I wonder if all the slots that used to be filled with the things OP and I found interesting are now filled with LLM stuff (not saying AI because I'm interested in all the cool machine learning things, for example medical and game applications, just not the 'yet another text autocomplete' links), since a lot of coding is now... gone I guess? Not being done, or seen as worthwhile and thus not upvoted as much as before? So those "mostly not LLM talk" links may all be things we'd not have found interesting before either, and now there is almost nothing left of the old HN 'for us' (OP, me, and whoever else feels this way)
It's also way too harsh to just remove any mention of LLMs, as some people are suggesting shoehorning adblock filters for for example. I'm interested if GPT9 solved world hunger by presenting logic to world leaders and workers and creating a great collaboration that gets food to everyone. It would be a bit silly to hide that link. But all the tiiiiny incremental steps and projects that are outdated by (often quite literally) next week.... guys, please :/
> most attacks were 90 seconds long ... there's no way I'm convincing an ISP to drop a pwned customer over that.
Every victim (such as readthedocs), or even people sharing blocklists to avoid becoming a victim, blocking that ISP's ranges until they do clean up their network could be a convincing argument?
As you say, even at 90 seconds, it's clear to all involved parties that the customer is pwned or malicious. Such a reoccurring source of abuse needs to either clean up or find themselves a different ISP to spread harm onto the net
I get what you're saying about that this won't solve an ongoing attack right this minute, or even by next week. But if we just let it all happen then the solution is going to be either (1) we all buy equipment that can handle something like a terabit per second and arm our infrastructure to the teeth or (2) centralize all traffic through a vetting entity who decides which client gets to visit the internet today. So far we're headed towards the latter and nobody really wants that. Abuse messages will have to slowly trickle down from victims to originating ISPs to users, and if users didn't willingly sign up, then to wherever users are getting this malware (Google's app store will be a big component). Stopping this at the source seems to me a much more desirable long-term solution
> As you say, even at 90 seconds, it's clear to all involved parties that the customer is pwned or malicious.
It sure is --- but an ISP would want to observe the traffic themselves, and if it's a 90 second attack every so often, chances are they won't see it when they look. When it's volumetric reflection, you can probably tell them how to send a request and see the response, and maybe they'll contact the customer, but maybe they'll just sit on it. As a victim, the ROI for reporting just wasn't there.
I wasn't getting huge traffic flows, and I was mostly getting attacks against www, which wasn't my actual service, so making sure volumetric attacks below my interface rate were shrugged off and taking simple actions like dropping requests from http clients with user-agent Wordpress were good enough. If the volumetric attacks were much over 10G, my host would have null routed my servers, which is annoying but highly scalable --- many ISPs support a BGP blackhole community, so my host can add my attacked IP to that and their upstreams will drop inbound packets when they enter the ISPs network.
I can't find a reference now, but I've seen things that allowed for more specific blackholing, such as by source or destination port number or by protocol. If my host's ISPs are dropping all UDP and IP fragments to my IP under attack, I could keep serving my TCP traffic and ignore a huge DDoS. I wouldn't even be able to measure the size of the DDoS.
www.uceprotect.net does that for email. It's a DNS blacklist that puts hole networks on it, even if "only" a individual hosts SPAMs.
It's a double-edged sword. That is how you end up with most ISPs blocking port 25 completely. If your hosting provider is on the list you are collateral damage. You yourself can do very little to remedy the situation except to beg your provider "to look into it".
What do you expect the ISPs to do in this story? We are talking about TSL connections. Block port 80 and 443 and expect the costumers to use your HTTPS-Proxy. Than they could inspect and block individual actions.
> The false positive rate for Pangram 4 is something like one in 24,000.
Gotta suck to be one of the 8B/24k=~300k people in the world whose writing pattern is falsely labelled as slop by this tool that people say is so accurate so customers are going to feel really sure about your alleged dishonesty about writing your own texts
This false positive rate is a double-edged sword. Please still be careful when accusing people
Ctrl+f clipboard, no results. What does "Secure Clipboard" in the title refer to?
