Hacker Newsnew | past | comments | ask | show | jobs | submit | awirth's commentslogin

I have a 60L fish tank in my Tokyo apartment on around the 10th floor. It's sitting on stand that is not bolted to the wall. I have several friends with similar setups.

In the last 6 years there have been two or three earthquakes that caused enough water to slosh on to the floor.

Of those only the 2021 Fukushima earthquake caused any fish to slosh out - perhaps 10 medaka if I recall correctly. Luckily I was home and I was able to save all the fish, however there was one adult red cherry shrimp that didn't make it because I had trouble picking it up off the floor. I cleaned up the water with some paper towels and it didn't seem to cause any lasting damage.

I think if I had a 600 lb (270L?) tank or expensive fish though I would probably have a different perspective.


It's been a year. Has it been disclosed what tool had this misconfiguration?


I also got a lot of value out of wanikani even without completing it.

I tried and failed several times to get started with Anki before having success with Wanikani. The key diffentiator for me was the learning step. Anki is great for remembering things you were taught or learned outside of it, but using Anki to learn new things is very much a learned skill that Wanikani holds your hand through.

I have N2 and am working on N1 now, and feel I still have a very long way to go before getting to CEFR C1. Now I only use Anki with the yomitan and takoboto integrations to quickly add any words I look up, which seems to be working well.


These tokens never expire, and there is no way for organization administrators to get them to expire (or revoke them, only the user can do that), and they are also excluded from some audit logs. This applies not just to gh cli, but also several other first party apps.

See this page for more details: https://docs.github.com/en/apps/using-github-apps/privileged...

After discussing our concerns about these tokens with our account team, we concluded the only reasonable way to enforce session lengths we're comfortable with on GitHub cloud is to require an IP allowlist with access through a VPN we control that requires SSO.

https://github.com/cli/cli/issues/5924 is a related open feature request


That is crazy. See, this is what I'm talking about. It shouldn't even be possible to have services that sensitive with auth tokens that can't expire.


What you're describing is a specific case of a confused deputy problem: https://en.wikipedia.org/wiki/Confused_deputy_problem

This is captured in the OWASP LLM Top 10 "LLM02:2025 Sensitive Information Disclosure" risk: https://genai.owasp.org/llmrisk/llm022025-sensitive-informat... although in some cases the "LLM06:2025 Excessive Agency" risk is also applicable.

I believe that some enterprise RAG solutions create a per user index to solve this problem when there are lots of complex ACLs involved. How vendors manage this problem is an important question to ask when analyzing RAG solutions.

At my current company at least we call this "権限混同" in Japanese - Literally "authorization confusion" which I think is a more fun name


Exactly. We often end up doing 'direct' retrieval (ex: DB query gen) to skip the time suck , costs , and insecurity of vector RAG, and per user indexing for the same. Agentic reasoning loops means this can be better quality and faster anyways.

Sometimes hard to avoid though, like our firehose analyzers :(


Now, I've done it by email! (although still using the convenience store for print/scan)

Unfortunately, https://www.sec.state.ma.us/ is geo-blocked for all of Japan (and several other countries AFAICT) "due to cybersecurity reasons", so I can no longer check/update my registration to vote without a VPN. I tried contacting different parts of the MA state government to get it unblocked several times over the past few years, but had no success. I have no idea what the other MA-voting residents of Japan do.

Last time I contacted the secretary of state's office via my state representative, they were kind enough to temporarily unblock my home IP address for one week though!


Indiana is also geo-blocked outside the US. I've tried contacting the secretary of state's office and they sent me a form reply with a link to the geo-blocked site.

I wonder how many other states have their voting portals geo-blocked.


Might the embassy be able to assist? Just a thought.


Cat's Cradle is one of my favorite books, but to be honest, I've never found it that funny - at least not in the sense that it makes me laugh much. What do you find so funny about it?


Everything about it is funny. Humans are absurd, and Cat’s Cradle revels in the absurdity. It’s funny in the same way atom bombs are funny, that our species would hate itself so much as to make a weapon that could destroy us all, and like, we ignore it almost all of the time? Bokonon and the dictator becoming their roles is absurd, but aren’t people this absurd?

