esdf (u/esdf) - Readit News

esdf commented on Leaking Passwords and more on macOS wts.dev/posts/password-le... · Posted by u/nmgycombinator

saghm · 6 months ago

> But this was in the early 90's when everybody was a lot more innocent about security.

There are definitely more recent flaws that might have been suspectible to "cat butt on keyboard", like this one in 2016: https://www.bleepingcomputer.com/news/security/linux-flaw-al...

esdf · 6 months ago

And more!

https://bugzilla.gnome.org/show_bug.cgi?id=758032

https://github.com/linuxmint/cinnamon-screensaver/issues/354

esdf commented on Interview with gwern dwarkeshpatel.com/p/gwern... · Posted by u/synthmeat

michaelt · 10 months ago

I don't follow gwern's work closely.

But I do know he created an enormous dataset of anime images used to train machine learning and generative AI models [1]. Hosting large datasets is moderately expensive - and it's full of NSFW stuff, so he's probably not having his employer or his college host it. Easy for someone on a six-figure salary, difficult for a person on $12k/year.

Also, I thought these lesswrong folks were all about "effective altruism" and "earning to give" and that stuff.

[1] https://gwern.net/danbooru2021

esdf · 10 months ago

Hosting large datasets can be expensive but the hosting for the danbooru datasets was not. It's "only" a few terabytes in size. A previous release was 3.4TB, so the latest is probably some hundreds of GB, to a TB~, in size larger. The download was hosted on a hetzner IP, which is a provider known for cheap servers. You can pay them $50/m for a server with "unmetered" 1gigabit up/down network + 16TB of disks. $600 a year would not be difficult.

esdf commented on WordPress Plugin Mirror Downloader (Proof of Concept) github.com/centminmod/wor... · Posted by u/rob

vundercind · a year ago

Also, unless something's changed, the free tier only technically covers "web content". Going outside HTML and related material directly supporting the display of ordinary web pages (javascript referenced by your HTML, some light image serving, CSS) puts you outside what's covered by the TOS. You can't count on it for that at all.

IIRC that also goes for the other "self serve" plans, so includes paid plans. You need an enterprise plan (probably $5k+/m) to distribute non-Web-page-related files without violating the TOS. People often get away with it as long as they don't go too wild, but you're in even riskier territory than one already is using non-enterprise Cloudflare.

esdf · a year ago

Cloudflare does allow R2 (& some other "Developer Platform" services) for non-HTML content. They made some TOS changes in the past to be more explicit about it.

esdf commented on What to do when someone clones your site? · Posted by u/aiagents_dir

gargan · a year ago

Find out where the domain is registered with a whois command or goto who.is, then find their copyright/DMCA email and submit a complaint.

For example if it's Namecheap their details to complain are here - https://www.namecheap.com/support/knowledgebase/article.aspx...

GoDaddy here - https://supportcenter.godaddy.com/ipclaims/copyright/infring...

They should take it down pretty quickly if it's a direct copy!

esdf · a year ago

And DMCA takedowns to the webserver's hosting provider

esdf commented on Safe curves for Elliptic Curve Cryptography [pdf] eprint.iacr.org/2024/1265... · Posted by u/sebgan

api · a year ago

Infosec suffers from a huge cargo cult and mindless sticky meme problem because so few people actually understand it.

There are still admins who block all ICMP because of the “ping of death,” a Windows bug from either the late 1990s or 2000s. They don’t know this though. They just heard that ICMP is “dangerous.”

People also don’t use IPv6 because they think NAT is a security feature.

I guess it’s similar to baseless health fears and happens whenever people don’t really understand a domain. You get a proliferation of lore that is just repeated.

esdf · a year ago

Windows had an ICMP CVE last year and also just released a patch for an IPv6 CVE. OpenSSH on Linux had a CVE recently too. Security in depth is reasonable and not baseless.

esdf commented on How WASD became the standard PC control scheme (2016) pcgamer.com/how-wasd-beca... · Posted by u/ibobev

jameskilton · a year ago

Yet ESDF is objectively better because it frees up Q, A, Z, and W to easily be used for other keybinds. The number of people I've seen stretch their pinky down to Left-CTRL for crouch boggles my mind. With ESDF, crouch is A!

Yes, this is a very tiny hill on which to die on, but it's my hill!

esdf · a year ago

I've got to agree with you on this

esdf commented on C Isn't a Programming Language Anymore (2022) faultlore.com/blah/c-isnt... · Posted by u/olalonde

JackSlateur · a year ago

Bah

I read until the "FFI" section

Yes, you must use "C" if you use the libc (seems obvious)

However, you can issue your syscalls directly. Of course, to do that, you will have to rewrite your own libc .. nothing is free.

It shall be noted, however, that this is not possible in every environments: I believe that openbsd's code must use the system libc. At the same time, on windows, you must use the provided library. This does not mean the OS library is always C (but this means your new language must do FFI with whatever language is used by the system).

Maybe only Linux allows anybody to issue syscalls directly ?

esdf · a year ago

You can issue syscalls directly on Windows too but updates often change the syscall numbers so you never see them used legitimate software.

esdf commented on Understanding HTTP/3 – Features, Benefits and Impact hayageek.com/understandin... · Posted by u/thunderbong

Alifatisk · a year ago

I remember reading about the downside with HTTP/3, which was something about it making the web more centralized and reliant on the big tech. I just don't remember exactly what the user pointed out.

esdf · a year ago

Probably about the protocol being more complex with less implementations or the forced encryption which means acquiring certificates for TLS. Spoofed IPs for DDoS is a bit more troublesome for UDP protocols, though smaller players will get smacked down by any DDoS anyway. I hope to see more applications and games wrap their traffic in QUIC/HTTP3 to "defeat" firewall filtering.

esdf commented on What's the deal with the blue "robins" in gacha games? jgeekstudies.org/2024/07/... · Posted by u/zdw

harimau777 · a year ago

I wonder if there could be different cultural associations at play with the FGO robin. I associate Robin Hood with woodsiness and therefore with colors like browns and greens. So a bright blue bird looks out of place to me while a mostly brown robin would not. Perhaps there is something cultural that blue might seem like less of an odd choice to someone from Japanese culture?

esdf · a year ago

There is actually a blue/green language quirk in Japanese and they even have blue traffic lights because of this

esdf commented on You can help Anna's Archive by seeding torrents annas-archive.org/torrent... · Posted by u/FabHK

sillysaurusx · a year ago

As a PSA, one additional reason to seed is because Anna accidentally doxxed herself via GitHub. So it’s worth preserving the archive on the basis that we should expect {the centralized portion of} it to disappear within the next couple years.

I was sad to see that happen, but it’s important to be objective and plan future actions accordingly.

(And sure, there’s always the chance that some random person on GitHub just so happens to be named Anna and is an archival enthusiast, but a jury of one’s peers may find that it passes the reasonable doubt threshold.)

My legal troubles with books3 weighed on me pretty heavily, and I wasn’t even the target. Yet. I can only imagine what it feels like to be waiting for an indictment.

There ought to be some sort of protection for preserving books in bulk. No one is going to read two million books. But of course, one could also argue that having a readily available archive is harming the economic profitability of the works, on the basis that content licensing for AI is now a multimillion industry. It’s weird, because it feels like important work, rather than criminal — someone should put into words exactly what the distinction is.

esdf · a year ago

They did deny involvement so it'll be interesting to see what happens (you probably know this though) https://torrentfreak.com/key-defendant-in-annas-archive-laws...

>It’s weird, because it feels like important work, rather than criminal — someone should put into words exactly what the distinction is.

Important work can be criminal