HNHacker News
TopNewBestAskShowJobs

david_shaw

3,407 karma · joined September 25, 2010

I do security.

contact:

  dshaw
    (at)
  dshaw.net
submissionscomments
david_shaw··on An interactive map of Flock Cams
It would be an interesting and potentially useful project to combine these camera locations with Maps routing -- similar to "avoid toll roads," we could "avoid surveillance cameras."
david_shaw··on Zed will require age identification for its services
It's wild that all other comments in this thread (so far) seem to completely miss this nuance. There are lots of services that, in their terms, require users to be adults.

This type of age "identification" is a lot different than age verification, submission of ID, etc.

david_shaw··on We Will Not Be Divided
I'd prefer to see board (or executive) level signatories over lay employees -- the people who can enforce enterprise policy rather than just voice their opinions -- but this is encouraging to see nonetheless.

I can't help but notice that Grok/X is not part of this initiative, though. I realize that frontier models are really coming from Anthropic, OpenAI, and Google, but it feels like someone is going to give in to these demands.

It's incredible how quickly we've devolved into full-blown sci-fi dystopia.

david_shaw··on Claude Code Remote Control
> What does "solving" coding mean?

Maybe this was sarcasm, but it's a good point:

"Coding" is solved in the same way that "writing English language" is solved by LLMs. Given ideas, AI can generate acceptable output. It's not writing the next "Ulysses," though, and it's definitely not coming up with authentically creative ideas.

But the days of needing to learn esoteric syntax in order to write code are probably numbered.

david_shaw··on I built Timeframe, our family e-paper dashboard
This is for sure an inspirational project, but I wish the barrier to entry was lower.

I've noticed e-ink/paper displays having somewhat of a moment right now (especially very small "phone-like" form factors as portable ereaders), and I hope this trend continues.

I'm very far from a meaningful reduction in "screen time," but looking at e-ink displays instead of OLEDs feels like a nice step in that direction.

david_shaw··on Making frontier cybersecurity capabilities available to defenders
> I am seeing something closer to the opposite of skepticism among vulnerability researchers.

My initial claim was overly broad, but the feeling of discomfort feels widespread to me.

In my experience, some of that is technical skepticism, some of it is job-related anxiety, and some might just be fear of the unknown.

I still think that security engineering skill sets, once pivoted to "design of resilient systems," will be a differentiator between quickly-built projects and enterprise-ready software. But we'll see!

david_shaw··on Making frontier cybersecurity capabilities available to defenders
There's a lot of skepticism in the security world about whether AI agents can "think outside the box" enough to replicate or augment senior-level security engineers.

I don't yet have access to Claude Code Security, but I think that line of reasoning misses the point. Maybe even the real benefit.

Just like architectural thinking is still important when developing software with AI, creative security assessments will probably always be a key component of security evaluation.

But you don't need highly paid security engineers to tell you that you forgot to sanitize input, or you're using a vulnerable component, or to identify any of the myriad issues we currently use "dumb" scanners for.

My hope is that tools like this can help automate away the "busywork" of security. We'll see how well it really works.

david_shaw··on Discord Rival Gets Overwhelmed by Exodus of Players Fleeing Age-Verification
Totally. I meant if people were all using the same replacement software, that joining groups' different "servers" would be the same experience.

Absolutely agree that if everything splintered, it would be a mess.

david_shaw··on Discord Rival Gets Overwhelmed by Exodus of Players Fleeing Age-Verification
Those are all great points. I totally agree.
david_shaw··on AI adoption and Solow's productivity paradox
> I'm a SWE who's been using coding agents daily for the last 6 months and I'm still skeptical.

What improvements have you noticed over that time?

It seems like the models coming out in the last several weeks are dramatically superior to those mid-last year. Does that match your experience?

david_shaw··on Discord Rival Gets Overwhelmed by Exodus of Players Fleeing Age-Verification
I agree that most Discord users do not want to self host. However,

> Everybody will have to join everybody else’s server. Too much effort.

