mukesh610

6 ms·

1.
Code of Ur-Nammu(en.wikipedia.org)
5 points by mukesh610 10mo ago|0 comments
2.
by mukesh610 1y ago
From the README: A sync process syncs the open disk files once every config.syncInterval. Sync also can be done on every request if config.alwaysFsync is True.
3.
by mukesh610 1y ago
Ah, failed to notice that. I was so excited because this was exactly what I coded up today, I jumped straight to the comments.
4.
by mukesh610 1y ago
I built this very same thing today! The only difference is that i pushed the tool call outputs into the conversation history and resent it back to the LLM for it to summarize, or perform further tool calls, if necessary, automagically. I us
5.
by mukesh610 1y ago
Unintentionally discovering a thing you know you're going to hate has got to be top 10 internet experiences.
6.
by mukesh610 1y ago
Even then, use of a DNS CAA record should mitigate this, right?
7.
by mukesh610 1y ago
Both articles are correct, from me reading them. When you invoke a shell script directly, it gets passed to the kernel to try and execve. The kernel returns ENOEXEC when it detects it doesn't have a shebang. The shell catches the error
8.
Advanced web application fingerprinting with favicon hashes(blog.razzsecurity.com)
1 points by mukesh610 2y ago|0 comments
9.
by mukesh610 2y ago
No, in my YAML example, you could see that there were no credentials directly hard-coded into the pipeline. The credentials are configured separately, and the Pipelines are free to use them to do whatever actions they want. This is how all
10.
by mukesh610 2y ago
You're right, there are other avenues of exploitation. This particular approach was interesting to me because it is easily automatable (scour the internet for exposed credentials, clone the repo and detect if Pipelines are being used,
11.
by mukesh610 2y ago
It's pretty common in systems where the final output to be deployed is the same as the root of the source tree. More often than not, lazy developers tend to just git clone the repo and point their web server's document root to the
12.
Exploiting CI / CD Pipelines for fun and profit(blog.razzsecurity.com)
124 points by mukesh610 2y ago|44 comments
13.
by mukesh610 3y ago
Don't use this. I once tried it and it changed the UUID of the Linux partition without any warning. Grub was unable to pick up the partition and boot, so I was stuck at grub rescue. God knows what other bugs their software has.
14.
by mukesh610 4y ago
Not exactly sure how streamlined your security process is, but for some orgs it is a red tape roller coaster to even get one TCP port open. Anyways, you could also block all traffic to ngrok servers just to ensure your Dev teams aren't
15.
by mukesh610 4y ago
IMO fair use is still not a strong argument for Microsoft. They commercialized the product and made money out of it. Fair use is only allowed if the work you're doing is purely for the greater good. I might be wrong though, IANAL.
16.
by mukesh610 4y ago
I don't see what your comment is trying to point out. The same could be said for all the other Secret Scanning partners GitHub has, like AWS and so on. That being said, it's impossible that a "bad regexp" is gonna make i
17.
by mukesh610 4y ago
Detecting GPT generated content will take a fairly large language model to be reliable. Obviously this would need to be run in the cloud. Considering Apple's stance on privacy, sending private correspondence to the cloud is a huge no-n
18.
by mukesh610 4y ago
I'm confused. In your first comment you seemed to refer to legitimate sites harvesting credentials using Google SSO (whatever that means) Now you're talking about phishing sites. Can you clarify which kind of websites you're
19.
by mukesh610 4y ago
There's a difference between getting fired and laid off
20.
by mukesh610 4y ago
Fiction isn't exactly a good argument
21.
by mukesh610 4y ago
I'm interested in the thought process that made you conclude that that is the simplest explanation
22.
by mukesh610 4y ago
It depends on which keyboard you're using. I'm using the Google keyboard and it's pretty advanced: i typed this comment with it, and only corrected the word "typed" which showed up as "tired"
23.
by mukesh610 5y ago
I don't see the connection, but I know of a bunch of people who'd be pretty mad about how a corporation can remotely cut off an entire country's digital access.
24.
by mukesh610 5y ago
So right to repair right out of the window?
25.
by mukesh610 5y ago
Why is it "shocking"? Why are you saying "gender-dominated" like it's a bad thing? Which areas are "gender-dominated" that you are upset about?
26.
by mukesh610 5y ago
"Suggested searches" are not ads. I'm pretty sure Google does not financially benefit from a user mis-clicking on suggested searches.
27.
by mukesh610 5y ago
I'd say knowing your IDE well is critical to speeding up your workflow. I managed to fix three thousand code smells on a very badly written codebase in a span on two days. Thanks IntelliJ IDEA!
28.
by mukesh610 5y ago
Usually, I feel like git is more than enough. But when I have my push rejected because I failed to fetch first, it's just a single click in IntelliJ to fetch, rebase my work on that and push it again. There's also hub, from GitHub
29.
by mukesh610 5y ago
I'd say it's a rather insecure platform if it's meant to evade surveillance. In a heavily censored state, the only types of people who'd use this platform are those who are against the state, and if the state gets hold o
30.
by mukesh610 5y ago
As I've commented elsewhere, DoS can be easily mitigated by implementing another layer with basic object recognition to filter out false positive collisions.

More ›