The release seems to be only the SMS/RCS app, rest is future:
> We're also going to be overhauling or fully replacing the rest of the AOSP apps in the near future. AOSP Gallery is incredibly outdated and is being entirely replaced. AOSP Keyboard may be similar. We recently hired a bunch of new people and will be hiring more so our progress will be accelerating.
This is exactly why I switched to Android. Running any Linux binary with just a small bit of patchwork to get Xorg running (this was before Wayland) felt like magic. So much power in your pocket, I could plug a keyboard and display into the device and use it as a computer! And internet-connected 24/7! Coming from a literal Nokia where I made some web-apps for the javascript-supported browser (that was already a major leap for a mobile phone), it blew my mind. The sole reason Android blew up is the endless possibilities developers saw (starting with the device manufacturers of course). Now the developers are here, the competitors haven't been competing because who cared about Firefox OS or Windows Mobile even back in 2014, and so Google can do whatever
I'm pretty sure if I try calling my bank or searching the website to confirm the developer's public key fingerprint, there's not going to be any answer. You have to ask Google's servers to give you the APK and trust what it gives you, either via the front-end called Aurora or the front-end called Play Store
I think in general trust is established for Play Store apps by downloading the app with the Play Store on a phone with Google Certified Android. Then the app can get the signing key for storage in the database. Then this can be used to verify APKs downloaded outside the play store.
Maybe not in practice, but in theory, it works. I don't think there's a better way of handling this without relying on some centralised authority (Google) to validate the authorship of an app, which is hardly desirable.
My phone uses wpa_supplicant v2.10-devel-11 (from late 2021 I think) and I see in NeoStumbler that the record is at 227 access points (from this vantage point: https://osm.org/go/0GAnN~St0?m)
The query for anyone else who has that app and is curious:
> .he on
> select reportId, count(id) as c from WifiAccessPointEntity group by reportId order by c desc limit 10;
reportId|c
123|227
> select * from PositionEntity where reportId = 123; -- find where this was
Are you sure it's a wpa_supplicant limitation? It sounds like a very arbitrary number, not even 2^8=256 or something, so like it should be trivial to find and chance that constant limit in the source code, if this limit exists
Edit: a quick grep through the source code (`grep -rE '[^0-9]200[^0-9]'`) doesn't reveal anything that looks very promising at first glance. I'm curious what you're running into now though
It's ostensibly a configurable variable (bss_max_count). I bet your phone's system has done so. I'm talking about my laptop and NixOS, and I was definitely getting limited to 200.
Huh, why did I not see that variable in the grep results... ah, that line didn't match because I negative matched 0-9 but not 'nothing' (end of line in the config file).
If it's just a configuration variable though, why bother migrating away instead of configuring it? Or even opening a ticket upstream that the 200 APs limit is causing issues if you would want to go that far. Ditching the software altogether seems radical
Unfortunately, NixOS makes it impossible to configure while NetworkManager is installed. This is because bss_max_count is a runtime var, so you have to use wpa_cli instead of a config, which requires a socket in a dir that NixOS conventionally keeps empty. I decided it wasn't worth the effort to fix.
> They use the words WiFi (or, as we say in Germany, WLAN) and "Internet" almost interchangeably.
I was helping our neighbor with WiFi issues. They asked at some point if a "WLAN-Kabel" would solve the issue :)
The sad part is that they realized the mistake a minute later, and since I didn't say anything but just answered the question (I understood what they meant, no point correcting the technicality), they assumed that I was just laughing at them behind their back / internally. Turns out once again that tech is as much social as it is technical, and I really struggle with people who think everyone else is hiding something (they vote accordingly, let's say)
It really doesn't help that a part of our attention-economy has hopped on the "what (the government/big tech/car company) doesn't want you to know!11" bandwagon and constantly feeds into this notion that there is this great ominous evil cabal working against you.
reply