Skip to main content

2024-09-11

We spent $20 to achieve RCE and accidentally became the admins of .mobi

  • Researchers exploited vulnerabilities in WHOIS clients and discovered the old .MOBI TLD WHOIS server domain was available for purchase, leading to unexpected control over the domain.
  • Their server received 2.5 million queries from various entities, including government and military, cybersecurity companies, and Certificate Authorities (CAs), exposing significant security risks.
  • The incident highlights vulnerabilities in the WHOIS system and CA verification process, emphasizing the need for continuous security testing and vigilance against outdated internet infrastructure.

Reactions

  • Researchers spent $20 to gain Remote Code Execution (RCE) and accidentally became admins of the .mobi TLD due to an expired domain.
  • The incident underscores the importance of never letting a domain expire and suggests that Verisign's monopoly on domains should be regulated.
  • The article emphasizes the fragility of TLS/SSL and the critical need to maintain domain ownership to prevent security breaches.
  • Pave, a YC-backed startup, assists other startups with compensation by integrating with HR and Payroll systems to aggregate data and provide compensation range breakdowns.
  • There are concerns about whether this practice could be considered anti-competitive wage fixing, similar to the case with RealPage, raising questions about the legality of colluding on wages.
  • The legality and ethical implications of Pave's business model are under scrutiny, as colluding on wages is generally illegal.

Reactions

  • Pave, a YC-backed startup, aggregates data from HR and Payroll systems to provide compensation ranges, raising questions about potential anti-competitive practices.
  • Critics compare Pave's service to RealPage's rent pricing issues, while others argue that sharing compensation data isn't illegal without explicit wage-fixing agreements.
  • Similar services, such as Equifax's "The Work Number" and Radford, have been around for years, but concerns about privacy and wage suppression persist.

Another police raid in Germany

  • On August 16th, 2024, German police raided the home and office of Artikel 5 e.V., aiming to de-anonymize Tor users, but seized no hardware.
  • Artikel 5 e.V. plans to legally challenge the search warrant to prevent future raids and is calling for a general assembly on September 21st, 2024, to discuss the organization's future.
  • The assembly will consider options such as finding new board members, stopping exit nodes, or liquidating the organization, with details available on their website.

Reactions

  • A Tor Project forum user shared their experience of running Tor exit nodes for five years, during which their hosting provider received three subpoenas from law enforcement.
  • The subpoenas were related to serious incidents, including a bomb threat, phishing email, and nation-state hackers from Qatar, leading the user to shut down their exit nodes due to stress over potential legal consequences.
  • The discussion highlighted the ethical implications and the balance between privacy and crime prevention, with hopes to resume operations in the future despite challenges from law enforcement.

The magic of DC-DC voltage conversion (2023)

Reactions

  • DC-DC converters use inductors to create voltage spikes, which charge capacitors, similar to an auto ignition system.
  • They are efficient but require safety measures like current limiters or fuses to prevent fires.
  • Types include boost, buck, and transformer-based converters, with the latter offering input-output isolation for safety; practical uses include converting USB 5V to 120V for antique devices.

Chai-1: Decoding the molecular interactions of life

  • Chai-1 is a new multi-modal foundation model for molecular structure prediction, excelling in drug discovery tasks, and is available for free via a web interface for commercial use and as a software library for non-commercial use.
  • It achieves a 77% success rate on the PoseBusters benchmark and outperforms AlphaFold-Multimer in folding multimers, with a 69.8% accuracy.
  • Chai-1 can predict multimer structures using single sequences and doubles antibody-antigen structure prediction accuracy with epitope conditioning.

Reactions

  • Chai-1, a new model for decoding molecular interactions, has been released, sparking significant interest in the tech community.
  • The model claims to improve upon AlphaFold, a well-known protein structure prediction tool, but the improvements are marginal, with only a 1% higher score on one metric.
  • Concerns have been raised about the potential misuse of such technology for creating bioweapons, although experts argue that the complexity of molecular biology makes this unlikely.

How economical is your local Taco Bell?

