ryan-c

Like WiFi?

They probably can if you ask, but most people don't use wired networks at home.

Mine definitely supports Ethernet and WiFi with password, both what it connects to and the SSID it broadcast, though I had to change some settings on my AP (running OpenWRT) to get it to work.

I'm not aware of anything that needs 512 bit RSA for compatibility. At minimum generating the keys should go away.

The link had been to an unofficial upload. I guess the uploader took it down after EMF's official version was posted.

I've fixed the link.

The Ars Technica article may also be of interest - it has a statement from the company.

https://arstechnica.com/security/2024/08/home-energy-system-...

Yeah, this is pretty much what I did, except the demo account had an employee's email address in the details so I knew the format.

They do have a vulnerability policy page, but that was harder to find than figuring out an email address. I did suggest they implement security.txt, as it would have made things easier.

Oh, yeah, I'd forgotten about the NDAs, those are a big NOPE for me.

In the footnotes:

> Someone once asked me, as commentary on my ability to figure out email addresses, “Are you a Hacker or in sales?”

Just a bit of OSINT and educated guessing.

I think very few customers had ever generated API keys, and as best I can tell they made an allowlist for them.

One of my suggestions to them was to switch to elliptic curve, but I imagine RSA 4096 "just worked".

I suspect they'll rework it later now that it's not "on fire".

I'm not male and I use gender neutral pronouns.

The bugs I find are usually just ones I stumble across, I don't go looking for them.

Bug bounty programs generally aren't worth the trouble for me anyway - I have to file taxes in both the US and the UK so the paperwork gets really annoying.

chinese remainder theorem implementations fail if there are duplicate factors

These get styled such that they're black-on-black until you click on them. detail/summary doesn't work like that. Maybe with wild css hacks?

Convenience? I have a "spoiler" role for rST, for example, which works like this:

    # state class to contain the counter
    class _spoiler:
        count = defaultdict(lambda: 0)
    
        def id(src):
            _spoiler.count[src] += 1
            src_hash = sha256(src.encode()).hexdigest()[:7]
            return f'spoil-{src_hash}{_spoiler.count[src]:03}'
    
    def spoiler_role(name, rawtext, text, lineno, inliner,
                     options={}, content=[]):
        src = inliner.document.attributes['source']
        html = (
            '<input id="{id}" type="checkbox" class="spoiler" checked />'+\
            '<label for="{id}" class="spoiler">{text}</label>'
        ).format(text=text, id=_spoiler.id(src))
        return [nodes.raw('', html, format='html')], []

I don't want to do that manually, and this lets me write :spoiler:`Rosebud was the name of his sled`.

ROFL. Good find. I'd forgotten I left it running that long, I thought it was probably just overnight. Nowadays when I want to brute force something like that, I just rent a couple hundred cores for an hour.

(and pray to the gods I don't somehow leave the instances running by mistake)

Imagine my surprise at opening the comments and seeing a reference to some obscure art I made a dozen years ago.

The code that checked for DRM support set the "distinctiveIdentifier" config option to "not-allowed" specifically to avoid being useful for tracking. Most of the stuff that people think is "fingerprinting" is just trying to confirm the browser is what it claims to be. It is (or was) tricky to make DRM work in chromium compiled from source.

`!("a" == "a"[0])` just detects IE6/7, as they return undefined for "a"[0]: https://unspecified.wordpress.com/2008/06/15/portable-javasc...

Here's the slide deck for a con talk I did a while back: https://rya.nc/files/A_nickel_tour_of_the_ad_fraud_ecosystem...

I haven't worked there for a couple of years though.

If I recall correctly, I downloaded all of them, then pruned any that appeared to have non-deterministic behaviour (for example, using random), then used the offline testing script[0] helpfully provided by the site.

It was the first piece of code I put out that someone referred to as "art"[1].

Some others that hit the HN front page over the years:

https://news.ycombinator.com/item?id=10195358

https://news.ycombinator.com/item?id=9516824

https://news.ycombinator.com/item?id=26615938

I also had wrote some code for my former employer containing the magic string "haha jit go brrr" that raised some eyebrows when someone reverse engineering the code noticed it. It was part of a routine to try to coax the JIT into optimizing the code soon on low end Android devices for performance reasons, but someone who didn't understand what the code was doing thought it was part of an exploit... :facepalm:

0. https://rpscontest.com/rpsrunner.py

1. https://rya.nc/threads/art-and-beauty.html

> LGBTQ+ rights? Think of the children.

A lot of people prefer dead kids to queer kids, unfortunately.

or... they could hash the images and use an error correcting code to allow recovery of some lost files?

I expect this bullshit still works:

https://rya.nc/files/librejs-poc.html

    <script id="harmlessNullScript" type="text/javascript"></script>
    <skript id="derp" style="display:none;">
    /**
     * @license Proprietary
     * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved
     */

    // WARNING: Code here needs to avoid the "less than" symbol.
    (function(){
      // LibreJS modifies the text of script tags onced they've been
      // checked, which offers a very convienant way to detect it.
      if (harmlessNullScript.textContent.indexOf("LibreJS: ") > 0) {
        eval("alert('LibreJS detected, but non-free eval works');");
      }
    })();
    </skript>
    <script type="text/javascript">
    /**
     * @license Proprietary
     * @copyright Copyright 2018 Ryan Castellucci, All Rights Reserved
     */
    
    // An eval that works in the WebExtension port of LibreJS.
    // Untested on the original XPI version.
    Function(derp.textContent)();
    </script>

In any event, there are a lot of ways to eval code...

QR codes use a series of (mode, length, characters) segments - a given code can switch between modes. I think for QR codes the length encoding is mode-specific.

Crude static Huffman example, that could definitely be improved:

     5 bits 0 0000-1111      acde fghi lmno rstu
     7 bits 10 00000-11111   bjkp qvwx yzAB CDEF GHIK LMNO PRST UVWY
     7 bits 110 0000-1111    JQXZ 0123 4567 89/.
     8 bits 111 00000-11110  !@#$ $%^& *()_ {}[] `~+= |\"' ;:<> ,?  (space at the end)
    16 bits 11111111 00000000-11111111 plus UTF-8 1 to 256 unicode characters encoded as UTF-8

You could even include some bigrams in this sort of table.

There's some code here that could maybe be used for that sort of static huffman tree:

https://github.com/ryancdotorg/lztp/blob/main/generate-seed....

Alternatively, have something like this:

    00 000000-111111 1-64 characters, 5 bits each
    01 000000-111111 1-64 characters, 6 bits each
    10 000000-111111 1-64 characters, ~6.4 bits each (character set of 84 characters, every 5 packed into 32 bits)
    11 000000-111111 1-64 characters, UTF-8

This is vaguely similar to how data is encoded for QR codes.

As pointed out elsewhere, this will not outperform zstd with a dictionary trained on a corpus, but zstd would require pulling in a lot of code.

You don't need to. You compute a static huffman tree over fixed probabilities you've estimated or generated from a corpus.

I'm confused about the wheelchair thing - is she expecting them to automatically provide a wheelchair for her due to age, or is she requesting one explicitly?

I've been surgically modified such that my body doesn't produce sex hormones in any significant quantity on its own. As a substitute, I use separate transdermal gels containing testosterone and estrogen, which have relatively short metabolic half life in my body.

I normally target an estrogen level similar to an average woman and a testosterone level between the female and male reference ranges. I'm able to adjust the mix on the order of days when it suits me, and there absolutely is a difference. People who know me well can usually tell what mix I'm running.

I got business cards made that politely explain why my appearance may not match their expectations based on my name, and that has been quite effective at diffusing such problems.

Nobody seems to care that I leave my middle name off my tickets and book with a sex doesn't match my ID, even internationally.