231–240 of 274 posts
Earlier quoted context omitted.
Why do you have a problem with this?
I was explaining this part > how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox
Earlier quoted context omitted.
Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.
It took around 15kJ to access the site... that's a proper waste and somewhat sad, even though I understand.
Earlier quoted context omitted.
It's Anubis and it's actually cool and loved project here. It's an open-source Captcha that filters out bots, and it doesn't track you around the web, unlike Google or cloudflare captcha.
Cool, and loved by some. Annoying and disliked by others. I understand why people choose it, but if I see the catgirl I close the tab - same is I get the test from cloudflare.
Isn't it easier to just .. start loving it instead?
Earlier quoted context omitted.
I'm not so sure LLM code today is below average. There was a time that things posted to dailywtf were normal everyday stuff
Sorry, no, they wouldn't have been WTF's if they were normal
IDK seems like a bug that could've taken a human a few minutes at best to find. I found a bug in SystemD that would crash the daemon because a bad SystemD unit file configuration. That took me like 5 minutes to actually track down in the actual source code. I understand the utility of this though, I just don't see this particular bug and something that would be particularly difficult o find pre LLM era.
The fuzzer found the bug before any humans did, so there is a mismatch of developers who could find this bug and those who did (without an LLM-coded fuzzer).
The value of the fuzzer continues long after it found this one bug.
It's worth nothing that in the bug discussion thread, the bug fix author pointed out that it's not easy to set up the config then call the functions in the right order. Your comment assumes that the reader has enough context to read the code and build the finite state automata in their mind. The bug fix reporter's comments suggest that you are assuming things which you shouldn't assume.
Did we find it?, or Did AI do my job?
given enough ai, all bugs are shallow
Earlier quoted context omitted.
That's not a quality of ffmpeg or this bug, but of the application you use it for. If you only expose your ffmpeg-based application to your own input then yes, of course it's a self-DOS. But if you, say, expose it as a web service passing arbitrary user input to ffmpeg, that no longer holds.
Even then it will be a self-dos: the video you uploaded won't be processed.
The implications of the crash depends entirely on the implementation of the process it crashes. If I use ffmpeg as a library it'll crash my process upon processing the offending file. How is my process designed? How is every process that uses ffmpeg designed? You don't know, therefore you can't say that it's a "self-dos" in every case even if you know that it is in some cases.
Maybe I am clever enough to have read up on the history of ffmpeg vulnerabilities before deployment to an attacker-facing service and have designed a solution where a crash has minimal implications, but maybe I'm not, and haven't. It's beside the point.
Earlier quoted context omitted.
Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…
It keeps casual users (which most bots masquerade as) out. For frequent users of that site it is a solve once access forever.