143 Matching Annotations
  1. Last 7 days
    1. JavaScript is not available. We've detected that JavaScript is disabled in this browser.

      这句话看似简单,实则揭示了现代网络架构的脆弱性—整个平台功能依赖于单一技术组件。这种单点故障风险与平台宣称的'可靠性'形成鲜明对比,暗示了数字基础设施的潜在不稳定性。

    1. We experienced a sudden and extreme spike in Gemini API usage. The traffic was not correlated with our actual users and appeared to be automated.

      描述了高达54,000欧元的账单激增现象,表明AI API使用监控和防护存在严重漏洞,这种自动化滥用突显了当前API安全机制的脆弱性,对AI服务提供商和开发者都是警钟。

    1. just a handful of obviously fake articles could cause Gemini, ChatGPT, and Copilot to inform users about an imaginary disease with a ridiculous name.

      令人惊讶的是:仅凭少量明显虚假的文章就能导致主流AI模型传播虚构疾病信息。这揭示了AI训练数据容易被污染的脆弱性,也暗示了未来可能需要类似'低背景钢'的纯净数据源来确保AI输出的可靠性。

  2. Apr 2026
    1. we had predetermined that we would withdraw the paper prior to publication if accepted, which we did.

      通过评审后主动撤稿——这个决定令人感到既欣慰又不安。欣慰:Sakana AI 展示了负责任的研究伦理;不安:如果换一个不那么有道德感的团队,这篇 AI 生成的论文本可以悄悄混入正式出版的学术文献库。同行评审制度目前对 AI 生成内容几乎没有系统性防御,这是整个学术界的集体盲点。

    1. select known-vulnerable dependency versions 50% more often than humans.

      这一统计洞察颠覆了“AI写代码更安全”的迷思。AI代理在优化代码功能性时,往往以牺牲安全性为代价,倾向于选择存在已知漏洞的旧版本依赖。这反映出当前AI模型在训练时对安全维度的忽视,也警示我们在AI辅助开发流程中必须强制引入自动化的安全卡点。

  3. Jul 2025
    1. According to psychotherapist Esther Perel, "[in therapy speech], there is such an emphasis on the ‘self-care’ aspect of it that is actually making us more isolated and more alone, because the focus is just on the self".[21] Therapists find that using therapy speak can prevent people from being open and vulnerable with each other.[7] It may be used in an attempt to define the other person's lived experiences.[3] It is frequently used in ways that elevate a one-sided view of a relationship or situation.[9]
  4. Mar 2025
  5. Jun 2024
  6. Mar 2024
  7. Jul 2023
  8. Aug 2022
    1. Given the strong coupling between data andcryptosystems in blockchains, the potential vulner-ability of these cryptosystems to quantum attacks,the likely introduction of capable quantum com-puters in the mid-term future—not to mention theusual high monetary value of the assets secured byblockchains—it is important to more deeply under-stand their current level of vulnerability.

      Author states its motivation: - strong coupling between data and cryptosystems in BCh - the cryptosystems potential vulnerability to quantum computers - the likely introduction of quantum computers in the mid-term future - also the high monetary value of the assets secured plus momentum of BCh.

  9. May 2022
  10. multidimensional.link multidimensional.link
    1. Love, Its like a playing card A wild card, Your “lucky card”. You throw it into play Hoping it will land you your win. You throw it wrong, Your hand is forced You have to fold- But it hurts.

      I want to know more...a deeper context to these emotions. Why do you think you need to fold? Are you afraid to be vulnerable? To take a chance? What will ease the pain?