Also, there are a lot of chapters. Every single chapter break is there to let a punchline sink in. It’s a literary pause for laughter.


That's interesting, I've always reveled in the absurdity, but perhaps I'll re-read it with an eye to take each chapter in as a discrete unit. Thanks!


Sometimes it’s a whole scene, but sometimes the only reason for a new chapter is comic timing. Or to shove more jokes in the chapter titles, of course. So I wouldn’t say they were discrete, as a break could come in the middle of a scene.

Seeing Vonnegut use chapter breaks for all sorts of purposes — dramatic, comic timing, scene breaks, suspense, etc — really encouraged me to use shorter chapters in some of my own writing, along with some of the techniques. Just like metadata is data, chapter breaks, line breaks, and white space are text. Of course the more you use it for tricks, the more you see the fourth wall, which might not match your tone — like all techniques there’s always a trade-off. More tonally serious works that use short chapters tend to avoid chapter titles, for instance.


Have you read Tim Dorsey at all?

His stuff is full of this type of humor, with notes of whatever decades of covering Florida Man stories for a Miami newspaper does to a man.


I’d never even heard of him. But as a meteorologist, that main character of his sure sounds fun.


If you can access the classloader that's pretty bad, it's likely people will find other gadgets.

It's insane to me though that class.* isn't completely disallowed. What is the legitimate use case for deserializing allowing web requests to call setters in the reflection API?

Also, agree it is impressive to me how much bad information I've seen.


Yea it didn't help that this was posted a bit after https://spring.io/blog/2022/03/29/cve-report-published-for-s... and that the original article mentioned a commit on the class `SerializationUtils` which in the end has no connection to this.

I believe accessing the `class` object here is a mistake. You can see my analysis here where I trace the POC https://news.ycombinator.com/item?id=30862953 but like you said, there are other problematic code paths for sure with this.


I've been able to vote abroad in state/presidential elections from my last address in the US. I do it by email.

My only major hiccup is that the MA secretary of state's website www.sec.state.ma.us (which has the info about upcoming elections, the tool to check your registration, and the instructions for voting overseas) is blocked in Japan "for cybersecurity reasons". I've tried contacting the department of state and my state representative about this, but nothing's come of it.

The government of Cambridge on the other hand has been quite pleasant to deal with.


I’ve tried. The local clerk of courts required contact via fax.

You’re at the mercy of your local election officials.


Now that I live in Japan, I've come to learn that for Japanese Windows users, seeing the ¥ symbol as a path separator is normal, it isn't a quirk or a bug. In fact, IIRC the copy machine in the closest convenience store shows a ¥ as the path separator when browsing a USB drive, even though I'm almost certain it's not running Windows.

A few years back, I wrote a CTF challenge around this quirk of SHIFT_JIS. It used a python MySQLdb connection set to SHIFT_JIS mode and a custom naïve mysql escape function. The trick was to use a yen symbol and have it get interpreted as an unescaped backslash, leading to a SQL injection. Also it was all over websockets just to be annoying.

There's a few nice writeups from it:

https://www.kernelpicnic.net/2016/03/06/BKPCTF-Wonderland-Go...

https://0day.work/boston-key-party-ctf-2016-writeups/

https://security.szurek.pl/en/boston-key-party-ctf-2016-good... (this one has the original challenge source)


I mean, yeah, it's been that way for decades. Why wouldn't they see it as normal?


We have a Toshiba CNC machine at our shop that enters paths like this on the controller, always wondered why; now I know.


It may be running Windows CE


But you can always just use a different layout for your keyboard. So eve with a keyboard with physical key engravings in Japanese you could just use a US layout.


The keyboard layout makes no difference; the yen symbol is just what ASCII 92 looks like.


Looks like i replied to wrong comment. Wanted to reply to use linguae below. Sorry about that.


> seeing the ¥ symbol as a path separator is normal

Also for people working in many Japanese MNCs.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: