Hacker News: iancarroll

New comment by iancarroll in "Epic Games' new vibe-coded launcher is 46% faster than Steam"

iancarroll — Wed, 14 Oct 2026 22:43:32 +0000

That doesn't seem relevant for the stated tasks, especially given they are running on Windows...

New comment by iancarroll in "OpenAI engineer arrested in bugging of executive conference room"

iancarroll — Tue, 13 Oct 2026 22:42:02 +0000

This was taken about five days after they discovered the device[0], so it appears to have been installed to catch the culprit. I was confused as well.

[0] https://www.justice.gov/opa/pr/saudi-national-arrested-insta...

New comment by iancarroll in "Postgres isn't slow, your storage is"

iancarroll — Mon, 12 Oct 2026 08:15:18 +0000

Recently moved our RDS instances from r8g. to r8gd., which adds local NVMe, and I think the average I/O latency went from 1.0ms to 0.1ms. Adds up in big queries!

New comment by iancarroll in "Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones"

iancarroll — Thu, 01 Oct 2026 18:49:20 +0000

> “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”

Based on this, it seems more likely that this involves exploiting the device to retrieve the underlying keybags present in AFU mode and store them, rather than manipulating the actual feature of automatic reboots. Then the device can be exploited again in BFU mode but with the prior keybag to decrypt everything.

It sounds like this feature is being used to exploit and extract keys from devices without a warrant (or in advance of getting one), which seems dubious to me.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Mon, 14 Sep 2026 05:28:50 +0000

I think most people are using some variation of Chinese models due to the safeguards. I have some self hosting but the economics are bad - OpenRouter etc are a very competitive marketplace and usually better.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Mon, 14 Sep 2026 00:03:28 +0000

Pretty hard to implement in practice!

% dig www.tesla.com +short

www.tesla.com.edgekey.net.

e1792.dscx.akamaiedge.net.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 23:06:13 +0000

We can quantify the impact of the scripting tools pretty easily - 1.5k requests per day! I just went on Reddit and viewed a few posts, and it caused about 500 HTTP requests in DevTools. Luckily HN is not that bloated, but I just don't see the number of requests as meaningful even if it was orders of magnitude higher.

As the OP said, they don't do anything when the server isn't vulnerable, and serving a 404 page is incredibly cheap.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 22:45:32 +0000

Even before AI, I can't imagine a single bug bounty researcher doing that. Pre-AI, everyone ran a tool like subfinder to enumerate subdomains, httpx to resolve them, nuclei to scan them, etc. There's no human review involved there at the subdomain level.

And I don't know anyone that would really look at the intermediary of a CNAME even during a manual test. Maybe if it was obviously a third party service.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 20:50:22 +0000

Are you confident you are not viewing too many pages on HN? What if many other people are also trying to read this thread?

I think this line of reasoning doesn't make any sense. The internet is not an inherently safe network regardless of what we wish for; we can't wish away the bad activity, and it's only going to increase. The activity that helps prevent the bad activity from working is a net positive.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 20:19:13 +0000

I feel confident that no system exposed to the internet should have a problem with 50,000 requests per month! If they do, they probably shouldn't run a public NTP server, or have a public IP address at all.

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 20:01:33 +0000

The OP says they have received 50,000 requests in about a month. What service is being denied by 0.01 requests per second?

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 19:43:12 +0000

How do you suggest I determine the information is bad, if the domain is hosted on tesla.com, and Tesla says I am authorized to test it? Should I inspect all 1,368 subdomains on tesla.com by hand, and then do the same for 400+ bug bounty programs?

New comment by iancarroll in "I'm being cyberattacked by Tesla, Inc"

iancarroll — Sun, 13 Sep 2026 19:08:27 +0000

As a bug bounty researcher, my systems would do the same thing if they ended up georouted to this IP. *.tesla.com is marked as in scope on https://bugcrowd.com/engagements/tesla, and my agents will probe anything under there as it is presumed to have explicit authorization.

Not sure if there is a great solution, but I'm inclined to say that attack traffic like this is the new normal. In fact, the attack volume they got is quite small compared to the volume I have seen on other tech company subdomains - the new normal is probably much worse.

New comment by iancarroll in "What do Visa and Mastercard do? An intro to card networks"

iancarroll — Thu, 10 Sep 2026 18:23:37 +0000

Prepaid cards are great for the vendor because they have breakage (the unspent amount before expiry). I doubt the data is worth much relative to that. If anything, they have much less of a tie to the individual.

New comment by iancarroll in "What do Visa and Mastercard do? An intro to card networks"

iancarroll — Wed, 09 Sep 2026 20:46:08 +0000

Importantly, there is only an incentive for L2/L3 data on business/corporate cards, which have an inflated interchange rate above personal cards anyway.

This is not a scheme to get enhanced targeting data for personal transactions.

New comment by iancarroll in "Elevators"

iancarroll — Sat, 01 Aug 2026 03:39:57 +0000

I agree, I have been in a lot of buildings where the elevators have extremely poor performance due to this. It can be 4AM but they are all configured to rest on one floor or something like that.

New comment by iancarroll in "Codex Security"

iancarroll — Tue, 28 Jul 2026 22:11:00 +0000

Looks great but the CLI output is not particularly interesting while the scan is running. I wish it could show token usage, some kind of progress, etc.

New comment by iancarroll in "Una GPS smart watch – Repairable, USB-C charging, developer-friendly"

iancarroll — Tue, 28 Jul 2026 17:47:24 +0000

I've wasted so much money on vendor charging cables in the past 10 years while traveling or moving that I would probably buy this just for the USB-C port, assuming it is actually splash proof.

I wonder what HR sensor they use. Samsung apparently has an average error of 7% which is pretty bad, so I wonder if this would be worse. [0]

[0] https://www.cnet.com/tech/mobile/i-ran-30-miles-testing-5-sm...

New comment by iancarroll in "Opaque, Interoperable Passkey Records (and a Go API)"

iancarroll — Tue, 21 Jul 2026 15:57:57 +0000

We use github.com/go-webauthn/webauthn with no complaints!

New comment by iancarroll in "Driving in China as a Tourist"

iancarroll — Mon, 06 Jul 2026 00:30:18 +0000

In Shenzhen, they told me that I can take the full test on any visa if my permitted length of stay is 90 days or more. Supposedly the US embassies now issue 90 day visas for Americans, so I am hoping to try that route soon as I have already been through two temporary licenses...