Hacker Newsnew | past | comments | ask | show | jobs | submit | consp's commentslogin

In my case a downtime of over 4 hours will switch it. Might just be lease time doing its job.

When you underpromise and deliver sales will still tell you they could have sold the overpromise for even more and should have gone with that.

Where my parents live they leave the door unlocked, easily invite people in and there is strong social cohesion. Where I live that's invalidating your home insurance since it's "asking to be robbed" and people don't talk to each other or report crimes.

Difference between the countryside and the city I guess.


Exactly live in rural Midwest. Most vehicles and houses are left unlocked 24 / 7. If you forget you wallet you can still buy things and just come back later to pay. Don’t get me wrong lots of problems in the rural parts but something about how people relate does feel more human or natural IMO.

Doesn't this just support the AI's takes of how tribal humans are? Many of the examples in these threads are about small homogenous communities where it's easy to trust someone very similar to yourself.

How does that apply to the above story about a pilgrimage though? My experience in the way of St. James is very similar, the vast majority of people will not walk that road ever again in their lives and I saw plenty of people from all around Europe, even a few Americans.

It does seem to apply to rural areas specifically though.


I think your experience would vary hugely based on your skin colour (ie. the tribalism)

If your tribe is a billion people then that's not very narrow.

The same communities are frequently the most racist, xenophobic and homophobic. The dark side of the tribal mindset I guess.

Have you ever contemplated that the "racist, xenophobic and homophobic" behaviour is what is keeping those communities and used to keep other communities homogenous and thereby ensured high-trust? In that case the xenophobia acts like the immune system but for a community/society.

Yeah, I guess being against anything that might be remotely disruptive, means they can trust things not to be disruptive in their daily life.

>Have you ever contemplated that the "racist, xenophobic and homophobic" behaviour is what is keeping those communities and used to keep other communities homogenous and thereby ensured high-trust?

Not much, no. A small community that only trusts itself and pushes any out-group away (regardless of disposition) tends to be called a "cult".


Doesn’t that make you think : why are they so nice on the one hand , but so bad on the other hand? Well I know why: you can’t have the cake and eat it too. One thing is the mirror image of the other, you need to choose which side you prefer to value more.

You can't just throw out cliches if you're going to claim something as impactful as that. You seem to be saying there's some kind of conservation of niceness so increasing your treatment of one group requires decreasing it for another group? Why is that?

And the answer couldn't be based on the amount of effort it takes, since in the small town scenario you're doing the effortful nice behavior 95% of the time.


First of all , this is an observation of facts in the reality we live in. I agree with the OP argument that these things are intrinsically linked when we just observe the facts without trying to impose our beliefs on them. If we accept that, we can try to theorize about why that may be. My theory is that people are nice when they live among others who look and behave like themselves because that what humans did for almost their whole existence as a species. Archeological evidence suggests that if you met a stranger, someone not from your tribe, chances were high they would be a danger, not an opportunity to make a new friend. So humans seem to have evolved to not trust outsiders, not just strangers. In a small society, conformity is highly valued because doing things without understanding its consequences could often end up in catastrophe. People didn’t understand the world, and other tribes, well enough to have any confidence in whether a new behavior would be beneficial or not. So we end up with humans who trust and depend on others from their own tribe for everything, are highly distrustful of outsiders, and not looking like yourself is the greatest sign that someone is an outsider, and who value and demand conformity as a matter of survival. The world of today breaks some of these expectations in some ways, but they are still mostly accurate in my opinion. People who are more open minded tend to be so because they live in fairly cosmopolitan areas, but those also tend to be bigger cities where you don’t really know most people and where trusting others becomes harder, especially when many people have completely different backgrounds than you.

Nothing you just said backs up the argument you were making earlier that who you are nice and mean to is "two sides of the same coin" and it's impossible to be nice to both (or mean to both based on the mirror comparison). You're giving a fine explanation that there are different motives involved in the treatment of insiders and outsiders, but that's much more general and nonspecific.

