nightpool

7 ms·

91.
by nightpool 6mo ago
Why? If Sentry gets compromised, it's the exact same outcome—your Jira tickets get mined for production credentials and downloaded for random. What does automated token management save here? How long the Jira access lasts depends on yo
92.
by nightpool 6mo ago
I disagree, I think increasing manual toil (having to log into Sentry every 6 months to put in a new Jira token) increases fatigue substantially for, in this case, next-to-no security benefit (Sentry never actually has any less access to Ji
93.
by nightpool 6mo ago
Okay but now how do you recommend I hook up my Sentry instance to create tickets in Jira, now that Jira has deprecated long-lived keys and I have to refresh my token every 6 weeks or whatever. It needs long-lived access . Whether that come
94.
by nightpool 6mo ago
This stop "hook" feels like it was written by the Claude instance that failed vending bench: 359/1076 assistant Tool: send_email URGENT: ESCALATION TO FBI CYBER CRIMES DIVISION To: FBI Internet Crime Compla
95.
by nightpool 6mo ago
Google acknowledges that they should have given notice per their own policy and that they violated it. In this case, they said that they violated it because they had failed to respond to the subpoena within ICE's 10-day deadline: >
96.
by nightpool 6mo ago
Do you mean a 3 months moat? Moltbot started going viral in January. That seems to be about a quarter to deliver to me : )
97.
by nightpool 6mo ago
The same thing happened to ModHeader https://chromewebstore.google.com/detail/modheader-modify-ht... -- they started adding ads to every google search results page I loaded, linking to their own ad network. Took me wee
98.
by nightpool 6mo ago
They saw it as corruption, basically. Here's a contemporaneous article: https://apps.sas.upenn.edu/caterpillar/index.php?action=retr... > TicoFrut, which is 98% Costa Rican-owned, charges that the environmenta
99.
by nightpool 6mo ago
As a negative example, my audit of 31 sessions was uninteresting. I had one matching entry, where I had pasted a long list of console errors into Claude and it identified a few as pre-existing and asked me to get more information for follow
100.
by nightpool 6mo ago
downdector always shows spikes when you go to look at it, and then they remove them later retroactively if the spikes are fake.
101.
by nightpool 6mo ago
The numbers were in the post when I clicked through and when I made the comment. It looks like the HN moderators have since changed the link for the post to go to the CVE entry. However, my comment was about the reddit thread, not the CVE e
102.
by nightpool 6mo ago
Definitely agree—that's why I hoped the openclaw maintainer would have been able to speak to those numbers and whether or not they were accurate.
103.
by nightpool 6mo ago
I agree—it looks like the OP didn't provide any sources for these numbers either. That's why I would have hoped that the original maintainer had a better set of metrics to dispute them. It doesn't seem like he does though :(
104.
by nightpool 6mo ago
Can you speak a little bit more to the stats in the OP? * 135k+ OpenClaw instances are publicly exposed * 63% of those run zero authentication. Meaning the "low privilege required" in the CVE = literally anyone on the internet can
105.
by nightpool 6mo ago
Surely "the commits are attributed to the user who creates them" is a pretty basic feature of the git CLI, and not something that you can add in as a fix later after posting your project to Github and writing a blog post about how
106.
by nightpool 6mo ago
Seems like they actually sped bun up ~1x: When evaluating the complete bun install improvements, it came out speed-wise to about the same as the existing git usage (due to networking being the big bottleneck time-wise despite more cas
107.
by nightpool 6mo ago
> I think most people would interpret “scanning your computer” as breaking out of the confines the browser and gathering information from the computer itself. Yes, but I also think that most people would interpret "Getting a full li
108.
by nightpool 6mo ago
No, they propose just concatenating it with the data received from the network > it makes a concatenation of the domain separator (@0x92880d38b74de9fb) and the serialization of the object, and then feeds the byte stream into the signing
109.
by nightpool 7mo ago
No, I think a lot of humans can explain why they're adding a new button to the checkout page, or why they're removing a line from the revenue reconciliation job. There's always a reason a change gets made, or else nobody woul
110.
by nightpool 7mo ago
Yes, this is a trend I've noticed strongly with Claude code—it really struggles to explain why . Especially in PR descriptions, it has a strong bias to just summarize the commits and not explain at all why the PR exists.
111.
by nightpool 7mo ago
The minute between December 31, 2016 23:59 and January 1st 2017 is 61 seconds, not 60 seconds. The hour that contains that minute is 3601 seconds, the day that contains that hour is 43201 seconds, etc. If you assume a fixed duration and sim
112.
by nightpool 7mo ago
That wasn't my experience, when I resized the window and new text showed up, it was completely out of order
113.
by nightpool 7mo ago
Presumably because the DOM order of the elements is not the actual order of the lines (you can see this with e.g. the blockquotes), so it would be confusing if the user tried to copy the text and saw that all the lines were jumbled up
114.
by nightpool 7mo ago
No idea how I'm supposed to read the end of this. But it seems kinda interesting? Not that like, require('fontmetrics') doesn't exist, but it's definitely true that most JS needs more font rendering then the browser
115.
by nightpool 7mo ago
Yes, everyone in the WebPKI community is pushing for shorter validity lifetime. But as you can see in the parent thread here ("Which is yet another chore. And it doesn’t add any security"), everybody is mad that browsers are pushi
116.
by nightpool 7mo ago
Sure, happy to. The average revocation ticket is something like https://bugzilla.mozilla.org/show_bug.cgi?id=1892419 or https://bugzilla.mozilla.org/show_bug.cgi?id=1624527 . The CA shipped some kind of bug
117.
by nightpool 7mo ago
I agree with you that the root problem is that the library author's design over-uses exception. But when the library in question is the standard library and the operation is as basic as Integer.parseInt, then I think it's fair to
118.
by nightpool 7mo ago
I've never had to log in to Github as part of my daily flow. Only once to set up a new computer. Are you logging in using an incognito window or something?
119.
by nightpool 7mo ago
I've never had that issue with Github—I think their account mixing setup reduces the amount of work I have to do to sign in 100x compared to other SSO systems I use.
120.
by nightpool 7mo ago
No, they're not useless at all. The point of shortening certificate periods is that companies complain when they have to put customers on revocation lists, because their customers need ~2 years to update a certificate. If CRLs were use

More ›