kaivi

Before you visualize a straight path between "a bag of cool ML tricks" and "general AI", try to imagine superintelligence but without consciousness. You might then realize that there is no obvious mechanism which requires the two to appear or evolve together.

It's a curious concept, well illustrated in the novel Blindsight by Peter Watts. I won't spoil anything here but I'll highly recommend the book.

Can't help but imagine your www-data which spawned nc, and it seems too amateurish for a high profile hacker group. Makes it seem as if they've copy-pasted the first one-liner reverse shell found on Google. Even the Metasploit framework has introduced payloads a while ago which do traffic encryption/obfuscation. Much more subtle reverse shells are used in the wild, where a compromised machine reaches out to hacker's server once in a while and receives commands and dumps output, even over something like ICMP/Loki or Covert TCP.

Cool story, that does indeed sound like a plot out of a movie!

How were you able to extract a password from just listening to scp (ssh really) traffic though? Also, how did you know that someone's entire network was SSL MITM'd, only by looking at the data they dumped? Did the hackers store a readme file along with every dump?

Beware that Hetzner is quick at blocking IPs, with zero recourse or explanation.

If they receive any kind of abuse report, they instantly put you on a 24h timer, but they won't show you contents of that message. If you do not respond in time, they will simply block the IP. What's strange is that I was using Cloudflare in front of Hetzner, but it seems that Cloudflare is ratting their users out and forwarding any abuse mail to the owners of "cloud protected" IPs, all without any notification or warning. Hetzner then sends you an email like "Please remove <sitename> from our network within the next 24 hours. This site violates 6.2 of Hetzner's terms and conditions.", where site in question is an obvious mirror/search engine of another social network.

What's perhaps more irritating is that Hetzner Cloud has a tiny LIFO queue of ipv4 addresses unique per customer, so you will get the same IP as soon as you release one. You can imagine what happens to a Rancher-managed k8s cluster with Hetzner node driver when one of those IPs gets a no-route: it will get stuck trying to re-deploy a failed node. Mine eventually fell apart though because I did not attend to it for a couple of years.

I'm now hosting from a proverbial garage (NixOS and cron) but proxying traffic through a cheap cloud VM, which saves me at least $1500/mo.

TIL, that's super interesting, never guessed that it could be a SIM application!

What a nasty thing! Seems there's no other way but using dedicated hardware.

BankID also needs to be tied to a specific SIM, so I suspect that they somehow store and validate SIM ID and IMEI on the other side.

You must be using the new BankID app which sends push notifications, but I don't think it's supported by every site which uses BankID.

Here is what it looks like: https://youtu.be/zX3UJO4paxk?t=15

iOS visuals have changed since 2012, but the process is the same in 2021: 1. full-screen message 2. another full-screen message with a numpad and buttons.

I'm surprised that this feature is not massively used to scam people. Is it because sending service SMS is restricted to certain parties?

It doesn't work with my bank unfortunately, and it does not seem to replace "BankID on mobile".

Slightly off-topic, but has anyone managed to automate receiving and replying to so-called "flash SMS" or "Class 0 SMS"?

In Norway, there is a thing called "BankID on mobile", which is used for 2FA by government services, along with any companies requiring authentication with person's ID. Examples: banking, insurance, health and vehicle registration: you initiate a log in using either your personal ID or a combo of phone number+birthdate, and you receive this interactive, full-screen flash SMS asking you to ensure that a certain word combo matches, and to confirm the action with your PIN. To be clear, the interactive part does not come with some app, but it's a feature built into most smartphones.

This thing drives me nuts when traveling: it is slow when abroad and costs money. What's worse, is that it only works with a physical SIM, so I can't easily use a local SIM abroad. There is an alternative way of authenticating using a code-generating unit, but it is not perfect - you can only have one of them at a time, they're really fragile and non-waterproof.

What I'd like would be to leave my SIM at home, preferable inside of a hardware SIP gateway from Aliexpress, and proxy those prompts through a Telegram bot.

Tbh I'm still selling that data.

For a while I've had reoccurring nightmares that my DB had been stolen and published together with an article on how stupid and incompetent I am.

>Somewhat ironically Elasticsearch would probably work really well for this too (just make sure your elasticsearch isn't open to the world on the internet!).

