tyingq

61 ms·

751.
by tyingq 3y ago
I imagine "go to market".
752.
by tyingq 3y ago
Yes, but exposed to everyone. This proposal settles on headers that get passed back and forth that surely some servers would adopt. Headers that established "previously downloaded thing" with a hash. It feels like the process co
753.
by tyingq 3y ago
Interesting two comment snippet from HN in 2018 about this: https://news.ycombinator.com/item?id=18720554
754.
by tyingq 3y ago
There's lots of common sense missing in how CVEs are used at ground level in a company also. Like, say, I use node.js in my project solely in the build/deploy process, and not at all in the deployed code. Something like using the
755.
by tyingq 3y ago
Makes me wonder if rsync-style differential download would be more generally useful than "shared dictionary for shared brotli". The implementation is letting you reference a previously downloaded artifact using a hash value, whi
756.
by tyingq 3y ago
>AWS Lightsail Read the burst/throttling page carefully before you choose this product. https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amaz...
757.
by tyingq 3y ago
How is what I said "FUD"? I know what it stands for. I don't see where I went with any of those three themes. Akamai has certainly done well over their lifetime, but their revenue for the last 5 years is very flat. That&#x2
758.
by tyingq 3y ago
I believe the idea is that the big customers are interested because everyone is raving about it. If you price out the smaller customers, there's nobody to rave about it. Consider, for example, that Akamai's revenues are sitting i
759.
by tyingq 3y ago
Sure. Just saying there are some setups that either don't work, or don't work completely. Steering wheel controls is a good example. You can go to the product site for one of those expensive integration units, and their "pro
760.
by tyingq 3y ago
It's tricky for some cars. Things like non-standard sizes for the opening. Important functionality baked into the head unit (Volvo, for example, has paths to configure some safety options, trip/mpg display, etc). Integration fo
761.
by tyingq 3y ago
Excellent! Looking forward to your pure bash TLS implementation next :)
762.
by tyingq 3y ago
I imagine some companies do it right. I know some don't. Maybe Canada has better laws around it than the US? Or more context...like you could probably do some amount of matching registered make/model to a plate/picture with
763.
by tyingq 3y ago
Another comment mentions it, but it is PalmOS 5, which already ran on ARM devices. Some of them 400MHz+ ARM chips like various Intel XScale models: https://en.wikipedia.org/wiki/Palm_Tungsten So I imagine it was alrea
764.
by tyingq 3y ago
I don't think so. Poking around the source code, the only thing exposed in the cli client around listen() and accept() is related to FTP, because of the way FTP works. It does mean, though, that libcurl has functions like Curl_conn_t
765.
by tyingq 3y ago
That matches my experience. It's a sort of shortcut to the old process of googling for examples and sifting through the results. And those results, I didn't typically cut and paste from them, or if I did, it was mostly as a sort
766.
by tyingq 3y ago
Do you mean "they choose one for you" happens to be true? Does depending on that, or hoping what they choose is okay make her not dumb and not attention-seeking?
767.
by tyingq 3y ago
No idea, not my script. Socat does support this kind of syntax, which would seem better suited in this case. socat -v -v TCP-LISTEN:8080,reuseaddr,fork SYSTEM:/some/script It also has a settable max-children so you can put
768.
by tyingq 3y ago
It's a one-shot awk script. Handle one request and exit.
769.
by tyingq 3y ago
$2.99/month shared hosting plan. https://www.inmotionhosting.com/home-b It does allow for 2 websites, so perhaps this one is riding free on something else the owner does.
770.
by tyingq 3y ago
“We chose methamphetamine thinking there’s no way that anyone will see that word and think it’s OK,” "Drysdale said she was under the impression that if a name was rejected by the registry, they choose one for you." Surely th
771.
by tyingq 3y ago
They do show that: https://www.flyzipline.com/technology (scroll down, it first shows the thing that it drops, rather than the drone itself.) Lots of CGI and notices about "simulated" though. The videos that appe
772.
by tyingq 3y ago
This happens today with various state-hired contract firms that do ANPR reading of plates to automatically bill people for toll roads. They give zero shits about how accurate their readers are. So, someone with a plate of "3EE 432&qu
773.
by tyingq 3y ago
Finding a way to get a presence in the major airports would probably make it reasonable. Partnership with someone already there, like a currency exchange booth? Then, at some point, maybe there's enough volume to gain leverage with the
774.
by tyingq 3y ago
Sort of. Gawk supports magic file names like "/inet/tcp/8080/0/0" to be a tcp client or server, but you don't get control of accept()...it's all mooshed together. So you can make a slow, single
775.
by tyingq 3y ago
Ah, I had posted a golfed silly gawk webserver here some time ago. It uses gawk's built in tcp. https://news.ycombinator.com/item?id=22085459 Pretty printed: https://gist.github.com/tyingq/4e568425
776.
by tyingq 3y ago
I guess, though they work on an SAST scanner that identifies problems pretty similar to this one, untrusted input, "confused deputy", etc.
777.
by tyingq 3y ago
> some crazy PDF reader exploit One of those: https://6point6.co.uk/insights/abusing-pdf-files/
778.
by tyingq 3y ago
"In some cases" seems reasonable to me. Google poured a lot of money into V8 performance for 15 years. There's also situations like AWS's Lambda environment where more time was spent getting node/JS optimized for
779.
by tyingq 3y ago
Their product includes a static code analysis tool you can run in ci/cd pipelines, triggered by the existence of some files in your repo. It's the entry point for this exploit. Something the attacker abuses to get rights they sho
780.
by tyingq 3y ago
No, it works cross project, with no specific need for the victim to do anything dumb. And the attacker needs no rights to the victim target repo. You end up with an active CI_JOB_TOKEN that impersonates the victim. It's pretty bad.

More ›