Stefan-H

9 ms·

31.
by Stefan-H 8mo ago
You might be conflating "cloud" with serverless. Serverless is where developers can focus on code, with little care of the infrastructure it runs on, and is pay-as-you-go.
32.
by Stefan-H 8mo ago
Ethical disclosure existed before bug bounties. Someone who wants to ensure the remediation of the bug might recognize that the staff member responding to bug bounty reports is limited in their purview and might be badly trained. Upon learn
33.
by Stefan-H 9mo ago
Your comment gets to the crux of my thinking about LLM coding. The way I think of what LLM coding is doing is decompressing your prompt into code based on the statistical likelihood of that decompression based on training data. Basically &q
34.
by Stefan-H 9mo ago
Can you elaborate on the logic that makes preventing scrapers (note, you didn't mention actually hindering accessibility technologies) customer antagonistic?
35.
by Stefan-H 9mo ago
See my other comment, but the answer here is resoundingly "No". For the communication to be end-to-end encrypted the payload needs to be encrypted through all steps of the delivery process until it reached the final entity it is m
36.
by Stefan-H 9mo ago
No, because there is a web server that exposes an API that accepts a plaintext prompt and returns plaintext responses (even if this API is exposed via TLS). Since this web server is not the same server as the backend systems that are proces
37.
by Stefan-H 9mo ago
The point of measured environments like the TEE is that you are able to make guarantees about all the software that is running in the environment (verified with the attestation). "If the software can modify data legitimately, it can be
38.
by Stefan-H 9mo ago
That is where the attestation comes in to show that the environment is only running cryptographically verified versions of open source software that does not have the mechanisms to allow tampering.
39.
by Stefan-H 9mo ago
E2EE is usually applied in contexts where the message's final recipient is NOT the server on the other end of a TLS connection, so yes, this scenario is a stretch. The point is that in the context of an AI chat app, you have to decide
40.
by Stefan-H 9mo ago
The point of E2EE is that only the people/systems that need access to the data are able to do so. If the message is encrypted on the user's device and then is only decrypted in the TEE where the data is needed in order to process
41.
by Stefan-H 9mo ago
When the server is the final recipient of a message sent over TLS, then yes, that is end-to-end encryption (for instance if a load balancer is not decrypting traffic in the middle). If the message's final recipient is a third party, t
42.
by Stefan-H 9mo ago
Just like your mobile device is one end of the end-to-end encryption, the TEE is the other end. If properly implemented, the TEE would measure all software and ensure that there are no side channels that the sensitive data could be read fro
43.
by Stefan-H 10mo ago
The image is watermarked from gemini, so presumably the author was trying to allay concerns that the important content was fake.
44.
Andy Jassy makes Amazon leadership announcement(aboutamazon.com)
3 points by Stefan-H 10mo ago|0 comments
45.
by Stefan-H 10mo ago
An attacker with a privileged position on the network allowing them to eavesdrop (but not decrypt) traffic could use a bug like this to identify the device on the network associated with a phone number in Signal. Given nation state level ad
46.
by Stefan-H 1y ago
Cooperation under duress is still cooperation.
47.
by Stefan-H 1y ago
Many consumer devices can be selectively targeted for updates. The entities that control the update servers are controlled by the states that they are a part of. People seem to have forgotten that companies once felt the need to invent warr
48.
by Stefan-H 1y ago
How user antagonistic changing code on IoT devices should be is highly dependent on the threat model for the devices. I'm happy to trust home users to flash their lightbulbs and door locks (though the company might not see that as acce
49.
by Stefan-H 1y ago
Are you familiar with the academic field of security and the notion of trust in trusted computing? The IoT devices that is being discussed in the article are for industrial control systems, not necessarily your home lightbulb. The threat m
50.
by Stefan-H 2y ago
What alternatives come to mind when asking that question? Not being in the PKI world directly, web of trust is what comes to mind, but I'm curious what your question hints at.
51.
by Stefan-H 2y ago
It's really just about giving yourself enough time to think before you respond. That's the entire difference between a reaction and a response. You can use dialectical and cognitive behavioral therapies to help develop the toler
52.
by Stefan-H 2y ago
"How do you slog through something you truly hate?" - I don't. When signals that a role is not aligned with my needs start cropping up, I begin searching for a new role passively, and as the situation develops I speed up my s
53.
by Stefan-H 2y ago
"... is called a delusion". What I am suggesting is not delusion, it is mindfulness and cutting through delusion. When one is presented with something that elicits a fear response (whether the stimulus is rational or not) the goal
54.
by Stefan-H 2y ago
While YMMV, a fear response is a choice. You can have all the rational reasons to be afraid (like the bottom of your hierarchy of needs being unmet) and choose to act out of cold rationality rather than fear. Then it becomes a self-fulfilli
55.
by Stefan-H 2y ago
As someone who is more in the middle of my career rather than the end of it, I would like to echo your sentiment. I have had plenty of roles where I was tasked with things that were out of my depth, and the answer is to just not let it be.
56.
by Stefan-H 2y ago
Source? My Suburban school district primarily heated up foods from Sysco.
57.
by Stefan-H 2y ago
The monetization of social and parasocial relationships (from advertising in social media to the industry around influencers and celebrities of all types) might be one of the cruelest things in modern capitalism.
58.
by Stefan-H 2y ago
In your first scenario, any connections established through the ISP-A's IP address would be routed back through the VPN connection that they came in on. If that server were to establish it's own connections to external resources,
59.
by Stefan-H 2y ago
Ha! Thanks for the elucidation. My assumptions around the GP did include the assumption of sex, but it was more in a honeypot context rather than as an end in an of itself.
60.
by Stefan-H 2y ago
And worst case there is always the rubber hose.

More ›