Reactions

  • Discussion centers around the pricing and features of various Taco Bell locations, highlighting the unique Pacifica Taco Bell with amenities like a fireplace and margaritas.
  • The Seattle Lower Queen Anne Taco Bell/KFC combo store is noted as the most expensive Taco Bell in the nation, with users sharing their experiences and frustrations with the Taco Bell mobile app.
  • The Taco Bell app is criticized for its data collection practices, with users debating its necessity versus traditional ordering methods, and its role in price discrimination and targeted marketing.

Why Not Comments

  • "Logic For Programmers v0.3" has been released, focusing on improved book formatting.
  • The release emphasizes the importance of comments in code, particularly for explaining "why" decisions and tradeoffs, which cannot always be self-documented through function or variable names.
  • An example is provided where a comment explains the choice of an inefficient method for replacing math notation with Unicode symbols, highlighting the tradeoff and future optimization potential.

Reactions

  • Comments in code should focus on explaining "why" and "why not" to aid future understanding, especially in large, complex codebases.
  • Mandatory comments for obvious functions are seen as wasteful and can lead to ignoring comments altogether.
  • While some prefer long function names or commit messages, the author finds comments essential for clarity, maintenance, and documenting decisions and trade-offs.

Flipper Zero Gets Major Firmware Update, Can Eavesdrop on Walkie-Talkies

  • Flipper has released a major 1.0 firmware update for its Flipper Zero multi-tool, significantly enhancing its functionality and user experience.
  • Key improvements include doubling Bluetooth data transfer speeds from Android, a 40% increase in Bluetooth firmware installation speed, and a revamped NFC engine supporting more card types and faster data reading.
  • The update also introduces new features such as the ability to eavesdrop on analog walkie-talkie audio, decode 89 radio protocols, run apps directly from microSD cards, and extend battery life to a month in low-power mode.

Reactions

  • Flipper Zero, a crowdfunded device, has received a significant firmware update enabling it to eavesdrop on walkie-talkies, fulfilling its promise of ongoing software enhancements.
  • The device is notable for its versatility and user-friendly interface, making it accessible for various radio frequency tasks, unlike traditional software-defined radios (SDRs) which require more powerful processors.
  • The update has sparked interest due to Flipper Zero's ability to perform multiple functions beyond eavesdropping, positioning it as a comprehensive tool for radio frequency enthusiasts and professionals.

Tutorial on diffusion models for imaging and vision

  • The tutorial by Stanley H. Chan focuses on diffusion models, which are pivotal in generative tools for text-to-image and text-to-video applications.
  • It is aimed at undergraduate and graduate students interested in machine learning and computer vision, providing foundational knowledge for research or practical applications.
  • The tutorial has been updated twice, with the latest version submitted on September 6, 2024, and is available on arXiv for further reading.

Reactions

  • A tutorial on diffusion models for imaging and vision has been highlighted, sparking interest among tech enthusiasts and researchers.
  • Various resources and discussions are shared, including Andrej Karpathy's YouTube tutorials, Sebastian Raschka's new book on building large language models, and 3Blue1Brown's video series on Transformers.
  • The tutorial emphasizes the mathematical foundation of diffusion models, with suggestions for more approachable resources like the Hugging Face course and blog posts for better understanding.

Git Bash is my preferred Windows shell

  • Git Bash has been highlighted as a preferred Windows shell, offering Unix-like command-line functionality within the Windows environment.
  • Key advantages include familiarity with bash commands, easy installation, small footprint, and integration with Windows File Explorer.
  • Git Bash supports many Unix-like commands and scripts, making it a versatile tool for developers working in a Windows environment.

Reactions

  • Git Bash is favored by many Windows users for its familiarity with Unix commands, making it a comfortable choice for those with Linux experience.
  • While PowerShell is praised for its structured data handling and .NET API, it is often criticized for verbosity and encoding issues.
  • Alternatives like WSL, MSYS2, and Busybox for Windows exist, but Git Bash remains popular due to its simplicity and ease of use.

Some of us like "interdiff" code review

  • Gerrit Code Review is an open-source tool compatible with Git repositories, facilitating patch writing, submission, feedback, and fixes.
  • Traditional GitHub code reviews can lead to "diff soup," complicating commit histories and making tools like git blame and git bisect less effective.
  • The "interdiff" review method, which publishes new versions of original commits, maintains cleaner commit histories and simplifies the review process using tools like git range-diff.

