progbits

Interesting. I'm in EU and see these constantly but usually in the afternoon so it bothers me less as I'm already wrapping up, but my US coworkers are getting hit much worse.

What's with the charts and numbers?

It says #1 for speed but then in the chart it's #2. Also says #10 for intelligence but then it's #7 in the chart.

Malware uploading the credentials it managed to steal

All these claude issues are full of bots, sometimes bots replying to themselves and getting confused. It's impossible to tell what is a real issue and what is hallucination. I'm surprised anthropic even bothers to read them.

In this particular case I think the authors reply is them quoting what support told them?

I think IETF will have to restrict the submission process (somehow), or just hide unreviewed drafts from their domain entirely.

The slop submissions using "IETF Draft" as a trick to gain legitimacy are getting more and more frequent. It's really sad to see.

I have a coworker who's clearly following this guide. So exhausting.

Vercel runtime must be able to access the values (so customer's apps can use them). But nobody else should ever be able to. This is the typical amateur hour security but on the other hand, who was naive enough to expect any better from vercel?

It's the new sophisticated nation state.

If they had SSO sign in to their admin panel (trusted device checks notwithstanding) the oauth access would be useless.

Vercel is understandably trying to shift all the blame on the third party but the fact their admin panel can be accessed with gmail/drive/whatever oauth scopes is irresponsible.

I don't know why you are downvoted. The article is AI blogspam, it doesn't have any more factual information than eg https://www.darkreading.com/application-security/vercel-empl... and is full of empty LLMisms. It's depressing people are willing to read this.

I was trying to look it up (basically https://developers.google.com/identity/protocols/oauth2/java... -- the consent screen shows the app name) but it now says "Error 401: invalid_client; The OAuth client was not found." so it was probably deleted by the oauth client owner.

Why use AI generated pictures for the letters? Lot of the site wording is clearly AI too, but the pictures of final product are the most important aspect.

I'm genuinely asking, since it just makes the site look untrustworthy. The only thing balancing that are the real pictures of the peltier stamp process.

The site claims to be by cloudflare (didn't find a reverse link to confirm), so maybe they use their own little backdoor.

Anyone who relies on IP filtering for security deserves to have it broken. Change my mind.

These people give the slopmachine credentials for their own github account?

I know I should not be surprised at this point, yet they keep reaching new lows.

> Anthropic gave him a refund for the whole month that was underway, despite him being nearing the end of it

I sense an opportunity for free tokens.

Ideas for prompts that reliably trigger the age check?

They will never see a single cent from that, AA will continue to rotate domains and nothing was accomplished, except for spotify's legal team which earned easy money arguing against empty chair in court.

BTW, you can donate and get faster downloads: https://annas-archive.gl/donate

Just donated in honor of this. Up yours spotify!

That makes sense. They have definitely made the hobby a lot more approachable.

Long time fan of atomic14, thanks for all your videos!

It's interesting perspective and I'm happy to hear it works well for you.

Tangential but since it's in the title...

pcbway and jlcpcb sponsorships, especially on hobby electronics YT videos, are quite interesting case.

On one hand they seem redundant at this point. Both companies are well known to the target audience to the point of saturation, there isn't really any serious competition (in terms of capabilities, speed and price) and yet they keep sponsoring more projects.

On the other hand, it's probably the sponsorship I tolerate the most. Both are genuine companies unlike all the borderline scams such as all the vpns, brilliant, mobile games, etc.

Reasonable.

I wish there was a common convention for logical grouping like we have in math when disambiguating operator precedence with parenthesis, but those are already taken for asides in regular prose. Maybe curly braces?

I'm guessing bambu implementation returns the server socket's listen address, and they bind to 0.0.0.0. (Typography pet peeve, how do I disambiguate that dot?)

What's surprising is how this got shipped. Do the devs use some other client that has the WinSCP setting on by default, or is that feature only used by their slicer and their SDK does it by default?

One theory I have is they bound the server to the printer's address originally and it behaved properly, but then changed to 0.0.0.0 later.

Great article, I've been saying something similar (much less eloquently) at work for months and will reference this one next time it comes up.

Quite often I see inexperienced engineers trying to ship the dumbest stuff. Back before LLM these would be projects that would take them days or weeks to research, write, test, and somewhere along the way they could come to the realization "hold on, this is dumb or not worth doing". Now they just send 10k line PR before lunch and pat themselves on the back.

Hmm I'm not sure how to interpret that page but it looks like you are right, I'll edit my comment. I was told by GCP PMs that is how the GCP/tsystems setup is structured (see sibling comment) and that it mirrored AWS setup, but maybe that was not correct.

I don't know about AWS but I dealt with some (small / tangential) aspects of the GCP setup: https://www.t-systems.com/dk/en/sovereign-cloud/solutions/so...

It is completely separate. There isn't a shared control plane. You don't manage this in the GCP console, its a separate white-label product.

Any updates GCP wants to push are sent as update bundles that must be reviewed and approved by the operator (tsystems). During an outage, the GCP oncall or product team has no access and talks to operator who can run commands or queries on their behalf, or share screenshots of monitoring graphs etc.

(This information is ~3 years stale, but this was such fundamental design principle that I strongly doubt it has changed)

Edit: Looks like the below is not true. However, such setup is technically possible and if they were serious about making it truly isolated from US influence, it can be done.

Original comment: No it's not owned by AWS. It's a separate legal entity with EU based board and they license the technology from the US company.

No, they-are-not-actually-contamination. Some studies might have inaccurate numbers due to contamination. That's all.

Important to correct for, but doesn't invalidate the whole microplastics concern.

ETHZ news page is always overhyped. There is good research coming from there but their marketing is never worth reading.

If you take a selfie with a sports player, you probably don't endorse their political views, you are just a fan of their play.

If you take a selfie with an author, you probably don't endorse their political views, you just like their books.

If you take a selfie with a politician ...

I actually think it's ripe for an extra season because the stuff that happened in last few years is comedy goldmine.