Hacker Newsnew | past | comments | ask | show | jobs | submit | bdcravens's commentslogin

No one is going to be bankrupted over a $6500 AWS bill. I did a major F-up a few years, letting a key get pushed to a public repo, resulting in instant pwnage and $50k in charges from AWS due to crypto miners being launched. We communicated to AWS, did some work on our part to demonstrate that we put in proper safeguards and auditing, and they removed the charges.

They already talked to AWS and had the bill cut down to ~1800 dollars from ~6300, but they legitimately launched those processes instead of having the key stolen so the cost reduction is understandably less generous in those situations. Also potentially the agent was able to connect to more open networks and might have been running jobs on them incurring legitimate costs.

That makes for a funny tongue in cheek comment, but it's not MS's AI they're after, it's end user secrets, and the exploits target multiple LLMs. (by adding commands to relevant MD files)

By finding a way to get at least $41 million to the other side

I've always tried, but usually work demands make it difficult to stop and finish. At least these days I can hand off documenting to an LLM. If anything, I have to tell it to back off a little to make it more readable for human eyes.

You're right, but many EVs today can't take full advantage of the faster chargers currently available. I have one of the faster charging vehicles available (EV6) and even at 350kW chargers, I've never seen faster than 200kW, and usually much lower than that.

I don't plan on leaving technology, but I am scaling up a side hustle as a hedge.

Honestly you can go back much further than that. Every few years it's broken for different reasons, but the exuberance is irrational all the same.

> The stock market doesn't operate on long-term principles anymore

by "anymore" I assume you mean for a few decades now


Yes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.


Except now you're making http calls to remote servers that could be compromised.


This is a solved problem.

Use HTTPS and use the integrity attribute.

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

Also, what's more likely? Someone hacking jsDelivr/cdnjs OR some random NPM packages getting hacked?


As long as you embed it with an SRI integrity hash, you're safe, even if the remote server is compromised.


Can be mitigated, as the sibling comment points out, but even in the situation you described, the blast radius is reduced, especially for frontend libs.


Dreamweaver lives!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: