nneonneo

12 ms·

151.
by nneonneo 1y ago
Looks like tests were added: https://github.com/apache/httpd-tests/commit/48a85e34051959c... Shame it wasn’t caught by any existing test though.
152.
by nneonneo 1y ago
CGTN is a Chinese state-run broadcaster; they themselves chose to use the phrasing “China does thing”. It may be in an effort to present a more unified face for the widely varied research happening in China, as well as showing a more easily
153.
by nneonneo 1y ago
I wish there was a good udm option for "what you used to show me before AI took over". For example, I like seeing flight updates when I punch in a flight number, which udm=14 does not show. That said, udm=14 has still been a huge
154.
by nneonneo 1y ago
Google's AI overviews gives you sources. The sources don't always say what Google AI thinks it says. Or, Google will mix up two sources that are talking about totally different things, assume they're the same thing, and then
155.
by nneonneo 1y ago
Yes, SVGs are XML-based and may be vulnerable to generic XML-based XML external entity (XXE) or exponential entity expansion attacks, but this particular malicious SVG is using SVG-specific features to create the resource exhaustion.
156.
by nneonneo 1y ago
It's recursive, but not XXE. It is 20 layers of nested SVG groups, where the first group contains 10 blue circles, and every subsequent group contains 10 of the previous group. This would render as around 10^20 blue circles.
157.
by nneonneo 1y ago
sqlmap not only figures out how to dump the DB, they even provide a handy "shell" mode that parses SQL, converts it into an injection payload, and executes it on the server. It feels just like having a mysql or sqlite etc. shell.
158.
by nneonneo 1y ago
dupe: https://news.ycombinator.com/item?id=44320285
159.
by nneonneo 1y ago
Cool! I used a similar trick in my 2048 AI: https://github.com/nneonneo/2048-ai . In my case I allow the tiles to go all the way up to 32768, so I just have one tile per nybble. Using this representation is great: it le
160.
by nneonneo 1y ago
DHT works as long as the client is configured to use it, so if that old seed upgraded their client they might end up automatically sharing the metadata over DHT.
161.
by nneonneo 1y ago
Now I'm wondering: with the wide range of bittorrent clients out there, and the fact that many are written in unsafe languages, could it be possible for some of them to be exploited through a malicious tracker? It would not surprise me
162.
by nneonneo 1y ago
US ton is 2000 lb, not 2200. I spent some time in the US and had never heard of a ton meaning 2200 lb. Unfortunately, that's a 10% error off of a metric ton.
163.
by nneonneo 1y ago
Maybe that works for you, but in the case of the article, the random shocks were bad enough to make him literally choose death over the shocks…
164.
by nneonneo 1y ago
If the defibrillator has any kind of warmup period before it fires, I wonder if that interval could be used to send a signal to the patient, e.g. to their phone. The most “usable” form of this would be to allow the patient to agree or disag
165.
by nneonneo 1y ago
You need (1) a valid license file and (2) a list of all the checks that are made and (3) some way to override the output of each check. Furthermore, you want to ideally do this in a way that makes your cracked software actually deployable o
166.
by nneonneo 1y ago
Mathematically, the odds of getting exactly N heads after flipping a fair coin 2N times is surprisingly high - it asymptotically approaches 1/sqrt(pi * N) as N becomes large. For the problem in IJ, this comes out to 1/(3.14 * 5
167.
by nneonneo 1y ago
The clever thing here is that Denuvo is only used to protect certain functions, not the entire game. The functions it protects should be functions that run infrequently, but contain enough critical game logic that they can’t just be replace
168.
by nneonneo 1y ago
The “stolen” constants/instructions are bits of code that were in the original (VM-obfuscated) binary. These constants/instructions are deleted from the binary and provided by the server in an obfuscated form. Effectively, the bin
169.
by nneonneo 1y ago
We use honor pledges not to reduce cheating directly - but rather, to create incontrovertible evidence that the student was aware of the course policies. This supports those rare cases where a student chooses to fight a plagiarism case and
170.
by nneonneo 1y ago
It’s useful for simple breakpoint automation and conditional breakpoints, as well as basically adding virtual print statements to programs (the printf command in GDB is very powerful). I also used it to find a complex bug that someone po
171.
by nneonneo 1y ago
Eh, using GDB directly is a lot more convenient for me. Integrations with pwntools, good scripting support, and familiarity are big reasons I keep using GDB. Plus the last few times I’ve tried to use Ghidra’s debugger I ran into weird issue
172.
by nneonneo 1y ago
Ghidra to DWARF was already possible via this plugin: https://github.com/cesena/ghidra2dwarf . I’ve used this a lot (and contributed some patches) as it’s immensely useful in reverse engineering code. It gives me sourc
173.
by nneonneo 1y ago
Yes, although some people do slip through the cracks anyway: https://en.wikipedia.org/wiki/Christopher_Duntsch . He wasn't an LLM user, but was a cocaine user...
174.
by nneonneo 1y ago
EV sales are up, Tesla sales are down, and around the world people are protesting against Tesla because of Elon specifically. If this was simply a demand problem because Teslas were being compared against “incumbents” (ICE cars?), what expl
175.
by nneonneo 1y ago
> The model is trained on the textual contents of the notification, like the title, body, and action button texts. So...if someone wants to be naughty, they just have to tune their notifications until it passes the filter? An AI/ML
176.
by nneonneo 1y ago
That exists via sysconf(_SC_PAGESIZE). The problem is that hard coding the page size to 4k has worked just fine for much of the software written in the last few decades, which means that the 4k size has ossified to some extent (Hyrum’s La
177.
by nneonneo 1y ago
Oh, I'm fully aware an LLM can hallucinate a GDB trace just fine. My complaint is: if you're trying to use an AI to help you find bugs, you'd sincerely hope that they would have *some* attempt to actually run the exploit. Hav
178.
by nneonneo 1y ago
Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop b
179.
by nneonneo 1y ago
I mean, you are literally reading the first chapter of the tutorial for beginners (“Beginner's Guide to Elvish is for you if you haven’t used shells a lot or want to brush up on the basics”). They have a separate set of docs for people
180.
by nneonneo 1y ago
If it’s just electron, any reason it can’t be “native” Linux/macOS?

More ›