recursed subdirectories. Right? I've seen a couple of issues for it, but I don't believe I've seen a concrete reason why it's a no-go.

There are some really amazingly rare and sought after tax scam records. I've been lucky enough to find/have a couple (Newban 2 & Jay-T - Party Time) but there's some heavy 4 figure LPs out there:

https://gripsweat.com/search/?query=(%22tiger%20lily%22%7Cgu...

There's also the vinyl-only availability of a lot of recordings, especially if you're interested in niche pre-80/90s genres. I collect private press / avant jazz from the 60s and 70s along with some soul/funk, and while there are reissues available for some recordings in a lot of cases your only option for a good quality copy is finding an original copy of the vinyl record.

The 'niche' collecting part of vinyl records is really interesting and I wish someone would do a good story on that instead of the "vinyl's not dead!" approach.

(self plug: I wrote/run https://gripsweat.com which tracks auctions and sales so if you're curious about high-dollar niche records it's a good listening / browsing resource.)

I think getting sued is really dependent on the size of the company you're scraping vs. what kind of 'business' you're cutting out from under them. There's a number of sites like https://gripsweat.com (mine) that are important to collectors/niche users but are basically to small to bother with otherwise.