c0pium

7 ms·

31.
by c0pium 3y ago
That’s not how this marketplace works at all. A better analogy is to say that BMW has a monopoly on making BMWs, yet they are still forced to compete with Porsche, who has their own monopoly on creating Porsches. There’s a two-sided marketp
32.
by c0pium 3y ago
What you’re proposing would require a literal quantum shift in DRM, where it’s only possible to use a copy of something if that thing hasn’t been itself copied somewhere else. That world would ironically unite the desires of publishers, cre
33.
by c0pium 3y ago
I own multiple books that are over 100 years old. They weren’t even that expensive.
34.
by c0pium 3y ago
That’s what I said, just less precisely. The system is as secure as the least secure auth mechanism, the existence of better ones is irrelevant.
35.
by c0pium 3y ago
The lack of a period on their thought fragment implies it’s incomplete, allow me to supply the second half. …assuming we lived in a completely different world where money doesn’t matter.
36.
by c0pium 3y ago
…on the straight away of lap one. The top trim model 3 performance best time around the green hell is like 9 minutes. There are factory Porsches that will do it in under 7. This is a very ironic comment to have made in a thread about how ch
37.
by c0pium 3y ago
Huh? I very clearly said what would get you through the audit is not breaking the law. Are you ok?
38.
by c0pium 3y ago
Those are apples and oranges. You can submit corrections for much longer than 1.5 years. Why be afraid if you filed correctly? Just have some confidence.
39.
by c0pium 3y ago
Yes. It does. It can choose to outsource some of the verification pieces to the several states (e.g the REAL ID act) but the government needs a way to uniquely identify residents that it interacts with. The founding documents make this very
40.
by c0pium 3y ago
That’s a federated IDP which can be used to access your identity instead of using your social security number. It doesn’t replace the fact that your social security number is still your username and password in the canonical identity system
41.
by c0pium 3y ago
From the average user perspective those settings are equally impossible to change, as they neither know nor care that they even exist.
42.
by c0pium 3y ago
That’s not really how it works, unfortunately. Once a company releases a patch, the clock starts ticking on reverse engineering what that patch does. Amusingly, all of the efforts to shrink patch sizes have made this even easier, as you can
43.
by c0pium 3y ago
Why would you think I’m talking about pentests? Those are largely checkbox engagements run by people who use some automated tool; they’re pretty unlikely to find 0-days. I’m talking about real security audits, where a researcher takes signi
44.
by c0pium 3y ago
It very much is the norm, lots of security research companies have similar policies. It’s called coordinated vulnerability disclosure, or CVD. Rapid 7 is throwing the random company under the bus to protect users of that company’s software.
45.
by c0pium 3y ago
It’s primarily marketing for sure, but the fig leaf is that the details allow targeted detections and mitigations based on the details of the bug. You can use the PoC code to test WAF rules for instance.
46.
by c0pium 3y ago
It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.
47.
by c0pium 3y ago
>… then there’s no reason… The reason is to avoid getting dragged by Rapid 7. If you don’t play by the generally accepted community standards for coordinated vulnerability disclosure, you can expect the researchers to point that out as l
48.
by c0pium 3y ago
At this point, the burden of proof is the other direction. All crypto is a grift until it proves otherwise.
49.
by c0pium 3y ago
Except that is how the registry works. Get-ChildItem -Path HKCU:\ | Select-Object Name works exactly how you think it will. https://learn.microsoft.com/en-us/powershell/scripting/sampl...
50.
by c0pium 3y ago
You’re certainly right that calendly is just a conduit for this attack, and the attackers would simply pick something else if calendly disappeared overnight. Calendly is really relevant to the article from the perspective of a cybersecurity
51.
by c0pium 3y ago
That should be an email ahead of time.
52.
by c0pium 3y ago
I loathe talking to people who rehearse the conversation ahead of time. They invariably don’t respond to what I actually said but rather change what I said to line up with what they practiced in the mirror. Or they say some version of “I ex
53.
by c0pium 3y ago
> This is a single user application K8s installation instructions: https://superset.apache.org/docs/installation/running-on-kub... RBAC configuration: https://superset.apache.org/docs/secur
54.
by c0pium 3y ago
Do you own a Steamdeck?
55.
by c0pium 3y ago
> …homeserver market, it's getting larger and larger. Is that true? How are you measuring it?
56.
by c0pium 3y ago
You should read the referenced RFC, it’s right there. “””Because all domain names end at the root, which has a null string for a label…”””
57.
by c0pium 3y ago
Having all addresses be rooted in an untypeable null isn’t much better.
58.
by c0pium 3y ago
Oh, or we could add drive specifiers (maybe letters for ease of typing?) and then a reserved character before the root path separator to signify the change in context. Something like c:/dir_name could really take off…
59.
by c0pium 3y ago
Of course it matters. One extremely frequent complaint about Signal is that you have to give out your actual phone number to use it, and anyone with your number can determine if you use it. This cuts off both of those.
60.
by c0pium 3y ago
That is obviously incorrect, is English not your first language?

More ›