  11. Mar 2022
  12. Feb 2022
  13. Oct 2021
  14. Sep 2021
  15. Aug 2021
  16. Jul 2021
  17. Jun 2021
    1. That means if an attacker can inject some JavaScript code that runs on the web app’s domain, they can steal all the data in localStorage. The same is true for any third-party JavaScript libraries used by the web app. Indeed, any sensitive data stored in localStorage can be compromised by JavaScript. In particular, if an attacker is able to snag an API token, then they can access the API masquerading as an authenticated user.
  18. May 2021
  19. Apr 2021
  20. Mar 2021
  21. Feb 2021
  22. Dec 2020
  23. Oct 2020
    1. Could you please explain why it is a vulnerability for an attacker to know the user names on a system? Currently External Identity Providers are wildly popular, meaning that user names are personal emails.My amazon account is my email address, my Azure account is my email address and both sites manage highly valuable information that could take a whole company out of business... and yet, they show no concern on hiding user names...

      Good question: Why do the big players like Azure not seem to worry? Microsoft, Amazon, Google, etc. too probably. In fact, any email provider. So once someone knows your email address, you are (more) vulnerable to someone trying to hack your account. Makes me wonder if the severity of this problem is overrated.

      Irony: He (using his full real name) posts:

      1. Information about which account ("my Azure account is my email address"), and
      2. How high-value of a target he would be ("both sites manage highly valuable information that could take a whole company out of business...")

      thus making himself more of a target. (I hope he does not get targetted though.)

    2. That is certainly a good use-case. One thing you can do is to require something other than a user-chosen string as a username, something like an email address, which should be unique. Another thing you could do, and I admit this is not user-friendly at all, to let them sign up with that user name, but send the user an email letting them know that the username is already used. It still indicates a valid username, but adds a lot of overhead to the process of enumeration.
    1. When I received Chris’s comment, my first response was that I should delete my post or at least the incorrect part of it. It’s embarrassing to have your incorrect understandings available for public view. But I decided to leave the post as is but put in a disclaimer so that others would not be misled by my misunderstandings. This experience reminded me that learning makes us vulnerable. Admitting that you don’t know something is hard and being corrected is even harder. Chris was incredibly gentle in his correction. It makes me think about how I respond to my students’ work. Am I as gentle with their work as Chris was to mine? Could I be more gentle? How often have I graded my students’ work and only focused on what they did wrong? Or forgotten that feeling of vulnerability when you don’t know something, when you put your work out for others to judge? This experience has also reminded me that it’s important that we as teachers regularly put ourselves into situations in which we authentically grapple with not knowing something. We should regularly share our less than fully formed understandings with others for feedback. It helps us remember that even confident learners can struggle with being vulnerable. And we need to keep in mind that many of our students are not confident learners.

      I'm reminded here of the broad idea that many bloggers write about sooner or later of their website being a "thought space" or place to contemplate out in the open. More often than not, even if they don't have an audience to interact with, their writings become a way of thinking out loud, clarifying things for themselves, self-evolving, or putting themselves out there for potential public reactions (good, bad, or indifferent).

      While writing things out loud to no audience can be helpful and useful on an individual level, it's often even more helpful to have some sort of productive and constructive feedback. While a handful of likes or positive seeming responses can be useful, I always prefer the ones that make me think more broadly, deeply, or force me to consider other pieces I hadn't envisioned before. To me this is the real value of these open and often very public thought spaces.

      For those interested in the general idea, I've been bookmarking/tagging things around the idea of thought spaces I've read on my own website. Hopefully this collection helps others better understand the spectrum of these ideas for themselves.

      With respect to the vulnerability piece, I'm reminded of an episode of <cite>The Human Current</cite> I listened to a few weeks back. There was an excellent section that touched on building up trust with students or even a class when it comes to providing feedback and criticism. Having a bank of trust makes it easier to give feedback as well as to receive it. Here's a link to the audio portion and a copy of the relevant text.

