frenchtoast8

I believe this is a scenario where AWS recommends multiple accounts.

1. Create another "management" AWS account, and make your other AWS account a child to that.

2. Ensure no one ever logs in to the "management" account, as there shouldn't be any business purpose in doing so. For example, you should require a hardware key to log in.

3. Configure the "management" account to force children account to enable AWS Config, AWS CloudTrail, etc. Also force them to duplicate logs to the "management" account.

Step 2 is important. At the end of the day, an organization can always find a way to render their security measures useless.

I recently learned Go for the first time and I have played almost 50 games of 9x9 on Online Go Server so far. I’m finding it a lot of fun but it has been very humbling.

I learned chess in 7th or 8th grade and was easily able to get to about 700 Elo on chess.com after barely learning the rules, which is about the 60th percentile on the site. I only play a couple games a year now but can still hold my own against 1200 Elo opponents, which is in the 90th percentile.

I feel like I have put in just as much effort into learning Go. I bought a book and have been doing exercises. But I’m still in the 0.1 percentile on the site! (Yes, that’s not a typo.)

I’m sticking with it because it’s fun and that’s all that matters. But I definitely have a lot to learn.

He's accused Luis Paulo Supi (Brazillian grandmaster) a few times after losing to him, and he accused Andrew Tang after losing to him. The latter was criticized in some online circles because it was seen as bullying a then 14 year old.

I don't know many other notable cases of Nakamura accusing players of cheating. Many players dislike how Nakamura conducts himself on stream and how he interacts with the chess community and this leads to exaggeration. It's simply wrong to compare him to Kramnik, who has dedicated many hours over the last couple years to accusing players.

It’s a good first step, but a significant number of GitHub Actions pull a Docker image from a repository such as Docker Hub. In those cases, the GitHub Action being immutable wouldn’t prevent the downstream Docker image from being mutated.

It's pretty clear the developer blocked him from the @iceblock.app account because of the blog post criticizing him, and then blocked him from the other account after he said to not respond but got a page of text back instead. It had nothing to do with the vulnerability report.

Now, the blog post seems to be reasonable criticism to me so I don't think the developer should have blocked him for it. But I don't know, no one has ever written a blog post about me, and I'm not receiving death threats and being threatened by the federal government.

At the end of the day, the author is trying to frame this interaction along the lines of, "Sensitive user data is at risk, and I was blocked for no reason other than for letting the developer know" -- the first part has not been proven to be true, and the second is obviously not true.

The author says "it might be trivial for anyone to hack your server." "Might" is doing way too much heavy lifting here. Actually, the author has no idea if there is any actual exploitable vulnerability on the server. They just Googled a version number and fired off a "vulnerability report," which "might" be worth as much as the dozens of emails I get a month about "huge vulnerabilities" related to my SPF record, or those CVEs that boil down to "if someone has root on the machine they could do something bad on the machine."

I can't help but feel that the author's motivation was to get some sort of reaction, and now they've gotten it. If this vulnerability was so vital to be patched, why would it be bundled into a "by the way" DM on Twitter along with a post heavily criticizing the app developer? Both people involved can be idiots here.

It took me a couple reads of the PDF but I think you're right. The author creates an HTTP request Promise, and then immediately returns a response thereby shutting down the Lambda. They have logging which shows the background HTTP request was in the early stages of being sent to the server but the server never receives anything. They also have an error handler that is supposed to catch errors during the HTTP request but it isn't executed either. The reason for both seems quite obvious: it's completely expected that a Lambda being shutdown wouldn't finish making the request and it certainly wouldn't stick around to execute error handling code after the request was cancelled.

As an aside I find it strange that the author spent all this time writing this document but would not provide the actual code that demonstrates the issue. They say they wrote "minimal plain NodeJS functions" to reproduce it. What would be the reason to not show proof of concept code? Instead they only show code written by an AWS engineer, with multiple caveats that their code is different in subtle ways.

The author intends for this to be some big exposé of AWS Support dropping the ball but I think it's the opposite. They entertained him through many phone calls and many emails, and after all that work they still offered him a $4000 account credit. For comparison, it's implied that the Lambda usage they were billed for is less than $700 as that figure also includes their monthly AWS Support cost. In other words they offered him a credit for over 5x the financial cost to him for a misunderstanding that was his fault. On the other hand, he sounds like a nightmare customer. He used AWS's offer of a credit as an admission of fault ("If the platform functioned correctly, then why offer credits?") then got angry when AWS reasonably took back the offer.

At work I use Datadog, but it's very expensive for a homelab: $15/mo per host (and for cost I prefer using multiple cheap servers than a single large one).

NewRelic and Grafana Cloud have pretty good free plan limits, but I'm paying for that in effort because I don't use either at work so it's not what I'm used to.

