Daviey

Technically Amiga Workbench was always superior to Windows 3, I think Microsoft won the PC because it was not tied to the hardware and variety of software.

But now it's a sunk cost, might as well keep it going, right?

AOSP is coming to an end...

https://old.reddit.com/r/StallmanWasRight/comments/1l8rhon/a...

https://news.ycombinator.com/item?id=44254540

I can only talk about the law in England & Wales, but:

For code generated by an LLM the human user would likely be considered the author if you provided sufficient creative input, direction, or modification.

The level of human involvement matters, simply prompting "write me a function" might not be enough, but providing detailed specifications, reviewing, and modifying the output would strengthen the claim.

the Copyright, Designs and Patents Act 1988 (CDPA), Section 9(3) staes, "In the case of a literary, dramatic, musical or artistic work which is computer-generated, the author shall be taken to be the person by whom the arrangements necessary for the creation of the work are undertaken". This was written before LLM's existed, but recent academic literature has supported this position, https://academic.oup.com/jiplp/article/19/1/43/7485196?login...

However, a comparable situation was tested with Thaler v Comptroller-General, where courts emphasised that legal rights require meaningful human involvement, not just ownership of the AI system. - https://www.culawreview.org/journal/unlocking-the-canvas-a-l... and https://www.whitecase.com/insight-our-thinking/uk-supreme-co...

I do acknowledge there is uncertainty, and this is highlighted here in "The Curious Case of Computer-Generated Works under the Copyright, Designs and Patents Act 1988.", with "section 9(3): the section is either unnecessary or unjustifiably extends legal protection to a class of works which belong in the public domain" - https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4072004

Today, I think it's doubtful that a functional application can be entirely vibe coded without decent direction and modification, but I don't think that will always be the case.

It's a angle I hadn't considered, but I'm aware that I likely do this so the impact of the paper is that I be more dilligent. Thank you for sharing.

This is nice, but what I'd really like is native integration with tools such as WhatsApp. Sadly, being closed source we can't help with this.

Perhaps I misunderstood, but I read it that the account they got access to was a highly privileged account, which did have general access to all data.

The report didn't make it clear to me if an unauthorised user, or an account with low privilege can still access data they otherwise should not have access to.

If this is true, then I agree it is an IDOR, but I read it as they had access because of their current context.

Perhaps I'm being overly cynical, but I'm struggling to see how this qualifies as an IDOR in the strict sense. While using UUIDs might reduce guessability, the real issue here is weak authentication, not insecure direct object references.

OWASP defines an IDOR as "an access control vulnerability that occurs when an application uses user-supplied input to access objects directly… without verifying the user is authorized for the target object" (OWASP Top 10 2021 – A01: Broken Access Control). But in this case, access to highly privileged internal functionality was granted simply by logging in with default credentials, no authorization bypass was needed because authentication was effectively absent.

This aligns more closely with CWE-1390: "Use of Default Credentials" and CWE-306: "Missing Authentication for Critical Function." The attacker was able to log in as a privileged user due to trivial credentials, and the lack of multi-factor authentication (MFA) further compounded the issue. Had MFA been implemented, or default credentials disabled, the ID enumeration would have been irrelevant. That makes it clear the real vulnerability lies in the authentication mechanism and not in how object references were structured.

[flagged]

> I wouldn’t replace much of that with an Intel NUC style computer

Can you explain why?

This is nothing new, it has been baked into their business model forever. It's quite genius really (in a sinister way), have 30|60|90 day payment terms with suppliers and reap interest on a significant sum of money over that term.

I have a "free" subscription to the FT, and it's worth every penny. I would be tempted to pay for it if I didn't get it free, because it's my go-to news source as it is generally neutral on politics, therefore providing more accurate coverage.

Similar to the effects of the internet. Before the internet, people used to have to research subject matter in the library, or (shock) ask someone knowledgeable, and likely trust their view.

I remember around ~2000 reading a paper that said the effects of the internet made people impatient and unwilling to accept delays in answering their questions, and a poorer retention of knowledge (as they could just re-research it quickly).

Before daily use of computers, my spelling and maths were likely better, now I have an overdependence on tools.

With LLM's, i'll likely become over-dependant on managing of sentence syntax and subject completion.

The cycle continues...

The commentents suggest Tailscale, but the author assumes this could only mean Funnel, but you could use Tailscale/Headscale for handling the wiregiard and low-level networking / IP Allocation.

Then doing straight-forward iptables or L7, or reverse proxy via Caddy, Nginx, etc, directly to the routable IP address.

The outcome is the ~same, bonus is not having to handle the lower level component, negative is an extra "thing" to manage.

But this is how I do the same thing, and i'm quite happy with the result. I can also trivially add additional devices, and even use it for egress, giving me a good pool of exit-IP addresses.

(Note, I was going to add this as a comment on the blog, but it seems their captcha service is broken would not display - so it was blocked)

A tobacco company offered me quite lucrative work, but I didn't want to support it. And I was a smoker at the time.

It largely depends if it is bought by a public service under a license that allows public release, surely?

Yes, I found one in a car park many years ago. Disposed of the balloon, but gave the radar reflector to the local school geography department.

It would be a project, but the HeeWing's T2 Cruza VTOL is extremely interesting as you could put in both a high capacity battery and a good quality camera.

That's the point, a legitimate tracker, such as personal tracker or fleet tracker for company owned vehicles.

I saw a YouTube video where someone did the same with some legislation, but the interpretation was entirely wrong... but they printed it out and tried to use it to defend their position. It was cringe.

Interesting research, but the paper does not address the contribution to the arms race of good vs bad. The criminals will likely use this technique to find legitimate car trackers before stealing the vehicle.

Loved to death I assume. :(

  $ curl parrot.live                                                                                                                                                             

  <html>
  <head><title>504 Gateway Time-out</title></head>
  <body bgcolor="white">
  <center><h1>504 Gateway Time-out</h1></center>
  <hr><center>nginx/1.14.0 (Ubuntu)</center>
  </body>
  </html>

Well done for solving it.. but I'd have preferred you had not shared the solution, it's against the spirit of these sorts of things, but I can't stop you. :)

EDIT: I do appreciate you removing the solution. Have a great day.

Patch has now been merged, seems the Full Disclosure process works, https://github.com/psf/requests/pull/6965

That's really strange... because it seems to be working for some people (already have the first solve). I can't see an issues in CF...

EDIT: I had the security in CF too robust, try now?

Well, it's probably just a coincidence, but I literally just spun up a web service that is vulnerable to this: https://isitup.daviey.com/

The code doesn't make any reference to a .netrc, but I happen to have one in ~/.netrc:

  machine localhost
  login *REDACTED*
  password CTF{*REDACTED*}

It's not ideal that requests automatically slurps credentials from ~/.netrc and leaks them, even when my code never references it. It's possible that the netrc is on the same server from a different application, developer debugging environment, or just forgotten about etc.

First one to grab the flag wins, well, nothing. But have fun. I'll keep it online for a couple of weeks, or until the VC money runs out.

> It was explained in the manual, if you didn't warez the game. :-)

No Comment. :`(

I'm curious, why Ruby?

For background, the original leader of OpenStack Nova said many years ago that whilst Python enabled them to make fast progress, he regretted not doing it in Java (!!) due to the performance issues they were hitting with Python.... and that concurrency in Python is a second-class citizen compared to other languages.

If I was doing this today, i'd likely have chosen Golang (or perhaps Rust).. so why the choice of Ruby?

This brought back so many memories. I loved this game on the Amiga in the early 1990's. Trying to work decipher the intent of the game, without the ability to research it on the internet was really challenging. The graphics were "good enough" to inspire imagination about the characters. I loved it.

But.... i never worked out the intent of the sun height measurer. :/

Got this error for a Uk->UK station search:

  Uh oh!

  We couldn’t find what you were looking for. Try searching with some different criteria.

  Error message: e is not iterable