progval

Unless you send any reply that is significantly largest than the request, like this one, and then you can be exploited to DDoS someone else via an amplification attack. https://www.cloudflare.com/learning/ddos/dns-amplification-d...

They offer hardware tokens for 29€, but stopped making new ones. Android/iOS will indeed be a requirement once the existing stock is gone. I was promised a hardware token, but I'm still waiting for it six weeks after my initial request.

Mine turned off SMS 2FA last month and forced me to install their mobile app. Which also required me to enable Google Cloud Messaging on my phone.

from the article:

> Steam is huge and requires 32-bit to work properly for the client and for Proton / Wine

Mozilla is an ad company now: https://www.mozilla.org/en-US/advertising/ https://blog.mozilla.org/en/mozilla/mozilla-anonym-raising-t...

I'm 31 and I don't know mine.

Can't they be split into lines? OTR was designed for IRC that limited protocol lines (ie. payload line + command + extra fluff) to 512 bytes, so that ought to work on Discord too.

There are no occurrences of "cell" or "phone" in GDPR, and the only relevant occurrences of "number" are about "national identification numbers", which phone numbers are not.

It's not open-source (nor open-weight): https://huggingface.co/nanonets/Nanonets-OCR-s/discussions/2

At Software Heritage, we listed 380M public repositories, 280M of which are on Github: https://archive.softwareheritage.org/

Repository search is pretty limited so far: only full-text search on URLs or in a small list of metadata files like package.json.

> but github may have a feed of new repos anyway?

Yes: https://docs.github.com/en/rest/repos/repos?apiVersion=2022-... (you can filter to only show repositories created since a given date).

> So, I tell the server to drop traffic from the IPs that were scraping. Problem solved! Then immediately I start seeing a large number of attempts from different IPs. Residential IPs in the US: they're buying residential proxies.

Might, of course. And in my experience it's what happens most times I ask a LLM to do something I can't trivially do myself.

The other side of the coin is that if you give it a precise input, it will fuzzily interpret it as something else that is easier to solve.

> written with a fair bit of feature flags

I see you use Cargo feature for this. One thing to be aware of is Cargo's feature unification (https://doc.rust-lang.org/cargo/reference/features.html#feat...), ie. if an application embeds crate A that depends on nova_vm with all features and crate B that depends on nova_vm without any security-sensitive features like shared-array-buffer (eg. because it runs highly untrusted Javascript), then interpreters spawned by crate B will still have all features enabled.

Is there an other way crate B can tell the interpreter not to enable these features for the interpreters it spawns itself?

Researchers' blog post: https://comsec.ethz.ch/research/microarch/branch-privilege-i...

Paper: https://comsec.ethz.ch/wp-content/files/bprc_sec25.pdf

Installable versions of Windows apps still bundle most of the libraries like portable apps do, because Windows does not have a package manager to install them.

Source?

Archived repository: https://archive.softwareheritage.org/browse/origin/directory...

You can download it as a Git repository from https://archive.softwareheritage.org/api/1/vault/git-bare/sw...

The toolchain (eg. compiler) reads the time from an environment variable if present, instead of the actual time. https://reproducible-builds.org/docs/source-date-epoch/

> There have been security vulnerabilities for example that only existed in the Debian-based package of software.

Any examples more recent than CVE-2008-0166?

Debian didn't "divert engineering resources" to this project. People, some of whom happen to be Debian developers, decided to work on it for their own reasons. If the Reproducible Builds effort didn't exist, it doesn't mean they would have spent more time working on other areas of Debian. Maybe even less, because the RB effort was an opportunity to find and fix other bugs.

2FA only protects login. If you're already logged in, someone with access to the computer can just copy the session token. Or instruct the email client that is already running to dump all your emails to a local file.

On SourceHut, git blame is available while logged out, but the link to blame pages is only showed to logged-in users. That may be a recent change to fight scrapers.

git blame is always expansive to compute; and precomputing (or caching) it for every revision of every file is going to consume a lot of storage.

That doesn't work if other teams want to apply their own cURL patches, or update as soon as upstream publishes new security fixes without waiting for you.

Google (probably) doesn't consider selling Chrome to be good for them or they would have done it on their own.

The French translation of the Terms of Use says they apply both to services and products:

> Vous ne pouvez pas utiliser les services et produits de Mozilla dans les buts suivants :

But a personal account is not Workspace, as Google Workspace is a B2B product, right?

There is no evidence in the article that it does. "Google is providing Pentagon with access to TensorFlow" means nothing because TensorFlow is open source.