Mogzol

I think you are underestimating how many apps get over 1M downloads. According to [1], the Google Play Store has over 34000 apps with 1M+ installs, I assume the number is similar for the App Store.

So if you have a popular free app, there is a good chance you will hit the 1M install threshold. This change is basically forcing you to monetize your app. Plenty of people can afford losing $99/year for having a free app that isn't monetized. Not many can afford losing several thousand per month.

[1] https://www.androidrank.org/categorystats?category=&price=al...

They meant t56 as in "temperature is 56", not as in every random phrase gets assigned a jumble of numbers and letters. Though I suppose error-correction could still apply.

You don't need three taps per letter, they had T9 [1], you only had to hit the key with the letter you wanted once, it predicted which letter you actually wanted, and worked surprisingly well. Once you got used to it you could type messages very quickly.

[1] https://en.wikipedia.org/wiki/T9_(predictive_text)

Page 9 & 10 of the paper [1] go into some detail:

> By constructing a search query that joins together 32 randomly generated identifiers using the OR operator, the efficiency of each search increases by a factor of 32. To further increase search efficiency, randomly generated identifiers can take advantage of case insensitivity in YouTube’s search engine. A search for either "DQW4W9WGXCQ” or “dqw4w9wgxcq” will return an extant video with the ID “dQw4w9WgXcQ”. In effect, YouTube will search for every upper- and lowercase permutation of the search query, returning all matches. Each alphabetical character in positions 1 to 10 increases search efficiency by a factor of 2. Video identifiers with only alphabetical characters in positions 1 to 10 (valid characters for position 11 do not benefit from case-insensitivity) will maximize search efficiency, increasing search efficiency by a factor of 1024. By constructing search queries with 32 randomly generated alphabetical identifiers, each search can effectively search 32,768 valid video identifiers.

They also mention some caveats to this method, namely, that it only includes publicly listed videos:

> As our method uses YouTube search, our random set only includes public videos. While an alternative brute force method, involving entering video IDs directly without the case sensitivity shortcut that requires the search engine, would include unlisted videos, too, it still would not include private videos. If our method did include unlisted videos, we would have omitted them for ethical reasons anyway to respect users’ privacy through obscurity (Selinger & Hartzog, 2018). In addition to this limitation, there are considerations inherent in our use of the case insensitivity shortcut, which trusts the YouTube search engine to provide all matching results, and which oversamples IDs with letters, rather than numbers or symbols, in their first ten characters. We do not believe these factors meaningfully affect the quality of our data, and as noted above a more direct “brute force” method - even for the purpose of generating a purely random sample to compare to our sample - would not be computationally realistic.

[1]: https://journalqd.org/article/view/4066

In this case it makes sense, the key is a "private key" in the cryptographic sense, but it's not "private" in regards to the pypush app, it's needed for the app to work, so it needs to be public information or else the app would be useless for anyone who didn't have that key.

Even if it could format 128 bit integers, I don't see how that would be any better than base64-encoding them. Base64 is already pretty close to the maximum efficiency you can get for shortening UUIDs while still using URL-safe characters.

I'm pretty sure the answer is #1. Gradual, per-account roll-outs of new "features" is very common on YouTube, and from the people I've talked to, the affected people seem to be fairly random.

This exploit isn't at all related to the Intel CVE, just a coincidence they came out around the same time. And an instruction set that strips everything but the necessary instructions sounds a lot like ARM or RISC-V. No need to re-invent the wheel.

I think it may seem like Torx has more sizes than say Phillips or flat-headed screws due to the fact that with those you can generally get away with a screw driver that is "close enough" in size, whereas with Torx you really need the exact size the screw is using.

You can cheat by entering the board state into a site like https://nextchessmove.com/

They're well supported on modern browsers, both mobile and desktop. If you need to support IE then you can use a polyfill. It's essentially just a long-running HTTP request. The main issue I've run into before is if your server has a response timeout configured then you'll need to disable or work around it, otherwise it will disrupt the event stream whenever the timeout is hit, since the event stream is just an HTTP response.

> NewsBlur is useful, destroying it serves no purpose at all. And make no mistake: the hacker clearly aimed to simply destroy it and pretend they have copied the data, so they were more than willing to do just that, wanton destruction for a miserly amount of money. Whoever did this may think they're l33t and cool but I personally think they are utter trash.

I doubt this was even specifically targeted at NewsBlur. Reading the article it sounds like it's just an automated attack that scans for any open mongo servers on the internet and does the same thing to any of them. Not that that's any better, really.

Yes, you can run standard desktop Firefox extensions on FF for Android. There was a whitelist of extensions Mozilla allowed you to install though, I'm not sure if that still exists on the most recent versions.

