Viewing profile — outloudvi

Went through the comment page and found this comment that explains well on most of the popular opinions. Thank you, hennell!

I agree cooldown is not harmful in general. What I intended to say is that people (mostly) only know a security company is not trustable because they once failed to detect a malwar…

I agree that LLM does not (and believe it never) fully replace researchers, but it produces artifacts (e.g. writeups, PoCs) at a cheaper price. That makes me think LLM impacts huma…

After reading the comments I now agree a short-length cooldown (maybe 1 or 3 days) is beneficial, given the following assumptions: - Independent security companies are scanning the…

Sorry! That's 100% on me failing to make the analogy understood. Shall have thought about that... but I'm playing too many Unity games recently.

Thanks for your explanation on the definition of "security theater"! > But if it turns out they can’t serve as the cooldown vanguard, then we have great evidence that they shouldn’…

I applaud you if you do setup automated security scanners, without counting on external security groups or individuals (that doesn't have a security contract with your company). Th…

> The idea of not moving quickly to new software versions has been around for decades. There are COBOL users and CentOS 6 users. They aren't affected by this issue. They might need…

I think it's great if people actually use LLM for the analysis. I did mention it in the solution part in the post: > Run LLM-assisted audit on vendored code.

I also believe sandboxing will get more and more important. There might be some trade-off on user experience or convenience, but given the security enhancement and (LLM agent's) fr…

I do appreciate these security companies a lot (for example, Snyk), but I feel it hard to believe this is sustainable. Especially in the current world where LLM is devaluing securi…

May I put some contents against GCP's AUP in my repo, wait for Grok Build to upload them, and report the bucket to Google?

> Sadly, the RDS kernel module this requires is only default on Arch Linux among the common distributions we tested. Sir, what do you mean by "Sadly"? I know your write-ups are mos…

The article speaks well but the situation for coding is more severe. Shells are not needed once they are not in needed. Code does not: customer need is always there. Before forgott…

These companys don't care about the reputation of their domains anymore at the moment they start to send spams. However, email senders (SendGrid, Mailgun etc.) care about the reput…

I usually check the "Received" header and report to the email service provider. Once in a while I receive a response saying the case is properly handled. These providers are the on…

> Is there good public discussion on root expiration? Haven't seen a specific one but I guess the most relavant public discussion on root CA-led device bricking issues might have o…

While the style and headline seems like Hacker News, the usernames seem increasingly alike Slashdot.

I'm worried about the situation when Dark Patterns are not widely recognized enough as a malicious practice for users. Half a month ago I see someone on Twitter defending its own p…

Vercel has a fairly generous free quota and a non-negligible high pricing scheme - I think people still remember https://service-markup.vercel.app/ . For the crawl problem, I want …

The reveal.js slide itself probably isn't the best way for readers. The reveal.js project actually provides a PDF export feature which can be more helpful. Anyway, it's an asahilin…