I do post things like a promotion, certificate, speaking opportunity or a new blog post I made.

I can only hope I'm not too cringe and corrupted.

Meaning roughly: these tech startups guys are regularly pumping out multi-million companies and all they need is two college dropouts with laptops and an initial investment. So if I see two college dropouts I should give them money, right?

The Americans were seen as the god-honest people speaking the uncomfortable truth to people in power, supported by the 2A.

Note: there are trace elements of satire and irony present in this comment.

I still think we should take the opportunity to discuss this case in particular.

Comments URL: https://news.ycombinator.com/item?id=49182052

Points: 62

# Comments: 121

https://www.theguardian.com/media/2026/feb/07/revealed-how-s...

Natsoc newsletters are apparently fine, but showing porn is too much and you'll be moderated. Go on, tell me how one is more harmful to kids than the other.

It really can be a fancy auto complete, but more agentic usage moved out of the editors (and I think that's a good thing).

What I think is a bit of a missed opportunity is for the product to fail with "the pizza|cake|pastry is half-baked" and so customers still have to do the rest of the job anyway.

So I've written up my thoughts on the topic. Since we're distributing limited resources to achieve the priorities decided, security is in fact a political problem.

Comments URL: https://news.ycombinator.com/item?id=48662863

Points: 3

# Comments: 1

Sadly, security is a political problem, because in risk management you can always take the risk and so every technical solution might be abandoned the moment this decision is made.

Realizing and working with this fact helps me surviving another day in this line of work. Maybe it'll help you too.

Comments URL: https://news.ycombinator.com/item?id=48628650

Points: 3

# Comments: 1

Now, to differentiate between spoofed and non-spoofed header, I need to check the "valid" JA4 signature for a given browser and then proclaim that the rest of them are wrong. The "valid" JA4 signature can be observed, but I've found that sometimes browsers tweak their handshake a bit, so it's not 100% consistent.

The JA4 DB was recently taken down, I've requested full access, but no response (as expected). There might be some issues in getting those valid headers for the browsers, the hardware and software varies a lot (PC, Mac, Android, Iphone of all kinds of versions and browsers).

I was hoping for a quick win to share, but it doesn't seem like so and I'll have to do it properly. That should be my next post on JA4.

As a quick note, approx 30% of traffic claims to use http2 and approx 60% of that traffic has a non-bot user-agent (you know, along the lines of "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.102 Safari/537.36"). I suspect majority of those are spoofed as I know how many readers I have on my blog.