owl57 · HackerTrans

w zeszłym miesiącudiscuss

If you have a service that shares information between people all over the world, a few big companies and one government is for most cases an improvement over all the involved ISPs and all of their respective governments.

owl57

w zeszłym miesiącudiscuss

If the malicious-npm-package-of-the-week is reading arbitrary files on your workstation, isn't it usually able to run git clone/push/whatever with your current credentials anyway?

owl57

2 miesiące temudiscuss

But then why change the renewal process for the people who were already fingerprinted for the original visa?

owl57

2 miesiące temudiscuss

I often use vim despite knowing only a few basic commands because I'm already running various commands on the remote machine in the terminal and don't want the context switch. And because connection / file path completion in TRAMP is annoyingly slow if the server is far enough.

As an extreme example, today I needed to combine parts of two files into one and decided that

  cat foo bar > foobar && mv foobar bar && vim bar

of all things will better keep me in the flow than either googling how to insert one file into another in vim or starting up TRAMP.

owl57

2 miesiące temudiscuss

This idea of everyone producing absurd amounts of git objects is less fantastic now [1]. We're still far from these numbers, but an order of magnitude less far than last year [2].

Also an interesting bit of history here: apparently there was a time when people were already writing books on Git but "one enormous Git repository" wasn't yet the most common mode of using it.

[1] https://news.ycombinator.com/item?id=47932422

[2] https://x.com/kdaigle/status/2040164759836778878

owl57

2 miesiące temudiscuss

And the U in GNU, while we're at it.

owl57

7 miesięcy temudiscuss

And most of them are pretending to be Chrome. If Google had a good case against someone reusing their user agent, maybe they would already have sued?

Or maybe not. Got some random bot from my server logs. Yeah, it's pretending to be Chrome, but more exactly:

"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"

I guess Google might be not eager to open this can of worms.

owl57

7 miesięcy temudiscuss

> scrapers can ingest them and say "nope we won't scrape there again in the future"

Do all the AI scrapers actually do that?

owl57

7 miesięcy temudiscuss

> Hey I wonder if there is some situation where negative SEO would be a good tactic. Generally though I think if you wanted something to stay hidden it just shouldn’t be on a public web server.

At least once upon a time there was a pirate textbook library that used HTTP basic auth with a prompt that made the password really easy to guess. I suppose the main goal was to keep crawlers out even if they don't obey robots.txt, and at the same time be as easy for humans as possible.

owl57

6 lat temudiscuss

There's about a dozen Russian posts now, only one of which looks like spam.

owl57

8 lat temudiscuss

> How the wayland server and the shell are going to share (or agree to) that file descriptors or secrets in the first place?

I read that GNOME just implements both in the same program (and calls it "shell").

> Or how can you ensure that the shell is not a rogue one?

I'm confused. Do you mean this kind of attack would become somewhat more probable or more dangerous if the original shell had some mechanism of allowing certain apps to pick colors?

owl57

8 lat temudiscuss

Assuming other apps are sandboxed from /proc/1234, can't the shell just exec "/usr/bin/foo" and pass some file descriptors or secrets in environment variables?

comments