nullityrofl

Yes, that's certainly where he gets his reputation on HN from. He's largely considered not-that-impressive off HN (e.g., people who have worked for or with him and I say that as someone in that category).

After their partnership with Microsoft, no IMO.

> "okay, this JS library is vulnerable to XSS, but has anything actually been stolen? If not, I guess I'm fine to use it in production then."

Yes, that's a perfectly valid question we ask ourselves regularly. I work in security at one of the companies named in this thread. We probably receive hundreds of XSS reports to our bug bounty every week to the point where most bug bounties won't pay out XSS unless you can demonstrate that it actually leads to something. Because it almost always doesn't.

Demonstrating a vulnerability requires demonstrating it's value. We will never build a perfectly secure system: risk management matters.

Yes, prompt injection has been demonstrated.

But has prompt injection leading to PII disclosure or any other disclosure that a company actually cares about been disclosed?

Security is risk management. What's the actual risk?

> Apparently you have no opinion, you just want to refute mine.

I do have a point, you just don't like it. The point is thus: Europe spies on their allies and enemies just as much as the United States does.

> You won't find anything comparable on any other country. And the fact that every nation has secret services means nothing.

I think you may have forgotten that Russia exists.

> By the way you realize that other countries being bad doesn't make the US any better?

I never said it does. I said that spying on other countries isn't the deciding factor.

You mean 2 of 5 and those 2 still involve the EU spying on it's allies, right? So all 5 examples of the EU spying on its allies a thing that you said there was "no proof whatsoever" of?

I never said that the US is or isn't a positive net on the world: I said that spying isn't evidence of your point. Because by your definition no country is positive net on the world.

It's a claim made by the head of the agency that did it. If you're not willing to take their word, I think you're being stubborn and obtuse and this will never be a productive discussion.

If you're willing to believe a US whistleblower -- whose evidence you can't personally verify -- you have to be open to believing the _former head of the agency_.

> Yet another case of the US spying on its allies.

I'm not sure if you're being obtuse or just didn't bother reading.

Denmark was complicit in the US spying on Germany, Sweden and Norway.

https://www.dw.com/en/danish-secret-service-helped-us-spy-on...

France and Germany both have admitted they have spied on the White House.

https://www.france24.com/en/20131024-nsa-france-spying-squar...

https://www.dw.com/en/german-intelligence-spied-on-white-hou...

Germany has been found to helping the US spy on EU allies:

https://www.dw.com/en/parliamentary-report-finds-spying-by-b...

This is a childish and naïve stance.

Also, I'm not American. You can stop referring to me in the second person.

The fact that it has not been leaked is not proof of the negative. The US had been spying on Europe for 50+ years before Snowden and the US continues to spy on Europe right now without any further leaks -- by your logic that must mean that the US isn't currently spying on the EU, right, or there would be leaks?

There's plenty of evidence of the EU spying on allies. I can't tell if your implication is "Europe can't maintain smart enough computer scientists and engineers capable of spying on the US" or "Europe has the moral high ground and doesn't spy on allies".

Both are naive.

Ah, you think that the EU spies on their own citizens but is above spying on allies? Allies not OK, citizens OK?

Like how Denmark helped the US spy on the EU?

https://www.theguardian.com/world/2021/may/31/denmark-helped...

Yes, EU nations are somehow totally incapable of a thing every country is doing. That is naive.

You mean like Europe's use of Pegasus?

https://slate.com/technology/2022/11/europe-spyware-scandal-...

It's already well known that many EU nations have capabilities like this.

The French: https://www.theguardian.com/world/2013/jul/04/france-electro... The Germans: https://www.reuters.com/world/europe/germany-arrests-foreign...

Lets not forget that most of the EU is wrapped up in the Pegasus spy scandal: https://www.dw.com/en/eu-watergate-the-pegasus-spyware-scand...

Playing holier than thou with intelligence services is a losing game. There is no holy intelligence service and there is no nation without an intelligence function.

