dist-epoch

Both are correct :)

Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.

> on servers with a multipath TCP listener

I was talking about the Anthropic blog post, only Go/Caddy enable multipath TCP listeners by default.

You have a Wifi network interface and a wired Ethernet one, multipath is somehow combining the two together.

Those routers probably have 20 other critical un-patched exploits ...

An entire ecosystem of malware crawling and cohabiting in them.

My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.

This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

I wanted to check your website from your profile, but then I remembered your advice. Thanks!, dodged a potential bullet

Somehow all the other apps, including bank apps, do not seem to consider this necessary.

Signal always has excuses, "we can't add usernames because we don't know how to make them secure"

2 years ago when I got a new phone, I had to re-register in both WhatsApp and Signal.

Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.

This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.

You seem to be using "formal verification" with a non-standard meaning.

> I feel that when you formally verify one condition, verification of another condition gets weakened

In standard formal verification there is no problem here: you formally verify the composite "condition_1 AND condition_2"

I've lived to see the day when half of the Hacker News front page is about hacks. What a time to be alive.

AI's can decide on the action to open the vault file. It can also prevent TCP connections from unexpected IPs.

The insurance fund is not for covering hacks.

Binance is making so much money, covering this hack is peanuts for them.

So explain why the Chinese are not paying to put their model on top, surely that would drive a shit ton of business to them.

Or are you implying that the Chinese can't afford the amounts paid by OpenAI/Google.