micaksica

30 ms·

1. 241.▲
   by micaksica 10y ago

   > we've had better alternatives all along We've had better alternatives on the desktop for over six years now, since Apple said "No Flash for iOS" in April 2010, when content creators panicked to capture that market a
2. 242.▲
   by micaksica 10y ago

   The end of an era, to which all I can say is good riddance. Flash Player has been responsible for 892 published CVEs [1]. The world is safer without it. [1] https://www.cvedetails.com/vulnerability-list/vendor_id-53&#x2
3. 243.▲
   by micaksica 10y ago

   > It's odd not to examine the "contacted a friend at GitHub" part. Authentication aside: what does somebody do to talk to GitHub if you don't have a friend at GitHub that's willing to chat with you? Would Kenne
4. 244.▲
   by micaksica 10y ago

   Good on Kenneth for being quick on the draw. I love 'requests'. If you're a developer of a popular open-source project, this should serve as a warning to make sure you have multi-factor authentication on, yes, but it's e
5. 245.▲
   by micaksica 10y ago

   Sending images to do this is bad enough, but I'd hope that they have some serious protections around that data in transit and on the servers themselves. If they are saving these images at all that's not any good.
6. 246.▲
   by micaksica 10y ago

   I'm curious how they're protecting this data. Having access to a bunch of raw, high-megapixel ID images is enormously useful for bad actors.
7. 247.▲
   by micaksica 10y ago

   Your DMs are closed.
8. 248.▲
   by micaksica 10y ago

   Thanks. Reaching out.
9. 249.▲
   by micaksica 10y ago

   Really? I don't see it. https://news.ycombinator.com/user?id=siddharthkp doesn't return an email address, and I don't see one on the GitHub profile page either.
10. 250.▲
    by micaksica 10y ago

    I actually looked at the code for 5 minutes. This module is vulnerable to arbitrary code execution simply by having a malicious JavaScript file in a directory or subdirectory underneath where `auto-install` is run, without the user even nee
11. 251.▲
    by micaksica 10y ago

    > The alternative is a tightly controlled standard library, but that isn't npm's stated goal. What npm says it is doing on paper and in its charter is not necessarily what npm gets used for. At this point in the ecosystem'
12. 252.▲
    by micaksica 10y ago

    Tor itself is already a prime target for hackers. There are plenty of malicious exit nodes as is; as for nation-states, the cost of entry into polluting the Tor network with your own circuits to probabilistically deanonymize users is low en
13. 253.▲
    by micaksica 10y ago

    This. I love that the Node community enjoys innovating for convenience, but ideas like this one are less than half-baked from a security perspective. Just make a few typo'd popular packages, and use npm install scripts [1] and you have
14. 254.▲
    by micaksica 10y ago

    I agree with this. "Tor Browser Mode" should become the default "Private browsing mode" on Firefox. It seems to me that a lot of uneducated users seem to have the idea that Incognito/Private mode does, somehow, give
15. 255.▲
    by micaksica 10y ago

    Virtually everyone can run a relay. BitTorrent is effectively a "relay" when you seed. The anonymity network I2P actually works in a way that you are both the relay and the client by default. According to Tor, "decent" i