I'm not getting into a discussion about tribalism in general right now. You made a strong claim that goes well beyond what I normally think of as tribalism. Do you have a scrap of evidence or research for that claim?


I think you didn't understand my claim. My claim is simple, my long explanation above was meant for you to arrive at these conclusions yourself:

* people are nice when they still behave in the old, tribal way.

* the tribal way is always going to be creating individuals who are racist and conformant/conservative.

* not behaving the tribal way means going outside the conformist mold, which means you take risks and eventually learn by experience that taking more risks come with consequences. You become less trustful of everyone, while almost paradoxically proclaiming yourself to be more open.

This fits observation. If you believe it's wrong, you must demonstrate why with supporting evidence without contradicting the evidence I've used, obviously.


If you want to assume you can trust your network, so you don't need security in the hosts, you need to have a sysadmin who secures the network or have it airgapped directly. You can get rid of all of that, but then you must assume your network is untrusted and need to have security in every service you run.

I don't think switches refusing connection to devices that don't live there is a good analogy to "racist, xenophobic and homophobic".

Why not? The behaviour is kind of similar. The difference is that humans have an inherent right to live, while packets don't have an inherent right to be delivered.

Consider what happens if you have a community that is very nice, very trusting, and open to everyone including complete strangers who behave weirdly.

At the beginning it can be a nice place. Until the first abuser finds them. And then... depends on the abuser.

This is not a theory; I have seen it happen, often in groups of nerds who are somewhat naive about how real life works. Then a new guy comes, borrows some money from each of them individually, then disappears. Or a new guy comes, invites a girl to his place, and rapes her. Sometimes some people even get suspicious about the new guy, but is a taboo to express such thoughts loudly, to spread suspicion in a group based on mutual trust.

To avoid things like this, you need to split people into "those I trust" and "strangers". Different people and cultures draw the line differently. For some of them, "those I trust" only includes people they have known for a few years. It is frustrating for a newcomer, and you often wish you were able to do something so that they accept you faster. Unfortunately, if that worked, the abuser would probably do the same thing.

Another strategy is to have mutual friends vouch for someone. But this only works when it is a part of the culture, where people know that vouching for someone brings heavy consequences if that person turns out to be an abuser. In cultures that do not have such experience, abusers often do the trick where they befriend someone, use them to get introduced to their friends, and while the first target is like "this is a nice stranger that I have met yesterday", their friends are like "this is a nice person recommended by my trusted friend, which means I can trust them too", and then the abuser exploits them. (And when they complain to the first target "why did you make me trust such a horrible person", the first target is confused "well, I actually barely knew them, this was a horrible misunderstanding". But the abuser probably has a lot of experience creating such misunderstandings on purpose.)

Finally, you can have a close community that is very difficult to enter. You can trust everyone in that community, because if they do something bad, they will be kicked out, or worse. But this requires the community to be very difficult to enter, and to have ways to punish the abusers in a way that actually hurts them. (Merely kicking someone out of the community is not enough, if there are hundreds of communities, and the abuser simply infiltrates the next one.)

Abusers exist. You need to build a firewall somewhere. There are different places where you can build it, but you have to build it somewhere, or you get hurt.


You're talking about it being hard to join the community.

That's arguably xenophobic depending on how you interpret the word. But it doesn't require anything resembling racism or homophobia.

I'm objecting to the idea that the downside of a tight-knit community is some kind of bigotry. Not just barriers to entry.

(Alternatively, if it's not a specific community, it's some super-wide group based on some obvious feature, than that group isn't keeping out abusers and someone in a different group has probably the same odds of being an abuser.)


I would say decency arises as a function of culture, so it depends on the value system that generates.

There’s something tribal-ish to it, but also something philosophical. You can also belong to a culture which makes this kind of trust or goodwill far more limited, for instance only between family members—you’re just as culturally homogenous but not nearly so kind to strangers.


Isn’t that a function of density? The denser the place, the more random chance someone wrong would pass by?

