gnfargbl

8 ms·

91.
by gnfargbl 10mo ago
So: OP wants to grow, but at his own pace and in his own way. He values transparency and autonomy. He doesn't mention salary as being particularly important, but does want a good work/life balance. I wonder if he's considered
92.
by gnfargbl 10mo ago
That's actually a fair defence against this kind of abuse. If the attacker has to get some information (the tunnel ID) out of the victim's machine before they can abuse this service, then it is less useful to them because getting
93.
by gnfargbl 10mo ago
Be aware of threat actors, too: you're giving them an easy data exfil route without the hassle and risk of them having to set up their own infrastructure. Back in the day you could have stood up something like this and worried about ab
94.
by gnfargbl 10mo ago
The real kicker is in point 1.13: > website activity logs show the earliest request on the server for the URL https://obr.uk/docs/dlm_uploads/OBR_Economic_and_fiscal_outl... . This request was unsuccessful, as t
95.
by gnfargbl 11mo ago
Are there fewer busy-work jobs in China? If so, why? It's an interesting assertion, but human nature tends to be universal.
96.
by gnfargbl 11mo ago
Could this be a problem not with AI, but with our understanding of how modern economies work? The assumption here is that employees are already tuned so be efficient, so if you help them complete tasks more quickly then productivity improve
97.
by gnfargbl 11mo ago
Let's invert that thinking. Imagine you're the "security area director" referenced. You know that DJB's starting point is assumed bad faith on your part, and that because of that starting point DJB appears bound in
98.
by gnfargbl 11mo ago
I'm a huge Go proponent but I don't know if I can see much about Go's module system which would really prevent supply-chain attacks in practice. The Go maintainers point [1] at the strong dependency pinning approach, the sumd
99.
by gnfargbl 11mo ago
If I understand TFA then the defendant is arguing that his message about owning a gun was made less glib by the verbatim inclusion of a tears-of-joy emoji plus a smiling-devil-horns emoji at the end. That is... an unusual argument to make
100.
by gnfargbl 11mo ago
The recent Azure DDoS used 500k botnet IPs. These will have been widely distributed across subnets and countries, so your blocking approach would not have been an effective mitigation. Identifying and dynamically blocking the 500k offending
101.
by gnfargbl 11mo ago
Nah, that's delight in someone else's misfortune. This is delight that the misfortune wasn't yours, which is slightly different.
102.
by gnfargbl 11mo ago
I don't think it's being looked at by the UK government through the lens of "right" or "wrong" but simply as a matter of the rule of law. If a course of action is illegal, they have to avoid it.
103.
by gnfargbl 11mo ago
You're correct, but it's the social norms -- or at least, the norms as I perceive them -- that I am talking about here. If you find yourself with potentially serious security bugs in your repo, then the social norm should be for y
104.
by gnfargbl 11mo ago
They could, but there is really no requirement on them to do so. The security flaw was discovered by Google, but it was not created by them. Equally there is no requirement on ffmpeg to fix these CVEs nor any other. And, of course, there
105.
by gnfargbl 11mo ago
Þis gewrit is scræp. Hit is alyfed to awritan fullice riht Englisc butan þæm fule Frenciscan wordum eallunga.
106.
by gnfargbl 11mo ago
The soft power aspect of this dependency is a problem, but the bigger problem is that it has made UK universities dependent on a fundamentally unsustainable revenue stream. Chinese students come to study in the UK because British universiti
107.
by gnfargbl 11mo ago
I edited my post to make the nature of the requested payment clearer.
108.
by gnfargbl 11mo ago
FFmpeg seem to be taking the position that their code must be considered insecure in production unless you pay them for security consulting [1]. On the one hand, that's fine; it's their project, and if attack surface is not a prio
109.
by gnfargbl 1y ago
I do get what you're saying, and it sounds almost analogous to visualisations of bad PRNGs, e.g. https://www.reddit.com/r/dataisbeautiful/comments/gv4fhr/oc_...
110.
by gnfargbl 1y ago
You don't, I guess. But again that's just the same as when you insert something into an object store: you can't be absolutely certain that a future retrieval will give you the same object and not a colliding blob. It's
111.
by gnfargbl 1y ago
Sure, but the paper doesn't claim absolute injectivity. It claims injectivity for practical purposes ("almost surely injective"). That's the same standard to which we hold hash functions -- most of us would consider it r
112.
by gnfargbl 1y ago
I'm not quite getting your point. Are you saying that their definition of "collision" is completely arbitrary (agreed), or that they didn't use enough data points to draw any conclusions because there could be some unkno
113.
by gnfargbl 1y ago
The nature of high-dimensional spaces kind of intuitively supports the argument for invertability though, no? In the sense that: > I would expect the chance of two inputs to map to the same output under these constraints to be astronomic
114.
by gnfargbl 1y ago
Yep, absolutely. I hear you. Like everything legal, it seems to be fuzzy and context-dependent. And that is the point -- the HOPL asserts that you can just put a robots.txt on your website and say that it means bots accepted the terms in th
115.
by gnfargbl 1y ago
The actual ruling says, literally, that " Adherence to the rules in a robots.txt file is voluntary. " It's not a settled area of law, but that seems to be the current position.
116.
by gnfargbl 1y ago
Making a second legally dubious assertion does not strengthen the first legally dubious assertion. Courts have tended to find that robots.txt is non-binding (e.g. hiQ Labs v. LinkedIn). It's a different situation if the website is gate
117.
by gnfargbl 1y ago
> If you make a website using HOPL software, you are not breaking the license of the software if an AI bot scrapes it. The AI bot is in violation of your terms of service. Assuming a standard website without a signup wall, this seems l
118.
by gnfargbl 1y ago
You're talking about wiping hundreds of billions of market cap from Nvidia/Google/OpenAI/Anthropic/Amazon/Meta etc, and also the loss of a very large number of tech jobs. It's hard to imagine any country v
119.
by gnfargbl 1y ago
No high horse here, I promise you. I'm not French and I didn't know much in detail about Sarkozy before this, but being convicted of taking political campaign donations from the architect of the Lockerbie bombing is more than enou
120.
by gnfargbl 1y ago
Article 3 ECHR should prevent the prison authorities from putting any prisoner in a position where they know he's going to "get roughed up". You and I both want that right for ourselves, so surely we should also extend it to

More ›