The bypass sends a fixed one-byte NAT-T keepalive outside VPN lockdown every 10 seconds to any IP addresses, including most private and reserved ones. The tested packets all reached the router while VPN lockdown was on. I am selling an app to mitigate this VPN leak. Any app with the default Internet permission can bypass the VPN.

The article contains all disclosures and more details. For the full technical analysis, check the paper linked from the blog post.

I am here for about the next two hours and can answer questions.

Comments URL: https://news.ycombinator.com/item?id=49096839

Points: 2

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=42467532

Points: 9

# Comments: 1

It's German, but shouldn't matter much in th days of AI.

ChatGPT anwsers to some questions brought up here based on the NZZ article:

1. The "Desert Kites" or stone structures were dated using two methods. The researchers used Carbon-14 (C14) dating on charcoal samples found near the structures. Carbon-14 dating can only be used on once-living material like wood or bone, hence its use on the charcoal. They also used a technique called Optically Stimulated Luminescence (OSL), which measures the last time sand grains were exposed to sunlight, based on the accumulation of electrons in their crystal structure. These two techniques revealed that the structures are between 7560 and 9000 years old.

2. Your instinct aligns with the interpretations of the researchers. The article suggests that the rock carvings depicting these structures may have been created after their construction rather than as blueprints. One reason for this is that the physical structures follow topography, incorporating or based on terrain features which are not reflected in the plans. The researchers propose that these drawings could have been used for hunting planning, demonstrating attributes of the structures that aren't noticeable from ground level. Also, they argue these drawings could serve as a demonstration of knowledge, the ability to depict spatial elements, and the act of transmitting this knowledge. The idea that these could be plans created before construction is less likely but not entirely dismissed.

Comments URL: https://news.ycombinator.com/item?id=35601147

Points: 51

# Comments: 29

Managing a server is nowadays with offerings like Hetzner the easiest way to run apps which just need to work and don't need to scale to exponentially over time. Why add anything on top of it? It's done really within 5 minutes if you know what you do.

If you need something which scales and doesn't require file storage / databases, then I'd go for the provider-agnostic Serverless framework. If you need storage and/or databases then it really depends, as Serverless gets costly at these things and more complex and there are more provider-lock-ins. Containers may make mor sense in such cases.

At our company we use these two systems to reduce maintaining basically to zero.

Edit: and only one app per server. Also only the Hetzner Cloud offering with managed backups and managed firewall.

- a Google account can have multiple Google Payment profiles and multiple Google Ads profiles

- every Google Ads profile has a Google Payments profile tied to it (if you finished setup and started displaying ads)

- once you started using a Google Ads profile, the link to the payment profile can't be changed anymore

In detail:

- we "transformed" a normal Google account to a Google Business account

- the business account got access to the Google Ads profile and payment profile of the normal account

- the old account stopped existing, you can't log in anymore or recover access somehow. It looks like the old account became the new one.

- the new account has no admin access to the Ads profile, and it doesn't have access to the payments profile linked to the ads profile

- the only admin is the old account, which should be the same as the new one, but it isn't somehow. So the old account is somewhat gone, but not completely, but enough gone, that you can't access it anyhow

- we used it likes this for some time, probably 2–3 years without realising that we have no admin access

- we contacted Google support about 2 years ago due to this, and they gave us admin rights over the ads account

- the payments profile linked to the ads account still can't be accessed, but we never used anything related to this, so we didn't notice

- then some or all (unclear) of our payment profiles got suspended. Google Ads continues to work for another 10 days.

- we immediately take action and fill out the form accordingly to the UI. Open Google Ads -> Your payments profile is suspended [...]. To solve this, click "Fix it". -> click Fix it -> a form opens -> fill out the form -> they say "Open this link and copy the payments ID you see" -> click the link -> copy the ID -> paste it -> send the form

- then the Google support staff starts going crazy, often no responses at all, nearly 2 weeks pending, then the ticket just disappears without further notice, false promises over and over (absolute hell, not the usual stuff, 10+ tickets)

- we learn that usually all payments profiles get blocked if one payment profile gets flagged, but also that usually all get unblocked if we successfully fill out the form. That's why they don't bother to tell you which ID to fill in, just copy any ID from the link, which leads to an ID of any payment profile

- then our payment profiles get unblocked, all, except the crucial one which is tied to the ads profile

- guess what, the payment profile tied to our ads account is somehow not really tied to us, but also isn't closed, it exists and works and Google lets you use it, but no original user can access it, so it doesn't get unblocked automatically with the other profiles, but somehow it got blocked because of the others (?), it looks like that it got blocked 10 days after the other payment profiles got blocked

- The UI at Google Payments tells us now, that all our payments profiles are ready to use, we test it, they work!

- The UI at Google Ads tells us that our payment profile is still suspended. Probably just a delay, right?

- Just in case, as the responsible business we are, we ask Google, they tell us, to fill out the form. We say we did, and it worked, so they say, again, fill out the form without further advice.

- Now, if you click the links send by the Google support or the "Fix it" link by Google Ads, you will end up at the same form which clearly says (with a hyperlink to the Google payments settings): "Enter the 12-digit payments profile ID shown in your Google payments settings." (https://support.google.com/payments/contact/account_verifica...)

- In the end, we filled out the form again with the ID from the Google Ads Settings and got unblocked. However, to realise that we need to do this took some time.

In detail: (see comment)

This whole nightmare was caused, because: - Googles account transformation process leads to broken access rights - Google allowed us to use a payment profile which we somehow can't access / probably shouldn't be even using according to their TOS, because we can't keep the address up to date, etc., but they still reinstated admin access to the ads profile and let us happily spend money over years - Google didn't invest enough resources in a robust and correct UI regarding support forms / tickets / suspension UI elements / etc. The presented information was false and misleading. Just check out the account recovery form, it's not even clear that it is about unblocking payment profiles, and it's not clear if you unblock all of them or only some - Google support ignored a bunch of our support requests, like "Is it possible to get access to the payment profile of our ads account?" and even the account verification form tickets ended up just disappearing - Google support was basically completely clueless what to do, what's going on, not capable of explaining why it takes so long or what the problem is, and the next steps were always the same, we made 3-4 full circles with over 10 tickets, and they were constantly making false promises

The other stuff: - They have a monopoly - We must use them. We are significantly less competitive in our industry if we don't. - Google support admitted to us that they can't prevent the same thing from happening again, because their automated flagging process could kick in anytime

This was the most dystopian thing I ever experienced, we heavily rely on Google Ads to be able to pay salaries and rent on time (although this is very soon changing). So we tried to communicate as professional, calm and clear as possible, but it didn't help much. How much sense does it make to take legal action against Google? How will they react? Could they block our accounts immediately? What do you think would happen if our lawyer takes action?

Comments URL: https://news.ycombinator.com/item?id=34293999

Points: 2

# Comments: 1