  24. Sep 2020
  25. Aug 2020
  26. Jul 2020
  27. Jun 2020
    1. Goldman, P. S., Ijzendoorn, M. H. van, Sonuga-Barke, E. J. S., Goldman, P. S., Ijzendoorn, M. H. van, Bakermans-Kranenburg, M. J., Bradford, B., Christopoulos, A., Cuthbert, C., Duchinsky, R., Fox, N. A., Grigoras, S., Gunnar, M. R., Ibrahim, R. W., Johnson, D., Kusumaningrum, S., Ken, P. L. A., Mwangangi, F. M., Nelson, C. A., … Sonuga-Barke, E. J. S. (2020). The implications of COVID-19 for the care of children living in residential institutions. The Lancet Child & Adolescent Health, 0(0). https://doi.org/10.1016/S2352-4642(20)30130-9

  28. May 2020
  29. Apr 2020
  30. Feb 2019
    1. a belief thal we have an accurate memory of a past fact or demonstration or a belief that others have been correct in their proofs.

      We must trust in our memories, our senses and observations, and in others. Which of these do we have faith in more/most? And what are the consequences when we make ourselves vulnerable to that trust (and are proven wrong)?

  31. Jan 2019
    1. anguage come to be more trustworthy than matter?

      People seem to trust in themselves more than what's outside themselves. Even though language is constructed, it's our construct, something we made, and therefore (?) something we can place our faith in more so than in matter, something we had less of a hand in making. When we place our faith in things outside ourselves, we become more vulnerable--we open ourselves to other things as well as to the possibility of being wrong.

    1. CORRESPONDENCE

      Throughout this section, Foucault characterizes correspondence as a way to reveal the self: "a certain way of manifesting oneself to oneself and to others," to "show oneself," "a decipherment of the self by the self as an opening one gives the other onto oneself."

      This sort of 'opening' is to make oneself vulnerable, to be seen by others. (cf. Marback's "A Meditation on Vulnerability in Rhetoric")

      This is characteristic particularly of writing that is intended for others (correspondence), but in what ways are other forms of writing equally--if not more--revealing of the self?

      (That also makes me question whether any writing is truly for the self and not intended in some way for others. Even diaries/journals are written with the possible eventuality that someone other than the writer will read it.)

  32. May 2017
  33. Mar 2017
  34. Jan 2017
  35. Dec 2016
  36. Oct 2016
  37. Aug 2016
    1. "We demonstrate that well-known compression-based attacks such as CRIME or BREACH (but also lesser-known ones) can be executed by merely running JavaScript code in the victim’s browser. This is possible because HEIST allows us to determine the length of a response, without having to observe traffic at the network level."

      HEIST attacks can be blocked by disabling 3rd-party cookies.

      https://twitter.com/vanhoefm<br> https://twitter.com/tomvangoethem

  38. Jun 2016
  39. Apr 2016
  40. Feb 2016
  41. Nov 2015
    1. Businesses need to be more careful to avoid revealing customers' personal information. And they should record calls, and watch them collectively over time for signs of suspicious activity.

      The harasser in this article tricked customer service representatives into giving him private details about his victims. Starting with whatever information he could find online (a birthdate, the name of a pet) he would call repeatedly until he succeeded in getting other details -- which would make him still more convincing, so he could get more details.

      In one case, he pretended to be a company technician for ISP Cox Communications. They didn't have a procedure to verify the ID of their own technicians?

      Social engineering)

    1. All new Dell laptops and desktops shipped since August 2015 contain a serious security vulnerability that exposes users to online eavesdropping and malware attacks.

      "At issue is a root certificate installed on newer Dell computers that also includes the private cryptographic key for that certificate. Clever attackers can use this key from Dell to sign phony browser security certificates for any HTTPS-protected site."

  42. Jul 2015
    1. The result? Students’ sense of vulnerability is skyrocketing.

      I had similar thoughts around the immensely popular video about street harassment made by hollaback! after a former partner compared an unwelcome invitation I had extended to see a concert together to street harassment. It got me wondering what disciplines have good dialectic for separating useful from harmful exposure. So far I have only an inkling that trauma therapy offers some hope, and it connects the conversation to concepts like triggers.