oefrha

24 ms·

451.
by oefrha 2y ago
No, I’m arguing with someone who thinks I’m saying arbitrary arrests are not new (in fact I believe those aren’t new either, but I’m not arguing that and can’t be bothered to dig up sources), when I’m saying not being able to attend confere
452.
by oefrha 2y ago
Once again, when I say “not new” I’m talking about > The fact is if you care about people from all around the world being able to attend your conference, the U.S. hasn’t been a good location for a long time. TFA says > As an Internet
453.
by oefrha 2y ago
People are randomly arrested and detained base on official government policy. And they have been arresting and detaining people long before Jan 2024, but it was scaled up recently. A recent story made it clear that some people with minor vi
454.
by oefrha 2y ago
Reminds me of [1] from 2013, and [2][3] from 2017. This is not new at all, just affecting more people, and more importantly, more Western people now. [1] https://www.theguardian.com/science/2013/oct/05/us
455.
by oefrha 2y ago
If you think FreeType is bad, wait until you find out win32k.sys used to parse TrueType fonts directly in the kernel. https://msrc.microsoft.com/blog/2009/11/font-directory-entry... (that’s just one of a mill
456.
by oefrha 2y ago
> Why do people want to live in the US and jump through all these hoops and be subject to arbitrary detentions, anyway? Lots of people, especially those from third world countries, don’t know what they are getting into. They’ve been brai
457.
by oefrha 2y ago
https://github.com/elazarl/goproxy is pretty nice Go library for writing proxies, I used it once. Supports both HTTPS passthrough and MITM. Here's a trivial example MITMing connections to www.google.com and reject
458.
by oefrha 2y ago
Sure, the blog post didn't mention PQexec would reject it, so I assumed it would be accepted. Turns out it's a narrowly dodged bullet, I'm wrong on that. But having to chain two vulnerabilities together to own the system does
459.
by oefrha 2y ago
> If BeyondTrust had just used it as part of a postgres query string, the escape function would have been sufficient. That's completely false. The following (pseudo code because working with C strings is verbose and beside the point
460.
by oefrha 2y ago
Gitolite is a bare bones git server. Gitea is a forge. They’re not remotely in the same class of software. Gitolite doesn’t even have a web view for the repos, you need a separate package like cgit for that; never mind project management fe
461.
by oefrha 2y ago
The more you work in software the more you should realize the developers writing security-critical software (in this case the one writing that sanitizer) are often/usually as clueless as you are. The solution? Hard to say.
462.
by oefrha 2y ago
People say WHOIS is useless these days due to WHOIS privacy, but it's useful for at least one thing: checking when a domain was registered/transferred. Fishy stuff tend to be registered/transferred recently. Also older and la
463.
by oefrha 2y ago
I was thinking you can strip out the retarded signature protocol in SAML (replace that with libsodium) and leave the actual payload intact, or even switch from XML to a simpler wire format like JSON for the payload. But maybe even the paylo
464.
by oefrha 2y ago
I’m aware of the reputation of XML signatures, but it’s the first time I read about technical details, and they make my head spin. Q: Is there any non-legacy reason to use SAML instead of libsodium’s public key authenticated encryption (cry
465.
by oefrha 2y ago
As long as you subscribe to security advisories, it’s a lot more likely that new vulnerabilities are introduced than old undiscovered vulnerabilities are accidentally patched. In fact barring rewrites (which usually won’t be picked up by se
466.
by oefrha 2y ago
> https://github.com/tj-actions/changed-files/pull/2460 This kind of auto dependency bump bots are more trouble than their worth. If your app works today, bumping random deps won’t make it work better in a
467.
by oefrha 2y ago
Often times I hear a fairly important piece of negative news about <group>, then look up which MSMs have reported it. Chances are I can find it on CNN, but it’s completely missing from NYT, or only one tangential sentence/paragra
468.
by oefrha 2y ago
I suspect AI does technically write 80% of code I currently generate (mostly writing Go probably inflates that number quite a bit). On a lot of lines I type a couple characters and the AI can complete that line, often times a few lines. But
469.
by oefrha 2y ago
> These things have been reported hundreds / thousands of time Yet they’re still largely unknown. So the thought that reporting Internet interruptions in Africa => people all over planet earth will be talking about that in real l
470.
by oefrha 2y ago
Did you hear about hundreds of thousands of people dying in South Sudan’s civil war since 2013? Did you hear about the return of open-air slave markets in Libya since NATO intervention in 2011? Did you hear about dozens of other hideous thi
471.
by oefrha 2y ago
Previously discussed: https://news.ycombinator.com/item?id=43157000
472.
by oefrha 2y ago
Usually (but not always) the complaint with such scams is the work is being “done” at such low quality that it doesn’t match what’s demonstrated in the interview process; if it’s done at all, that is.
473.
by oefrha 2y ago
> Return of in-person final rounds? This looks an obvious consequence of these incidents. Well, even before AI we had qualified people being paid to go to interviews for scammers. Or qualified candidates outsourcing their jobs after bein
474.
by oefrha 2y ago
Yep I asked about this exact problem the other day: https://news.ycombinator.com/item?id=43308153 Having something like “always read the current version of the file before suggesting edits” in Cursor rules doesn’t help, the
475.
by oefrha 2y ago
Search for top Show HN threads within a month and click on each one: https://hn.algolia.com/?dateRange=pastMonth&page=0&prefix=tr... Most of them are overall positive, a few are overwhelmingly positive (it's tr
476.
by oefrha 2y ago
Do I have to point to 1000 failed Show/Launch HNs with negativity? This kind of cliched meta commentary whenever a Show/Launch is criticized on HN is getting really old.
477.
by oefrha 2y ago
One problem I run into somewhat frequently with Cursor in agent mode: instead of trying to augment the current version of code, it will try to work on top of what it generated last, overriding my manual edits since then in the process. I ha
478.
by oefrha 2y ago
Back when I was at Stanford a decade ago, I spotted him biking to/from Green Library quite a few times. You can probably run into him with some regularity if you make a habit of going to said library, assuming his routine hasn’t change
479.
by oefrha 2y ago
Visas can be revoked at any time for any reason. USCIS can revoke your visa because the supreme leader doesn't like your haircut and that's probably good enough for SCOTUS. > In the Court’s opinion, they noted Section 1155 as a
480.
by oefrha 2y ago
The article isn’t specifically about the USA (the word “American” appeared once in “American English” when explaining the name Pi-hole). The CharlesW comment doesn’t mention the USA. The nik282000 comment says NextDNS is a U.S. company so U

More ›