insomniacity

Reminds me of this point by Matt Levine:

> If you have a pot of money that is immune to bank runs, over time, modern finance will find a way to make it vulnerable to bank runs. That is an emergent property of modern finance. No one sits down and says “let’s make pension funds vulnerable to bank runs!” Finance, as an abstract entity, just sort of does that on its own.

https://www.bloomberg.com/opinion/articles/2022-09-29/uk-pen...

Thanks for the interesting info. As you didn’t want to go into the failure there, would you be willing to explain more here?

You mentioned some missed out on the government grants - was that the main cause?

Stack Overflow Jobs used to do this at a very shallow level.

So when you use the on-prem agent, does it rewrite all the backend endpoints to point at the agent, and continue serving the frontend externally?

“The reasonable man adapts himself to the world; the unreasonable one persists in trying to adapt the world to himself. Therefore all progress depends on the unreasonable man.”

s/man/woman, in this case of course.

Just scanned 1.0.1 - 26 vulns dating back to 2018.

That’s down from 35 when I raised the issue 2 years ago!

How would you like me to let you know about these?

Last time I tried to use this, it wouldn’t pass dependency vulnerability scanning to bring it into the company. Obviously it’s not going into production, but it doesn’t seem a big ask to eliminate known CVEs.

They didn’t seem interested in resolving!

In addition to the other suggestions, you could also pitch and prototype this at the NHS Hack Day.

https://nhshackday.com/

There is no formal route to production, but you might meet senior people who could help.

Bad Luck Brian - site gets posted to HN, TLS cert expires 5 hours later.

Neopets has a lot to answer for in our generation :P

+1 for encryption. I currently spend money on Standard Notes, but would probably move to this if there was end-to-end encryption.

Like https://en.wikipedia.org/wiki/Do_Not_Track ?

On, by Adam Roberts.

How does this compare to slip.so? I'm intrigued by the idea of these platforms, but not really seen them in use...

They’re still a target if an individual they’re targeting (to harass, find or discredit) banks there.

They’re still a target for someone wanting to cause disruption or engage in hybrid warfare - imagine a simultaneous hack of all the neobanks, possibly followed by a few of the traditional banks a week later for maximum impact?

They’re still a target for someone wanting to pivot into other organisations they might be connected to, such as card networks or regulators.

You could call okcupid feature complete. Keybase however still had plenty of exciting greenfield work to do (IMO) - my friend and I emailed them asking to pay for KBFS but the founders declined!

I think they needed to be more explicit for their commercial customers. Our c-suite is gonna prefer a blog post to a git diff!

I once applied as an external, rejected on grounds of being too experienced/senior. Then later heard they went the other way and hired someone more junior than me, by their own measure!

What did the EFF lie about? Missed that…

I wouldn't call this censorship. There is likely a paragraph right above "To develop or release a Personal Game..." that carefully defines it - but it wouldn't really add anything to the article to include that when it can be summarised as covering the output of an "indie game developer". Contract terms like that are often defined then given Initial Capitals.

We should assume good faith on the part of James Liu and Robert Adams unless you have evidence to the contrary.

To your point about carrot and stick - yes, the carrot here is likely excellent financial compensation for doing the main job, and the experience on the resume, same as all your colleagues. Amazon aren't going to pay you extra because your hobbies are impacted by their policy - at junior to mid levels it's take it or leave it.

I think it's related because eproctoring often forces people to electronically invite strangers into their homes and show them round.

Creeps are going to creep, but it's legitimate to want to reduce the number of avenues they can do that.

Yes, good point, I guess the first step is realising you have a problem and proving it to management!

I like this - we’ve had “reduce our bus factor” on the to-do list for a while, but not found a way to do it yet.

Anyone who hasn't signed up for various tracking!

I've followed this on and off for years, and I've always pined for a mobile version - to the extent I seriously considered learning mobile development in order to write my own!

Fortunately you can do the edge cases via email: https://medconfidential.org/how-to-opt-out/

You trusted Google not to track you in Incognito mode?

I love Netlify but this seems to be slowly reinventing dynamic sites?

I mean exactly what you did - "The vulnerability that is of interest is the one that allowed these commits to be injected".

Yes, it will be evident that the commits appeared in the git history, but not necessarily how they got there. If the git repo on disk suddenly has that commit, and no other usual indicators of compromise, that doesn't really give you anywhere to start looking for, what we agree is, the interesting vulnerability. All you have is "we know this box/service was definitely rooted, so look at all our infrastructure end-to-end".

They care about the exploit enough to move - of course. But do they care enough to investigate and find the actual exploit? Or hand over the server image to someone who does? Unless they've wrapped it in some PHP, it's probably not their core competency. I don't follow the PHP project, so I don't know the answer to that.

Problem is, burning the exploit this way only works if someone does the work to find it.

Of course, it could appear in the server logs (or be detailed on a file dumped on the filesystem) - but it seems PHP have just decided to move to Github, and may not actually care about this, so it may not see the light of day.