Density and the same people and ideas AKA homogenity of the population.

Look at Japan and rural Western societies. High trust, but the trust is because they are all pretty much the same people, demographics, beliefs, etc. and the density makes it so they pretty much know each other.


I'm not sure if it's directly related to density, see Japan as a counter example.

Canada too, for something closer to you. Doors are rarely locked, even in big cities.

I live in Vancouver and that is definitely not true.

Or familiarity. I tend to pick one or two favorite food places where ever I live (always in big cities) and go there till I know them and vice versa (locally owned, not chains) and when I forget all my payment methods they always say to pay next time. (Probably helps to be a self-deprecating white guy in this scenario, of course.)

What's the population? I'm wondering if this is a YMMV situation. My uncle lives in a town in Oregon with ~1500 people. Everybody knows everybody, but they all treat each other like thieves (rightfully so in many cases unfortunately). I remember one summer night in the mid-2010s a group of guys kept coming back to his property to steal stuff. He'd go out and start yelling, they'd take off and come back an hour later to try again. About the 4th or 5th time he went out and just started shooting into the field nearby and they didn't come back after that lol. I was shocked when he told me this was a semi-regular thing.

When you say leave the door unlocked, do you mean while you are in the house or away?

I encountered this when someone was talking about where I live as being the kind of place where you could leave the door unlocked. Everyone thought that seemed overstating it because you'd only really do that if you were going out for a few minutes. We were quite shocked to hear they were talking about locking the doors while they were home. None of us had even considered that as a meaning even though it was the norm for where they came from.


It seems like there are about four different options - Leave it unlocked all the time, even if you’re gone for a while - Leave it unlocked all the time, except for when you leave the house for more than a few minutes - Leave it unlocked when you’re home and locked when you’re not home (Maybe another option here for locking when you’re sleeping?) - Leave it locked all the time

Personally I default to the latter because that’s how my idiosyncratic anxiety feels comfortable, even when I’ve lived somewhere where I would be able to hear people coming a mile off. But I know people who default to the first option even in a place where some of their neighbors default to the latter. A lot of it comes down to personal preference rather than environment, I suspect.


Many single family homes in Germany (and apartments) don't even have a doorknob outside you can turn - you can only open the door with a key (from the outside).

I guess in rural areas and old style homes it might be different.


The norm (I think?) where I am is lock it if you’re out, and at night.

If and when you open it during the day, leave it unlocked (and perhaps open if it’s a nice day) until one of those two things happen.


Here in the UK, my mother locks her front door at night, even though she's in a relatively low-crime area (albeit, technically a 'city'). When I stay, it scares the life out of me; I worry about waking up to a fire and being stuck in the house!

Can you not unlock it from the inside?

Not without the key, which in the panic situation of a fire, I wouldn't want to spend time searching for!

Ah, very interesting. Many modern codes prohibit this for this exact reason. For example, in North America any residential door will have a thumb lever or other means of unlatching from the inside without a key.

For many years, where my grandmother lived (in Lexington, TN), she kept her front door unlocked. This was long after my grandfather had passed away. She still had neighbors who might need to come in and borrow some butter or something.

After a long time, she started locking the door. But she left a copy of the key in the mailbox next to the front door. That was also for her, in case she went out and lost her keys or forgot where she put them.

It was only a few years before she passed away that she had the key taken out of the mailbox.


My wife (before we were married) was visiting her grandparents in a town in western Pennsylvania. Not a large town, but not all that small, either. They were going out to lunch or dinner or something. My wife was the last one out, and locked the door. When she found out, her grandmother said, "Oh. I hope I've got the key..."

Then never locked the door, even when going out for an hour+ and leaving nobody home.


We don't even know where the keys our house are...

Why not treat both as bad instead of pointing to whataboutism to make a point?

Because some causes are significantly worse than others. If you want to have a big impact, you start with the big levers.

I'll give you an even better example than meat: golf courses in the US consume 2 to 100 times as much water as US datacenters depending on how you calculate.

