91–100 of 126 posts
Earlier quoted context omitted.
The main ones I don’t own are VPS servers from fairly large providers, or GitHub.
When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.
Earlier quoted context omitted.
When I said "own", I meant more in the sense of personally administering. It's like how you own a domain, but you're really renting it from a registrar. Rented hardware and VPSs count, as well as other servers/hosts you're responsible for.
I got that, and I'm not saying that it doesn't apply to you, but it surely does not apply to everybody.
Earlier quoted context omitted.
Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.
Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.
Earlier quoted context omitted.
There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox…
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 ("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.") Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
> The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation.
---
> abouts that you whatted
"Whataboutism" is perhaps the most infuriating and wildly misused word in the English language. Pointing out that somebody is scaremongering about an action that is significantly less dangerous than other everyday actions people take on their computers is not a fallacy. It is directly relevant to evaluating risk. Yes, technically there could be some critical bug that allows the posited thing to happen, but in reality it just doesn't happen. If it did happen, nobody would blow their once-in-decades exploit on pranking some people on a forum.
If you have a slight interest in originality of presentation, whatever website copy first comes out of Claude is not there yet. Its preoccupation with "no x, no y" and annoying runs of sentence fragments might have been a punchy rhetoric for a short while before it became a tired cliché, but by now it stylistically makes it look more like you're bragging on LinkedIn than presenting something fun and creative. I menti…
It's an extremely pervasive misconception, but a model's voice is not really a matter of its training data, not by the time it reaches consumer eyes. The voice these models use are specifically selected for in RLHF, ie, curated by humans by telling it it did a good job when it uses this voice and telling it it did a bad job when it didn't use this voice. Why do they specifically push for this voice? Because it is eff…
The tiny minorities are the people who are too dumb to notice, and on the other end, the people who can still sift through robot-made clickbait the same way they were wading through human-made clickbait before.
So cool! If I wanted to make a similar product, how should I do it? Do you have any advice or research directions? I saw a company using SSH for hiring a couple of days ago, and I thought it was really cool. I also want to build something similar.
I'm going to be so honest, I don't have much advice for you. I'm a teenager who's part of Hack Club ( https://hackclub.com ) who made this entirely for fun. I was inspired by @zachlatta's SSHtron ( https://github.com/zachlatta/sshtron ) and wanted to make an SSH game. I loved how easy it was for him to promote it too, he made a HN post with title "ssh sshtron.zachlatta.com" because it gets people to try out the actua…
Earlier quoted context omitted.
Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.
Yes, I was thinking of iTerm2. "Older" means not the latest release and "buggy" includes well-intentioned vulnerabilities.