Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Go's Infrastructure

reverse.put.as

Post reply on HN
Print view View original

41–50 of 80 posts

Re: Abusing Go's Infrastructure

#41

Post by _heimdall »

kccqzy wrote: post #33
zepolen wrote: post #30

Earlier quoted context omitted.

Question, how would you know without invading the user's privacy?

An algorithm that processes private user data is by itself not invading anyone's privacy. It's clear to me that invasion of privacy only happens when humans look at private user data directly, or look at user data that's not sufficiently processed by an algorithm. Otherwise, something as simple as a spell checker would be an invasion of privacy because it literally looks at every word in an email you write. That's ab…

At least in my opinion, there's a big difference with where the data lives and where the checking algorithm is run. I don't think a spell checker would fall into what I'd consider a privacy concern as long as the spell checker is running locally on my device.

Re: Abusing Go's Infrastructure

#42

Post by weinzierl »

miki123211 wrote: post #11

Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…

Not sure if it has already happened, but the not so obvious one is HuggingFace.

Re: Abusing Go's Infrastructure

#43

Post by romafirst3 »

howenterprisey wrote: post #29
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Just curious, "Delivery" doesn't seem to be the same sort of thing as "Spam" and "Abuse": why are the three grouped?

Delivery is what happens if it’s not spam or abuse.

Re: Abusing Go's Infrastructure

#44

Post by skybrian »

mynameisvlad wrote: post #39
skybrian wrote: post #27

Earlier quoted context omitted.

Interesting! Looks like it's being used by some npm packages [1] and soon homebrew will be using it [2]. Any other interesting usage? As a user, the npm usage doesn't seem very prominent. On an npm's web page, there's a checkmark next to the version number on the right side that I hadn't paid any attention to before, with more information at the very bottom of the page. Here's an example. [3] [1] https://blog.sigstor…

It’s at the bottom of the page on mobile . On desktop, that’s the first thing on the right hand side of the screen IIRC.

For me on desktop, the version seems to be the fourth thing down in the right column, under weekly downloads, and there's a checkmark. (Or maybe I'm missing something.)

Re: Abusing Go's Infrastructure

#45

Post by erik_seaberg »

W3C laid the groundwork for everything on the Web to be heavily cacheable, so it's weird that there are so few general-purpose proxy caches. Are publishers sending short "Cache-Control: max-age" or "Vary: Cookie" responses when they didn't need to? Are too many ISPs paying for transit rather than peering?

Re: Abusing Go's Infrastructure

#46

Post by carom »

zepolen wrote: post #30
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Question, how would you know without invading the user's privacy?

Companies are legally obligated to scan for CSAM in the US.

Re: Abusing Go's Infrastructure

#47

Post by withinboredom »

palata wrote: post #40

That's maybe naive, but... how is that different than just pushing files to e.g. a GitHub repository? Is it just the fact that you need to create an account for GitHub? Because I can store arbitrary data there, too. Without the 500M limit...

GitHub has some pretty stringent rate limits for anon requests.

Re: Abusing Go's Infrastructure

#48

Post by 12_throw_away »

mort96 wrote: post #37
8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

I guess that was much more useful as a use case before pip started requiring you to be in a venv/virtualenv/pipenv/pyenv/whatever to download packages

I've never encountered this requirement in many years of daily use - pip for me has always happily installed anything if it can.

Now I've definitely seen customized distributions of python from package managers that have taken steps to prevent you from using pip. IIRC, the python you get from `apt-get install python` in Debian does this? I.e., it's designed to support system utilities, not as a user's general purpose python environment, and they want `apt-get` to control this environment, not pip. So they've removed pip and ensure_pip and easy_install from your core system python environment.

TLDR: In my experience, that requirement doesn't come from pip, it's your distro taking steps to prevent https://xkcd.com/1987/

Re: Abusing Go's Infrastructure

#49

Post by IshKebab »

Too wrote: post #34
IshKebab wrote: post #19

Earlier quoted context omitted.

Yeah I copied CMake's idea of using PyPI and I also use it to distribute some pure Rust CLI tools using Maturin. It works really well. Pip is... well it's about on par with most other package managers, i.e. not great, not terrible, but it has some pretty huge advantages over any other software distribution method on Linux: * Very likely to be installed already on Linux and probably Mac too. * Doesn't require root to…

Some of those arguments are becoming more and more difficult as pip and distros are pushing for use of venvs and now requires a scary --break-system-packages argument if you were to use the pre installed launcher.

That is a good point. Distro package managers have somehow screwed this up too.

Re: Abusing Go's Infrastructure

#50

Post by cdelsolar »

gloryjulio wrote: post #38
liquidgecka wrote: post #25

Earlier quoted context omitted.

And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])

Just a side note, I found the name sad sre funny and blursed at the same time

Whats’ blursed mean?
Post reply on HN