semi

Testing your http/3 endpoint

this is why I never could get into counterstrike after 1.6

it's not just the visual noise, it's also the inconsistent behavior introduced by those details.

Yes everything being flat boxes was boring looking but I knew exactly what would happen when I tried to shoot through it or bounce a grenade off of it.

Now it's not obvious if that stack of sandbags is actually a single surface and my grenade will bounce off of a gap or if it will go through it. Or if that random bucket I'm shooting at is synced on the server and real or is a local prop.

one issue with default on with power is that in the event of a temporary power outage, all of your lights will turn on.

Probably better than the alternative for most people but just something to be aware of.

> > what sort of protection does ECC ram give me?

> Side-band ECC (which is what you'd use on desktops/workstations/servers) doesn't have a performance hit, as the overhead of ECC is fully neutralized by the additional bandwidth and capacity of an ECC DIMM.

This is true as far as I know but only for comparing ECC ram vs non ECC ram that is otherwise equivalent. But if you want the fastest ram available, it doesn't support ECC, so you're still taking a perf hit by buying slower ram with ECC support than you could get without ECC

it's not really possible to say if ecc would prevent the issue you're describing.. but that's why imo it is worth having ecc--so you don't have to worry as much about if the weird behavior you see is due to random memory errors.

On the more immediately practical side.. if this is happening frequently enough then running memtest86 or GSAT google stressful application test and see if it can pick up any errors.

You also might be able to improve things with a bios upgrade, or by lowering the clock speed of the ram.

it's equivalent to 'true'. It returns a successful value

DoSing the users they are signing up would be my guess. Many sites do not even do a validation step and will immediately add any submitted email to the mailing list. Your email box is then filled with tons of emails and manually unsubscribing takes a lot of effort and still only reduces the volume of incoming emails

This could just be used on its own as a way to annoy someone. Or it could be used to try to hide some legitimate email that you will receive, like if they are compromising your account somewhere that will notify you of the new login and hope you don't notice in the sea of spam.

you're making a lot of assumptions in bad faith. why?

Maybe they just don't want all of their personal information to be stored in yet another database waiting to be leaked.

They're even better than black text on white backgrounds. They're unstyled and use your browser default styling. granted it's rare anyone configured those so it's almost always black on white.. but for people who do specify their own preferences it's really nice to have them respected and not rely on hacking in my own css or js to override theirs

I somewhat agree in that it does feel like more of a problem in YAML than code, and infinitely more of a problem when doing both (template code generating yaml)

But I still don't think there's any desirability for whitespace significance in code. Is there any problem it solves that isn't better solved by having enough structure and standardized tooling for autoformatting like go fmt?

Being able to produce more variations of the same talking points sounds really useful for increasing the scale of distribution - you can much more easily maintain more legitimate looking sock puppet accounts that can appear to more organically agree with your talking points.

There was also a separate release of counterstrike called condition zero that included a single player campaign and a tweaked version of counterstrike multiplayer.

That was not included as part of that bundle.. but if you used the dedicated server tool to download the czero mod and copied it to your halflife folder you could play both the single player and multiplayer version on steam

For some context on the early days of steam, I remember the Friends network having reliability issues presumably due to scaling as everyone adopted steam.

But by reliability issues I don't mean it occasionally failed. It did, but that was early on. I assume they just killed the backend and never pushed a client update to remove it because I remember what was at least months if not a full year of the friends UI just saying it failed to connect to the Friends network.

The actual matchmaking never had any real issues that I remember, but the login servers definitely did, and deleting clientregistry.blob and restarting steam was just a routine thing you did to get steam working again.

None of this is really that surprising though, steam was originally a tool just for beta testers, while the live game used WON for matchmaking. WON was shutting down and Valve had to rush steams public release.

I'm a somewhat old coot and do remember those days, but I think the term still makes sense but only in a lan environment.

machines still have hostnames, and home routers will often trust your dhcp clients machine name.

So I can still look up steamdeck.lan and find the IP of my steam deck and in that context calling it a machine name is perfectly apt and I think would still be well understood.

Not as far as I'm aware, at least not without some really clever attack. The design is such that all you're doing is asking the remote agent to use it's private key to sign things, it never actually exposes the private key. Your agent doesn't even always have access to your private key- it could be on a TPM or Yubikey where the key never leaves the device. you are just passing around a connection to your agent that is able to authenticate with a private key.

I would not be surprised if there is some way to attack this into getting a private key, but it would either be a direct attack on the agent code like sending it malformed messages to somehow get remote code execution to then read the key. Or some more complicated attack on the cryptography where you repeatedly force it to auth and can somehow use the results to reduce the key space needed to brute force the key - along the lines of a known plaintext attack.

But I'm also just a hobbiest here who has looked a little into the security model but I am by no means a cryptography expert, so take all of this with a grain of salt.