This is already the model. Everyone has "their own" discord server, and you have to connect to it manually via an invite. That would actually be the exact same usage.

david_shaw··on Show HN: Moltbook – A social network for moltbots (clawdbots) to hang out
Wow. I've seen a lot of "we had AI talk to each other! lol!" type of posts, but this is truly fascinating.
david_shaw··on Show HN: A MitM proxy to see what your LLM tools are sending
Nice work! I'm sure the data gleaned here is illuminating for many users.

I'm surprised that there isn't a stronger demand for enterprise-wide tools like this. Yes, there are a few solutions, but when you contrast the new standard of "give everyone at the company agentic AI capabilities" with the prior paradigm of strong data governance (at least at larger orgs), it's a stark difference.

I think we're not far from the pendulum swinging back a bit. Not just because AI can't be used for everything, but because the governance on widespread AI use (without severely limiting what tools can actually do) is a difficult and ongoing problem.

david_shaw··on Convert potentially dangerous PDFs to safe PDFs
From the tool description linked:

> Dangerzone works like this: You give it a document that you don't know if you can trust (for example, an email attachment). Inside of a sandbox, Dangerzone converts the document to a PDF (if it isn't already one), and then converts the PDF into raw pixel data: a huge list of RGB color values for each page. Then, outside of the sandbox, Dangerzone takes this pixel data and converts it back into a PDF.

With this in mind, Dangerzone wouldn't even remove conventional watermarks (that inlay small amounts of text on the image).

I think the "freedomofpress" GitHub repo primed you to think about protecting someone leaking to journalists, but really it's designed to keep journalists (and other security-minded folk) safe from untrusted attachments.

The official website -- https://dangerzone.rocks/ -- is a lot more clear about exactly what the tool does. It removes malware, removes network requests, supports various filetypes, and is open source.

Their about page ( https://dangerzone.rocks/about/ ) shows common use cases for journalists and others.

david_shaw··on SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack
You can donate to reduce the national debt, so it's not that far out of the realm of possibility that federal agencies would solicit donations, too.

https://www.pay.gov/public/form/start/23779454

david_shaw··on Meta created 'playbook' to fend off pressure to crack down on scammers
Sure, I understand the thread's implication and I'm certainly not saying that it's never true.

But some companies have the choice of hiring, for example, one really great engineer for $500k, and one very solid one for $250k.

Another organization might want to hire three engineers for $250k.

A third, perhaps, wants to hire seven at $100k.

They're all spending the same amount of money, but not every company can "afford" that spend -- especially if they need several engineers working on unique feature sets.

I just think it's a leap to say that every company paying more than average market value is criminal.

david_shaw··on Meta created 'playbook' to fend off pressure to crack down on scammers
It's a valid business strategy to hire the best and brightest in the field, and to pay higher than average to attract that talent -- if you can afford it.

"Big law" firms are a good example of this too: they pay way more than some random family law practice.

david_shaw··on WPScan: WordPress Security Scanner
WPScan was (and maybe still is?) the de facto security scanner for WordPress security problems. I remember using it with great success during my days running security assessments, and it's great that the open source repo is still around.

However, my understanding is that it's no longer maintained -- instead, WPScan is now a private company that sells the product: https://wpscan.com

david_shaw··on Is Northern Virginia still the least reliable AWS region?
Yes, it's the least reliable. Thanks for summarizing the data here to illustrate the issue.

It's often seen as the "standard" or "default" region to use when spinning up new US-based AWS services, is the oldest AWS center, has the most interconnected systems, and likely has the highest average load.

It makes sense that us-east-1 has reliability problems, but I wish Amazon was a little more upfront about some of the risks when choosing that zone.

david_shaw··on Clair Obscur having its Indie Game Game Of The Year award stripped due to AI use
I'm not sure about licenses that explicitly forbid LLM use -- although you could always modify a license to require this! -- but GPL licensed projects require that you also make the software you create open source.

I'm not sure that LLMs respect that restriction (since they generally don't attibute their code).

I'm not even really sure if that clause would apply to LLM generated code, though I'd imagine that it should.

david_shaw··on Ask HN: Are LLMs worth more than the entire tech industry?
LLMs are part of the entire tech industry, so I'd have to say "no, probably not."
david_shaw··on Apple TV's New Fanfare
> Finneas (aka, Finneas O’Connell) has developed a new sonic logo for Apple TV, the streaming service previously known as Apple TV+.

