Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

341–350 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#341
post #289

Earlier quoted context omitted.

The design purpose of Windows Sandbox :)

TIL about Windows Sandbox. Not a Windows user myself (it's the Year of Linux on the Desktop™!) but this sounds immensely useful for technical and nontechnical users -- sort of a super-disposable container with UI? https://learn.microsoft.com/en-us/windows/security/applicati...

The short lifetime of it really seems to limit the usefulness. I had a look at it before and really struggled to see what I would use it for.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#342
post #55

Earlier quoted context omitted.

If it stops even just 1 person once, isn't it already worth it?

We slaughter animals millions by the day in an industrialized fashion. I'm sure they'll feel much better that even singular instances of sexual harassment are officially not ok on paper.

“Millions a day” is quite a low estimate;

“””here are the best estimates of how many animals are killed every day on a per-species basis.

Chickens: 206 million/day

Farmed Fish: Between 211 million and 339 million

Wild Fish: Between 3 billion and 6 billion

Ducks: 9 million

Pigs: 4 million

Geese: 2 million

Sheep: 1.7 million

Rabbits: 1.5 million

Turkeys: 1.4 million

Goats: 1.4 million

Cows: 846,000

Pigeons & other birds: 134,000

Buffalo: 77,000

Horses: 13,000

Other animals: 13,000

In total, this means that every 24 hours, between 3.4 and 6.5 billion animals are killed for food”””

- https://sentientmedia.org/how-many-animals-are-killed-for-fo...

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#343
post #130

Earlier quoted context omitted.

Gitea action runner has a bunch of different ways to setup and doing the isolation properly looks tricky. The documentation doesn't provide any isolation tests to administrators, either. The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. Not flawless security, but it's something...

> The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. This recommendation seems incompatible with third-party collaboration, at least on its face!

The idea is you first review PRs from external contributors before allowing the CI to run on them.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#344

Earlier quoted context omitted.

I'm not sure what your point is, to be blunt. It seems like you wanted to make some weird argument about the semantics of the word "abuse", and are now implying one of: 1) Beastiality isn't sexual abuse 2) Beastiality laws are pointless because it was already illegal under existing abuse laws (it wasn't, as we've repeatedly discussed) 3) Sexual abuse requires physical harm all of which are pretty gross (1,3) and/or p…

You got 2 wrong. It's: 2) If the existing abuse law doesn't include sexual abuse, we need to fix that law, not add a new one. And that's not a pointless argument. If we're still allowing the whole category of non-physical abuse to animals, except for bestiality, that's a terrible job of lawmaking. And just on a tangent here now that I'm reading the law they added, does it really make sense to have a blanket exemption…

This thread is one for the archives...

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#345

Earlier quoted context omitted.

A glance at the nmap one seems potentially high severity. It might be a nothing in practice, but it being around parser code means the chances of preparing something to jump around are pretty high. There'd be a certain irony being able to reverse shell anyone doing an nmap scan. If i had infinite tokens i'd throw claude on writing an exploit and dig through the history who made it possible because - if we take a mome…

Wireshark dissectors (protocol decoders) are basically all written in C, and anyone sending packets can pick a dissector.

I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through one of many pathways, and generally runs at a high privilege level. A huge attack surface that's easy to reach and with far reaching consequences if it can be exploited. Add to this that it's in wide use, often even mandated by corporate IT and its recipe for disaster.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#346
post #264
post #206

Earlier quoted context omitted.

As you're basically saying, the world isn't black or white. There's also a category of people that needs an incentive to behave. Also, without any laws, it would be problematic to punish "the bad guys". At that point, what you can or cannot do would be only a matter of relative power: who is stronger can do whatever they want to weaker people.

This is how it's always been. The law just produces another axis of strength that is easier to gatekeep.

Nope, it reduces the issue even if it isn't solving it entirely. Without laws and law enforcement, anyone with bigger muscles than you could break your nose just because they feel you looked at them the wrong way.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#347

Earlier quoted context omitted.

Using the legal definition of "abuse", yes it was illegal to sexually abuse animals. Their actions didn't qualify. That's what warrants clarification here. I appreciate your definition of abuse here but it's confusing in a discussion about legality.

> yes it was illegal to sexually abuse animals No, it wasn't. The laws are quite explicit about what "abuse" means, and if you take a gander at most laws (including Washington state's circa 2000 or so) in the context of animals it usually explicitly refers to physical harm (for example, mutilation) or improper living conditions. Charging them under Washington's existing abuse laws would've required the animal to be p…

[dead]

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#348
post #67
post #52

Earlier quoted context omitted.

> Please do not abuse these. Reminds me of Jamie Wolf's joke about bestiality laws. Who are those for? What stops most people from bestiality is… not wanting to have sex with animals! For people who do want to, what, they won't because of… the law?? Who will this comment stop??

Those seem like two different scenarios though, right? The point of beastiality laws are to give society some recourse to punish people who abuse animals. There was a very famous case back in Washington state back in the early 2000s where a group of men were sexually abusing horses. It was uncovered because one of them died, and the other could only be charged with trespassing because it wasn't illegal at the time to…

[deleted]

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#349

Earlier quoted context omitted.

You got 2 wrong. It's: 2) If the existing abuse law doesn't include sexual abuse, we need to fix that law, not add a new one. And that's not a pointless argument. If we're still allowing the whole category of non-physical abuse to animals, except for bestiality, that's a terrible job of lawmaking. And just on a tangent here now that I'm reading the law they added, does it really make sense to have a blanket exemption…

This thread is one for the archives...

If you jerk off a horse just for the love of the game, you're a criminal and that's abuse. But if you're paid to do it (e.g. for insemination) that's fine. The act is the same, seems doubtful the horse is harmed. What society has a problem with is the fact that you enjoyed it.

For some reason with people it goes the other way around.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#350
The readme was recently updated.

> In regard to AI usage, my fuzzing workflow was automated by AI with a strict harness. I used GPT-5.5-3-Codex-Spark for ALL the fuzzing, as barely any "thought" is necessary when provided with an efficient harness. Contrary to the growing narrative that I'm just some random child burning tokens, I DO actually have a degree in the subject and have published multiple papers on fuzzing methodology. I spent years researching and developing new tools and ideas for how to fuzz. You do NOT need a SOTA model to help you identify these issues, I promise!

Post reply on HN