> What I don't understand is the complete lack of response from countries like Italy and Germany once they found out being spied by an ally.

Because they're all doing it too. Any attempts at retaliation what have been hypocritical and met with callouts.

EDIT: Since this is news to some people who seem to think that the entirety of Europe is on a moral high horse, here's some references. There's little morality in intelligence.

Europe spies on its own citizens: https://slate.com/technology/2022/11/europe-spyware-scandal-...

Germany helped the US spy on EU allies: https://www.dw.com/en/parliamentary-report-finds-spying-by-b...

France admits they spied on the US: https://www.france24.com/en/20131024-nsa-france-spying-squar...

Germany was found to be spying on the US: https://www.dw.com/en/german-intelligence-spied-on-white-hou...

The Dutch helped the US spy on the EU: https://www.dw.com/en/danish-secret-service-helped-us-spy-on...

> A fine, but expensive and mechanically complex solution

I'm not sure I agree that they're mechanically complex. They're engineering 101. A pump, a heater and a thermostat. They're rather mechanically simple.

> Dual boiler machines generally cost thousands even for small home machines.

The _cheapest_ Decent is $3500.

> Commercial dual boiler machines will set you back at least $10-30k, easily.

You don't need a $10k-$30k machine to get a competent dual boiler. If you look at something like a Lelit Bianca, a dual boiler with preinfusion and flow control while $500 cheaper than the cheapest Decent, you can pull your first shot in 10 minutes. A home brewer making espresso on a Bianca isn't going to notice the difference on a $10k or $30k machine because at that price point what you're paying for isn't the ability to pull a shot, it's the ability to pull thousands of them every day of the year.

> But they basically haven't changed since the sixties.

That's true but I argue they don't need to. We don't need to iterate on everything. Technology doesn't always make things better.

Dual boiler machines have been a perfectly fine solution to this problem for a very, very long time.

Decent's offering is good but vastly overcomplicated for the majority of people who don't want a tablet on their coffee machine in their kitchen. I much prefer the tactile experience of using a traditional espresso machine.

It's also one of the single most abused platforms for malware command control hosting. I've spent the better part of a decade chasing down state based actors and crimeware actors who have abused Heroku's free tier. Heroku's abuse efforts cannot be cheap.

Exactly this: it's bidirectional protection.

I bought a HR1622 3 months ago and it's knobs for the induction elements. It's touch for the oven, I suppose.

https://www.mieleusa.com/e/30-inch-range-hr-1622-3-i-clean-t...

My Miele induction cooktop is physical buttons/knobs and has no auto offs. Honestly, I was confused by all of the replies with complaints about induction UI's because it's the first induction cooktop I've owned and it's been a joy. I couldn't go back to gas.

Tavis explains clearly why he thinks it's well maintained in the post, complete with linkages to source code. To paraphrase:

[...] NSS was one of the very first projects included with oss-fuzz [...]

[...] Mozilla has a mature, world-class security team. They pioneered bug bounties, invest in memory safety, fuzzing and test coverage. [... all links to evidence ...]

Did Mozilla have good test coverage for the vulnerable areas? YES.

Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? YES.

Is there a mutator capable of extending ASN1_ITEMs? YES.

I don't think at any point anyone assumed anything.

There have been a lot of people advocating for the death of the cult of celebrity and the narcissism it breeds in society, so maybe yes?

> Per phone might be low bandwidth

Yes, but you used the comparison to Starlink receivers. Per-phone is all that matters to refute your receiver size concern.

The reporting suggests that Apple partnered with Globalstar for delivery. I don't think anyone is under any illusions that Apple suddenly launched a LEO fleet but there's a lot of providers of satellite mobile telephony in the space and Globalstar is one of them. Low bandwidth satellite does not take huge hardware anymore.

You can buy Iridium or Globalstar mobile hotspots that are handheld in size (e.g., Iridium Go!). Many trail runners carry Garmin InReach which is phone-sized.