Thats typically something you can configure in your terminals settings. Though avoiding requiring everyone know how to do this and actually do this is an improvement in developer experience so there's some merit here.. but is there any real standards around what characters get included in copying like this, or any best practices based on common defaults?

if not it might just become a situation of optimizing for your own workflow. and considering how ubiquitous uuids are and how common dash delimiters are outside of that(jira ticketscome to mind) maybe it would be better to fix places where double click selections do not include dashes instead of trying to avoid dashes in identifiers?

They each have tradeoffs even only considering security.

Consider a situation in which there is a new vulnerability in openssl. you can treat this as a hypothetical question or just.. remember any of your past experiences of any of the many openssl vulns.

How many binaries on your server use the vulnerable version? If all binaries are dynamically linked you can answer this fairly trivially with a shell script to enumerate binaries, pass them to ldd, and a little grepping. If all of your binaries are statically linked what do you do? Ideally pull the build info from your build server that shows you every version of everything that went into the binary.. which is data that just doesn't exist for most people

Maybe you scan the binaries to do some kind of signature analysis... but I would not be confident in the results not having false positives and false negatives.

Now let's patch it. How quickly can you recompile every static binary on your server? Can you even easily cut new builds of these existing versions but with a small patch increment or will your dev teams just rush a new release of any changes they're working on?

or with dynamically libraries, you update the library on your server and be done with it

... or so you thought. you didn't check what processed were running with the old library still open in memory and restart them so you're still vulnerable :)

I'm not the OP but that sounds like http desync bugs like https://portswigger.net/research/http-desync-attacks-request...

What is a sane default for retries? is it to loop indefinitely? should it retry against the same TCP connection or establish a new one? To the same IP it picked the first time or a different one, or reresolve the DNS entirely? against the same resolver?

IMO theres too much complexity for 'sane defaults' to not just be 'surprising behavior' for someone else's use case.

I wonder how long until we can just use LLMs to do that for us - first summarizing a blog post (already something we've seen many examples of LLMs doing) but focusing on extracting factual claims, then using those as context when injesting linked sources to output to find what in the sources actually backs up the claims or if anything in the source goes against the claims made

I don't believe a remote host that has access to your forwarded agent can extract the keys().

But they can tell the agent to authenticate with any key loaded in your agent, not just the one you used to ssh into the machine you forwarded your agent to

So e.g if you have a distinct ssh key for GitHub and a different one for all other uses and you ssh to a compromised server with agent forwarding, the attacker can then ssh to GitHub as you.

() there was a vulnerability not too long ago involving getting the remote agent to load arbitrary shared objects for remote code execution, which obviously changes things

Is the increased resource usage inherent to the model or does it only happen when using the extra context? Like if your workflow currently fits in a 2k model would an 8k model be objectively worse and only worth using once you've filled the context up of a smaller model? Or would it be worth always using an 8k context model and just knowing it will get slower and more resource hungry as your context grows?

Sorry for the random question, I've just been curious about this for a while and unable to find out and you seem knowledgeable about these extended models.

The 'fuck ups' can be retroactive through. So you could do something that was totally fine and make multiple videos of said things, then have all of them individually flagged at some point in the future.

Nintendo has done this on multiple occasions.

Wouldn't that be better solved with health checking and removing the poor performing server from the pool?

That was true of early captchas but Google changed it from 'wasting humans time' to 'using humans time to train their machine learning algorirhms'

I assume it would be the same as when people install solar panels and feed excess power back into the grid. Many power companies do pay people for the excess power and you can in effect be a producer for your electric company and not a consumer.

Unfortunately not all of them do that. Austin Energy for example charges you the normal rate for all electricity you use even if you generate it with your own solar, and then monitors how much you generated and pays for that at a lower rate in the form of credits. So if you generate enough extra power you can end up with a $0 bill and reduce your next bill. But if you generate more than you use every month you'll never get any monetary return, and of course the rates can vary.

I hadn't set this back up after getting a new laptop, but it's great for any of the one-off things you might need to do like confirm that some webserver is down like someone on chat complained it was, or lookup an ip or dns entry.

So the real benefit IMO is that it then lets you keep your actual terminals more clean and focused, and not just interleave that kind of stuff with whatever you are doing.

> >without it other computers can [...] lie about their identity

> Are you saying that my demand to not have a server control what my client does is an act of control over what their computer does?

Yes. The owner of that computer does not want to serve your requests and you want to prevent them from exerting that control over their computer.

>Like if I told you not to use your forklift to take my stuff, I'm asserting power over your property?

Yes that is what is being argued here. Forklift owners demanding the right to lie about using a forklift to property owners like Google who do not want to allow forklifts to take their stuff.

the better argument is just flipping the perspective. if your computer runs a web server this increase the control because without it other computers can connect to it and lie about their identity. that's not to say I think this is a good thing, I just don't think control over your computer is a good argument when both sides of a connection are computers, and both operators want not just control over their computer but also what the other computer can do.

I've had mild success using Any desk to remote control a phone, but that only works for app issues and not random power or reboot issues. you could slightly help that with a smart power strip to power cycle.. but only if you had a phone with no battery that still ran when plugged in. maybe if you even could remove all security so it doesn't require a pin on reboot ... but then you can't trust it for 2fa stuff