I've tried this on a RCL ship and it didn't work, so YMMV

"Minor" was a poor word choice, I'm not sure what word would have been better. My intention was to say that I don't see how a non-lawyer could have any reasonable opinion on how a legal document is drafted. That is also why I don't agree with the author about replacing that with AI. They absolutely should weigh in on overall strategy because you need to consider factors such as your company's finances, risk tolerance, etc. In the same way that you might decide with your doctor that you want a surgery done but you have to trust them to do the surgery properly.

My reading of the article is that it has nothing to do with the author's trust or lack thereof for their lawyer. I think the author would agree that you have to find a lawyer you trust, just as you need a doctor you can trust.

I trust my doctor, and if it's a minor issue like needing antibiotics for something I just accept whatever they prescribe. But if it was a life or death situation I am not going to blindly follow their advice without any questions. I ask my doctor for their recommendations but I make the final decision. They may disagree with that decision but ultimately it's my life at risk and I'm the one who suffers the consequences. As long as you are reasonable and not trying to cure cancer with fruit I hope that the majority of doctors are going to support this.

When it comes to drafting contracts or other minor issues you should just trust your lawyer. But if the lawsuit has the ability to completely end your company I think it would be a mistake to do the same. But I'm not a founder so maybe my opinion isn't worth anything here. I've only hired a lawyer once for a landlord-tenant dispute, my lawyer gave their recommendations, I disagreed with it, and they said alright it's your money, but it ultimately worked out so we were both happy. I find it interesting that the author had trouble at first finding a lawyer who would agree to this arrangement because that wasn't my experience.

If you're going to do this, you need to do your own research beforehand. In my case I read all the relevant tenant laws before I even met with the lawyer. Today I might use AI to help with that, but I would be wary of hallucinations. I think the majority of the article is about this: just using AI to help with research before meetings with your lawyer.

At the end of the article the author says they are now using AI to draft legal documents and I don't agree with that but that's just me.

It is legal for a bicyclist to run a red light in a specific circumstance (when the light is red but the pedestrian walk signal is lit). This has been a NYC law since 2019, but NYPD is still routinely giving tickets for this, and judges are routinely refusing to vacate them. I can understand a lone NYPD officer not being aware of the law (although I think 6 years is getting ridiculous). But the issue is also the DMV judges that, in some cases, have acknowledged the law but have claimed they have the power to ignore it as it is a NYC law and not NYS law. This argument is bewildering to me - if it was true then what is the reason for NYC laws to exist at all?

https://nyc.streetsblog.org/2022/09/06/the-nypd-and-dmv-are-...

I feel very strongly about bicyclists running red lights, and I'm always the one looking like a nerd who stops at the light. But I am very concerned about bicyclists getting criminal summonses for them when our system of checks and balances is consistently not working even in the unambiguously legal cases.

There are a lot of people who get confused using the SMS code they received, let alone setting up passkeys, or TOTP and backing up their codes, and so on. The systems are designed for those people, not you. Even offering passkeys or TOTP as an option is a customer support liability, that's another thing agents need to support when someone nontechnical inevitably enabled this on accident or has a family member set it up for them.

> Think of the person from your grade school classes who had the most difficulty at everything. The U.S. expects banks to service people much, much less intelligent than them. Some customers do not understand why a $45 charge and a $32 charge would overdraw an account with $70 in it. [...] This customer calls the bank much more frequently than you do.

https://www.bitsaboutmoney.com/archive/seeing-like-a-bank/

Related discussion: https://news.ycombinator.com/item?id=43833195

Related: https://news.ycombinator.com/item?id=43535953

From what I understand, the judge ruled that it wasn't defamation for Jobst to call Mitchell a cheater but saying he drove Apollo Legend to suicide was too far considering he didn't have a lot of reason to believe this: it was mostly based on online rumors about an apparent out of court financial settlement between Apollo and Mitchell which never existed. What probably drove the nail in the coffin is that Jobst did edit the video later to remove the claim, but after Mitchell sent legal action, he republished the original video. This might have felt vindictive to the judge. Now, Jobst did eventually ask Apollo's family for the facts, remove the claim and publish a retraction about a month later, but perhaps the judge thought this was too little too late.

I don't agree that Mitchell's reputation was harmed as he brought attention to the video multiple times, but it's hard to argue against the facts: Jobst said something he wasn't sure was true, and when he learned it was false he kept it up anyway.

Edit: fixed timeline, which is documented here: https://perfectpacman.com/2024/09/20/karl-day-4/

I can understand small businesses relying on Facebook or Instagram or Twitter because they may not have the resources to provide a perfect solution to everyone.

My country’s consulate in NYC posts important news only to Facebook. That is a problem.