Sure it will work, but I personally don't like Elasticsearch for anything high-intensity because of its HTTP REST API and the overhead it carries. Take a look at Cassandra's [1] "CQL binary protocol", it simple and always on point.

[1] https://github.com/apache/cassandra/blob/trunk/doc/native_pr...

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping.

Here are some tricks which may or may not work today:

- Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of users.

- Call their API through ipv6, because they may not yet have a proper, ipv6 subnet-based rate limiter.

- Scrape the mobile website. Even Facebook still has a non-js mobile version. This single WAP/mobile website defeats every anti-scraping measure they may have.

- From a purely practical perspective, start with a baremetal transaction-isolation-less database like Cassandra/ScyllaDB. Don't rely on googling "postgres vs mongodb" or "sql vs nosql", those articles will all end in "YMMV". What you really need is massive IOPS, and a multi-node ring-based index with ScyllaDB will achieve that easily. Or just use MongoDB on one machine if you're not in hurry.

- Don't be too kind on the big websites. They can afford to keep all their data in hot pages, and as a one man you will never exhaust them.

On one index I'm using OPQ16_64,IVF262144_HNSW32,PQ16 with 128 dimensions initially.

1024 dimensions is a lot! Could you elaborate on what application requires that many? If it's a DNN layer output, your data must be sparse, so dimensionality reduction won't affect your recall if tuned properly.

It is really fine as it is for me, the custom styles don't really matter for a B2B app I am working on. Just add an InlineEdit mode to a Table, and it will be better than any OSS table component there is today!

One thing about inline-editable components and tables. As a former office drone and a part-time speditioner, I believe that such components must be tabbable, and an ideal editable table should try to mimic the desktop experience. Office workers spend thousands of hours in backoffice apps, watching 0.3s animations and aiming with a cursor, but they never complain because they don't know any better.

Just to demonstrate a different InlineEdit, here is a demo of a lib I made several years ago. It worked great with tables and card views: https://kaivi.github.io/riek/

Also didn't your former colleague write up this post on data tables in 2017? It was trending here yesterday. Looks like a lot was already implemented back then: https://uxdesign.cc/design-better-data-tables-4ecc99d23356

Finally, a decent table component! Just what I was looking for my new project.

A nitpick concerning slow animations: there is no place for them in a modern enterprise app.

In my experience, the cube extension is unusable for >10M x 128D vectors without PCA. I'm using Faiss now with ~500M vectors, and it works great!

We should control greenhouse emissions by releasing more wolves into shopping malls.

You made me wonder -- what happened to ulv.no and sau.no?

My case was really simple. I was done with my ML pipeline and nuked the database, but pics in B2 remained with no quick way to get rid of them and/or to stop the recurring credit card charges.

IMO an "Empty" button should have been implemented by Backblaze.

S3 has an "Empty bucket" button, unlike B2.

You do need access to an index/DB of all files in a bucket in order to delete them in parallel. Otherwise you're stuck paginating with the B2 API.

Backblaze is cheap, but if you're uploading millions og files, beware -- there is no way to just nuke/empty a bucket with a click of a button. If you're not keeping filename references in an external database, you are left to sequentially scan and remove files in batches of 1000 in a single thread.

Support could not help, and it took me months to empty a bucket that way.

Also this really short documentary on warez [1] is gold. [1] https://www.youtube.com/watch?v=bAQqrnX7BsM

I second this, it's a decent app! Only wish they would stop obsessing over new icons and fixed bugs instead.

Sounds like a great premise for a sci-fi movie.

Yep, logging in to Backblaze is a PITA, in addition to their unreasonably short-lived sessions.

Whatever reason, this practice needs to die in a fire.

Maybe off topic, but if anyone from NordVPN is reading this: for the love of god fix your iOS and OS X clients, so they don't log out randomly. I can't even begin to describe how frustrating that is.

Indeed, cloud+dedicated infrastructure is really cheap after certain load/volume, compared to pure GCE/AWS. I have been using k8s with Hetzner for 6 months now, with dirt-cheap SSD/NVMe storage and 1080 GPUs. Can't recommend them enough, and I do not really see any competition here.