How many golf-course-water-saving initiatives have you seen? Have they even tried anything at all?


AI data centres are a thing we are choosing to add, we could just not do that.

What benefit is the AI summary on search giving me Vs the actual search for a start.


Have a look at a graph of meat consumption in the US. We are also adding to that. That's my point, we don't need to add to meat consumption, we can make reductions.

what benefit is it giving to the search engine is what you have to ask.

if you dont leave the page they get more ad-money


Eating more meat is a thing we are choosing to add, we could just not do that.

Flying more is a thing we are choosing to do, we could just not do that.


and what benefit does a golf course have to anyone? Unlike golf courses, AI summary is used by pretty much everyone. And if you dont think this is true, then you live in a bubble.

Because they’re not both equally bad.

If you eat meat, you’re producing more CO2 and using more water than 100 vegan vibe coders sitting around creating slop 24/7. It’s not on the same level.


I'm the recovery account to at least two accounts of real people with the same name (the people are real, despite the uncommon name). Don't bother reporting it via the link in the mails, it does nothing. I'm not even sure this isn't some Google shenanigans either.

If they put the match ratio value lenient enough to not reject a lot of people in bad lighting conditions you can make a dog match. So it's likely useless.

> https://www.php2shell.com/

Boy, do I hate these PR websites masquerading as vulnerability reports. It's slop all the way down with these companies.


I wonder how early the domain was registered and when the first certificate was issued for it, whether you could’ve had advanced notice of this by watching the DNS records


Guess what, there are answers to that question! October 14, 2026 was the date the domain got registered.


Domain registration doesn't mean that much. Many similar domains are already registered, eg python2shell.com is 5k aftermarket but js2shell.com is unregistered. Might not be a bad investment to register the .com for all the top PLs.


8 hours of highly concentrated work is a unbearable load to do continuously for days, you definitely need some "normal" task as well. I can't imagine anyone claiming to do "12 hour work days" to engage in anything thoughtful for more than 12 minutes.


I'm still flabergasted the HSM allowed this key to be generated. Then again, I've worked with HSMs, there are always many mistakes in the firmware, usually less severe though.


It seems there was some issue with the ceremony with some wrapping/unwrapping scripts.

They explicitly said they wanted to export the keys from the HSM; the keys were intended for USA/Europe (for sovereignty reasons) but were never actually used.

It seems the HSM itself worked, their ceremony around wrapping/unwrapping didn't.


Makes more sense.

I'm sure the Utimaco's used (haven't worked with one) also allow all slots to contain the same name or keys with the same name and the device always selecting the first one if you only provide the name and not the slot ID or token identifier. Don't ask how I found out the hard way.


Yes there was something about key names in the write-up (which I cannot find now)

oh here

https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11


> and presumably nobody would try to brute-force a private key.

Why not? There are examples of RNGs providing very poor entropy which might be a reason to check it (looking at you Sony).


Just seems weird for anyone to focus on trying to crack private keys starting with absurd 8-bit values that "nobody would use for a private key", let alone bother to do it at all, given the search space.


I would not expect anyone to be on the lookout continuously, but like the researcher doing a "yolo" and trying. There are enough people out there that it is likely to happen at least once in a while. Or for instance someone looking for a firmware exploit in a downstream device.


And here you learn why security is often just theater (not saying a proper elliptic key is theater)...

It took less than a second to factor this key. Why not attempt, say, to factor every CA, with a budget of less than a minute each?

The reward/risk ratio is skewed so heavily in favor of trying, the only reason not to is this idea that it is "impossible".

It's clearly not, hence, the theater. Your locks don't have to work, they often only have to look like they work...


Factoring is for RSA. The best non-quantum attack against ECDSA is meet-in-the-middle brute force, with sqrt complexity. With RSA you can check if any keys in the world have any low factors and that might be interesting to do, even if you don't get any complete keys. With ECDSA the search is all or nothing and without an obvious starting point.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: