greysteil

6 ms·

1. 1.▲
   by greysteil 1y ago

   Is $2,300 the going rate for an RCE with a totally believable attack vector these days?
2. 2.▲
   by greysteil 1y ago

   I dunno, I’m still pretty surprised the MCP server auth process could pop a calculator on widely adopted clients. The protocol isn’t perfect but that’s totally unnecessary unsafe. Glad it’s fixed!
3. 3.▲
   by greysteil 1y ago

   PM at Figma here (for dev tools, not slides). What happened to Allen here sucks. I've messaged the team so we can dig into this specific case. More generally, we know that Slides needs to be bulletproof when presenting, and nothing les
4. 4.▲
   by greysteil 1y ago

   I did most of this too! It was great. Do you have recommendations for folks who can only do a shorter trip (say, a long weekend, or a week)?
5. 5.▲
   by greysteil 1y ago

   Thanks! I haven't used Pulsar, but the general answer is that mentions.us is focussed on sending you alerts for notifications, whereas more sophisticated social listening tools provide a lot more analytics (e.g., sentiment analysis). I
6. 6.▲
   by greysteil 1y ago

   For now we use the LinkedIn voyager API's search endpoint
7. 7.▲
   by greysteil 1y ago

   I put more details in a reply to another comment, but basically I think the number of people willing to pay for email alerts is small, so I’ve made the service free for them. It’s only teams who want Slack notifications who have paid plans.
8. 8.▲
   by greysteil 1y ago

   We’re hooking up to the APIs - the goal is to alert you of mentions as quickly as possible, so waiting for Google to index results would introduce (much) too much lag. Interesting feature request! I’ll have a think on it.
9. 9.▲
   by greysteil 1y ago

   Thanks for the feedback! For saved terms we show you the number of matches we’ve notified you about, which always starts at zero, whereas during creating we show you how many you would have matched. That’s a confusing UI and I should improv
10. 10.▲
    by greysteil 1y ago

    Hey Julien! I’ve seen you advertising KWatch in lots of places, assume you’re connected to it / know the founder? For LinkedIn monitoring we use the voyager APIs. It’s not perfect because it gets posts but not comments, but it’s pretty
11. 11.▲
    by greysteil 1y ago

    I think most of the people who sign up for email alerts would never pay. Lots of them are indie hackers or folks with a side project - I've been there, and know how price sensitive those communities are. I'd rather they use the se
12. 12.▲
    by greysteil 1y ago

    :D
13. 13.▲
    by greysteil 1y ago

    Through the API - in particular the info endpoint[1], combined with the fact that Reddit IDs are base36 encoded sequentially increasing integers[2]. You can get 100 objects at a time, so if you make ~3 requests a second it's enough to
14. 14.▲
    by greysteil 1y ago

    I've been building mentions.us[1] - it sends you alerts when your keywords are mentioned on Hacker News, Reddit, Bluesky, LinkedIn and a few other places. For anyone who uses F5Bot, it's similar but with some extra data sources an
15. 15.▲
    by greysteil 1y ago

    Can we take a moment to appreciate how good the disclosure and coordination process on this were? * Reported to the maintainers privately * Patch published and CVE issued before wider disclosure * Automated fix PRs created within minutes of
16. 16.▲
    by greysteil 1y ago

    I'm a bootstrapped solopreneur at the moment. I would maybe use this, but I generally DIY everything. For contracts, for example, I'd probably just dust off the YC template, make a few tweaks, and not sweat it. For my T&Cs I t
17. 17.▲
    by greysteil 1y ago

    I'm building mentions.us. It's a simple idea - alerts for keyword mentions on Hacker News, Reddit, Bluesky, etc., but has been a fun project. I wanted to build something that had broader coverage than F5Bot (which is excellent) an
18. 18.▲
    by greysteil 2y ago

    Yeah, it's on my list. When you're scanning sites with high volume (Reddit has ~300 posts per second, Bluesky has ~100) you have to keep things fast and cheap, so I think keywords still have a role, but I think they can become an
19. 19.▲
    by greysteil 2y ago

    I've been building https://mentions.us for the last couple of months. It's a little web app that monitors Reddit, Bluesky, Mastodon, Hacker News and a bunch of other sites for keyword mentions. Not an original idea (F5
20. 20.▲
    by greysteil 2y ago

    I’ve found that everyone learns in different ways, and if having mentors / seniors to absorb knowledge from is how you learn best then I’d agree with the comments suggesting you change roles. However, if you learn well by doing, or by
21. 21.▲
    by greysteil 2y ago

    Pincites | Software Engineers | ONSITE (NYC) | Full-time Pincites is automating contract review with AI. We integrate with Microsoft Word to help in-house legal teams review and redline contracts faster. You can read more at pincites.com. W
22. 22.▲
    by greysteil 3y ago

    Same goal, different strengths / weaknesses. GitHub has really focussed on preventing credential leaks. It's particularly good at scanning for highly identifiable patterns and preventing pushes that include them. That makes sense
23. 23.▲
    by greysteil 3y ago

    It’s a bespoke scanning setup designed to deal with GitHub’s scale, minimise false positives, and scan fast enough to be in the `git push` request/response cycle. Under the hood it’s using Intel’s hyperscan as the regex engine. https:
24. 24.▲
    by greysteil 3y ago

    I worked on this before leaving GitHub a couple of months ago. It’s awesome. This release is a repo-level setting, which is nice, but it will be even more useful when the team releases a user-level setting in June/July. That will allow
25. 25.▲
    by greysteil 3y ago

    Have hope. There are structural differences between spammy accounts and real ones, because their incentives are different. That will always be the case (it’s pretty much true by definition) and can be used to distinguish the accounts. AI ha
26. 26.▲
    by greysteil 3y ago

    Not just that, though? I thought the comparison with the cost of sponsoring Citi Field was instructive - compared to that it does look like the advertising benefits to Citi from the deal are outsized, and there is a competitive market for t
27. 27.▲
    by greysteil 3y ago

    If it’s the same as NYC then the steam you see is generally from water evaporating off the outside of the pipes ( not steam escaping from the pipes). The pipes are very hot, so any outside water that touches them quickly turns to steam. h
28. 28.▲
    by greysteil 3y ago

    +1 for this approach (and thanks for all your work on PyPI William!). FWIW, I think it's worth clarifying that PyPI is already involved in malware detection and takedowns (as are almost all the package registries). The curation that co
29. 29.▲
    by greysteil 4y ago

    GitHub PM here, just confirming that that's correct (re: us sending detected secrets to the relevant service provider, who take action automatically). There's more detail here: https://docs.github.com/en/code-
30. 30.▲
    by greysteil 4y ago

    GitHub PM here. Right now we scan code, commit metadata, issues, and issue comments. We're expanding to other content types over time, with support for pull request bodies and comments coming in early 2023. Actions logs are on our list