maxboone

You're assuming rational goals instead of thinking in radical acts of terrorism.

Throwing paint at a painting does not help the environment, but it does create radical flank effects.

Blocking the highways does not help agriculture, but it does bring their problems in other people's home / discourse.

Definitely, and destabilizing by proxy is still an attack

I'm not defending Russia, it's just that the farmers terrorist organisation has announced major disruptions today and has also set hay bales on fire to shut down highways.

For context: it's "Prinsjesdag" in the Netherlands which is when the budget is announced, and there are major changes to agriculture subsidies.

We don't know whether this was Russia, it's just as likely it was the "farmers defence force" or climate activists.

Edit: some context as I'm looking like a Russian shill now, which I understand. Today is the day that the budget gets announced, and the farmer terrorist organization (farmer defence force) have announced actions - and have disrupted highways by setting bales of hay on fire, and all the disruptions happened where farmer concentrations are high.

Regardless, the situation is dire, and probably either the tankies or terror farmers are being helped by Russian destabilizing forces, it's too early to call this disruption an action from the FSB.

"a filter" is an even better analogy because it is also technically correct

That doesn't solve anything, you can just create event-specific accounts as a scalper (which you can reset after the event has happened).

Non-transferable tickets are bound to a specific name iiuc.

How would 2FA help here, you'd still create the compromised OAuth credential with 2FA?

You should use the subject identifiers, not the usernames. You store a mapping of provider & subject to internal users yourself.

But this has been a problem in the past where people would hijack the email and create a new Google account to sign in with Google with.

Similarly, when someone deletes their account with a provider, someone else can re-register it and your hash will end up the same. The subject identifiers should be unique according to the spec.

How does that work, when you add an OAuth app, the resulting tokens are specific to that app having a certain set of permissions?

It's not a new attack vector as in giving too many scopes (beyond the usual "get personal details").

I am curious how this external OAuth app managed to move through the systems laterally.

RAM producers aren't adding more capacity on the non-HBM side of things, so we shouldn't see a dramatic drop in pricing if AI HBM memory demand drops.