I think that’s it. Thanks.

Thanks!

I had been wondering about this stuff. That’s neat.

What’s the vertical distance between stories? If someone drops something into an underlay can they just climb down and grab it?

Just last night while reading A Wrinkle in Time i decided that pine-like trees that are rich in iron exist, and shed rusty needles that coat the forest floor. There was some line about rusty pine needles in the book.

It seems there’s no CSS equivalent to noscript, but what i can do is put the CSS version of a page inside a <div hidden style=“display:block”>, and the non-CSS version in a <div style=“display:none”>. But this doubles the size of a page so i don’t like doing it.

Natural two in the sticker, you’re probably safe. For the first 3 seconds, at least.

In one of my random tables is a shady dealer selling “death sticks” which are actually just cigarettes made with dried grass. It’s yet to come up tho.

See also: https://codeberg.org/small-hack/open-slopware

There can be more to worldbuilding than placing mountains and deciding what kinds of elves exist. This is part of computer systems of an advanced alien race.

“dwarves” and “elves” are consistent with things like “wolves” instead of “wolfs”, “lives” instead of “lifes”.

Fun fact: this never got applied to dwarf stars, which are still “dwarfs”.

At least your workplace isn’t yet forcing you to use Al instead of your own brain. Some people are at the point of having to fake Al contributions, like Dan Q here.

A vulnerability analyst and prominent member of the infosec industry has blasted Microsoft for refusing to look at a bug report unless he submitted a video alongside a written explanation.

Senior principal vulnerability analyst Will Dormann said last week he contacted Microsoft Security Response Center (MSRC) with a clear description of the bug and supporting screenshots, only to be told that his report wouldn’t be looked at without a video.

MSRC told Dormann: “As requested, please provide clear video POC (proof of concept) on how the said vulnerability is being exploited? We are unable to make any progress without that. It will be highly appreciated.”

Frustrated with Microsoft’s demand, which Dormann said would only show him typing commands that were already depicted in the screenshots, and hitting Enter in CMD, the analyst created a video laden with malicious compliance.

The video is 15 minutes long and at the four-second mark flashes a screenshot from Zoolander, in which the protagonist unveils the “Center for Kids Who Can’t Read Good.”

It also features a punchy techno backing track while wasting the reviewer’s time with approximately 14 minutes of inactivity.

Dormann said via Mastodon: "I get that people doing grunt work have mostly fixed workflows that they go through with common next steps.

“But to request a video that now captures (beyond my already-submitted screenshots) the act of me typing, and the Windows response being painted on the screen adds what of value now?”

To top it all off, when trying to submit the video via Microsoft’s portal, the upload failed due to a 403 error.

Dormann’s complaints coincidentally came on the same day MSRC published a blog highlighting the strengths and key features of its coordinated vulnerability disclosure program.

Requiring a POC video - in addition to screenshots - as part of a vulnerability disclosure isn’t often required in the industry.

CISA uses the Vulnerability Information and Coordination Environment (VINCE), run by Carnegie Mellon, to receive vulnerability reports. It has the option to include a single 10 MB file to support written reports and additional files can be sent directly upon request, where necessary.

Public sector organizations in the UK tend to follow the advice issued by the National Cyber Security Centre (NCSC), which also doesn’t mandate a video report. A short description of the issue and details of how to reproduce the bug are the only requirements. This is generally standard practice, though not universal.

Medusa ransomware affiliate tried triple extortion scam – up from the usual double demand
Expired Juniper routers find new life – as Chinese spy hubs
This is the FBI, open up. China's Volt Typhoon is on your network
Choose your own Patch Tuesday adventure: Start with six zero-day fixes, or six critical flaws

We also asked Dormann for additional input. He said requests for video can be found on other platforms such as HackerOne and Bugcrowd but in his opinion, requiring one signals to researchers that the reviewer is merely following a process rather than understanding the report itself.

As the post and video suggest, he was unimpressed by MSRC’s refusal to proceed with the vulnerability report just because a video wasn’t submitted in tandem.

“If a researcher is going out of their way to be nice to vendors and writing up vulnerability reports to share with them, the least the vendor could do is at least pretend to be taking it seriously,” said Dormann.

“I reported three related but different vulnerabilities to Microsoft recently. Two of them requested video evidence of exploitation (for things that don’t even make sense to have a video of, thus my malicious compliance example that I posted), and the third was rejected as not a vulnerability with clear evidence that the MSRC handler didn’t bother actually reading what I submitted. Researchers doing the ‘right thing’ deserve better.”

Dormann said he was still waiting to hear back from Microsoft after sending them the video. But Redmond messaged The Register on Friday about the request, and apparently those who like bounty should comply. A spokesperson told us: “In some cases, our team may ask a security researcher to provide additional evidence with their vulnerability submission. This is not a requirement but can assist in ensuring accurate assessment and potential bug bounty reward.” ®

I don’t have Switch edition, and it’s my understanding that unless you have it on a cartridge you can only get Bedrock edition for Switch now. It’s cool that Chunker supports Linux tho.

I wonder what would be the power consumption of a device that sits on your head and emits IR light in all directions until you turn it off, instead of just over your eyes. Similar to how microphone blockers work.

What would jewelry and hats do about cameras?

It would have to be strong enough to damage the cameras, if it’s not to be always on.

Maybe something similar to how microphone blockers work, flood a space with EM radiation outside the typical human visible range.

Or i think i’ve heard of ways to detect when someone has one of these near you (identifying bluetooth signals and such), in which case you can look around for who has glasses thick enough to hold a camera and shine a laser in their camera/eye. That could have too many false positives though.

See also: Firefox tab containers (built in feature), Temporary Containers extension (makes a new temporary folder for cookies & cache every time you go to a new domain/subdomain), and uMatrix extension (block embedded anything from any source, by domain & subdomain).

Yeah, that might be my bad. I currently pay $10/month. Light is asking for $25.

I repeated what stood out to me. They log mouse movements and keystrokes on their website, and also want details about all my contacts. I could maybe understand them needing to know the numbers i call, but not names and pictures.

United States dollars? I’m seeing unlimited plans from them for $25 minimum.