I still find it perplexing that Apple TV[1] the service and Apple TV[2] the device -- technically now Apple TV 4K -- have the same name.

Even in Googling to link the right pages, I ran into issues finding the device. For a top-tier company with a $4+ trillion market cap, you'd think they'd find a better naming scheme.

1: https://tv.apple.com/ 2: https://www.apple.com/apple-tv-4k/

Side-note: I have an Apple TV (the device), and I think it's great. I've used Fire Sticks, Rokus, built-in TV software, and more, and the Apple TV is the first device I've used that really feels good to use. I'm a fan.

david_shaw··on MIT professor shot at his Massachusetts home dies
>"The theoretical physicist and fusion scientist was known for his award-winning research in magnetised plasma dynamics.

Magnetised plasma dynamics is the study of the state of matter in which the motion of charged particles is influenced by the presence of an external magnetic field, according to Nature.

Loureiro joined MIT's faculty in 2016 and was named director of MIT's Plasma Science and Fusion Center in 2024."

Although it may be a total red herring, it may be worth noting that there are (debatably pseudoscientific) theories -- primarily Plasma cosmology[1] and the Electric Universe theory[2] -- that are related to (and potentially in conflict with) this field of research.

1: https://en.wikipedia.org/wiki/Plasma_cosmology

2: https://rationalwiki.org/wiki/Electric_Universe

david_shaw··on Getting into public speaking
In my experience, getting over the fear of public speaking is really just an exercise in exposure therapy. There are no silver bullets.

But my advice to current and future public speakers is this: never, ever add fluff to fill the engagement time. Every audience everywhere would rather you take 33 minutes instead of 50 if those 17 minutes would have been filled with, basically, garbage information designed to fill time.

It's awful how often people think giving a talk is some kind of speech class homework. It's not. You're not graded on filling the time.

david_shaw··on Cat Gap
> The cat gap is a period in the fossil record of approximately 25 million to 18.5 million years ago in which there are few fossils of cats or cat-like species found in North America.

25M - 18.5M years ago.

david_shaw··on Perl's decline was cultural
Yes: in retrospect, the Perl community (and maybe even the language in general) was cringe-worthy and perhaps even toxic.

But at the time, that elite and esoteric language drew me and many others to it in much the same way that *BSD and arguably even Linux did. The way that programming computers in general did.

It wasn't a pleasant vibe that anyone should strive to recreate, but Perl was something that felt cool to many nerds back then. Perl's decline being cultural is a good thing: it's because the industry grew and matured.

david_shaw··on Dark Pattern Games
Since they mentioned intermittent reward, I take that comment to mean that they prefer to play skill-based games rather than time-sink-for-variable-reward games.

I agree with you that Blizzard didn't stand to directly earn from the D2 grind, but it's valid to not want to participate in a time-sink.

david_shaw··on The dangerous intimacy of social location sharing
> i mean this is cute in an isolated incident, until, you know, all the corporations sell that info to a fascist government who uses it to track dissidents in Portalnd.

The phones (GPS) and cell networks (towers) have your location anyway. The article -- and what the parent comment was talking about -- is social location sharing.

Although citizen tracking is a valid concern, turning on "Find my Friends" isn't going to make you any more vulnerable.

david_shaw··on Supporting Our AI Overlords: Redesigning Data Systems to Be Agent-First
> Is the title to be taken seriously or is “AI Overlords” become some type of well-meaning indication of the positivity of having overlords?

The abstract blurb (linked) doesn't mention AI overlords in either context, so I think it's mostly just an edgy title.

david_shaw··on Bulletproof host Stark Industries evades EU sanctions
> WTH is a “bulletproof host”?

A "bulletproof" host or provider is the colloquial term for a business that will not reveal your identity, payment information, provide LEO access, respond to subpoenas, etc.

It's generally used by cyber-criminals as a "safe" vendor, though some privacy-minded individuals like this type of provider as well.

← PreviousPage 2 of 17Next →