ebfe1

6 ms·

1.
by ebfe1 1mo ago
It's DNS issue, i'm telling ya!
2.
Show HN: Yes, I vibed coded something But not sure what to do with it(trustenvelope.com)
2 points by ebfe1 4mo ago|2 comments
3.
by ebfe1 10mo ago
I will look into that, thanks for the recommendation!
4.
by ebfe1 10mo ago
TIL! Thank you!
5.
Ask HN: Do you use your phone as hotel/free WiFi condom for laptops?
4 points by ebfe1 10mo ago|5 comments
6.
by ebfe1 1y ago
Anyone know if there is a public events feed/firehouse for npm ecosystem system? Similar to GitHub public events feed? We, at ClickHouse, love big data and it would be super cool download and analyse patterns of all these data & pr
7.
S1ngularity/nx attackers strike again(aikido.dev)
1 points by ebfe1 1y ago|1 comments
8.
by ebfe1 1y ago
I found there are many links from stepsecuritiy, socket.dev but aikido seems to have the most up to date information about this ongoing npm hack.
9.
by ebfe1 1y ago
Is it just me who think this could have been prevented if npm admins put in some sort of cool off period to only allow new versions or packages to be downloaded after being published by "x" amount of hours? This way the npm mainta
10.
by ebfe1 1y ago
I don't see mentioning of e2e encryption, that would be nice but I love the webrtc usage here! Shameless plug: I built small file sharing tool with encryption in browser and added a "tunnel" feature to make it easier for shar
11.
by ebfe1 1y ago
Honest question: So who gets this $1.38B? The user? Some company? The government/treasury?
12.
by ebfe1 1y ago
Yea hence it prompts for you to check the first time but once you verify the hash for particular version of action, it would automatically apply the hash to that same version of action everywhere. Also you can reuse the same config for all
13.
by ebfe1 1y ago
Yeap - that is exactly what it does ;) Example: uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 #v1.16.0 And for anything that previously had @master, it becomes the following with the hash on the day it was pinn
14.
by ebfe1 1y ago
oh damn - that is a great point! thanks matey!
15.
by ebfe1 1y ago
After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features&quot
16.
by ebfe1 1y ago
Ok ....where is the form so as an ex-whatsapp user, I can get a piece of that 167M pie? Oh... there isnt one... :)
17.
by ebfe1 1y ago
And this is how Chinese model will win in long term, perhaps... They will be trained on everything and anything without consequences and we will all use it because these models are smarter (except for area like Chinese history and geography
18.
by ebfe1 1y ago
Like any tech nerds, I went through "camera phase" and carried canon 350d, 50d then 6d everywhere i go with my 50mm and 135mm ... but they were indeed bulky, it was a hassle to get people to pose for photos while i run 100m back s
19.
by ebfe1 1y ago
Not exactly related but on the topic of finding target's location, A few years ago i used to run a little demo of capturing probe wifi ssid network on prefered network list of nearby devices and used https://wigle.net/
20.
by ebfe1 1y ago
100% this... the authn/authz should be gated at the server that store sensitive data... whatever token/user that MCP uses must have its access scope down to what needed. I guess the biggest issue right now is many of these APIs ha
21.
Show HN: Pin My Workflow(github.com)
2 points by ebfe1 1y ago|0 comments
22.
by ebfe1 1y ago
Love the use of chdb for this!
23.
Ask HN: What tricks do you use to protect yourself against cyber attack?
4 points by ebfe1 1y ago|1 comments
24.
by ebfe1 2y ago
I wonder if they forked it to "experiment" with the workflow coinbase has and doesn't actually make any pull request toward them, perhaps to validate their hypothesis/attack. with that said, coinbase pulled the workflow
25.
by ebfe1 2y ago
It seems i forgot to cater for the quota applied to free "play" user in ClickHouse in my previous query... In fact, the threat actor did a lot more... this should give a better list of actions that was performed - Clearly showed h
26.
by ebfe1 2y ago
Note that these account seems to be deleted now - 2ft2dKo28UazTZ clearly did more than just changed-files and also seem to target coinbase/agentkit as well (Actually .. they might be targeted by the threat actor)
27.
by ebfe1 2y ago
Doing a bit of investigation with github_events in clickhouse, it is quite clear that the accounts used to perform the attack was "2ft2dKo28UazTZ", "mmvojwip" also seems suspicious: https://play.clickhouse.com
28.
by ebfe1 2y ago
That is correct and s3 are in 3 different regions with object lifetime of maximum 10 days, it is backed by s3, the idea is to have the simplest code for anyone to review what it does (encrypt in browser and send encrypted blob to s3, key ne
29.
by ebfe1 2y ago
Oh i love the use of webrtc for this, thank you for sharing! This was my half day covid project to share file... inspired by firefoxsend a while back... https://www.relaysecret.com/ the infra is super lightweight and you ca
30.
by ebfe1 2y ago
AFAIK, Opensource Elasticsearch does not offer any form of authentication upon installation for many years but ClickHouse does and in fact I'm often surprised at how many authentication mechanisms were introduced over the years and can

More ›