karel-3d

thanks!

I don't know, I don't see any of the clickspam that the article describes on the frontpage now. No "your cat is a racist" or "relationship with my penis".

On the other hand, I also don't see anything else that's particularly interesting or thought provoking. Which is kind of sad for this US election season.

Congratulation you discovered prompt injection attacks

does this have CVE or something?

It arguably gets worse with every OS X iteration. I understand why they removed postscript support, but it still makes me sad.

But it can still do a lot.

Bruno Premium is some enterprise nonsense. You don't need to use it.

Voiden also has premium enterprise plans.

https://voiden.md/enterprise

edit: ah there is no "enterprise plan" but you pay for the services. nice.

I don't understand who would use Postman in 2026.

There are open source alternatives like Bruno (my favourite app ever).

And, if you need something advanced, just vibe-code it.

"Windows without the junk - never released"

...but that's literally LTSC.

I have read somewhere that ISIS mostly runs on cryptocurrency now because it's harder to block.

Oh here

> They delve in weapons and human trafficking, sometimes take part in drug smuggling, more and more engage in crypto mining and frauds related to the crypto industry - the whole Islamic State is now operating by crypto, whether it’s various European countries, West or East Africa, Asia, or such weird places like Costa Rica, Brazil or Argentina.

https://saladinaldronni.substack.com/p/recent-islamic-state-...

edit:

but it seems they have mostly moved to Monero

https://gnet-research.org/2025/02/18/combating-islamic-state...

I feel sad honestly.

Yes all the bureaucracy was annoying. But when I asked on Stack Overflow, the same question is there 5 7 10 years later, queryable by everyone. Ironically by LLMs too.

While when I ask LLMs - as I do now, of course, nobody has time for SO nowadays - nothing is left, everything is ephemeral, LLM forgets, the world doesn't learn.

Oh well. They will surely bolt LLM to SO one day as Quora did already.

Oh it's Minecraft! I didn't realize what is this about for the longest time. I thought it's their own game named "blocks".

I have no idea! I just react to the claim that this is not a real person. I have no idea if there is a PHP exploit, I have not looked that hard; but it is interesting nobody actually linked one so far, and all the write-ups people link are obviously LLM generated.

But again this is very very simple to refute by actually linking a working PoC.

Yeah it is this guy, trivially easy to find out

https://www.twitch.tv/zkldi/about

https://github.com/zkldi?page=2&tab=repositories

https://wiki.archlinux.org/title/User_talk:Zkldi

https://tachi.ac/

edit: unless there is AI that fakes being human since 2021 and has its own Twitch channel in order to post a blog post to Hacker News.

There is something called "wrapping/unwrapping" - you encrypt the key, move it to the other HSM, and it unwraps it. So what moves around is encrypted. I don't know enough about HSMs to tell you if it's done using symetric or asymetric crypto, but no the key should not move around in the plaintext.

The write-up from eMudhra mentions something about wrapping/unwrapping ceremony failing.

Yes there was something about key names in the write-up (which I cannot find now)

oh here

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11

It seems there was some issue with the ceremony with some wrapping/unwrapping scripts.

They explicitly said they wanted to export the keys from the HSM; the keys were intended for USA/Europe (for sovereignty reasons) but were never actually used.

It seems the HSM itself worked, their ceremony around wrapping/unwrapping didn't.

Well, if you use Brave, Tor is just one click

Well humans should NOT glance at private keys! That is the whole point of HSMs!

It has parts that are human written and parts that are generated. I couldn't tell at first, but now seeing it in Pangram, it's kind of clear.

I don't know, I just consider quitting, but the money is still keeping me here.

This is very obviously done as a fun experiment, not as a security measure.

Yeah but the explicit goal of LLMs is to mimic human chains of thought.

Getting random scammy ads and occasional malware is what you pay for pirating. It was always like this.

btdigg is fine? (on tor)

Crypto people keep rediscovering we live in a society.

There is an eSIM with worldwide data in the device.

They tracked the traffic (not the eSIMs) to some servers in Hong Kong, managed by Alibaba.

Not your factory, distributor, warehouses, fulfillment centers and entire supply chain, not your coins.

The author gently notes what my current Passkey problem is. I don't know what "passkey" really is, because there is a huge array of "things" that "can be passkeys".

I still really like fido U2F. They are (relatively) obvious; they are (relatively) open - there are many third parties that support it; they can be done shareable (I know Trezor - which is mainly a crypto wallet - can be used as U2F with the same "seed" that you can share); it's much more simple to grasp. They also solve the phishing issue effectively.

I can't really grasp what Passkeys are.

But how does this lead them there? It's really badly explained. They already have a paid version that has extra features. (For years now.) Like the SSO integration. What will be different now?