HackerLangs
TopNewTrendsCommentsPastAskShowJobs

tkel

465 karmajoined vor 10 Jahren

Submissions

Six New High Severity CVEs for Next.js and 1 for React

github.com
4 points·by tkel·vor 2 Monaten·2 comments

comments

tkel
·vor 10 Tagen·discuss
All this hypothetical grandstanding is so obnoxious. Have you seen the video? There was just a few fireworks, regular ones purchased from a roadside stand. They went into the air, FAR from the facility. There was no damage. It's called a noise demonstration. The prisoners were watching from inside and cheering in response. Please go outside on the 4th of July while people are setting off fireworks and touch grass.
tkel
·vor 11 Tagen·discuss
I reject that simplistic fearmongering, the US acts as a neoliberal warlord on the international stage, but my point is that what the state chooses to do with the monopoly on violence is extremely political.
tkel
·vor 11 Tagen·discuss
I'm not trying to redefine the word for everyone, I'm speaking to you, I'm trying to get you to be more critical of your own personal usage of the word. When you adopt/parrot someone's claim about terrorism, that is not a neutral territory, and certainly isn't "fact-based". Especially if your other claims/deductions are downstream of the word "terrorism". It is almost always used as a propaganda term, commonly to justify horrific things, clearly it's been effective on you as well. There's a good book that spends a huge amount of time dissecting the use of the word terrorism you should check out: "Manufacturing Consent".

Besides I don't think you can neatly cleave the world, or this website, or the news, into "facts" and "emotions" as you seem to think.
tkel
·vor 11 Tagen·discuss
OK, July 4 is coming up, get ready to throw hundreds of thousands of people in jail for decades for setting off "explosives", right? Most fireworks, you can literally stand on top of them while they are going off and not be injured. I've seen videos of police doing it while just wearing light body armor, unphased. Stop being ridiculous. These laws about explosives were intended to be used for military-style weapons.
tkel
·vor 11 Tagen·discuss
"Terrorist-related crime"? I mean, wouldn't the entire US air force be guilty of "terrorist-related crimes" for recently bombing a school full of children in Iran? Yet you don't see them being charged. Courts and the term "terrorist" are tools applied by the powerful to those without power in society.
tkel
·vor 11 Tagen·discuss
Prisons are political violence. War is political violence. Policing is political violence. Pretty rich to hear moralizing about "poticial violence" from US citizens, the country which has the largest military, largest prison system, and spends the most on policing out of any country on the planet.
tkel
·vor 11 Tagen·discuss
Also, "It's okay for the government to shoot people, use explosives, kidnap people and put them in cages for their entire lives. But if you try to stop them, you are bad and deserve to be in a cage for your entire life."
tkel
·vor 11 Tagen·discuss
"Lure police into an ambush" is quite a stretch. It's quite normal to do noise demonstrations outside jails/prisons to show solidarity with the captives, the captives will often times knock on the windows to communicate back. In fact there were noise demonstrations outside the Delaney Hall ICE jail in New Jersey just this month, which you may have heard about. The mischaracterization of fireworks as "explosives" is also a huge stretch by the government in order to pursue their antifa conspiracy.
tkel
·letzten Monat·discuss
This is a problem fundamental to capitalism. Capitalist organizations are organized as dictatorships, with capitalists as the dictators. Captialists have their own class interests that is opposed to the workers'. And they also are the ones who unilaterally decide how increased productivity gains (revenue/profit) are distributed. They are not going to decide to give you another day off. They are going to maximize profit.

ALL technological progress under capitalism goes through this same conflict. It's why workers are sometimes pressed into reactionary positions like opposing self-checkout lanes. Capitalists decide to deploy the technology in a way that is worse for the workers. Technological progress could be liberatory. Technology could be used to make workers' lives better, like working less, if workers were in charge of the organizations in which they worked.
tkel
·letzten Monat·discuss
I don't know about a hole, but the reason why the tank didn't rupture, is because a crack was discovered, which relieved the pressure. They got lucky.
tkel
·vor 2 Monaten·discuss
It's nothing new, the Pentagon has failed 8 audits in a row. In just one year (2022), $220 Billion dollars of their spending were totally unaccounted for.
tkel
·vor 2 Monaten·discuss
Pretty ironic that this article was also written using LLMs. It has all the LLM-isms.
tkel
·vor 2 Monaten·discuss
Or even just a proxy that can enforce the constraints
tkel
·vor 2 Monaten·discuss
[dead]
tkel
·vor 2 Monaten·discuss
yes, props to pnpm for adding 1 day cooldown by default in v11.
tkel
·vor 2 Monaten·discuss
I audited several postinstall scripts recently in popular packages. They seem to be mostly around using native binaries, downloading them, detecting if the platform is compatible, linking to it directly instead of having it bootstrapped by node, working around issues in older versions of npm, etc. Since dev toolchains (e.g. esbuild) are now being built in compiled languages and distributed as binaries via npm registry. If you are on a recent version of node/npm and a common/recent OS/platform, you should be able to disable all the postinstall scripts without legitimate issue.
tkel
·vor 2 Monaten·discuss
at least 3 that i can remember off the top my head in these last couple months. If you look further back you will find more.
tkel
·vor 2 Monaten·discuss
shai-hulud and variants

https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-s...
tkel
·vor 2 Monaten·discuss
Just dont use npm. Use a package manager which doesn't execute postinstall by default. The switch is incredibly simple.
tkel
·vor 2 Monaten·discuss
If you look at the last N npm worms, they all used postinstall scripts.