yfiapo

Highly likely to be coincidence. Typically an exposed access key. Exposed password for non-MFA protected console access happens but is less common.

I agree this was a security concern and it was reported and addressed appropriately. With that said as things go this is pretty minor; perhaps a medium severity issue. Information disclosures like this may be leveraged by attackers with existing access to the lower environment, in conjunction with other issues, to escalate their privileges. By itself, or without the existing access, it is not usable.

More over, the issue wasn’t that AWS recommended or automatically setup the environment insecurely. Their documentation simply left the commonly known best practice of disallowing trusts from lower to prod environments implicit, rather than explicitly recommending users follow that best practice in using the solution.

I don’t think over-hyping smaller issues, handled appropriately, helps anyone.

Thanks, missed that.

> We're not done with our request payload yet! We sent:

> Host: neverssl.com

> This is actually a requirement for HTTP/1.1, and was one of its big selling points compared to, uh...

> AhAH! Drew yourself into a corner didn't you.

> ...Gopher? I guess?

I feel like the author must know this.. HTTP/1.0 supported but didn't require the Host header and thus HTTP/1.1 allowed consistent name-based virtual hosting on web servers.

I did appreciate the simple natures of the early protocols, although it is hard to argue against the many improvements in newer protocols. It was so easy to use nc to test SMTP and HTTP in particular.

I did enjoy the article's notes on the protocols however the huge sections of code snippets lost my attention midway.

This feels akin to excessively auto-completing shells to me. It is pretty awesomely quick when you are starting, but it feels like it has to impact learning/muscle memory which gives you the accuracy and speed in the long-term. Maybe just the bias from learning without these things but I can't shake the feeling.

I don't know if this is everyone's reasons but for me it is:

- it does too much. doesn't follow the Unix norms of doing one thing and doing it well. things like DNS resolution, time sync, etc all exist as systemd components.

- complexity - similar to doing too much but also just that it is no longer easily inspected and understood imo.

- participates in the Linux cycle of reinventing the wheel, excessively. Linux distros felt like they were changing their service management commands every other release for a while.

- breaks compatibility with BSDs.

I'm sure it solves real problems for real people.. but I don't like it.

This honestly seems like it could be interesting but I don't grok it at all being dropped in with zero context.

The article you linked is from five years ago when the new badges were being initially tested. They have been rolled out for years with color photos. Both styles still work and if you don't go into one of a few big offices you might not have easy access to the newer style.

I was diagnosed with ADHD almost twenty years ago as a young adult. In my experience learning about how your mind works and spending time to come up with the best system and techniques to keep yourself on task is absolutely critical and should be worked on by any adult with ADHD. I would say that long-term it is more important than medication.

With that said, medication is also quite helpful. In my experience it provided a quick and independent support to my feeling better and productive. I found them critical when the controls I had built for myself proved insufficient or had collapsed. For example, when I moved from an office job to remote work I found the change and the lack of societal pressure to be focused on work left me in disarray. Medication helped me stand myself back up and find the routines and structures that worked in the new environment. As I built these support structures up I found the need for medication was reduced and stopped taking medication for many years. Years later, after a cross-country move which came with the loss of local friends and community I found it necessary to restart. I prefer to not take medication unnecessarily so one day I may be at the point where I stop taking them again, but I'm not there yet.

My advice would be to try medication if your gut says you need it but if you already feel fairly happy and productive then it may not be necessary.

Ah, but there is so much value in fresh eyes. Miod, who has been involved with OpenBSD development for 20 years and has surely seen those function names a thousand times, provided the historical reason (they thought they might need to allocate memory) but agreed they never ended up using that.

The fresh eyes don't have the history and are thus able to point things out that the older eyes inherently accept.

That's neat to see. This may not be a big story but as a fan of OpenBSD who doesn't currently have time to read the CVS log I appreciate it.

OpenBSD source is one of the cleanest I've had the pleasure to work with. You (generally) won't be scoffed at for submitting a semantic change like this, fixing typos, or the like. It certainly isn't perfect but the bar feels higher than elsewhere. Clean code and as importantly the documentation kept in sync.

I don't see any additional context but this does appear to be a new thing. Two commits credited to Carmack in the OpenBSD source and they are dated 5/16/2020 and 5/17/2020.