81–90 of 119 posts
Earlier quoted context omitted.
> „popularity“ Why are you using weird quotes?
I'll take a wild guess and assume they are of a German or Polish language background. Wait 'til you encounter a French person who accidentally uses guillemets if you want one even «weirder».
Earlier quoted context omitted.
Why don’t they also read your gmail and get your bank passwords? And maybe have access to EVERY site actually, with “forgot password” type stuff in addition to providing oauth tokens…
> Why don’t they also read your gmail Boy do I have news for you.
Earlier quoted context omitted.
I've also seen Google indexing pages with random values in the path that don't get linked to statically (server asks for the URL then redirects to it immediately). I'm pretty sure they index straight out of the Chrome address bar.
Holy crap I hope that's not true. I've also had unguessable pages indexed, though, and don't have an explanation.
Earlier quoted context omitted.
CT logs just explain how they found the domain. T doesn't explain how they could have found unlinked content on the domain itself. If I put up secret-example.com/asdf-1234567.html, how does that page get found if there are no public links to it?
Don't underestimate people not knowing were they share stuff by accident. Creating Sitemaps, sharing it somewere public, putting the url in some 3th party service, server logs, some indirect path in javascript. But if you never mention that url, it will not be found if not leaked by your server.
That sounds like a claim that security through obscurity is infallible, which is dubious. Don't get me wrong, it can be a reasonable part of defense-in-depth strategy, but like, brute force attacks are kinda a well known thing, especially if your URLs aren't truly random...
Someone used Codex to scrape the ICM website schedule and discovered that the winners list was simply hidden in the front-end code with a "hidden" tag This is on the devs and feels like a very basic leak which could have exploited in the non LLM world as well.
Well, the angle is kind of important here. The company gets their name in the news, they have a reasonable explanation why they were scraping around, and we end up with a story about innovative tech company whiz-kids who made a funny discovery, while it was the webdevs on the other side that goofed up. Imagine a private individual just scraped the website (or simply clicked 'view source') for no reason in particular…
"In early October, Renaud discovered that Social Security numbers for teachers, administrators and counselors were visible in the HTML code of a publicly accessible site operated by the state education department..."
"Yet despite the fact that officials within the Missouri Department of Elementary and Secondary Education initially wanted to thank Renaud for uncovering the flaw... [Governer] Parson labeled the reporter a hacker and called for criminal prosecution."
https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...
> The leak occurred when four Fields Medal laureate lecture fields, marked "HIDDEN," were discovered in the front-end code of the ICM 2026 official schedule. So it was easier than I thought. Bot just scraped public page with hidden fields, not a secret page or to-be-published page from database.
I'm tired of the framing in the media these days. "Mythos will end the world!!" "How?" "By finding a bunch of wide open security holes that have existed for years." Oookay. Is this a Mythos problem? Or a lazy/greedy/uncaring people problem?
too bad that those winners can no longer bet themselves on polymarket as the winner and make big money.
I've been working on a site. It's new, domain is only a few weeks old. It's got SSL, so all the bots know it exists. It's never had any sub-pages exposed, just the placeholder lander, no links. Somehow in Google search one of the unguessable pages is indexed. We have used Claude and Gemini to assist with some design aspects. I'm thinking some aggressive data ingestion/indexing is happening by all the bots in the ques…
Might have been an evil chrome extension, but ever since Google went IOK2BE ("It's OK to be Evil"), maybe it's just Chrome itself.
> The leak occurred when four Fields Medal laureate lecture fields, marked "HIDDEN," were discovered in the front-end code of the ICM 2026 official schedule. So it was easier than I thought. Bot just scraped public page with hidden fields, not a secret page or to-be-published page from database.
I'm tired of the framing in the media these days. "Mythos will end the world!!" "How?" "By finding a bunch of wide open security holes that have existed for years." Oookay. Is this a Mythos problem? Or a lazy/greedy/uncaring people problem?
But scale and accessibility are absolutely a new class of problem.
In the 1960s you could pay thousands of people to watch hundreds of cameras and listen to hundreds of phone lines to monitor people, but the cost was so enormous that unless you were in East Germany or Moscow it wasn't a realistic threat model.
Now with computers we can cheaply have thousands of cameras with cheap storage that's retained forever and automatic image processing that means everyone is exposed to that kind of surveillance, which is a brand new problem.
> The leak occurred when four Fields Medal laureate lecture fields, marked "HIDDEN," were discovered in the front-end code of the ICM 2026 official schedule. So it was easier than I thought. Bot just scraped public page with hidden fields, not a secret page or to-be-published page from database.
I'm tired of the framing in the media these days. "Mythos will end the world!!" "How?" "By finding a bunch of wide open security holes that have existed for years." Oookay. Is this a Mythos problem? Or a lazy/greedy/uncaring people problem?