dontdoxxme

Bugs are "High value" in different ways, you have to find the companies willing to pay highly. Most of the high payers are on bug bounty programs (like hackerone.com) and don't always give you ability to talk about bugs later.

Google is quite unique here, particularly given Chrome is paying easily 10x what Mozilla would for a sandbox escape. Apple is in the middle -- per [1] a "WebContent sandbox escape" would be $50k, but to get $250k on their scale you need to combine that with a kernel bug.

So if you want to optimise for "value", you have to pick the targets that are easier (still not easy, obviously).

[1]: https://security.apple.com/bounty/categories/

"file paths (obfuscated)" -- this is likely enough for them to work out who the user is, if they work on open source software. They get granular timing data and the files the user has edited, which they could match with open source PRs in their analytics pipeline.

I suspect they aren't actually doing that, but the GDPR cares not what you're doing with the data, but what is possible with it, hence why any identifier (even "obfuscated") which could lead back to a user is considered PII.

2.5GBASE-T? But I do 10GBASE-T over one. Provided it has Cat 6A cable inside it and has been tested to IEC 60512-9-3 & IEC 60512-99-002. (See https://ieee802.org/3/bt/public/oct15/Draft%20of%20IEC%20605... for some fun photos of what happens when PoE is disconnected on a connector before IEC 60512-99-002...).

#include <Usual IANAL comment>

In the US usage like this may be considered "Fair Use", however UK copyright law is less generous in its "Fair Dealing" and associated exceptions to copyright[1].

This is a problem when standards are pushed by US tech companies but don't consider the rest of the world.

[1]: https://www.gov.uk/guidance/exceptions-to-copyright

> One of the reasons why these patches are not included in the kernel is that the free space calculations do not work properly.

It seems these patches possibly fix that.

That example doesn't work, but an IPv6 address like: 3fff:0020::

Would be in the IP SAN as 3fff0020000000000000000000000000, which this code expands:

   "3fff0020000000000000000000000000"
                .toLowerCase()
                .match(/.{1,4}/g)
                .join(":")
                .replace(/\b:?(?:0+:?){2,}/, "::")
   '3fff::20:0000:0000:0000:0000:0000:0000'

Which has one too many parts and doesn't parse as an IPv6 address. But like mentioned this is just presentation code. I don't want to waste time if this isn't actually a bug, but maybe someone on the LetsEncrypt trial could actually make a cert to see if IP addresses formatted like that are a problem in reality...

> even if the server is breached, attackers cannot impersonate users

The weakest link is still the web platform, an attacker can change the JavaScript served.

> even if users reuse the same password across services the impact to other services using the same password is minimal

Failing to understand this argument, if an attacker wants to target the service, they can run the key derivation themselves?

They can also enumerate users because the salt is returned. It says the server should implement rate limiting to stop brute forcing, but that isn't going to help with simple password reuse.

Not yet: https://github.com/apple/container/blob/main/docs/technical-...

https://web.archive.org/web/20250606081030/https://00f.net/2... given this seems to not accept (most?) TLS handshakes...

It translates exactly to Kubernetes though, except without the concept of pods, I don't see anything in this that would stop them adding pods on top later, which would allow Kubernetes or compose like setups (multiple containers in the same pod).

The post alludes to it, the previous post has details[1], setup did it, based on the data in APPS.INF (a massive file shipped with Windows, although you could add your own data[2]).

[1]: https://devblogs.microsoft.com/oldnewthing/20250505-00/?p=11...

[2]: http://www.bitsavers.org/pdf/microsoft/resource_kits/0030-54... page 183

The post you're looking for is about how they also NIH'd a source code browser: https://flak.tedunangst.com/post/humungus

Confusing messaging, a previous version is: https://huggingface.co/hexgrad/Kokoro-82M (matching the demo if you use the "TTS v0.19" tab, it has some artefacts in the voice[1] and definitely doesn't sound as good as the latest version).

"There currently isn't a release date scheduled for the other voices"

[1]: https://huggingface.co/blog/hexgrad/kokoro-short-burst-upgra...

We don't. If anything just using HTTP and HTML the way it was designed is fine. See https://indieweb.org

Submitted it to The Daily WTF yet?

You'd be better off with passage[0] -- it's a fork of pass but uses age for encryption. You can just make a directory hierarchy with appropriate .age-recipients files at the right levels.

[0]: https://github.com/FiloSottile/passage

It sounds like jujutsu is not honoring the filter option, see man gitattributes, it even lists encryption as a possible use.

For the MIT license to make sense it needs a copyright notice, I don’t actually see one in the original license. It just says “The MIT license” but then the text below references the above copyright notice, which doesn’t exist.

I think both sides here can learn from this, copyright notices are technically not required but when some text references them it is very useful. The original author should have added one. The user of the code could also have asked about the copyright. If this were to go to court having the original license not making sense could create more questions than it should.

tl;dr: add a copyright line at the top of the file when you’re using the MIT license.

And this is a company people trust with their data, if the employees can’t be held to and meet higher moral standards they shouldn’t be there.

…maybe Zuck is exempt though? (https://www.15minutebusinessbooks.com/blog/2019/07/26/you-ca...)

Hardly, the benefit of binary is if everything lines up once, it always will. It’s not an analog world with pesky things like wind resistance.

Person seems to work for cure53, who have done reviews of lots of open source apps. Apparently they don't care about copyright though.

For some reason there’s not a feed on each page but the front page links to https://www.archcloudlabs.com/index.xml

Why don’t CT logs include revocations? Seems like that could provide transparency into this without the need for another system (OCSP)

Also without a demo the TOS has lots of words such as: “You must not access or use for any commercial purposes any part of the website or any services or materials available through the Website.”

Fairly sure my work todos could be considered commercial purposes, so I don’t even want to risk trying it.

I think it’s better to see it as not a shift in culture but understand that the internet represents all culture now. There are still under 30s that believe in real freedom but everyone is on the internet now, rather than a set of people that were more biased towards freedom (as that was partly what the internet represented).

This web version supports adding to the home screen and you maybe won’t even notice the difference.

Or invert your screen.

+1, soatok has a write-up of how that works: https://soatok.blog/2022/12/21/extending-the-aes-gcm-nonce-w...

...a variant on that is DNDK-GCM in draft at https://datatracker.ietf.org/doc/draft-gueron-cfrg-dndkgcm/ and a recent presentation: https://youtu.be/GsFO4ZQlYS8 (this is Shay Gueron who worked on AES-GCM-SIV too).

Diamond Geezer has been blogging for years and definitely understands what a high street is. In fact he’s probably planning a follow-up already about High Roads. (There’s already a visit to the shortest high streets as a follow-up: https://diamondgeezer.blogspot.com/2024/06/londons-shortest-...)

At the end it mentions a nonce based approach probably being the more sensible way. Shay Gueron presented at RWC 2024 about a nonce based approach (DNDK-GCM): https://www.youtube.com/watch?v=GsFO4ZQlYS8&list=PLeeS-3Ml-r... -- they mention Meta are using this as their default in their encryption library.

There is also an internet draft on it: https://datatracker.ietf.org/doc/draft-gueron-cfrg-dndkgcm/