Hacker News: bigfatkitten

New comment by bigfatkitten in "The RAM shortage is bringing back DDR4"

bigfatkitten — Fri, 16 Oct 2026 21:07:56 +0000

Why would a washing machine need an LLM?

The decisions those devices need to make, at their very most adventurous, can be and already are done using DSP instructions on a $2 MCU.

New comment by bigfatkitten in "Former German spy chief arrested for attempted treason"

bigfatkitten — Tue, 06 Oct 2026 19:12:54 +0000

Israel doesn’t really have any allies other than the United States, and even that is a one-sided relationship.

They are adversarial to everyone, but everyone who wants to maintain friendly relations with the U.S. is obliged to play nicely with Israel.

New comment by bigfatkitten in "SAML: A fractal of bad design"

bigfatkitten — Fri, 25 Sep 2026 05:59:24 +0000

The people running these WGs are mostly professional committee members who get paid by their employers to fly around the world to attend meetings.

They don’t build products, they don’t operate networks, and they don’t talk to customers.

New comment by bigfatkitten in "SAML: A fractal of bad design"

bigfatkitten — Fri, 25 Sep 2026 05:57:37 +0000

NSA has their own stripped down and opinionated profiles of IPsec that they mandate for applications they really care about.

HAIPE IS is classified, and mostly accommodates NSA’s private algorithms and key management practices.

IPMEIR is public, but it mandated the Suite B cipher suites and so I don’t know where it stands now with the move to PQC.

New comment by bigfatkitten in "SAML: A fractal of bad design"

bigfatkitten — Fri, 25 Sep 2026 05:52:23 +0000

Any specification that comes out of OASIS is almost guaranteed to be ridiculously complicated and mostly impossible to implement securely.

New comment by bigfatkitten in "SAML: A fractal of bad design"

bigfatkitten — Fri, 25 Sep 2026 05:50:58 +0000

This is a pretty common implementation error. You can just add your own assertion that overwrites any claims in the signed assertion (such as username) and use it to escalate privileges or take over any account that you like.

New comment by bigfatkitten in "Gemini Hacked Three Companies in First Known Breakout by Google's AI"

bigfatkitten — Sat, 19 Sep 2026 02:48:30 +0000

Better known as the “we are negligent” bench.

New comment by bigfatkitten in "Korea raises data breach fines to 10% of revenue"

bigfatkitten — Sat, 19 Sep 2026 00:20:39 +0000

The South Korean privacy regulator is the most diligent that I’ve ever seen in terms of slapping companies with fines when they screw up.

New comment by bigfatkitten in "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"

bigfatkitten — Fri, 18 Sep 2026 21:01:17 +0000

The price has gone up if you’re getting AI to do it. In terms of finding low hanging fruit, reasonably good code scanning tools have been around for a while.

The thing that’s changed for attackers is speed. The things that got you hacked yesterday are the same things getting you hacked today.

Finding and weaponising things like memory corruption bugs required an enormous amount of relatively hard to find skill, and considerable time. An idiot can now throw tokens at the problem and have something they can reliably use within minutes or hours.

New comment by bigfatkitten in "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"

bigfatkitten — Fri, 18 Sep 2026 20:47:19 +0000

Can you point to a single vendor where this has actually occurred?

Customers say these things in response to a breach, but in practice they don’t lift a finger to actually change anything.

Entra ID is full of design-level bugs that allow full tenant takeover, but nobody is abandoning M365 in droves.

Windows has been a piece of shit for decades, and it’s still the default and dominant desktop platform.

Equifax lost personal data for almost 150 million people in 2017, and they’re financially stronger than ever.

Okta got thoroughly compromised two years in a row (2022 and 2023), and they’re still the global market leader in their space.

New comment by bigfatkitten in "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"

bigfatkitten — Fri, 18 Sep 2026 08:35:50 +0000

If customers actually cared about this, Microsoft would’ve gone bust 20 years ago.

New comment by bigfatkitten in "A heap overflow and SSO misconfiguration to compromise OpenAI internal repos"

bigfatkitten — Fri, 18 Sep 2026 08:31:41 +0000

Assuming an equal level of impact per token spent, the scales have tipped in favour of the attacker.

White hats are constrained by needing to pay for their own tokens, only using (expensive) vendors who meet governance and risk requirements etc. Black hats are free to take over accounts and steal services from wherever they can.

New comment by bigfatkitten in "Telstra outage: The night a network decided the year was 2006"

bigfatkitten — Fri, 18 Sep 2026 05:24:14 +0000

No, it absolutely is not.

That timing requires a very tight time, frequency and phase reference. It’s derived from local high stability GNSS-disciplined time references.

New comment by bigfatkitten in "The Beauty of Roundabouts"

bigfatkitten — Wed, 16 Sep 2026 20:34:45 +0000

These are extremely uncommon events, and when they do occur, the driver’s consumption of alcohol and/or methamphetamine is often a contributing factor.

New comment by bigfatkitten in "Hackers Got Inside a Flock Camera"

bigfatkitten — Wed, 16 Sep 2026 20:27:49 +0000

YC does no meaningful vetting at all. You can steal another YC entrant’s product and still get funded.

https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

New comment by bigfatkitten in "I can't stop thinking about Papua New Guinea"

bigfatkitten — Tue, 15 Sep 2026 20:41:24 +0000

Until 1975, in fact.

New comment by bigfatkitten in "Iranian banks' SSL certificates are being revoked due to OFAC sanctions"

bigfatkitten — Tue, 15 Sep 2026 08:00:54 +0000

> Iran threatens that all the time "Death to America" so if they don't like someone saying it back to them maybe they should stop?

Have you ever thought to pause and wonder why they say that?

Suppose you discovered that a UK oil company on your soil had been robbing you blind, and so you decided to nationalise your oil industry. In response to this, the UK and the US overthrew your government and installed a puppet regime. In this situation, I’m sure you would form a highly unfavourable view of the United States.

New comment by bigfatkitten in "Ask HN: In The Matrix, the bad guys are the 'agents'. Coincidence? Clairvoyance?"

bigfatkitten — Sun, 13 Sep 2026 21:40:32 +0000

They were indeed. “Autonomous agents” were extremely trendy in CS 30 years ago.

https://dlnext.acm.org/doi/proceedings/10.1145/267658

New comment by bigfatkitten in "I've operated petabyte-scale ClickHouse clusters for 5 years"

bigfatkitten — Sun, 13 Sep 2026 03:47:48 +0000

And then hire a FinOps team to try and restrain the development team’s profligate spending.

New comment by bigfatkitten in "I've operated petabyte-scale ClickHouse clusters for 5 years"

bigfatkitten — Fri, 11 Sep 2026 20:49:27 +0000

Most software developers now are absolutely ignorant of performance concerns. Just throw more compute at it until it works, and someone else will pay the AWS bill.