cddotdotslash

They exist in a few forms:

- The company is smaller and/or already geo-distributed and doesn't have the ability (or awareness) to monitor employee locations or deal with the tax/compliance obligations and so turns a blind eye, intentionally or not. The employees are generally operating in a grey area - either on tourist visas or for a company that isn't registered to employee people in their locale.

- The company actively creates a remote-first environment, working with their employees to employ them (compliantly) in their locale, usually through a third-party employer of record. These are very few and far between, but they exist.

- Companies, like Airbnb, that allow for a certain amount of time outside of a "home locale" per year (IIRC, it's 90 days). This isn't truly "global remote" but employees can move around more freely than in-office or locale-only employers.

It’s incredibly annoying to read. So many super short sentences with the “not just X. Also Y” format. Little hooks like “The attack vector?”

“Not fancy security tools. Not expensive antivirus software. Just asking my coding assistant…”

I actually feel like AI articles are becoming easier to spot. Maybe we’re all just collectively noticing the patterns.

I wonder who actually discovered this attack? Can we credit them? The phrasing in these posts is interesting, with some taking direct credit and others just acknowledging the incident.

Aikido says: > We were alerted to a large-scale attack against npm...

Socket says: > Socket.dev found compromised various CrowdStrike npm packages...

Ox says: > Attackers slipped malicious code into new releases...

Safety says: > The Safety research team has identified an attack on the NPM ecosystem...

Phoenix says: > Another supply chain and NPM maintainer compromised...

Semgrep says: > We are aware of a number of compromised npm packages

Nathan, do you work for Socket? I think you should at least disclose that when sharing posts here.

NPM deserves some blame here, IMO. Countless third party intel feeds and security startups can apparently detect this malicious activity, yet NPM, the single source of truth for these packages, with access to literally every data event and security signal, can't seem to stop falling victim to this type of attack? It's practically willful ignorance at this point.

I can see the value, but to do the things you're describing, the AI needs to be given fairly highly-privileged credentials.

> Right now, Datafruit receives read-only access to your infrastructure

> "Grant @User write access to analytics S3 bucket for 24 hours" > -> Creates temporary IAM role, sends least-privilege credentials, auto-revokes tomorrow

These statements directly conflict with one another.

So it needs "iam:CreateRole," "iam:AttachPolicy," and other similar permissions. Those are not "read-only." And, they make it effectively admin in the account.

What safeguards are in place to make sure it doesn't delete other roles, or make production-impacting changes?

In China, nearly everything works via the same app (WeChat) and via QR code. Every grocery store, coffee shop, train station, or point of sale has the same scanner, where you can flash your QR code. I don't think I saw a single physical currency exchanged in the entire 6 weeks I was there.

I keep hearing that X wants to be the "everything" app. WeChat is _already_ the everything app. It's DoorDash, Venmo, Facebook, Instagram, and about 500 other apps in one.

I will say that I disliked the pattern of every restaurant using a WeChat "mini app" where it basically loads an entirely new app within WeChat just to see the menu or order. It felt much clunkier than just using a web page.

Companies should automate this. Write their own outage monitoring, feed the results, plus the cumbersome format you have to send to the provider, into an LLM, have it spit out an email requesting SLA credits or whatever the contract specifies.

Probably not worth it for low cost services, but if you’re paying GitHub $x millions per year, maybe it is.

Much appreciated! I just put this homepage together recently, so this is really helpful feedback.

This "AI will never replace _my_ job" attitude by security folks (and I say this as a security engineer myself) is insufferable. Yeah, there are likely lots of vulnerabilities getting vibe coded into apps right now. But AI is improving rapidly, and in a few years you'll likely look back wondering what happened to the job market. Adapt or don't, I suppose.

It’s interesting that multi-region is often touted as a mechanism for resilience and availability, but for the most part, large cloud providers seem hopelessly intertwined across regions during outages like these.

I can recall plenty of times HN has been down.