varun_ch

8 ms·

91.
by varun_ch 6mo ago
I wonder if it would be best if this was at the browser level as some sort of new format. Otherwise surely it would be really slow/cumbersome to deal with these in ‘user space’
92.
The woes of sanitizing SVGs(muffin.ink)
271 points by varun_ch 6mo ago|109 comments
93.
by varun_ch 6mo ago
I think we’ll get more powerful models when they become reasonable to run on regular people’s computers, in which case the compute costs would hopefully fall enough that people don’t need to resort to this kind of weird stuff. As for cloud
94.
by varun_ch 6mo ago
This feels like a lot of work for low reward, the technical/business infrastructure would be wild. And if anyone wants to offload their prompts to users browsers, they might as well just use the Chrome API correctly? How many server si
95.
by varun_ch 6mo ago
I like the way the LLM implies that an API call should have a “type DELETE to confirm”. That would make no sense, and no human would ever suggest or want that, I hope.
96.
by varun_ch 6mo ago
I used Niri on a Framework laptop a few months ago, and it was Okay. I don’t think it clicked with me/I’m not sure if I was using it right, but it was giving me a headache to mentally deal with spatially mapping all of my windows (I ca
97.
by varun_ch 6mo ago
so they’d need to change their QR codes every time the menu changes?
98.
by varun_ch 6mo ago
This makes me wonder: Cellebrite makes tools for law enforcement to break into iPhones, likely exploiting weaknesses/vulnerabilities. Does Apple buy Cellebrite’s tools and reverse engineer them? Or would they not have a way of acquirin
99.
by varun_ch 6mo ago
I have a MacBook Air M2. I bought a framework 13 last year right before the RAM shortage. I really wanted to love it but ended up returning it due to really bad battery life performance (NixOS). Still on the MacBook today, but heavily consi
100.
by varun_ch 6mo ago
Context.ai seems like it was the SPOF. By definition it has a lot of your data, and they didn’t secure it properly.
101.
by varun_ch 6mo ago
I wonder how long/far someone can truly go without actually knowing stuff today. I don’t know about game dev but the web is certainly built on abstraction: In university I’ve met people whose portfolio sites are made in NextJS but don’
102.
by varun_ch 6mo ago
I think this would sit best at the browser level. I’m not sure there’s a nice way for multiple websites to share a cache like that.
103.
IETF draft-meow-mrrp-00(ietf.org)
39 points by varun_ch 6mo ago|17 comments
104.
by varun_ch 6mo ago
with hackernews I wouldn't be surprised if this still worked
105.
by varun_ch 6mo ago
This is an interesting story and the part about using LLMs to re-build the site today is cool, but the LinkedIn-esque AI writing is really disrespectful.
106.
by varun_ch 6mo ago
https://news.ycombinator.com/item?id=47614038
107.
by varun_ch 6mo ago
it's a GitHub Pages site in the @GitHub org from a repo called gh-stack (i.e. the repo is at https://github.com/github/gh-stack/ ). There’s a special case where certain official orgs can continue to use github
108.
by varun_ch 6mo ago
Oh wait I didn't even register that! yeah of course you can do anything in a terminal using curl if you're piping to bash!!!
109.
by varun_ch 6mo ago
One interesting side effect of having a LLM write the thing including the README, is that the models tend to leave little hints of the authors intention or prompt as over-explained passages that make it obvious that AI help was used. https
110.
by varun_ch 6mo ago
hosting user content on the main domain seems like a Bad Idea..
111.
by varun_ch 6mo ago
If someone was a bad actor, right now would be a pretty good time to start exploiting zero days in WireGuard…
112.
by varun_ch 6mo ago
That is not standard even today. The main threat is in transit over the network, which https/TLS solves, but obviously this won’t stop error traces or logging on the server from including request bodies. If you do hash locally (not sur
113.
My university uses prompt injection to catch cheaters(varun.ch)
112 points by varun_ch 6mo ago|63 comments
114.
by varun_ch 6mo ago
Microsoft is really bad with this. Login might be live.com or microsoftonline.com or maybe onmicrosoft.com. I went to report a vulnerability to their security portal this week and it redirected me to b2clogin.com. OneDrive email attachments
115.
by varun_ch 7mo ago
that said, mitming stuff even on Android can be a pain, so I use a rooted Android emulator with Frida. Even that can be a hassle sometimes. https://www.trickster.dev/post/setting-up-rooted-android-emu...
116.
by varun_ch 7mo ago
Yes, it is _a lot_ easier to set up mitmproxy on iOS vs Android. But once you encounter an app with certificate pinning, being on a more open platform that lets you install your own apps can help get around that.
117.
by varun_ch 7mo ago
I knew about this for Google’s own fonts but had no idea they offered the option to use custom fonts. Is there any easy place to find a list of them? I wonder if the custom fonts are just hardcoded/pushed to their CDN alongside all the
118.
by varun_ch 7mo ago
A fun trend on the "small web" is the use of 88x31 badges that link to friends websites or in webrings. I have a few on my website, and you can browse a ton of small web websites that way. https://varun.ch (at the bott
119.
by varun_ch 7mo ago
A little ironic that the README, SPEC.md and the poster's comment here all smell of LLM writing!
120.
by varun_ch 7mo ago
The only way my Logitech MX Master mouse is remotely usable on macOS is with both linearmouse and mos, and that was really disappointing to me, because online, the MX Master mouse is sold as the best Mac mouse. Unbelievable that anyone actu

More ›