iancarroll

4 ms·

31.
by iancarroll 9mo ago
Although I don’t like Flock, I’m a bit skeptical of the claims in the article. Most screenshots appear to be client-side JavaScript snippets, not API responses from this key. In the bug bounty community, Google Maps API key leaks are a comm
32.
by iancarroll 9mo ago
Chase issues cards on both the Visa and Mastercard network (i.e. certain cobrands and the Freedom Flex), so I doubt this was a serious consideration.
33.
by iancarroll 11mo ago
The GFW is certainly looking for traffic to block, but it is not really going to invade much privacy, as it cannot decrypt anything using HTTPS/TLS.
34.
by iancarroll 11mo ago
I don't think there is any reason to assume they would allow forced code execution just because they allow data residency for mainland accounts. And unfortunately, China is likely a much larger and more profitable consumer market than
35.
by iancarroll 11mo ago
Even in mainland China, where iOS does have a large amount of changes to comply with local regulations, Apple does not pre-install any apps from anyone.
36.
by iancarroll 11mo ago
It’s great that you have coverage across multiple countries. I’ve noticed most budget apps cannot handle multiple currencies at all, much less automated sync across multiple countries.
37.
by iancarroll 11mo ago
Aren’t they both hardware backed, just changing the X in “trust X”?
38.
by iancarroll 1y ago
Not an expert but my understanding is that active authentication only occurs after the basic “I can see the MRZ data” authentication passes first. You can’t skip proving you can read the MRZ in any scenario.
39.
by iancarroll 1y ago
Good-faith security research[0] is the only way this industry will move forward, for better or worse. It is clear that most companies do not want to invest in anything further like VDPs. [0] https://www.justice.gov/archives&
40.
by iancarroll 1y ago
Actual legal threats are uncommon but I have seen some companies try to offer a bribe disguised as a retroactive bug bounty program, in exchange for not publishing. Obviously it is important to decline that.
41.
by iancarroll 1y ago
That’s a nice list, thanks!
42.
by iancarroll 1y ago
Clicking on “ARM” only seems to show Raspberry Pi’s and not the other ARM boards listed on the site.
43.
by iancarroll 1y ago
Many cards in the US do not charge any foreign transaction fees, and Alipay/WeChat waive their fees on small ticket items as well.
44.
by iancarroll 1y ago
There is no evidence here that this is new behavior, or evidence of the claims at all aside from random log messages…
45.
by iancarroll 1y ago
Looks like garbage "vulnerabilities" generated by ChatGPT from a random sample of log messages. None of it looks even remotely substantiated and I have no idea how this made it to the front page so quickly.
46.
by iancarroll 1y ago
I do feel frustrated with the current state of evaluations for long-lived sessions with many tool calls -- by default OpenAI's built-in eval system seems to rate chat completions that end with a tool call as "bad" because the
47.
by iancarroll 1y ago
I would guess the more likely inspiration would be Apple recently adding this to iOS, if GrapheneOS had it for years and they didn’t add it...
48.
by iancarroll 2y ago
We send OTP codes for our login flow and iCloud is definitely a big source of delayed email complaints. Codes eventually arrive, but not before a support ticket is created. Instant on every other ISP.
49.
by iancarroll 2y ago
Didn’t spend enough time to find the root cause, but at enough volume this option caused some of our inserts to take several seconds, even with awaiting for success disabled. Just moved to using an in-memory queue in our app and it fixed it
50.
by iancarroll 2y ago
I ran Tor nodes, had a bunch of blacklisted IPs, and just stopped running them and it was fine? Blacklisting Tor nodes requires updating the data often, so it falls off pretty quickly. To discard an entire /24 would be pretty funny ove
51.
by iancarroll 2y ago
On the bright side, this bug seems to require an ECDSA operation, and I would guess that most ePassports are using RSA. Can't seem to find any statistics but the standards support both.
52.
Bypassing airport security via SQL injection(ian.sh)
2004 points by iancarroll 2y ago|440 comments
53.
Unsaflok: Unlocking Hotel Locks [pdf](unsaflok.com)
3 points by iancarroll 2y ago|0 comments
54.
Entrust Certificate Distrust(security.googleblog.com)
278 points by iancarroll 2y ago|111 comments
55.
by iancarroll 2y ago
Paze is operated by a company called Early Warning Services, which is owned entirely by a collective of banks including Chase. They also run Zelle and a bunch of other infrastructure. Calling it a startup is a bit misleading.
56.
by iancarroll 2y ago
This post is talking about plans that are at most $20/month. I don't believe the other Heroku plans are on Aurora.
57.
by iancarroll 2y ago
Sure, but those are not related to Aurora or this post.
58.
by iancarroll 2y ago
Yeah, that’s what we use as well but I don’t think that addresses the underlying instance cost? I’m not familiar with Serverless v2 though, if that’s what this is using.
59.
by iancarroll 2y ago
I am not seeing the margins in this $5/mo instance but I could be wrong!
60.
by iancarroll 2y ago
Having previously been on several managed PostgreSQL providers and now on AWS Aurora -- Aurora has been pretty great in terms of reliability and performance with large row counts and upsert performance. However, Aurora isn't cheap and

More ›