cedws

13 ms·

271.
by cedws 7mo ago
Installing the CA requires jumping through some hoops, but yes, intercepting traffic for apps that don’t use cert pinning isn’t that difficult on iOS. Apps that do use cert pinning is a whole other matter, I’ve tried unsuccessfully a few ti
272.
by cedws 7mo ago
We do know that Anthropic has the ability to detect when their models are being distilled, so there could be some backend mechanism that needs to be tripped to observe certain behaviour. Not possible to confirm though.
273.
by cedws 7mo ago
It made me raise my eyebrows when everyone was rushing to jump to Claude because OpenAI agreed to work with the DoW. Both companies are just as shitty as each other and will resort to underhanded tactics to stay on top. Go China to be hones
274.
by cedws 7mo ago
Not sure, and not completely convinced of the explanation, but the way this sticks out so obviously makes it look like a honeypot to me.
275.
by cedws 7mo ago
ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently
276.
by cedws 7mo ago
>Following the Core Guideliness also helps Yes, this what Stroustrup said and it makes me laugh. IIRC he phrased with a more of a 'we had safety before Rust' attitude. It also misses the point, safety shouldn't be opt-in o
277.
by cedws 7mo ago
I watched a talk from Bjarne Stroustrup at CppCon about safety and it was pretty second hand embarrassing watching him try to pretend C++ has always been safe and safety mattered all along to them before Rust came along.
278.
by cedws 7mo ago
Because they don’t work with it. It’s a simple as that. I don’t trust people who don’t work with a terminal these days, the further they get from a terminal, the less grounded their views are. They rely on hearsay and CEO hype. To make matt
279.
by cedws 7mo ago
I've seen this misconception so many times in open source projects - commits just bumping the version in go.mod to 'get the latest performance and security improvements.' Like no, that's not how it works, you just made y
280.
by cedws 7mo ago
Are you able to share if there's a general trend behind the outages? Do you often hit capacity, or do you budget to have headroom?
281.
by cedws 7mo ago
The US under Trump is behaving exactly like a country with intentions of damaging the Western order and antagonising enemies to open new front lines. I think writing off Trump's actions as stupid is wrong, he's malicious.
282.
by cedws 7mo ago
It is in a sense dumping responsibility, but there’s a legion of security companies out there scanning for attacks all the time now to prove their products. They’re kind of doing a public service and you’re giving them a chance to catch att
283.
by cedws 7mo ago
Thanks, TIL.
284.
by cedws 7mo ago
GitHub, npm, PyPi, and other package registries should consider exposing a firehose to allow people to do realtime security analysis of events. There are definitely scanners that would have caught this attack immediately, they just need a w
285.
by cedws 7mo ago
It's not about expectation of work (well, there's some entitled people sure.) It's about throwing away the effort the reporter put into filing the issue. Stale bots disincentivise good quality issues, makes them less discover
286.
by cedws 7mo ago
Yes, trying to slow down response.
287.
by cedws 7mo ago
It's like playing The Witness. Somebody should set LLMs loose on that.
288.
by cedws 7mo ago
I don't think you can put them into buckets like that. All addiction is driven in persuit of a reward. The magnitude of reward can be estimated with brain scans and stuff but to my understanding isn't universal in all humans. Can
289.
by cedws 7mo ago
Wasn't Zuckerberg caught red handed in emails signing off on this? When is he going to be facing consequences?
290.
by cedws 7mo ago
I'm thinking along the lines of wikis, archival projects, and yeah pay-per-view video/photo websites. Torrents only work for static data and aren't very performant. This is a fair way to allow AI scraping too: you can let bot
291.
by cedws 7mo ago
Serve data to users at their expense instead of yours. I've wanted something like this for a while. S3 Requester Pays kind of achieves the same thing but requires the requester to have a funded AWS account.
292.
by cedws 7mo ago
If I remember correctly UK players can no longer chat at all until they verify their ID.
293.
by cedws 7mo ago
In this case I'm talking about what the Action did internally. The git clone inside was not pinned, but is now.
294.
by cedws 7mo ago
This is the security shortcuts of the past 50 years coming back to bite us. Software has historically been a world where we all just trust each other. I think that’s coming to an end very soon. We need sandboxing for sure, but it’s much bi
295.
by cedws 7mo ago
This looks like the same TeamPCP that compromised Trivy. Notice how the issue is full of bot replies. It was the same in Trivy’s case. This threat actor seems to be very quickly capitalising on stolen credentials, wouldn’t be surprised if t
296.
by cedws 7mo ago
First prove the solution wasn’t in the training data. Otherwise it’s all just vibes and ‘trust me bro.’
297.
by cedws 7mo ago
It amounts to an argument against pinning in a (IMO) weird world view where the package maintainer is responsible for the security of users' systems. That feels wrong. The user should be responsible for the security of their system, an
298.
by cedws 7mo ago
I audited Trivy's GitHub Actions a while back and found some worrying things, the most worrying bit was in the setup-trivy Action where it was doing a clone of main of the trivy repo and executing a shell script in there. There was no
299.
by cedws 7mo ago
While GitHub obsess over shoving AI into everything, the rest of the platform is genuinely crumbling and its security flaws are being abused to cause massive damage. Last week Aqua Security was breached and a few repositories it owns were
300.
by cedws 7mo ago
I think UBI is a pipe dream. I live in the UK and even with our social safety net which is much stronger than the US's, I can't imagine the government ever handing out money adequate to live a middle class life to large chunk of t

More ›