[-] towerful@programming.dev 7 points 4 months ago

Yeh, for 99% of casual internet users... they just aren't going to care about that.
They don't want their email/Facebook/back account pwnd.
Like, at all.

It's like saying that 0.01% of traffic fatalities are because an airbag forces your head into the roof of the car. So you should wear a helmet when driving.

You aren't wrong.
Internet is a massive part of our daily lives. We should be able to fully trust the things we use to interact with it.
But convenience is going to win

[-] towerful@programming.dev 7 points 4 months ago

Sure, or make a good product?
That's what other companies do. They make a good product, and people then depend on it.
The shitty VC companies then enshitify.
The actual "we believe in our product" companies continue making a good product.

[-] towerful@programming.dev 7 points 6 months ago

Well the point is that he should never have been the headline to start with.
And now all the sponsors have pulled out, because they don't want to be associated with a festival that is promoting a person like Kanye.

[-] towerful@programming.dev 7 points 1 year ago

He is. But the people around him and controlling/handling him aren't idiots.
It's either in project 2025, or some other republican playbook. Scattershot out a bunch of crazy news to swamp the news cycle and overwhelm everyone, then get to work doing the dirty stuff

[-] towerful@programming.dev 7 points 1 year ago

I swear there was a phase where shakey-cam had just become the in-thing.
I remember watching a TV series or a movie or something where shooting had clearly wrapped before shakey-cam was popularised. And it looked like they had just added it in post. It was unnatural movement (so, not like someone was holding the camera), and there was too much of it. I had to skip a lot of the shakey-cam scenes

[-] towerful@programming.dev 7 points 2 years ago

I hope this is a pausing strategy.
A few more days to see what shakes out of the EU and other allies.
EU and US are about equal for contributions:
https://www.bbc.co.uk/news/articles/crew8y7pwd5o

Considering that the eu is looking at €800bn spending to help arm Ukraine (https://apnews.com/article/europe-defense-ukraine-united-states-trump-c1f12e685afc3e2ca94c9a15ea28d8bb) I don't blame Ukraine for stalling to see what happens.
Monitarily, the EU is the biggest ally. The US is the biggest single ally, but not the biggest ally.
I expect big things from the EU in the next few days, and - in a dream scenario - Zelensky goes back to the white house to "capitulate" and tells them to fuck themselves on live television.
Because you KNOW trump wants Zelensky bending-the-knee to be televised

[-] towerful@programming.dev 7 points 2 years ago

I thought T568B at each end was standard practice these days

[-] towerful@programming.dev 7 points 2 years ago* (last edited 2 years ago)

Follow sensible H&S rules.
Split the responsibility between the person that decided AI is able to do this task and the company that sold the AI saying it's capable of this.

For the case of the purchasing company, obviously start with the person that chose that AI, then spread that responsibility up the employment chain. So the manager that approved it, the managers manager, all the way to the executive office & company as a whole.
If investigation shows that the purchasing company ignored sales advice, then it's all on the purchasing company.

If the investigation shows that the purchasing company followed the sales advice, then the responsibility is split, unless the purchasing company can show that they did due diligence in the purchase.
For the supplier, the person that sold that tech. If the investigation shows that the engineers approved that sales pitch, then that engineers employment chain. If the sales person ignored the devs, then the sales employment chain. Up to the executive level.

No scape goats.
Whatever happens, C office, companies, and probably a lot of managers get hauled into court.
Make it rough for everyone in the chain of purchase and supply.
If the issue is a genuine mistake, then appropriate insurance will cover any damages. If the issue is actually fraud, then EVERYONE (and the company) from the level of handover upwards should be punished

[-] towerful@programming.dev 7 points 2 years ago

I grew to love bf1.
BFV was great when it was one-shot-kill, but you could tell the devs made it because they had to, whereas BF1 was a passion project.
I haven't played any of the BFs after that (including their BR modes and all that)

[-] towerful@programming.dev 7 points 3 years ago

I think those are the triggers/fuses (fuzes?)

If you look at the larger ones, it looks like they have a "socket" in the top for the smaller brown bits to fit in

[-] towerful@programming.dev 7 points 3 years ago

It's beautiful!
Once you get something running proxmox you will fully go down the rabbit hole!
You will be thinking about k8s clusters, DNS and domain management, redundancy & availability, services for this, that and everything!
Before you know it you will have a rack of 8 servers doing various things, 2 UPSs, a standby generator and a backup 5G wan connection!

Or, you know, as much of that as you want.

[-] towerful@programming.dev 7 points 3 years ago* (last edited 3 years ago)

From what I have read so far....

XSS injection in custom emojis.
Essentially, custom emojis used by instances could allow a malicious actor to execute arbitrary code on clients that saw the emoji (within the scope of the website).
There is speculation about links and other vectors, but those aren't clear yet. But the successful attacks have been tracked back to emojis.

The emojis aren't federated, so it would only affect users of that instance that viewed the emoji during the attack.

The injected script (as it was being execute as part of the client UI, thus trusted) had access to the client cookies for the instance.
It would steal the JWT tokens stored in the cookies and send them to a 3rd party site.

Tokens of Admins were then used by the attackers to deface the sites.

It's unclear what user data would have been vulnerable during this time - still being investigated.
There is a high likelihood that this is a GDPR reportable incident.

The fix is for admins to delete all custom emojis via the database, then rotate JWT secrets.
Rotating the secrets invalidates all users JWTs, so everyone has to log in again. This also invalidates the stolen JWTs.

view more: ‹ prev next ›

towerful

0 post score
0 comment score
joined 3 years ago