yan

security engineering @brave / helped build Let's Encrypt, Privacy Badger, and HTTPS Everywhere @eff / physics alum @mit / rabbit enthusiast

[yan @bcrypt]

could not for the life of me figure out how to buy a bus ticket in Milan. it was literally easier to get a shell 😆

[yan @bcrypt]

@Noahpinion @ssvankai that neighborhood absolutely slaps for hole in the wall chinese food. in addition to HoP, check out Happy Family Gourmet

also noah i think u would like Esme which just opened in our general vicinity (modern-izakaya french food)

[yan @bcrypt]

@ZixuanLi_ i would submit some if it did not require write access to repos

[yan @bcrypt]

@octal truly sad that LLMs could never produce this specific type of trash

[yan @bcrypt]

@octal truly sad that LLMs could never produce this specific type of trash

[yan @bcrypt]

got the best, AKA worst, hackerone report ever. someone reported that an attacker website can figure out a person's IP address by *gaining local access to the person's machine*, installing a NodeJS webserver, and using the IP npm package to get the IP.

[yan @bcrypt]

if you’ve been on either side of a bug bounty you know the joy in it is gone now. it’s just AI reports coming in, AI patches going out, and decreasing human understanding of either. i wonder what is left of the security industry once the fun clever hacking parts are all outsourced to AI.

[Joel Margolis (teknogeek) @0xteknogeek]

after seeing the current state of HackerOne, I decided it was time to sit down and address the elephant in the room

https://t.co/aHg7T7ds31

[yan @bcrypt]

@octal having run one for a decade the amount and type of trash has changed. avg impact of reports has gone way up but they are unreadable walls of text now. also soulless.

[yan @bcrypt]

@connyb i think just the algo deciding i’m not incendiary enough lol

[yan @bcrypt]

@CharlesDardaman @DanielleFong this is my pessimistic take as well

[yan @bcrypt]

@__apf__ there was a tweet about this to the effect of “sept 12 2001 was the safest day to fly”

[yan @bcrypt]

@F_Vaggi definitely did it with improper form lol. i’m guessing they just check the correct limb parts are on the ground at all times

[yan @bcrypt]

planked for 9+ minutes continuously today to win a contest and now am regretting my hubris in even looking this up…

[yan @bcrypt]

(i thought the record would be approximately 10 minutes)

[yan @bcrypt]

@chrisrohlf omg you're also at anthropic now?! say hi to @garrettr_ :)

[ayush @hyusapx]

The site looks like a coffee shop to humans. To Claude, it serves a fake Cloudflare check.

web_fetch is read-only, so the page builds an alphabetical directory Claude clicks through to spell out your data, one letter at a time.

https://t.co/lTJZM0u28A

[yan @bcrypt]

@anaisbetts surprised mine is as high as it is tbh https://t.co/EpPIwiuXct

[Brave @brave]

By popular request: Brave now has Containers!

In Brave for desktop, you can now separate your browsing sessions with a couple of clicks.

Here's what this means...

[yan @bcrypt]

@BraydenWilmoth whoa cool, so it's a local browser mirroring what browser run is doing?
i tried a similar thing but starting from a local browser controlled by an LLM using cf workers for tasks that don't require the browser to be open

[Basil🧡 @LinkofSunshine]

Idk why this comic gets me every time lol