Reactions

  • The discussion highlights the use of "interdiff" code review workflows on GitHub, which allows reviewers to see diffs with feedback incorporated without breaking git blame and git bisect.
  • The workflow involves using git commit --fixup, git rebase --interactive --autosquash, and git push --force-with-lease to manage and merge changes efficiently.
  • The conversation underscores the limitations of GitHub's UX in handling advanced Git features like rebasing and autosquash, and suggests that better tools or workflows could improve the code review process.

Lottery Simulator (2023)

  • The PerThirtySix Lottery Simulator allows users to explore lottery probabilities and simulate thousands of tickets in seconds.
  • Users can set up simulations for existing American lotteries like Mega Millions and Powerball or create custom rules, including ticket cost and breakeven probability.
  • The tool provides visualizations of returns and includes simplifying assumptions such as a single jackpot winner and ignoring taxes.

Reactions

  • A new Lottery Simulator tool has been created, generating significant interest and feedback from users on Hacker News.
  • Users are suggesting various improvements, such as a faster simulation option, random number selection for each draw, and tracking the number of people who hit the jackpot.
  • The tool highlights the poor payout odds of lotteries, even when using custom number pools, and stimulates discussions on probability, expected value (EV), and the impact of jackpot size on winnings.

I wish I didn't miss the '90s-00s internet

  • An 18-year-old expresses nostalgia for the '90s-00s internet, contrasting it with today's commodified social media landscape.
  • The author criticizes modern platforms like Instagram and TikTok for promoting superficiality and FOMO (Fear of Missing Out), longing for the creativity and individuality of personal blogs and MySpace.
  • They mention a niche community on Neocities that appreciates the old web, but note that most peers find such interests unusual.

Reactions

  • The author reminisces about the '90s-00s internet, highlighting its amateur energy, pseudo-anonymity, and counter-cultural feel, which significantly influenced their career in the game industry.
  • They express nostalgia for the early internet's sense of wonder and community, contrasting it with today's commercialized and algorithm-driven web.
  • Despite technological advancements and increased access, the author and others feel that the original value of the internet has been diminished by its mainstreaming and commercialization.

AppleWatchAmmeter

  • Apple Watch Series 5 and newer can be used as an ammeter to measure DC currents by leveraging their built-in magnetometer.
  • By wrapping a coil of wire around the watch, the magnetic field generated by nearby currents can be detected and measured, with a sensitivity of approximately 100 uT/A.
  • An app like 'Sensor-App' can be used for calibration and to display the current in Amperes, allowing detection of current changes as small as 10 mA.

Reactions

  • Discussion revolves around the concept of using smart devices, like the Apple Watch, to measure electrical current, with references to DIY biohacking and historical experiments involving rare earth magnets.
  • Participants mention various methods and tools, such as Hall effect sensors and smartphone apps like Phyphox, for measuring current and voltage, highlighting the innovative yet risky nature of these experiments.
  • The conversation includes humorous and speculative comments about the practicality and safety of such biohacking techniques, reflecting a mix of curiosity and skepticism.

Radicle 1.0 – A local-first, P2P alternative to GitHub

  • Radicle 1.0, a peer-to-peer, local-first code collaboration stack built on Git, has officially launched after five months of feedback and 17 release candidates.
  • Key features include a peer-to-peer gossip and sync protocol, social interactions (issues, patches, code reviews), secure authentication, an intuitive CLI and web frontend, privacy features, and reproducible signed builds.
  • Future plans for Radicle include native CI/CD, a Terminal User Interface, advanced code review, and more, with growing ecosystem integrations like VS Code and JetBrains plugins.

Reactions

  • Radicle 1.0 is introduced as a local-first, peer-to-peer (P2P) alternative to GitHub, sparking discussions on installation quirks and comparisons with tools like Forgejo and Homebrew.
  • Users debate the practicality and philosophy of Radicle's decentralized code collaboration, with some preferring simpler task management using git repositories on virtual machines (VMs).
  • The conversation also touches on Radicle's funding, potential improvements, and integration with tools like ForgeFed and NOSTR.