Readit News logoReadit News
terom commented on Preliminary report into Air India crash released   bbc.co.uk/news/live/cx20p... · Posted by u/cjr
wkat4242 · 2 months ago
It's not an impossible maneuver. Glider pilots do this all the time especially if they don't have spoilers
terom · 2 months ago
Also with additional control difficulty due to reduced hydraulic pressure.

> On the Boeing 767, the control surfaces are so large that the pilots cannot move them with muscle power alone. Instead, hydraulic systems are used to multiply the forces applied by the pilots. Since the engines supply power for the hydraulic systems, in the case of a complete power outage, the aircraft was designed with a ram air turbine that swings out from a compartment located beneath the bottom of the 767,[10] and drives a hydraulic pump to supply power to hydraulic systems.

> As the aircraft slowed on approach to landing, the reduced power generated by the ram air turbine rendered the aircraft increasingly difficult to control.[16]

> The forward slip disrupted airflow past the ram air turbine, which decreased the hydraulic power available; the pilots were surprised to find the aircraft slow to respond when straightening after the forward slip.

terom commented on GCP Outage   status.cloud.google.com/... · Posted by u/thanhhaimai
rvnx · 3 months ago
Absolutely possible. Though there is something curious:

https://www.cloudflarestatus.com/

At Cloudflare it started with: "Investigating - Cloudflare engineering is investigating an issue causing Access authentication to fail.".

So this would somehow validate the theory of auth/quotas started failing right after Google, but what happened after ?! Pure snowballing ? That sounds a bit crazy.

terom · 3 months ago
From the Cloudflare incident:

> Cloudflare’s critical Workers KV service went offline due to an outage of a 3rd party service that is a key dependency. As a result, certain Cloudflare products that rely on KV service to store and disseminate information are unavailable [...]

Surprising, but not entirely unplausible for a GCP outage to spread to CF.

terom commented on DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage   micahflee.com/ddosecrets-... · Posted by u/micahflee
evrflx · 3 months ago
This feature must be explicitly enabled, it is not on by default nor by accident.
terom · 3 months ago
Based on [1] it seems like one `management.endpoints.web.exposure.include=*` is enough to expose everything including the heapdump endpoint on the public HTTP API without authentication. It's even there in the docs as an example.

Looks like there is a change [2] coming to the `management.endpoint.heapdump.access` default value that would make this harder to expose by accident.

Let's look for `env` next...

[1] https://docs.spring.io/spring-boot/reference/actuator/endpoi...

[2] https://github.com/spring-projects/spring-boot/pull/45624

terom commented on Curl: We still have not seen a valid security report done with AI help   linkedin.com/posts/daniel... · Posted by u/indigodaddy
terom · 4 months ago
The git commit hashes in the diff are interesting: 1a2b3c4..d4e5f6a

I think my wetware pattern-matching brain spots a pattern there.

terom · 4 months ago
Going a bit further, it seems like there's a grain of truth here, HTTP/2 has a stream priority dependency mechanism [1] and this report [2] from Imperva describes an actual Dependency Cycle DoS in the nghttp implementation.

Unfortunately that's where it seems to end... I'm not that familiar with QUIC and HTTP/2, but I think the closest it gets is that the GitHub repo exists and has a `class QuicConnection` [3]. Beyond that, the QUIC protocol layer doesn't have any concept of exchanging stream priorities [4] and HTTP/2 priorities are something the client sends, not the server? The PoC also mentions HTTP/3 and PRIORITY_UPDATE frames, but those are from the newer RFC 9218 [5] and lack the stream dependencies used in HTTP/2 PRIORITY frames.

I should learn more about HTTP/3!

[1] https://blog.cloudflare.com/adopting-a-new-approach-to-http-...

[2] https://www.imperva.com/docs/imperva_hii_http2.pdf

[3] https://github.com/aiortc/aioquic/blob/218f940467cf25d364890...

[4] https://datatracker.ietf.org/doc/html/rfc9000#name-stream-pr...

[5] https://www.rfc-editor.org/rfc/rfc9218.html#name-the-priorit...

terom commented on Curl: We still have not seen a valid security report done with AI help   linkedin.com/posts/daniel... · Posted by u/indigodaddy
nneonneo · 4 months ago
Good god did they hallucinate the segmentation fault and the resulting GDB trace too? Given that the diffs don’t even apply and the functions don’t even exist, I guess the answer is yes - in which case, this is truly a new low for AI slop bug reports.
terom · 4 months ago
The git commit hashes in the diff are interesting: 1a2b3c4..d4e5f6a

I think my wetware pattern-matching brain spots a pattern there.

terom commented on Widespread power outage in Spain and Portugal   bbc.com/news/live/c9wpq8x... · Posted by u/lleims
tux3 · 4 months ago
You can see the crash on the ENTSO-E live data: https://transparency.entsoe.eu/generation/r2/actualGeneratio...

Three quarter of the production disconnects from the grid between 12:30 and 13:00, with only a bit of solar and onshore wind sticking around.

terom · 4 months ago
Portugal has an even bigger relative drop in load, from 5852MW at 11:00 hours -> 613MW at 13:00 hours - these seem like 1 hour averages.

[1] https://transparency.entsoe.eu/load-domain/r2/totalLoadR2/sh...

terom commented on Widespread power outage in Spain and Portugal   bbc.com/news/live/c9wpq8x... · Posted by u/lleims
brohee · 4 months ago
Edit : I was misreading the confusing Rte site... Entsoe actually a lot more readable. France went from importing to exporting around the incident.

https://www.rte-france.com/eco2mix/les-echanges-commerciaux-...

https://transparency.entsoe.eu/transmission-domain/physicalF...

terom · 4 months ago
That graph doesn't seem to make a very clear distinction between historical, real-time and predicted values... I think the event happened at 12:30 local time or so.

There seems to be some kind of recurrent daily pattern where the French - Spanish interconnect switches from Spain -> France imports to France -> Spain exports at around that time, and then back again in the late afternoon.

terom commented on Widespread power outage in Spain and Portugal   bbc.com/news/live/c9wpq8x... · Posted by u/lleims
terom · 4 months ago
It looks like the Iberian peninsula is relatively isolated from the rest of the CESA synchronous grid, with only 2% cross-border capacity compared to local generation. [1]

There's a map at [2]

> The Spanish electricity system is currently connected to the systems of France, Portugal, Andorra and Morocco. The exchange capacity of this interconnection is around 3 GW, which represents a low level of interconnection for the peninsula. The international interconnection level is calculated by comparing the electricity exchange capacity with other countries with the generation capacity or installed power.

[1] https://www.ree.es/en/ecological-transition/electricity-inte...

[2] https://www.entsoe.eu/data/map/

terom commented on Malware found on NPM infecting local package with reverse shell   reversinglabs.com/blog/ma... · Posted by u/gnabgib
tbrownaw · 5 months ago
> Taken to the extreme you end up with something like "network connected physical machines aren't a security boundary" which is just silly.

1. This is why some places with secret enough info keep things airgapped.

2. OTOH, from what I recall hearing the machines successfully targeted by Stuxnet were airgapped.

terom · 5 months ago
Yeah, you have to move it off-planet to achieve an actual security boundary.

In our threat model the upper bound on the useful lifetime of the system is limited by the light-distance time from the nearest adversary.

u/terom

KarmaCake day1677February 4, 2016
About
www.qmsk.net
View Original