Hacker Newsnew | past | comments | ask | show | jobs | submit | tragiclos's commentslogin

FWIW, the article quotes people close to the researchers saying that the departure wasn't their choice.

> could things be better if we had an explicitly designed interoperability interface?

Yes, we could define a language-agnostic binary interoperability standard with it's own interface definition language, or IDL. Maybe call it something neutral like the component object model, or just COM[1]. :)

[1] https://en.wikipedia.org/wiki/Component_Object_Model


The general idea is sound. The implementation less so.


Most of those companies make huge margins by suckering large organizations into outrageous contracts. I don't see how AI moves the needle on this one way or the other.


> Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.

I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.


I dont know who hacked the servers nor I do know how to find out. Let's blame state actors, who's going to come verify these claims.


This article going into more detail on those targeted was posted later:

https://securelist.com/notepad-supply-chain-attack/118708/


It might have been explicitly targeted, but they did say that there were older versions of Notepad ++ with ""insufficient update verification controls" so it might have just been there was only one subset of users actually susceptible to this.


No, the additional update verification was added after this attack was discovered. All Notepad++ installations were vulnerable during the time of the hijacking campaign.


My guess would be certain IPs associated with universities, corporations and government institutions.


The docs list this caveat:

> Note that previous stable versions will not be suggested. The package will be completely ignored if its latest published version is within the cooldown period.

Seems like a big drawback to this approach.


I could see it being a good feature. If there have been two versions published within the last week or two, then there are reasonable odds that the previous one had a bug.


some lib literally publish a new package at every PR merged, so multiple times a day.


Doesn't sound very profitable:

>Over the last two years, the state transportation agency has spent more than $62,000 on repairs related to guardrail theft in the region.

If the full cost of replacement is ~$31k/yr, the scrap value of the stolen guardrails is surely far less. Seems like there wouldn't be enough for even a single thief to make a living.


Cost to repair correctly is almost always a lot higher than the fence value of the material, but more importantly, repair cost is always higher than the labor/tool cost to steal the material. Dunno how long it takes to cut off a 12 foot section of guard rail, but the fence value of that rail only has to be more than $15/hr over the time it takes to find and remove the rail to make it profitable.

Its the same thing with catalytic converters. The crackhead stealing a catalytic converter from a 2011 prius is interested in the $150-$350 of platinum in the catalytic converter, not the $2200+labor replacement cost of the thing. Considering that its ~20 minutes looking, and ~2 minutes sawing to steal the thing, we should all be so lucky as to make $150-$350 for less than 30 minutes' work.


Is that really how cat theft works- thief gets a couple hundred and it’s smuggled offshore and broken up for raw materials to make new cats? Why can’t the thief sell to a local shop for $1000, to repair maybe the very car it was stolen from? Are cats serialized and tracked?

When I was in Central America people would steal windshields from cars left outside at night. New replacements were very expensive because of import taxes but you could just go to the nearest shady shop and what do you know, they just happen to have a used one for your car in stock!


> Why can’t the thief sell to a local shop for $1000, to repair

Because there are federal laws against selling for re-use and installing used emissions parts[1] and there are federal laws that make the remanufacturing operation you'd need to make "new cats" less profitable than shipping the used stuff overseas and doing it there.


When my cat was stolen, I was living in California, where only state-certified exhausts will pass emissions testing. And to date, the state has only certified OEM exhausts for Priuses.

So in my case, it was especially egregious (seriously, people have been petitioning Toyota for decades to recall Priuses to make the cat harder to steal), but in general, if you’ve got the OK to sell exhausts in California, you’re not going to endanger it by coming anywhere close to an illegal platinum/palladium fencing operation.


Portable electric power tools, which are likely stolen themselves, can make quick work of almost anything. Only thing that stops even more theft is the tools themselves will get pawned for drug money quick enough.


People that steal almost anything off the street aren't making a successful career out of it, they're addicts.

A second hand iPhone is only worth a few tens of dollars on the black market, but that's enough for the next hit.


i don't understand how a stolen iphone is worth anything, do they part it out? I thought apple explicitly had coded/serialized parts, and i thought that would prevent someone from installing a stolen screen onto a different phone.

or, is it just because apple is a jerk and wants all repairs to be done by apple?


What happens sometimes is they get trafficked outside of the country, then they start sending messages to the original owner trying to manipulate them in various ways to remove the activation lock. Including lying that it's necessary to wipe the sensitive photos off the phone, lying that they're poor and got scammed by a seller who sold them a stolen phone, and sometimes harassing the owner with really graphic texts cursing their family members or threatening their lives until the phone is unlocked: https://www.independent.co.uk/news/uk/crime/iphone-theft-sto...

It's not like the users are really losing anything by wiping and removing activation lock, the phone is already stolen, so it often works


People willing and able to do this probably have a few things going on at a time. Plus they're not necessarily at the high end of living expenses. A couple grand haul for a couple hours work is pretty good.


Your cost of living is pretty low if you live in a nylon tent


Well, they're freelancers, so they probably have another half-dozen things going on.


Crazy that 27 C is deadly. I imagine most of Australia is hotter than that during any given summer.


But does the water reach 27°C during Australian summers, or just the air? Water will remain cooler than air for a long time, as anyone who's jumped into a swimming pool in summer knows. It was the sustained water temperature of 27°C that was the deadly issue for Winston the platypus.


It might be more appropriate to link to the original blog post: http://smoogespace.blogspot.com/2024/05/where-did-5-million-...


Ironic that the “about the author” section at the bottom names Monty Python as the origin of BDFL, a claim which is contradicted by the article.


I think it means it could be a title from a Monty Python skit, not that it necessarily is taken from one.


Aerospace programs can have extremely long timelines in the private sector, too. Variants of the Boeing 737 have been produced since 1966. While the recent MAX versions were flawed and Boeing has some real quality issues, you can still get service parts for the original airframe.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: