sslalready

Second this. It’s super hard to imagine in what ways things can go wrong before you have seen or experienced them.

Kick-backs would never even have been on my radar, even though I’m seeing myself as a careful person, if it wasn’t for YouTube and people like him taking their time to educate the rest of us.

Wood working newbie here. I recently learned about table saw kick-backs and ordered a Grr-Ripper push block[1] after seeing it being recommended on several YouTube videos. I’m quite happy with it but I’m not really experienced enough to make a fair judgement of the product. Is these kind of things something that more experienced wood workers are using/recommending?

[1] https://www.microjig.com/products/grr-ripper

It’s true. Also note that you get a physical core for each vCPU with t2.

I’ve benchmarked c5 and t3 against t2 and have found single thread perf to be better on c5 compared to t2. When loading all vCPUs the performance suffered on the newer instances (each HT performed worse than a single t2), so you would get more bang for your buck on t2. YMMV of course.

No.

If memory serves me right the CVS bug was originally discovered and exploited by a member of an infamous file sharing site. After descriptions(?) of that bug were leaked in underground circles, an east European hacker wrote up his own exploit for it. This second exploit was eventually traded for hatorihanzo.c, a kernel exploit, which was also a 0-day at the time.

The recipient of the hatorihanzo.c then tried to backdoor the kernel after first owning the CVS server and subsequently getting root on it.

The hatorihanzo exploit was left on the kernel.org server, but encrypted with an (at the time) popular ELF encrypting tool. Ironically the author of that same tool was on the forensic team and managed to crack the password, which turned out to be a really lame throwaway password.

And that's the story of how two fine 0-days were killed in the blink of an eye.

(The other funny kernel.org story is when a Google security researcher found his own name in the master boot record of a misbehaving server.)

Is it just me or does the HSTS preload list not work in Firefox 62 (macOS 10.12)? I see a plaintext HTTP request when opening http://www.google.com instead of an immediate https connection to www.google.com.

That's unfortunate. For those with enough karma it's however possible to _vouch_ for flagged posts. But maybe it's too late for that now.

Not sure if you would agree to call them major distros but at least Fedora 23 (Nov, 2015) and Ubuntu 18.04 LTS (Apr, 2018) ships with Python 3 in their base.

I would just be happy with /usr/bin/python3. That’s how it works on the popular Linux distros per https://www.python.org/dev/peps/pep-0394/

Hi. I found your thread while looking for more information on (the lack of) Python 3 on Mojave.

As a developer I’m annoyed with having to install third party packages to get access to Python 3. The software Apple ships is also code-signed, which is important to some organizations which relies on binary whitelisting (e.g. github.com/google/santa). Software from Homebrew or Anaconda are typically not code-signed.

I was hoping that perhaps bringing the old Python 2 interpreter up here could lead to more radars for the inclusions of a recent Python 3.x release in the base system.

ESLint maintainer responds here: https://github.com/eslint/eslint-scope/issues/39#issuecommen...

> One of our maintainers did observe that a new npm token was generated overnight (said maintainer was asleep). We think that token was likely used but are awaiting confirmation from npm. This maintainer has changed password, enabled 2FA, and generated new tokens.

Thanks for the update. Did this affect all of your public resolvers or only 1.1.1.1?

I love how this service is actually improving the 1/8 situation. It’s a very cool solution to a challenging problem. Well executed!

Are there any servers supporting JMAP today?

Looks great. Would love to try it out when it goes out of beta.

For testning the privacy when it comes to email rendering, have you tried this excellent service?

https://www.emailprivacytester.com

I remember how our Sun representatives would go to almost any length to avoid admitting a hardware problem. Instead they tried to blame the problems on cosmic rays or the fact that the servers wasn't running in an environment with a very narrow temperature and air humidity window.

Funny how they wouldn't admit to a hardware problem but still had data that showed that the problems were less likely to surface if the temperature and humidity was X and Y..

Wow, that's a pretty awful UI. The default search form screams "advanced search" from the late 90ies. The compare example looks pretty dated too. I think Kibana and Sourcegraph are on the right track with a single input field that accepts field:value type searches. They're great once you've learned them.

Thanks, I'll keep an eye on this.

Three examples: 300MB size, 600 branches, 25k commits. 250MB, 250 branches, 15k commits. 80MB, 100 branches, 4k commits. Textwise it is a mix of Golang, JS and Python. Most of the repo size comes from binary resources (images etc).

Just tried this out on some of our code bases. It appears to fail to generate snippets/highlights for all files that contain non-Unicode text, e.g. "Müller" in ISO-8859-1. Known issue?

Many queries times out for me although I'm running it on a pretty beefy AWS c5 instance with SSDs. Queries such as "type:diff" doesn't seem to work at all on my code bases. It also does not appear to cache any data from previous runs of "git log", so attempting to do the suggested reload doesn't really workaroudn the issue. Are you working on improving the performance?

I think TRIM is dangerous not because of information leaks, but because of the risk of IV/nonce reuse when SSD data blocks are unmapped but not cleared. This would pose a risk if someone dumps the raw content of the NAND chips and find two or more data blocks encrypted with the same IV/nonce.

I can recommend subscribing to Most recent announcements from AWS[1] for keeping up. You'll get weekly summary emails with headlines, HN style. They link to articles here[2].

[1] https://aws.amazon.com/subscribe-to-aws-announcements/

[2] https://aws.amazon.com/about-aws/whats-new/2017/

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used?

I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2].

[1] http://docs.aws.amazon.com/systems-manager/latest/userguide/...

[2] http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangero...

This happens in several parts of Europe as well. It's part of the telcos' billing infrastructures, and many operators for example have middleboxes which allow TCP streams to be looked up against the billing system.

I believe the original idea was to allow companies selling ring tones to able to bill customers who downloaded their ring tones directly on the customers' telco bill.

From a privacy standpoint it's been a catastrophe. There are countless of operators who have been caught decorating customers' outgoing HTTP traffic with their mobile number or personal details. It's just a few years since one operator was caught doing this in Denmark [1].

Again, just a few years ago, in Sweden, a company setup porn sites and pretty much blackmailed their mobile visitors into paying $$$ for porn they supposedly had agreed to download. This company was using operators' billing APIs to lookup subscriber details from the IP:port numbers of connections to their porn sites [2].

In Norway, a company called MobileTech, use the same APIs to improve unreliable web tracking using cookies. By using these billing APIs they can assign a unique identifier to a particular subscriber regardless if this subscriber clears their cookies or share the connection across multiple devices. Their tracking script (b.mobiletech.no iirc) is embedded on many popular nordic sites. Their improved visitor tracking and demographic data is also sold to third party marketing companies such as Research International.

[1] https://www.version2.dk/artikel/mobilsurf-danske-teleselskab...

[2] https://www.svt.se/nyheter/lokalt/skane/fangelse-for-skaning...

Wow, impressive! The 360 view, LED moving indicator and full BOM shows some attention to details. Also, the UX looks great. Very nice work.

Personally I've managaged to avoid using it so far. But yes, you can whitelist individual binaries or even directories. The lack of code-signing doesn't prevent whitelisting, it just makes your life harder than necessary.

In practise it's much easier to just trust well-known developers by whitelisting their code-signing certificates.

You could still get owned, of course, but the benefit here is that you're excluding everything not explicitly whitelisted, including drive-by downloads, crap on portable devices or random programs downloaded off the internet that someone thinks will solve their problem of the day.

When people do not code-sign their software every software update is painful. At work, where we run https://github.com/google/santa, it frequently happens that companies with code-signed software forget to code-sign their auto-updater, or random binaries that run during installation. Most of the time the application crashes/hang during the update (because some piece weren't allowed to run), only to remind to you update the software again when you restart the application.

I find it useful for filtering and caching. Things like redirecting traffic to /.well-known/acme-challenge/ to your certificate management host, providing an endpoint for machine status or filtering requests to dot-files. Or telling Nginx to cache responses and allow it to serve stale content when the backend server returns 4xx/5xx status codes during deploys or high load. Handling things like client certificate authentication in Nginx instead of doing it in every backend application is another thing I've found useful.

HTTPS would increase user privacy by not leaking application details though.

It doesn't regrow the (larger) blood vessels and doesn't maintain the original structure. A liver is essentially two halves with two separate, large blood vessels.

You're correct. It says in their FAQ that they're using ZigBee Light Link, AES-128 and have put time and effort into preventing them from being hacked. They also say that they work in a mesh and should be compatible with other products per the ZigBee Alliance.