thomc

Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.

I remember a lot of low number ICQ accounts being taken over back in the day, including my own and several security-minded friends. Because of how prevalent it was and how it was the only account we'd had compromised we assumed they found a flaw or had access to reset passwords, or could social engineer support etc.

It's good to finally know there was a critical flaw like the one in OP that was likely used.

Fantastic project, I use it regularly to test apps and there is a vphone-mcp which allows agents to control it, take screenshots and navigate the UI!

YouTube allows parents to turn off shorts for their kids (if their kids are part of their family account). Unfortunately it doesn't seem possible to turn off shorts for oneself without resorting to browser extensions.

Another thing to look at is the built-in sandboxing and permissions for your agent. Claude Code for example has the /sandbox command which uses Bubblewrap on Linux or Seatbelt on macOS for OS level sandboxing. Combine that with global default deny permissions for read & edit on your SSH, GPG keys and other secrets. You need both otherwise Claude can run bash commands which bypass the permissions.

My one and only experience of dealing with the police in the US was when I was visiting NYC. A tourist was being attacked on the subway because he was taking pictures and since we were still at the platform I jumped out and told 2 officers further down the platform what was going on. I expected them to sprint into action, but they could not have cared less and casually strolled along towards the carriage!

In a similar vain I was the first on the scene of a car crash in the UK, where the driver had exited the vehicle through the window (no seat belt) and was bleeding in the road. When the police turned up they casually and slowly walked up the road towards the scene.

It made me wonder if there was a good reason for this, like to control adrenaline, make better decisions, have time to assess the situation. Or if they were just jaded from seeing it a lot.

Lost an Apple iBook screen this way. Guy in front slammed his chair back while I was working on a presentation and the screen got caught at the perfect angle to flex it and it died.

Didn't blame him, lesson learned, and I move my own seat back very slowly now.

There are at least a couple of banks or credit card companies in the UK now that only offer mobile apps, as well as those now using push MFA with their apps for every large purchase. Recently I needed to install an app from the UK government to prove my identity via camera to renew my driving license, and that doesn't work in GrapheneOS either. I can do it in person (for now) but there is an extra fee.

I have used them for the following:

* Holding a bandage in place

* Temporary clothing fix (broken fly, broken strap)

* Keeping hotel curtains together to block out light

* Popping a SIM tray

* Pinning something inside clothing when travelling in risky areas

It is rare to need one, but they take up no space so I pop one in my bag.*

My M3 was parked for 3 months and went from 80% to 60% which I'm perfectly happy with. Just arrived home, got back in it and drove. It was on WiFi, no sentry, and checked in on it only every 3 weeks or so.

Agree, coffee shops are the modern version. Only 25 years ago as a student in Manchester pubs were everywhere, and we often used to go to the pub at lunch time. Went back there recently and all the pubs we used to frequent were gone, replaced by coffee shops and people with laptops and smart phones :)

I don't know if Google Maps pays much attention to Android users frequenting a particular path. Where I live you need to take a particular route else you end up at closed gates. Despite hundreds of people using this route every day for years Google will still try to take you via a different route that takes you to a closed gate. Other mapping software gets it right but we have to provide specific route instructions in case anyone uses Google and ends up at a dead end. I have noticed this all over actually, with Google trying to take short cuts that don't work vs following well-established routes.

I don't recommend their pegboard for this. When I had some very modest weight (soldering supplies and glues) in one of the compatible trays attached to the top, it bowed out over time and warped the board. This looks far heavier with more leverage.

They said OpenAPI is an open protocol, not OpenAI.