xmcp123

Nice to see someone not fucking up outreach during a security incident.

Good work.

I am backend, not frontend but doesn’t this basically mean that the data will never be indexed by a search engine?

I didn’t think I needed the /s there.

But there is still a distinction between monero being banned and the government saying “we don’t believe you can fulfill kyc obligations”. There is a legitimate argument that yes they could that could be made in court, depending on the implementation.

The currency itself is legal. Being an exchanger for it the government is ever so gently nudging you away from.

Same reason as it was in 2002. “No one ever got fired for buying Microsoft.”

God. I would hate to be the engineer forced to have enough Azure experience to be able to find these bugs and understand Azure’s infrastructure on this level.

Should have been addressed in the Geneva conventions.

It’s legal (at least in the US) the government just advised every major exchange that they couldn’t uphold their KYC obligations with it so they dropped it.

I keep a modest amount in Cake Wallet, not on an exchange. No hardware needed.

Tbh the biggest problem is platforms deciding you’re buying drugs because you purchase and transfer out (thanks Venmo)

No one does that though. The latency would be significant.

It is trivial to forge a Google bot user agent and scrape through GCP.

How do you tarpit GCP if Google’s search engine scrapers scrape from their own cloud?

If you block datacenter IP you’re also going to block all of the legitimate search engine crawlers.

This would have to be an incredibly targeted attack, and it would only work once. Once it happens, trust is broken and that model is fucked.

That’s not enough going to be enough to make companies pay 20x more.

Agreed. Feel like the AI era has removed a lot of the “don’t roll your own” instincts people had.

Just because you can doesn’t mean you should. There is a lot to be said for battle tested.

Yes, because you can run a chinese model on a USA server. The fact that it's a chinese model means nothing.

For now, there’s definitely some resistance because people don’t understand models can’t phone home (only the servers they’re hosted on).

But I don’t think this will be the first time in history that money doesn’t win.

You are not the real consumer though. The real consumer is API, inside of products ingesting vast amounts of data at scale.

My last role swapping from Haiku/Sonnet to GLM dropped costs by 90-95% and increased quality.

Money talks.

This is whack. Op has setup the server to be impossible to exploit, then challenged people to exploit.

The non default php settings he set break the exploit.

Reddit saying you turned off post requests? Is this accurate?

Edit: he turned off request body parsing. This breaks the exploit.

Thanks! Appreciated.

I have no idea how I have lived this long, having the career I have without knowing this existed.

Expand on that acronym for us

Bahaha someone added to the fund. It’s now $1004

Raw models without (or with incomplete) the safety built in only understand the thing that needs to be done and how to get there.

There is no proportionality. If they decide cooperation is the right way to handle it, that’s what they’re gonna do.

If they decide the only way to turn off your toaster is to shut down the electricity to your city, RIP to the city.

I tried to re-find it but could not.

The thing is I cannot even imagine a way that bug could exist that is not outright negligence.

A unit test becoming prod data? That’s really all I’ve got and that’s pretty unforgivable.

It’s the 2020s baby, this one is lucky to break the top 3!

Never thought there would be a silver lining on this issue. Fuck yeah.

Saw someone on Twitter indicating that they did this, and new keys got compromised.

I would actually love to change sides and work on bot defense, it’s more difficult than you’d think.