Hacker Newsnew | past | comments | ask | show | jobs | submit | presumably's commentslogin

There are actually several (published and non-published) ways to exploit that type of configuration, here is one example:

https://samy.pl/slipstream/


If you're talking about the general concept of using js to spoof another protocol: that exploit involves middleboxes sniffing TCP connections at the packet level, rather than at connection/stream level. It certainly won't work for connections with a TCP server.

If you're talking about using that exploit to allow access to the victim's machine from the internet: that won't work because listening interface for the x11 server is localhost, not the LAN interface.


Seems to be listed on the site: https://devgarden.macalester.edu/projects/1


There is only a single "archive" that does not allow access to Cloudflare DNS users - not many.

It is also exceedingly unlikely that you have greater density of anycast PoPs than Cloudflare's 200+. In your case, you have zero...


Akamai has more than 200 pops and do geodns to stear traffic.

If I compare cloudflare DNS vs Google DNS, I can see a difference of ~50ms between the Akamai POPs offered.

https://pastebin.com/raw/xFQb4pVF


Even archive.today has given up on that crusade; I noticed a few days ago that they don't block me anymore (I use Cloudflare DNS) so they have to have stopped within the past couple weeks.

So now AFAIK the number of sites that block DNS resolvers which do not forward edns-client-subnet is zero. As it should be.


They continue to attempt to try to associate your connections/use dns cookies. CtrlF 'pixel' when you are visiting one of their pages (not frontpage)

They also attempt to correlate .onion traffic.


What you're claiming is false.

Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.


>What you're claiming is false. Cloudflare has over 200 PoPs; in your own name servers, you can use the Cloudflare Resolver's IP (which will be a "close to the user" IP, not 1.1.1.1) to do geotargeting and serve from your closest IP address/server.

What if my server is closer than cloudflare? Why is cloudflare artificially limiting?


I use cloudflare precisely because I don't want clients hitting the server directly. That's its entire purpose. For both caching and anti-ddos reasons.


rydre is specifically talking about the perspective of someone running a non-cloudflare CDN or possibly a site that does their own CDN with DNS rather than anycast because they explicitly don't want to use cloudflare for whatever reason. They are not talking about someone just hosting a site.


What’s not reasonable about TiDB?


For hosting, I’d suggest to look at hosting providers rather than VPN providers.

Here’s one: https://freerangecloud.com/cart.php?gid=11

Cloudflare’s Argo Tunnel is another great option.


> As long as a third party central authority controls our money system, we will always be subject to the whims of the few. Bitcoin is helping to liberate us and it’s absolutely working.

A bold claim without evidence. In fact, the opposite may be true [1]. This is but one counterpoint; another notable problem is the centralization of bitcoin mining in China [2].

[1]: https://www.bloomberg.com/news/articles/2017-12-08/the-bitco...

[2]: https://thebitcoinnews.com/study-argues-chinese-mining-centr...


> A bold claim without evidence. In fact, the opposite may be true [1].

> [1]: https://www.bloomberg.com/news/articles/2017-12-08/the-bitco...

The same can be said about any money system in a capitalist economy (e.g., 1% owns 40% of the wealth in the US [1.1]).

> This is but one counterpoint; another notable problem is the centralization of bitcoin mining in China [2].

I'm not sure this is 'looming' today as the article boldly claims, but centralization is definitely a risk. It's important for everyone to participate in the system as they can for a more equal distribution of ownership - akin to how one should exercise their vote in US elections.

[1.1] https://en.wikipedia.org/wiki/Wealth_inequality_in_the_Unite...


SARS had escaped no less than 4 times from Chinese labs[1]. It’s not implausible at all that coronaviruses have a history of escaping Chinese labs.

Meanwhile, this[2] is a terrible source but some of the info can easily be verified. We know that China was researching exactly this type of virus and gain of function in Wuhan after the U.S. stopped due to “biosafety and biosecurity risks” exceeding benefits. [3]. The US explicitly ended that line of research due to the risks; China continued it.

[1]: https://slate.com/technology/2014/04/how-dangerous-viruses-c...

[2] https://www.thegatewaypundit.com/2020/04/exclusive-dr-shi-zh...

[3] https://www.phe.gov/s3/dualuse/documents/gain-of-function.pd...


That's too much stew from one oyster, and the oyster turns out in any case to be a clam.

The claim is that research involving gain-of-function techniques was stopped in the US - which is true - but continued in China without the involvement of US researchers - which is not substantiated by the sources at hand - and that the late 2019 papers and job postings were related to the same research - which is false. That work was a study of how native coronaviruses spread in wild bat populations, and involved US researchers including Dr. Jonna Mazet, who actually touched on the same project in the interview I linked elsewhere in this thread (0). Her description of that project seems fairly authoritative, given that, until her team was defunded last September, she was one of the people running it.

Speaking of GoF work - one would expect an honest reporter to note that the funding pause which makes up such an important part of this conspiracy theory was lifted in December 2017. (1) NIH belongs to the executive branch - if that kind of work is really as dangerous as is claimed in the Gateway Pundit article, how come the Trump administration's been funding it again for over two years?

(0) https://news.ycombinator.com/item?id=22848637

(1) https://www.nih.gov/about-nih/who-we-are/nih-director/statem...


There is no question that it was a real problem, details available in the linked post: https://objective-see.com/blog/blog_0x56.html

The only question is different interpretations of “fake”: it is a real system dialogue, invoked by a deprecated API; it is fake in that the text is set by Zoom to trick the user into allowing it to install itself without approval.


Clinton: https://en.wikipedia.org/wiki/Strategic_National_Stockpile

Republican ideology is abhorrent; one doesn’t have to be part of the Democratic Party to recognize that.

https://www.theatlantic.com/ideas/archive/2020/03/conservati...


From your Wikipedia link:

"In 2005 and in preparation for a predictable pandemic influenza, the Bush administration called for the coordination of domestic production and stockpiling of protective personal equipments.[6] In 2006, the US Congress funded the integration of protective equipment to a Strategic National Stockpile: 52 million surgical masks and 104 million N95 air-filtration masks were acquired and added.[6] During the 2009 flu pandemic, 100 million masks were used, but neither the Obama administration nor the Trump administration renewed the strategic stocks."


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: