Goofy_Coyote

Interesting question.

Maybe we can break out of it by giving who ever is taking accountability if that thing goes wrong a tie breaker vote, or have their votes weigh a bit more?

I see, thanks for helping me understand the issue (and also the solution)

That must’ve been a terrifying minute.

Glad you’re feeling better and got your vision back.

Sorry this happened to you.

This is definitely a horrible experience to have.

You said “between shoulder blades”, was that where they inserted the needle? Mine was way down the spine (near the end)

Thank you.

As Seneca said, I suffered more in imagination than reality in this case.

Had one of these a few weeks ago.

Just putting it here in case anyone has to do it (I hope no one ever needs it): it is NOT painful at all.

I was told “it’s like a grenade explodes in your spine” by a (stupid) friend, it caused me to refuse to do it for the first time, which if I went through with it, things would’ve been very different for me, I would’ve been diagnosed days faster.

Again, it’s NOT painful at all, they use Lidocaine, you’ll feel way less than when they draw blood from your arm.

If it’s needed, don’t hesitate.

Question: If I do a search for say crypto on your blog, how does Google gets to index the resulting page?

I’m imagining something like “blog.example/?s=crypto” which only I should see, not Google.

Edit: Where they linking to your website from their own? (In that case the link with the bad search keywords can be crawled)

My two problems with access through libraries is lack of app access, and that every time I login, all my progress is gone (not reset to cover - gone gone), and I have to find the resource again, open it and go to the page/time I was at. Also can’t create my own playlist or favorites.

At least my library acts like that.

Bought and started playing it, I love it.

One feedback I have is that the instant I get the combination correct and complete a challenge, it suddenly pops up a “congratulations” message with a button to go to the next level, I can’t see my final solution.

I really want to take a few seconds to see my final solution, study, understand and admire it.

And that’s why email compromises are so dangerous- aside from all different accesses tied to emails, there’s also a wealth of information inside the inbox.

I don’t think they’re scared, I think they know it’s a lose-tie game.

If you’re correct, there’s not much reward aside from the “I told you so” bragging rights, if you’re wrong though - boy oh boy, you’ll be deemed unworthy.

You only need to get one extreme prediction right (stock market collapse, AI taking over, etc ), then you’ll be seen as “the guru”, the expert, the one who saw it coming. You’ll be rewarded by being invited to boards, panels and government councils to share your wisdom, and be handsomely paid to explain, in hindsight, why it was obvious to you, and express how baffling it was that no one else could see what you saw.

On the other hand, if predict an extreme case and you get it wrong, there’s virtually 0 penalties, no one will hold that against you, and no one even remembers.

So yeah, fame and fortune is in taking many shots at predicting disasters, not the other way around.

Thank you, this helps a lot. Really appreciate your response.

Thanks for the tip, and also thanks for the explanation. I understand what’s going on here now. Much appreciated

Need some help understanding what’s going on here.

In

  function example(measurement) {
    console.log(calculation); // undefined - accessible! calculation leaked out
    console.log(i); // undefined - accessible! i leaked out
  <snip>

Why does the author say `calculation` and `i` are leaking? They’re not even defined at that point (they come later in the code), and we’re seeing “undefined” which, correct me if I’m wrong, is the JS way of saying “I have no idea what this thing is”. So where’s the leakage?

Because they either have side deals with the big names, or they want to set precedent for going after them.

Not trying to be a conspiracy theorist here, but my bet is on having a deal with the big players, we allow you to scrape us (or we give you a pipe you can consume out of), and you pay us in monetary or non-monetary terms; like how many business exchanges work

Great resources and sound advice. Thank you, will take a look at the beginner’s quest for sure. Also I definitely will follow the implementation advice. It just clicked. It’ll geerate a ton of aha moments for sure.

I’ve done Bandit years ago and many other wargames and ctfs (htb, defcon etc), and still doing ctfs every Friday, been working in the field for over a decade, and have 3 CVEs (cvss 7+, one 9) to my name. I think I’m missing something else entirely when it comes to Google CTF.

Maybe I need more theoretical knowledge (is that the right word here? By theoretical I mean more around pure cs and math) vs hands on real world (as in day to day) vulnerability research and exploitation.

Would love to hear some feedback to get better. There’s always more to learn in all directions.

Google CTFs are fascinating. Amazing questions, I always enjoy the write ups.

Unfortunately I’ve never been able to solve one, or even make meaningful progress.

Absolutely best response here.

Folks from multi-billion dollar companies with multimillion dollar packages should learn a few things from this response.

Can you elaborate on what is real crypto, vs what’s happening now with BTC or other decentralized stable coins, please?

I’m curious to know more.

Thanks

This will negatively affect individual/independent bug bounty participants, vulnerability researchers, pentesters, red teamers, and tool developers.

Not saying this is good or bad, simply adding my thoughts here.

Good point.

This made me laugh btw, imagining someone prompt injecting an AI in a drive through was both a funny and a grotesque picture of the future.

Same exact thoughts here. How the heck did this end up on the front page?!

Noob question, so feel free to correct me please, but wouldn’t having a simple anomaly detection prevented this?

Even an “if” statement, or heck, even running the order through an LLM with a prompt “does this look a normal order?” ?.

I’m sure I’m oversimplifying things here, but this specific case looks like it could be easily prevented vs “rethinking” the whole AI initiative.

This made me so happy to see this, I had the same idea, built the same kind of product but never shipped. So happy to see this out in the world. Will sign up for a premium plan today!

I don’t have a direct answer, and never used either for my company, but personally I wouldn’t risk compliance, I’d stick with anything that 1. Is tried and tested, and 2. Takes something off my plate not adds to it so I can focus on what matters.

> HttpOnly Attribute: Prevents client-side JavaScript from accessing the cookie, neutralizing XSS attacks

Just a note that ‘HttpOnly’ doesn’t neutralize XSS.(although this is not the main point of this blog)

This is dangerously misleading. HttpOnly prevents cookie theft, but it absolutely doesn't "neutralize" XSS.

First, even with HttpOnly cookies, malicious JS can still make requests on behalf of the user - the browser happily attaches all cookies (including HttpOnly ones) to XHR/fetch requests. So an attacker can still

`fetch('/api/admin/add-user', {method: 'POST', body: JSON.stringify({email: 'attacker@evil.com', role: 'admin'})})`

or delete data, transfer funds, whatever the victim is authorized to do. They don't need to read the cookie, they just need the browser to send it.

This is why many apps ask for your password to change your email or reauthenticate you/trigger an MFA workflow when doing certain things.

Second, tons of XSS attacks don't even care about your cookies. They can rewrite the DOM with a fake login page and harvest credentials directly. They can keylog everything you type. They can steal data that's already on the page, redirect you to phishing sites, or mine crypto with your CPU.

HttpOnly is a good defense-in-depth measure, but calling it a neutralizer for XSS is like saying a seatbelt neutralizes car accidents. You still need proper input validation, (contextual) output encoding, CSP etc.

Oh wow.

I just noticed how powerful power brands are, in this case BurntSushi’s personal brand.

I’ve been a long time ripgrep user, the moment I saw BurntSushi in the url, I clicked with positive expectations, I don’t even need a datetime cli…

Anyway, thank you for your amazing contributions, persobally my life would’ve been harder without them.

Glad to see BoldVoice here.

I’ve been using it for a few months, and I can confirm it’s working.

Same here.

It’s like saying Wayback machine is exposing private data because it was captured when it was public.

What an absolute waste of an item on the HN front page.

I’m using github to sync 3 instances (iPhone, desktop and one web-based instance). It needs some upfront set up and configuration, and I had to buy a git client app for my iPhone (one time purchase), but it’s been working with near 0 maintenance for 3+ years now. I have versioning, and full auto sync (automatic commit, push and pulls).