Hacker Newsnew | past | comments | ask | show | jobs | submit | _el1s7's commentslogin

Security is an illusion.

Then reply with your passwords.

******

Luckily HN automatically detects when you post your password and obfuscates it with * - try it out yourself!


You think I was born yesterday :P

hunter2

Doesn't look obfuscated to me.

It only obfuscates it for others :)

Thats the genius of it, to us it looks like **** but you see hunter2. Its an automatic replace.

Oh whew, I thought he was using hunter2 as his password too.

Next.js/RSC has become the new PHP :)

I guess now we'll see more bots scanning websites for "/_next" path rather than "/wp-content".


Inevitable when the line between the client and the server is blurred this much. RCE in a UI library is not a phrase you hear often.


Maybe one day we'll look back at JavaScript and conclude it was a gigantic mistake ship unaudited executable code to a few billion people every day.


JavaScript is fine, it's what and how people build with it that's the problem. It was never meant to be a systems language but we're desperate to make it one.


In light of this discussion:

https://news.ycombinator.com/item?id=46141771

that is an interesting observation.


I have seen a number of attempts at exploiting this on our deployment already. Luckily I saw and was able to apply the patch last night, but as a European, it wasn't great to only get the announcement after dinner time.


Why I stopped caring about "Why I stopped [insert something widely used here]" click bait articles


The points look a bit suspicious on this post, 23 points in 20 minutes and 1 comment? Hmm.


Good question, I guess progress to the betterment of society, people's lives, and human knowledge and power.

But no one really knows what future we are heading towards, or what would happen to us in 100,000 years. No one really cares to think that far ahead I guess.


We don’t think about it that much because every assumption we make is likely to turn out to be wildly inaccurate and the technology of the time will likely solve all of the problems we worry about now long before they ever reach that breaking point we are currently worrying about.

Take the example from another thread today. In the 60s we were worried about food shortages to support the exploding population, but it turned out that we solved that problem way before the population number was at that assumed “breaking point”.

We can theorize now about the problems we will face in 100k years, but what about the problems we can’t ever foresee? Aliens with hyperlight laser beams? Rogue asteroids? We have no answers for those types of problems, but they are probably more likely than anything we can dream up today.


astroids are a problem, but we know enough physics to say aliens can't attack. if they exist they are too far away to know we are here.


> we know enough physics to say aliens can't attack

Don't be too optimistic... This isn't just a question of physics but also about the probability of the emergence of complex technological intelligence. Since we only know about a single case, we can't determine this probability. We can make various guesses but these all involve assumptions about things other than physics


all the alien intelligence needs to obey the laws of physics we know. There might be major things we don't know but it still fits in our current laws.

unless you are appealing to 'God can do anything' - but since God wouldn't do that we can ignore that he could.


Well, one thing we don't know physically is whether traversable wormholes exist

https://en.wikipedia.org/wiki/Wormhole#Traversable_wormholes

Even if all travel is limited by lightspeed, without knowing the probability of emergence of intelligent life, we don't know how far away or how long ago such life is likely to have formed.

Even if we did have a better idea about this probability, we still couldn't rule out that intelligent life had by chance formed relatively nearby, relatively long ago, thereby allowing them to reach us by now. Nothing in physics forbids this as far as I know.

Personally I don't think an advanced alien civ would attack us anyway, because we'd be no threat. Since intelligence seems to imply curiosity, they might want to observe or experiment with us instead, but that's speculative


> Even if we did have a better idea about this probability, we still couldn't rule out that intelligent life had by chance formed relatively nearby, relatively long ago, thereby allowing them to reach us by now.

What is "now"? Within the next 100,000 years? In human terms, that's an eternity, and in galaxy term, that's an insignificant amount of time. In other words, almost certain not to happen. Even if it does, do we even notice? Chances are they either immediately kill us all, or they just observe and will stay hidden. A face to face interaction is scifi, not reality.

Tbh, on the list of things that humankind should worry about, an alien visit isn't even in the top 100.