The title is a little click-baity, I think they're really just saying current browsers don't handle subtitles adequately and should be improved. As in, "if you can read this, your browser captions are broken, because all browser captions are broken".

There's also some browser-specific bugs mentioned in the article, but I don't think those are really what the title is about.

I work with Spotify links and the Spotify API regularly for work and have never seen a link to a playlist or track randomly 404 or not work. Spotify share links are really basic, they're just an ID and type of link, like "/track/{id}" or "/playlist/{id}".

Not saying you're wrong, I've just personally never had issues with them, and I work with lots of share links from a variety of artists.

That already exists

https://github.com/revanced

They did mention they tried that, and got similar results to the binary search they were already doing: https://death.andgravity.com/pwned#position-heuristic

> It's a game to some people. It's a challenge.

GeoWizard on youtube has a whole series where he tries to pinpoint the exact locations of pictures sent to him by fans. Pretty fun to watch:

https://youtube.com/playlist?list=PL_japiE6QKWqMVC3JbyONau_0...

I don't understand how a black hat, even with access to your account, could spy on your traffic? They're entirely different concepts. Just having access to the account doesn't mean you can see all data going through the network for people using that account.

And even if they could, any sensitive page should be using HTTPS, so the data will be encrypted. A VPN still wouldn't make a difference.

> Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN?

Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN?

Using or not using a VPN in the context of this bug is totally irrelevant.

Thanks for the replies, I guess a lot of it does boil down to "that's just the way things were".

Although, like I mentioned, all those features do work on Windows 98, which released over a year before Mac OS 9, so I think the parent's comment of "no wonder Windows kicked their ass so hard" does have a point. Windows 98 feels far more "modern" than this, at least in my opinion.

Also, in response to "Choose shut down, and turn it off with the switch when it told you it was safe to do so." That's what I was asking, where do I choose "shut down"? I expected it to be in the Apple menu but it wasn't there. After searching some more I eventually found it in the "Special" menu, still seems like a weird place for it.

I don't know if they were being serious, but as someone who never used a mac back then, I really struggled with this UI. Why do folders all open in a new window? Why can't I maximize a window by double-clicking the title bar? Why can I only resize windows with the little handle in the bottom corner? What is the point of the settings dock in the bottom left of the screen? Do I really need to change resolution and colors that often? Why do I have to browse the whole hard drive to find any of my applications? Why can't I right-click files/folders? What is the point of the bigger/smaller window button, why not maximize? Why does minimizing just collapse windows to their title bar? How do you even turn off the computer?

These are all features that work how I would expect on Windows 98. I'm sure if I had used a mac back then this would all make sense to me, but even as someone who uses modern macs, I was very lost in the old UI.

The fact that it needs a server at all seems unnecessary. It's all written in JavaScript, and isn't doing anything that couldn't be done in a browser, I see no reason why this can't be an entirely client-side application.

Completely agree. I could actually get a lot of use out of a tool like this, but the fact that even the VSCode extension sends the JSON to their servers and opens it at a publicly accessible URL makes this a no-go for me. I wouldn't recommend anyone use this for any remotely sensitive data.

I was convinced of that until I was forced to stop using a wired connection (moved to a room that didn't have ethernet). I'm on wifi now and notice literally no difference compared to when I was on ethernet. As long as you've got a decent router/AP, modern wifi is really not bad. I get a consistent 400-500 Mb/s up and down with no hiccups. On my wifi 6 devices I get closer to a Gb/s.

They're slow, but this part is also very small. 30 minutes is a pretty good estimate.

Yes, "full" internet access is a hard to define term and this simple test doesn't cover all possible cases. But it will work in probably 99.99% of cases and honestly I think that's good enough. If it doesn't work you end up with a little "no internet connection" icon in your taskbar and that's about it. You can still use the connection, so I don't think it's a big deal that this test isn't 100% accurate. It's still more useful to the majority of users to have a slightly inaccurate test than to have no test at all.

The whole point is to determine if you have full internet access, so you want to make sure that an HTTP request returns the data you're expecting. You may be able to get DNS responses but not have full internet access, like when on a public wifi that redirects all requests to a login page.

It appears to use JavaScript to set a data attribute on the <html> element, and then the CSS has selectors to match that data attribute and set some color variables. There's also a transition CSS property on the elements that change color to achieve the fade effect.

Pretty simple solution and looks great.

> why would they format Months, by "L" instead of by "M"

"M" is used for months in Luxon, and is usually what you should use. "L" is only for standalone months, i.e. not within a date string, usually not what you want. In English these are the same thing, but in some languages they are different.

https://github.com/moment/luxon/blob/master/docs/formatting....