itintheory

Where did you migrate to?

> gmail inbox

Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.

I think "everything" is an overstatement. Browsers included the compromised intermediates in their CRLs within hours of disclosure.

So this isn't like Firesheep [0]. Yes, there would be vulnerable traffic, like the git client this thread is discusing, but it's not "everything"

[0] https://en.wikipedia.org/wiki/Firesheep

Why is the color of the access point relevant?

> cyberprotection services

These services cost money. Scrapers also cost money in terms of resource utilization and downtime. There's always a tradeoff.

The ROI of services like Cloudflare bot protection, Datadome, HUMAN, AWS bot mitigation etc. is highly dependent on your income from the data. In the case of publicly hosted freely accessible data it can be hard to justify.

Sure, that's why they sanitize the User-Ggent header when using these proxies. Good luck attributing the scraping to anyone at all.

I miss BonziBuddy. He had personality in a way that our modern agents lack.

Any recommendations? I'm finding a Lasko that looks fine but is out of stock everywhere.

1. Yeah, that's true. It'd need to be something akin to SPF where it gets validated and kept up to date. 2. Yep, you're right. CAA isn't the correct record type. 3. I'd guess that in the vast majority of cases where a TLS cert is used, DNS is also in use. In the case of an offline validation, you're also not able to check CRL, OCSP, etc. so there are already tradeoffs there. Oh, wrt to "secure" - I guess that's the gotcha. DoH would be chicken-and-egg... something like DNSSEC would be needed, though that may be an impossible prerequisite.

That makes sense. Seems like there could be a different record type, similar to SPF that could be used in this way though...

> One big problem with the CA system is that any CA - even the most incompetent - can sign certificates for any domain.

Is this not what CAA records were intended to solve? It seems like in practice they're only used by CAs to decide if they can sign a cert for a given domain, but it seems like a client could use it to determine if a server cert was from the correct CA.

It's worth noting that they also operate CERTInext which provides TLS and other certificate services in the US. In particular, CERTInext was chosen to be the CA for InCommon which means it's used by LOTS of universities all over the country. This was a migration from Sectigo that took place this year.

https://incommon.org/certificates

I've met plenty of developers who seem to go too far in the other direction and spend all their time optimizing their tools, and not actually producing anything that anyone else cares about. Reminds me of https://xkcd.com/1205/

Nest Hub was $99, and is now perpetually out of stock. AFAICT it's discontinued. Which is strange, and a shame, because it's a great product. People are paying similar prices for digital picture frames with a cloud service, which the nest hub can do with a little bit of config, and a bunch more.

The entire premise of cloaks as optional seems like broken UX to me. I'd like to see a new version make your connections details private by default.

Wasn't IRC always federated? There were different networks, but each network was a federation of independent servers.owmed by independent operators as far as I understand...

> No action is needed, and the apps will work exactly as they do today.

Oh no! They'll stay a buggy mess. Damn, I was really hoping the windows app might get cleaned up.

First I've heard of this DHT indexer concept. Is this bitmagnet? What kind of resources does it require? Thanks for any info you can provide.

Going to ask this here, but not sure there's a great answer. My 'homelab' runs mullvad over which I download my Linux ISOs. I tried to set up tailscale, with headscale on a $5 VPS, but the multiple VPN interfaces seemed like a challenge. Is this doable?

It seems to me the ROI on the research may be diminishing. If they aren't turning a profit with the infrastructure already deployed and the models already trained then buying more GPUs and spending billions more on training doesn't seem like it would improve the correct side of the balance sheet.

Was it for the log4shell vulnerability? I did something similar there.

It's static content in Cloudflare CDN. Seems unlikely that many requests actually hit any kind of origin server. If I were building something like this the origin would be Cloudflare R2 (or similar) object storage, with a very long cache lifetime. Nothing to update, nothing to maintain.

But beyond that, what are you referring to as compression? When I look at the source I see a VERY short easily human-readable HTML page. It doesn't have newlines, but I wouldn't consider that compression. It also references a short, but non-obfuscated javascript file at https://example.com/s.js .

Maybe I misunderstood what you're referring to...

> standard windows way

The thread you linked to suggests 'timeout'[0]

[0] https://learn.microsoft.com/en-us/windows-server/administrat...

But that's still DNS, right? Where does it bleed over into an LLM API? I understand there are DNS to LLM server projects, but how would the agent discover one? And I'm guessing most people who run something like that don't expose it publicly...

Right, but your have to run this server somewhere, which the agent couldn't do.

What DNS service did the agent discover that allowed it to execute arbitrary llm queries? And how?

Seems like this requires operating a proxy somewhere. In TFA it seems like all they needed was a DNS client, but I'm not at all clear how that could work. I'm definitely curious about the technique though.

On the quick start page it looks like you just pass it as a CLI argument: https://docs.plannotator.ai/open-source/start/quickstart

Couldn't you commit the plan markdown to git to get the tracking you're referring to?

What kind of fingerprinting are you thinking of? JA4? I haven't found a way to do that inexpensively at our scale, but we may have to go that route - looking at CloudFront bot mitigation.

For behavioral, we have Anubis honeypot functionality turned on, but it doesn't seem to be effective for 99% of scrapers. Anubis is also running behind TLS termination, so I don't think it can do full JA4. It does have the less robust JA4H apparently, but I'm not sure how effective that will be.

Edit: Oh yeah, forgot to mention - it's almost 100% residential proxies. Primarily China Telecom and China Unicom. Unfortunately those providers are HUGE and also host a ton of legitimate users all over Asia.