It's understandable that it's a great topic to muse about, especially among tech folks. It's been part of scifi lore for generations and one can spend a lot of time discussing technical aspects. That's by far less messy and depressing than dealing with actual real-world problems (like wars, drift to dictatorships, oppression of minorities, inequality, climate crisis, human-made ecological disasters, heritary or contagious diseases, etc etc). Though when it's about devoting actual societal resources, it would be a waste to spend them on alien visitor questions beyond writing novels and making movies. Even if it's more fun to nerd out on intergalactical travel rather than preventing school shootings.


> What is "now"?

"by now" means at some time before the present.

I'm just pointing out an alien encounter is not ruled out by physics. I'm not advocating for societal resources to be diverted to prepare for it.

You mention some well-known, difficult problems. Does their existence mean no one should ever talk about anything else?

I'm not sure why you get involved with a conversation just to point out that wars and climate change are happening. Everybody already knows that. I'm taking a little time out to comment on various topics here, as you seem to be doing too.

Anyway, if you're trying to encourage people to spend time on finding solutions to those problems, I'm listening. What's your proposal?


Sorry if I got you on the wrong foot. I was merely generally rambling, not critcizing you personally or your point. Of course it's fine to discuss this, just like it's fine that people discuss pokemon or cool jazz (who am I to judge). I could have posted this anywhere in the discussion tree. I'm merely a little fed up when some tech folks make it sound like this should be top priority for humankind.

Of course you're right about the physics.

And I don't have solutions to the hard problems either. They are hard for a reason.


Ah ok, thanks for clarifying. I certainly don't think it should be a top priority either, partly because of the low subjective probability, but mostly because it would be an outside context problem (excession) - it's impossible to prepare for an event whose implications we can't bound

https://en.wikipedia.org/wiki/Excession#Outside_Context_Prob...


Well it can be fun (sometimes terrifying) to try and imagine that far ahead, but unlike hindsight, it is, at the end of a day, just a guess


Yes, there is an opt out, make your profile private.


That's why https://tikapi.io exists.


Right, but they're scraping photos of people from the whole web, which of course includes photos of British and EU citizens.

So it's not just a normal American company in the American market, it wants to be an international company but without respecting international laws, and that's not going to end up well.


So is your argument that a company must follow laws of any locality they scrape information on the internet from?

Is that decided based on where the public content is hosted, where it was created, or based on the individuals created it or are portrayed in it?

If companies have to follow that then in all likelihood every big tech company would have to follow every law in the world, virtually all of them scrape data from the public internet.


Well yes, that should be self-evident. A company must follow laws of any locality under which it engages with or utilises resources from as a component of its business.

They're previously tried this domestically in every way possible under the purview of things like the MPA and the DMCA. The United States International Trade Commission went so far as to consider electronic transmissions to the U.S. as "articles" so that it could prevent the importation of digital files of counterfeit goods.

In the meantime, AI companies are forgetting when the shoe was on the other foot regarding Russian MP3 websites accessible from the US - with the US trade negotiators warning Russia that allowing AllOfMP3 to continue to operate would jeopardize Russia's entry into the World Trade Organization, and the US copyright lobby subsequently filing a $1.7 trillion lawsuit against them.

"AllofMP3 understands that several U.S. record label companies filed a lawsuit against Media Services in New York. This suit is unjustified as AllofMP3 does not operate in New York. Certainly the labels are free to file any suit they wish, despite knowing full well that AllofMP3 operates legally in Russia. In the meantime, AllofMP3 plans to continue to operate legally and comply with all Russian laws."."

On May 20, 2008, the RIAA dropped all copyright infringement charges against AllOfMP3.com

https://en.wikipedia.org/wiki/AllOfMP3


> engages with or utilises resources

This phrase does a lot of heavy lifting.

I have a small business for consulting and occasionally need to use hardware made in a foreign country to search online content created and hosted in another country.

I wouldn't expect buying that foreign hardware or searching foreign content would put me under the jurisdiction of laws from the various foreign countries involved.


But it always has - if a given user improperly gains access to an American computer system, they violate federal law, specifically the Computer Fraud and Abuse Act (CFAA) of 1986. By making these activities federal crimes, the CFAA creates a legal foundation for pursuing alleged infringers, regardless of their location.

