In the last 6 years there have been two or three earthquakes that caused enough water to slosh on to the floor.

Of those only the 2021 Fukushima earthquake caused any fish to slosh out - perhaps 10 medaka if I recall correctly. Luckily I was home and I was able to save all the fish, however there was one adult red cherry shrimp that didn't make it because I had trouble picking it up off the floor. I cleaned up the water with some paper towels and it didn't seem to cause any lasting damage.

I think if I had a 600 lb (270L?) tank or expensive fish though I would probably have a different perspective.

I tried and failed several times to get started with Anki before having success with Wanikani. The key diffentiator for me was the learning step. Anki is great for remembering things you were taught or learned outside of it, but using Anki to learn new things is very much a learned skill that Wanikani holds your hand through.

I have N2 and am working on N1 now, and feel I still have a very long way to go before getting to CEFR C1. Now I only use Anki with the yomitan and takoboto integrations to quickly add any words I look up, which seems to be working well.

See this page for more details: https://docs.github.com/en/apps/using-github-apps/privileged...

After discussing our concerns about these tokens with our account team, we concluded the only reasonable way to enforce session lengths we're comfortable with on GitHub cloud is to require an IP allowlist with access through a VPN we control that requires SSO.

https://github.com/cli/cli/issues/5924 is a related open feature request

This is captured in the OWASP LLM Top 10 "LLM02:2025 Sensitive Information Disclosure" risk: https://genai.owasp.org/llmrisk/llm022025-sensitive-informat... although in some cases the "LLM06:2025 Excessive Agency" risk is also applicable.

I believe that some enterprise RAG solutions create a per user index to solve this problem when there are lots of complex ACLs involved. How vendors manage this problem is an important question to ask when analyzing RAG solutions.

At my current company at least we call this "権限混同" in Japanese - Literally "authorization confusion" which I think is a more fun name

Unfortunately, https://www.sec.state.ma.us/ is geo-blocked for all of Japan (and several other countries AFAICT) "due to cybersecurity reasons", so I can no longer check/update my registration to vote without a VPN. I tried contacting different parts of the MA state government to get it unblocked several times over the past few years, but had no success. I have no idea what the other MA-voting residents of Japan do.

Last time I contacted the secretary of state's office via my state representative, they were kind enough to temporarily unblock my home IP address for one week though!

It's insane to me though that class.* isn't completely disallowed. What is the legitimate use case for deserializing allowing web requests to call setters in the reflection API?

Also, agree it is impressive to me how much bad information I've seen.

My only major hiccup is that the MA secretary of state's website www.sec.state.ma.us (which has the info about upcoming elections, the tool to check your registration, and the instructions for voting overseas) is blocked in Japan "for cybersecurity reasons". I've tried contacting the department of state and my state representative about this, but nothing's come of it.

The government of Cambridge on the other hand has been quite pleasant to deal with.

A few years back, I wrote a CTF challenge around this quirk of SHIFT_JIS. It used a python MySQLdb connection set to SHIFT_JIS mode and a custom naïve mysql escape function. The trick was to use a yen symbol and have it get interpreted as an unescaped backslash, leading to a SQL injection. Also it was all over websockets just to be annoying.

There's a few nice writeups from it:

https://www.kernelpicnic.net/2016/03/06/BKPCTF-Wonderland-Go...

https://0day.work/boston-key-party-ctf-2016-writeups/

https://security.szurek.pl/en/boston-key-party-ctf-2016-good... (this one has the original challenge source)

Comments URL: https://news.ycombinator.com/item?id=23840070

Points: 1

# Comments: 0

The list is still relevant to this discussion though as a nice "greatest hits" cheat-sheet of fun environment variables to play with here.

[1]: https://github.com/sudo-project/sudo/blob/master/plugins/sud... [2]: https://www.sudo.ws/repos/sudo/rev/bdf9c9e7f455

Timings for fred.cnf on my machine:

python: 0m53.744s

PHP (no PCRE JIT): (hits backtrack limit in 1m15.994s)

PHP (PCRE JIT): 0m20.109s

Also I don't understand the name "Web3torrent", is it intended to indicate a new version?

Personally I make the distinction, but I've noticed many many people do not, hence the question.

Is there a general consensus to use "regular expression" to refer to the actual regular ones and "regex" to refer to the non-regular variants?