For a while I've been searching for a note taking app that

* Allows more than one user editing the same page at once

* Is accessible on a mobile device (either app or mobile browser)

* Can be at the very least viewed in read only mode if disconnected from the internet

The last point is the most important to me and frustratingly has been the most elusive for me to find. For now I use Notion with the hopes they implement it eventually. I can't consider switching to a self hosted alternative without the last point.

Editing to add: the developer has locked further discussion about this. Very concerning as I believe their explanations are raising more questions than they are answering.

First of all, clearly Github can't answer for the developer how their bot's token was compromised, that's something the developer needs to find out. Instead they are repeating this statement like it's out of their hands.

But more concerningly, I don't believe the explanation is supported by the Github history which says the compromised commit was "authored" by Renovate and "pushed" by @jackton1. It's obvious how the first part was spoofed, but the second part is concerning as it indicates the @jackton1 account was compromised not @tj-actions-bot. If I'm missing something please let me know.

The repository is back online, with this explanation from the developer:

> This attack appears to have been conducted from a PAT token linked to @tj-actions-bot account to which "GitHub is not able to determine how this PAT was compromised."

> Account Security Enhancements

> * The password for the tj-actions-bot account has been updated.

> * Authentication has been upgraded to use a passkey for enhanced security.

> * The tj-actions-bot account role has been updated to ensure it has only the minimum necessary permissions.

> * GitHub proactively revoked the compromised Personal Access Token (PAT) and flagged the organization to prevent further exploitation.

https://github.com/tj-actions/changed-files/issues/2464#issu...

You can combine this with a policy that blocks third party actions from being used across your organization. https://docs.github.com/en/organizations/managing-organizati...

My day job is also in the middle of moving everything to Github Actions, so this is fun. But in my case, we aren't affected by this vulnerability because it could only be exploited by workflows with public logs, and currently my company only uses Github Actions for private repositories.

The version numbers aren't immutable, so an attacker can just update the versions to point to the compromised code, which is what happened here. Commit hashes are a great idea, but you still need to be careful: lots of people use bots like Renovate to update your pinned hashes whenever a new version is published, which runs into the same problem.

> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host.

Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date, or if malware is detected, or if the firewall is disabled, etc. But I don't use any of those integrations and can't speak to them.

I've never wanted to sideload an app until recently. I discovered that the recent generations of iPhones and iPads can achieve native performance with the Dolphinios GC/Wii emulator, but the app can only be sideloaded. Apple doesn't have a problem with emulation in general (there are NES/SNES/etc emulators available for download in the App Store), but they do not allow JIT compilation for security reasons which these newer generation emulators require.

Currently sideloading is a pain so I still haven't done it. If it becomes as easy as Android I personally would be pretty happy just for this use case.

Ironically I'm a bit disappointed by how powerful the hardware is getting these days because of the software limitations. Don't get me wrong, I fully admit my days of running custom OSes is over, I only use my iPad as an entertainment device and am happy to keep it very simple. I just feel power users should be able to sideload an app or two without needing to use an Xcode debugger or whatever.

For example, AWS's Mac machines frequently run into hardware failures. My current job runs a measly 5 mac1.metal hosts for internal testing, and we experience hardware failures on these machines a few times a year. Doesn't sound like a lot, but these machines are almost always completely idle, and we almost never get host failures for Linux hosts. To make matters worse, sometimes a brand new instance needs replacement before it even comes up for the first time, which is annoying because you are billed a minimum of 24 hours for these instances. People have been complaining about this for years and seemingly nothing is being done about it.

https://www.reddit.com/r/aws/comments/131v8md/beware_of_brok...

Does this graph format have a name? Google isn’t turning up anything for me.

Suing (or threatening to sue) everyone and anything that speaks poorly about the company is an interesting PR response, isn't it? I'm used to companies just ignoring the issue and hoping it goes away.

Not just the "50 to 60 percent" statistic, it looks like the entire paragraph in the ad is word for word identical to a preexisting cheese shop site. So either Gemini's "generation" is just searching the web and doing verbatim copy paste, or Google copied it themselves which would be a new low for Google.

My theory is that all the severed employees are doing various maintenance tasks to keep the floor functioning. Like the hospital in Yes, Minister that is closed to the public but has 500 employees, all of them overworked.[1]

Take O&D for instance, their full time job appears to be to just create art and handbooks used on the severed floor. Perhaps all the departments are like that. MDR could be doing some sort of ongoing maintenance for the severed system itself, like emotion or memory control of the employees on the floor.

I believe the "point" of the severed floor is not the actual work that's being done, but the act of keeping them occupied while they are experimented on. Besides Mark S and Cold Harbor, I believe there are hints of other experiments being run. The dreams Irving B has during work seem unique to him, and it's uniquely affecting his outie as well. I also believe recent events in Season 2 with Dylan G could be the start of another experiment.

^1: https://www.youtube.com/watch?v=JAk448volww