Live data from Hacker News

Viewing profile — werrett

werrett

HN member
Joined
Tue, Mar 23, 2010, 6:15 AM UTC
HN karma
452
Public activity
99 items

About werrett

infosec curmudgeon. appsec. product husbandry.

[email: jonathan at werrett dot co; twitter: http://twitter.com/werrett; mastodon: https://infosec.exchange/@werrett]

---

[age public key: age1jarg867ve9mg6w32vwx80qg873fryvhtuzd204fhxucs5afhns0saa587z; https://age-encryption.org]

Recent public activity

  1. comment
    Comment #48899623

    Oh cool. This is from the folks behind story time chess. https://storytimechess.com/ I can thoroughly recommend. I’ve purchased it for my (then) 4 year old and it’s definitely been…

  2. comment
    Comment #48699207

    > Frontier AI models, like airplanes, should be required to go through technical testing and auditing, and their release should be blocked or reversed as a threat to public safety …

  3. comment
    Comment #48482871

    And the just released “Palaces of The Crow” by Ray Nayler. I just finished it — really moving but also a brutal read in parts (c.f. because of what humans will do to each other not…

  4. comment
    Comment #48058675

    c.f. Linear for Agents https://linear.app/agents

  5. comment
    Comment #47805709

    Yes, let’s pay down the deficit by cutting funding to the sciences. While the latest war is running at ~1 billion a day (we’re in day 48 btw). https://iran-cost-ticker.com/

  6. comment
    Comment #47017652

    Yawp. T’was Strava. https://www.theguardian.com/world/2018/jan/28/fitness-tracki...

  7. comment
    Comment #45423395

    There’s Zenitizer by an indie dev https://apps.apple.com/us/app/meditation-timer-zenitizer/id6...

  8. comment
    Comment #44873165

    While appalling I don’t think you would find it 'crushing', even ignoring the jibe about expat conclaves. Costa Rica’s 17 in 100k is ~2.5 times bigger than the US’ 6 in 100k people…

  9. comment
    Comment #44764615

    You guys are tripping. EULAs have had anti-competition, anti-benchmarking, anti-reverse engineering and anti-disparagement clauses since the late 90s. These unknown companies calle…

  10. comment
    Comment #44105937

    > something being a liability and something having upkeep costs are not the same thing. What would your definition of /liability/ be then? 'An ongoing commitment to pay future cost…

  11. comment
    Comment #44010210

    At least one person has been subject to secondary screening and ultimately denied entry on the accusation that they had two phones. > I thought I was just going to be given my pass…

  12. comment
    Comment #43879206

    This is the ultimate nihilistic take on security. Yes, 'cyber' security has devolved to box checking and cargo culting in many orgs. But what's your counter on trying to fix the pr…

  13. comment
    Comment #43863229

    I’m a fellow cyclist in SF and can only wholeheartedly second this. To add some extra anxiety, I’m usually riding a cargo bike, ferrying a child to or from daycare. I still remembe…

  14. comment
    Comment #43629522

    I've got conflicted feels about Tailscale. I love their product and a bunch of the people I know use their free tier, including myself. But their enterprise strategy destroys their…

  15. comment
    Comment #43517429

    I doubt it’s a real threat but it would be a country that would happily unsubscribe from US export bans. So Israel or Singapore would be two good options for the chip industry. Sou…

  16. comment
    Comment #43517393

    As well as being disingenuous your whole argument is beside the point. ASML isn’t threatening to move to the US. The current administration has created day light between the US and…

  17. comment
    Comment #43517362

    Did you even read the article? ASML is chaffing against American-led export regulations. The Trump government is still very keen on restricting China’s ability to make cutting edge…

  18. comment
    Comment #43444365

    Here ya go: King Stingray does Coldplays's 'Yellow' https://youtu.be/sr3iI8gg2fo Denzel Curry does Rage against the Machine's 'Bulls on Parade' https://youtu.be/ZY4ywyFXdik

  19. comment
    Comment #43371141

    Yes. It was probably a maintainer's creds being compromised. The [malicious commit is masquerading as a commit from Renovate]( https://github.com/tj-actions/changed-files/commit/0e…

  20. comment
    Comment #43369671

    I mean maybe! But only if you've removed all of the usage of this compromised `tj-actions/changedfiles` action, across all your repos and their branches. Otherwise, if you continue…

  21. comment
    Comment #43369639

    You can pin GitHub Actions to specific versions or specific commits. But note you can change version tags arbitrarily. In this specific case, the bad actor changes all of the versi…

  22. comment
    Comment #43369621

    No idea. But they didn't do a great job -- they broke the action, which caused build failures that people were going to notice. The malicious commit only landed at 09:57 PDT today …

  23. comment
    Comment #43369595

    Only commit hashes are safe. In this case the bad actor changed all of the version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags All…

  24. comment
    Comment #43369588

    Exactly. And that's what happened here -- the bad actor changed all of those version tags to point to their malicious commit. See https://github.com/tj-actions/changed-files/tags A…

  25. comment
    Comment #43218657

    Not to go too much on an AusPol tangent, LNP Nuclear stuff is more about delaying the green-power transition. It keeps coal / gas power around for a nuclear future that is decades …