ipsin

What are the ways you can implement "log in as anyone accidentally"?

I'm imagining it was a case of an SQL-based password check where "TRUE OR" got added to the WHERE clause, and the code takes the first result instead of expecting only 0 or 1 row.

Are there other easy ways to do this?

Tool use, essentially. Of course that could be spoofed, but I think that's the origin of the claim.

https://www.reuters.com/article/us-global-cyber-solarwinds/s...

I think the most realistic threat model right now is "subverted browser extension", which is effectively equivalent to internet-wide XSS. Luckily I've only been hit once, and with adware, but it's a risk.

The write-up doesn't appear to have any author details, but the main page [1] credits Andy Nguyen.

[1] https://google.github.io/security-research/pocs/linux/bleedi...

Isn't FOIA something that applies only to federal agencies? Many states also have similar "sunshine laws", but I didn't think there was a nationwide mandate for all governments at all levels.

I think a bit more as ambition. If a standards body doesn't want to rescue us from the surveillance state, is it surprising that someone hopes to do better?

I look forward to a real IPv8 standard that respects user privacy, but I look forward to it in a way that recognizes that it's pretty damn unlikely at this point.

That, or forgeries being laundered... [1] https://www.linns.com/news/us-stamps-postal-history/quality-...

For a cash-like instrument, stamps seem to have very little in the way of anti-counterfeiting security.

I understand that there's a lot of work that could go into this sort of thing (mocks, accessibility, testing)... but is 2000 hours really a defensible number? It sounds like there's new per-inmate data and calculations for inmate eligibility and sentencing credit. But 2000 hours worth of work? Even sand-bagging it sounds like way too much.

Are there still people holding or opening active short positions in GME? I'm wondering how many people will be left holding the (overpriced) bag.

My problem with the example is that it relies on (and illustrates) a convention that seems arbitrary.

Why is a polygon with three consecutive collinear vertices not a polygon? Convention. Does anyone here have insight into why it's a good convention?

To me it sounds something like saying "9/12 is not a valid fraction because it can be simplified".

I actually thought the site was "do-it-hub", and they'd used an uppercase "i"...

Can anyone explain the "dolt" name? It's kind of surprising given its English meaning as "a stupid person".

How long until "Aggressive Self-Driving Mode" is a $5,000 add-on.

[Edit: Apologies, I got We Chat and Tik Tok confused...]

What seems outrageous to me is that this seems like simple retribution for Tik Tok users getting one over on the president [1].

So then Tik Tok tries to find a US partner, and actively searches for a Trump-supporting company, finding a partner in Oracle [2].

This seems like a corrosive use of power, an exercise in vindictive narcissism.

[1] https://www.theguardian.com/us-news/2020/jun/21/trump-tulsa-... [2] https://www.theverge.com/2020/9/19/21437850/president-trump-...

One question I have is, what could they have done to avoid such tracking?

I thought there were more secure coins, token remixers, etc., and that if you were determined and not stuck with one exchange or (say) Bitcoin, you could muddy the waters pretty well.

I'm curious -- I have a Facebook account, but I have the app platform disabled.

It seems that the app platform may be used for managing logins on third party sites. Are they likely to require it for Oculus devices?

There definitely is some opacity to the process, though.

I've heard anecdotally of people showing up and saying "I chose not to bring ID", and... that can fail. I wouldn't be surprised if those are most of the ones who were actually denied no-ID travel.

I was curious about that too.

The img tag has a "srcset" attribute with resolutions from 85x48 to 1920x1080, but the "sizes" attribute is "(max-width: 300px) 100vw, 300px".

  Trump acknowledged that he was made aware of the issue 
  after seeing a television ad ... that aired in prime time 
  on Fox News.
  ...
  The ad, Lynn said, had an “audience of one,” aiming to 
  persuade Trump to stop the TVA from outsourcing much of 
  its information technology division.

I wonder how many other Trump administration policy decisions can be linked back to an ad buy on Fox News...

The story below the linked one is how a man rammed his way into a gated community, beat two people to death with a baseball bath, and then the police found the suspect unconscious after he drank some bleach.

That seems more weird than my local news, by a bit.

I thought I was doing a champion job of leaving a trail of e-waste behind me, but here I see I'm not doing enough.

I would like it more if the "full-screen" mode was almost completely the content written, similar to a typewriter display.

No picture of a typewriter, minimal controls, a small box for the new line, and everything else is what you've typed so far.

Google search suggests it has "4chan racist troll" origins, but I'm hoping the origin for this poster was more innocuous.

[1] https://knowyourmeme.com/memes/clown-pepe-honk-honk-clown-wo...

I'm thinking of characters like Captain Jack Sparrow (partially inspired by Keith Richards) or Zuse from Tron: Legacy (partially inspired by David Bowie).

When it's less "inspired by" and more literally "0.5 David Bowie", I also imagine a lot of law firms writing letters.

This seems to be the plan, beyond modestly trying to grow supplies for medical response.

The U.S. is not ramping up a slew of mask production lines, unlike, say, Singapore.

We're not ramping up testing capacity to the point where we can have every person wearing a high-quality mask and getting tested to start contact-tracing regimes.

I wish the federal government stepped up here.

I was going to contact my senators. One of them is Dianne Feinstein, and... ugh, why is she always on the worst side when it comes to privacy? She's actually a sponsor of this thing.

I've written her enough that I can already write my own reply from her office. Shorter Feinstein: "Thank you for your concerns, but you're wrong."

More important (in my opinion), adding a random seed to your hash prevents collision attacks, where an attacker tries to ruin your performance by sending many values (e.g. HTTP params) that would hash to the same bucket.

I've been trying to figure out how much is specifically allocated to this "Space Force".

Is it just a notional change, or is new money going to into this, increasing the (already large) U.S. military spending?

I'm still shocked at how thoroughly the United States betrayed the groups like YPG that we were working with months ago.

Destroying fortifications on the Syrian border [1], providing intel to Turkey.

There's an official denial of a "green light", but it's pretty clear that that's exactly what it was -- a surprise withdrawal and support ahead of Turkey's offensive. U.S. hardware, support, and consent.

It might as well be U.S. troops slaughtering them now, but the U.S. press seems to be treating it as something that the U.S. was not deeply involved in, or something deeply shameful for the U.S.

[1] https://twitter.com/sojtfoir/status/1175869891305451522

[2] https://www.nytimes.com/2019/10/09/world/middleeast/turkey-a... ("Because of an American counterterrorism partnership with Turkey, Turkish aircraft were given access to a suite of American battlefield intelligence in northeast Syria.")

Doesn't that sort of reasoning make non-crypto QR resources a good target?

They could behave correctly until they see a wallet address, etc., so creating and verifying using separate means is essential.

Are they actually blocking Google somehow?

No robots.txt, no 403 when using a Googlebot user agent to fetch the site page...