101–110 of 126 posts
Imagine being an innocent developer trying to spin up some internal dev tooling and accidentally landing on the front page of HN to be misinterpreted as an attack against google which could affect both stock
Ah well I like your joke, but I know GPT is moving fast, but it would be unlikely and innocent dev can change DNS records of chatgpt.com
Earlier quoted context omitted.
Why? As I understand it, the domain owner can assign the name you “trust” to any server already. Might as well trust all names by that domain owner.
Because if your one wildcard cert gets compromised somehow, the attacker can now impersonate every subdomain of yours. Consider what happens if there's an old test box called daves-test-box.example.com that has a copy of the wildcard cert valid for *.example.com. Dave quits and never updates his box. Eventually an unpatched CVE gets used to steal the cert. Now the attacker can phish or MitM your users of www.example.…
Yours is not an argument against wildcard certificates! Yes, like, everything else ever, wildcard certificates can be misused.
RIP Google. Yet another story of a company killed by "effective" management. The McKinsey school isn't so effective after all, is it.
Earlier quoted context omitted.
It will be interesting to see what happens to copyright claims against ChatGPT. Google can just remove claimed content from its index, what will OpenAI do?
Use their legal and PR fund to fight back.
Earlier quoted context omitted.
Certificate Transparency really serves the end user. Because the most popular browsers (at least Chrome and Safari) generally require CT logged certificates, if you want to successfully perform a MitM attack against any user, even just some individual user, even controlling a CA, you still can't do so without publishing your fraudulent certificate to a CT log. This is the important function of the CT log. It is an ef…
I don't follow your threat model. Let's say that browser is fine with CT if either leaf or intermediate certificate is logged. If you need to issue fake certificate, you need to either log it, or you need to issue fake intermediate certificate and log it. Either way it's visible to website owner (and other people likely won't care anyway).
Public CT logs mean that the property of transparent certificate issuance extends to the entire Internet, which is good. If you want private certs, you can use a private CA and deploy it to the machines in your domain. Totally reasonable alternative in my opinion.
Imagine being an innocent developer trying to spin up some internal dev tooling and accidentally landing on the front page of HN to be misinterpreted as an attack against google which could affect both stock
Some creators also seem to suggest they know what is going on, youtube mattvidpro hinted at it when talking about the gpt2-chatbot, he mentioned he knew something but couldn't talk about it or get sued.
A new search system is coming. At least I've already seen about 50 visits to my website from ChatGPT.
Why do you think this implies they are building a search service rather than just scraping your site for more training data?
I've noticed an interesting pattern: before releasing LLaMA 3, OpenAI provided access to ChatGPT 3.5 without requiring registration.
Meta might also follow this path with its own search engine. Did you know that you can now ask questions directly on Instagram and receive answers from Meta AI using LLaMA 3?
Why go elsewhere for information when you can easily find it in the app you use every day?
Earlier quoted context omitted.
Use their legal and PR fund to fight back.
If all you have to do to beat these claims is throw money at the problem, then why haven't the other (better funded) search engines done that?
Earlier quoted context omitted.
Why? As I understand it, the domain owner can assign the name you “trust” to any server already. Might as well trust all names by that domain owner.
Because if your one wildcard cert gets compromised somehow, the attacker can now impersonate every subdomain of yours. Consider what happens if there's an old test box called daves-test-box.example.com that has a copy of the wildcard cert valid for *.example.com. Dave quits and never updates his box. Eventually an unpatched CVE gets used to steal the cert. Now the attacker can phish or MitM your users of www.example.…
Dave can test his stuff on a newly bought domain for testing or the internal domains.