In deciding whether a U.S. statute may be applied extraterritorially, courts look to two potential foundations for jurisdiction: first, the jurisdictional basis, “territoriality, nationality, passive personality, universality, or the protective principle”; and second, legislative intent. CFAA Passes both these tests. This is clarified in U.S. Const. art. I, § 8s. 10, 3; art. VI, cl. 2. Cf. United States v. Baston, 818 F.3d 651, 666-67 (11th Cir. 2016) (“Congress’s power to enact extraterritorial laws is not limited to the Offenses Clause”).

i.e. the Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax, https://www.justice.gov/opa/pr/chinese-military-personnel-ch...

If you want a phrase that does a lot of heavy lifting, the specific computers in scope are defined under section 18 U.S.C. § 1030(e)(2) - "...including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States."

Similarly, in United States v. Neil Scott Kramer (2011) it was determined that ALL cell-phones represent computers in scope - "...the United States Court of Appeals for the Eighth Circuit found that a cell phone can be considered a computer if "the phone perform[s] arithmetic, logical, and storage functions."

My favourite, however, is the precedent set by Pulte Homes, Inc. v. Laborers' International Union (2011) - urging legitimate communications via official digital channels constitutes a DDOS and breach of the CFAA if the official channel cannot handle the subsequent spike in volume!

This travesty arose after Pulte fired an employee represented by the union and LIUNA urged members to call and send email to the company to express their dissatisfaction. As a result of the increased traffic, the company's email system crashed. The Sixth Circuit ruled that the LIUNA's instruction to call and email "intentionally caused damage".


They were indicted, were they convicted?

My point wasn't whether a state can claim jurisdiction or whether they might even win in their local court.

They need to be able to actually try the case. For a foreigner charged with a crime they would need to be caught on US soil or extradited by a country willing to cooperate. For businesses it generally comes down to leverage the government may have on corporate assets or similarly arresting business leaders should they be caught on US soil (or whatever country is indicting them).

Governments can claim jurisdiction, they can't always enforce it and other countries don't always agree on that jurisdictional claim.


It depends on what information is being scraped and what is it used for.

Scraping people's personal photos and biometric information for shady agencies, is not the same as scraping e-commerce prices, social media posts, or blog websites.

The intention is important. And respecting people's privacy and copyrights.


> Scraping people's personal photos and biometric information for shady agencies, is not the same as scraping e-commerce prices, social media posts, or blog websites.

Hard disagree. They both violate people's privacy and copyrights.


I don't believe privacy rights can be violated when the information is available publicly.

Copyrights are a separate issue and one that LLM companies almost certainly violated.


I disagree that those two cases are really all that ethically different, personally. They're both harmful practices. A pox on both their houses.


> So is your argument that a company must follow laws

in principal, yes


You removed the important context


Bad luck. They don't have to scrape, you know.


> So is your argument that a company must follow laws of any locality they scrape information on the internet from?

i mean… yes? it’s entirely normal for a company to be bound to the laws of jurisdiction it wants to open a store or restaurant in or whatever. why on earth would this be any different?


What if they’re scraping from a US exit IP hitting a local Cloudflare cache node proxying to an origin in the UK? Their scraper only interacts with the US node, and in fact Cloudflare by design doesn’t tell the scraper where the origin node is. So are they subject to UK law in this case? No internet traffic left the US, aside from when the target site sent its data to a US server for publishing.


that’s a lot of “what if” wild hypotheticals.

clearview knows for absolute certain they’ve been operating in the eu.


>that’s a lot of “what if” wild hypotheticals.

What? No it's not at all - that exact flow happens tens of millions of times per day every single day. Cloudflare handles a plurality of all global internet traffic and makes extensive use of a geographically distributed CDN.


Yes, it's simple, S3 is for storing objects, not for processing.

Don't know how they came up with such a bad and complicated cloud design for something that is straight forward.


It’s a pattern prominently featured in AWS docs… upload to S3, react to CloudEvent in SQS, download and process with Lambda, upload back to S3…


Docs written by people who make more money the more services are consumed...


I'm confused, I don't see what they're offering in this website, looks like a blog post. They just got their hands on a catchy domain name.


I'm learning that hn isn't great at understanding satire. I find that interesting but I'm not sure why.


It’s a bot responding. That much I can tell


Is it? How can you tell?


Huh? Who is a bot?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: