Hacker News: new23d

New comment by new23d in "Ledger confirms spy chip implant behind wallet crypto thefts"

new23d — Wed, 14 Oct 2026 08:18:42 +0000

They should publish the precise weight of these things.

New comment by new23d in "SCH: An affordable sandbox for Coding Agents in your AWS account"

new23d — Mon, 14 Sep 2026 16:13:17 +0000

If the workload's network interface (ENI in AWS) is in a VPC that you manage, an outbound traffic filtering solution can prevent that. See AWS Network Firewall or the product we develop, DiscrimiNAT (https://chasersystems.com/), for example.

Rules can be per Security Group, too, for fine-grained access control. I would also strongly recommend that installation of dependencies is a build-time task, not a run-time task, and if those two stages are separated, it makes egress filtering a whole lot more effective since the build-time allowlists are often multi-tenant CDNs where a threat actor can host their own data capturing or malicious payload delivering service.

FreeDV RADE: A New Approach to Digital Voice over HF, Now for Popular Radios

new23d — Sat, 29 Aug 2026 16:49:03 +0000

Article URL: https://www.ardc.net/freedv-rade-a-new-approach-to-digital-voice-over-hf-now-integrated-into-popular-radios/

Comments URL: https://news.ycombinator.com/item?id=49491366

Points: 1

# Comments: 0

New comment by new23d in "The Curious Incidents with DNS in the Sandbox at Escape-Time"

new23d — Mon, 17 Aug 2026 15:07:20 +0000

Three variations on subversive use of DNS by the Agent are documented in Hugging Face's technical writeup of the July 2026 security incident involving OpenAI models. In this article, I discuss what each of these three types of DNS workarounds achieve in practice, the constraints an actor might have faced to attempt a particular one, and additional benefits from choosing each.

The Curious Incidents with DNS in the Sandbox at Escape-Time

new23d — Mon, 17 Aug 2026 15:07:20 +0000

Article URL: https://chasersystems.com/blog/the-curious-incidents-with-dns-in-the-sandbox-at-escape-time/

Comments URL: https://news.ycombinator.com/item?id=49332273

Points: 2

# Comments: 1

New comment by new23d in "Hacker Public Radio"

new23d — Thu, 30 Jul 2026 15:56:31 +0000

Says Not Before: Thu, 09 Jul 2026 01:02:21 GMT ; Not After: Wed, 07 Oct 2026 01:02:20 GMT for me. Works fine, too.

New comment by new23d in "Euro firms must ditch Uncle Sam's clouds and go EU-native"

new23d — Sat, 31 Jan 2026 12:56:11 +0000

netim.com has been reliable over the years for me

New comment by new23d in "What data do coding agents send, and where to?"

new23d — Tue, 04 Nov 2025 12:11:25 +0000

Our report seeks to answer some of our questions for seven of the most popular agentic code editors and plugins. By intercepting and analysing their network flows across a set of standardised tasks, we aim to gain insight into the behaviour, privacy implications, and telemetry patterns of these tools in real-world scenarios. Incidentally, a side-effect was running into OWASP LLM07:2025 System Prompt Leakage for three of the chosen coding agents. You can see the system prompts in the appendix.

What data do coding agents send, and where to?

new23d — Tue, 04 Nov 2025 12:11:25 +0000

Article URL: https://chasersystems.com/blog/what-data-do-coding-agents-send-and-where-to/

Comments URL: https://news.ycombinator.com/item?id=45810026

Points: 2

# Comments: 1

New comment by new23d in "Obfuscating outbound traffic via a Suricata "firewall""

new23d — Fri, 11 Jul 2025 14:42:18 +0000

Obfuscation via egress firewalls and evasive binary development with an iterative LLM agent.

Obfuscating outbound traffic via a Suricata "firewall"

new23d — Fri, 11 Jul 2025 14:42:18 +0000

Article URL: https://www.new23d.com/obfuscating-outbound-traffic-via-a-suricata-firewall/

Comments URL: https://news.ycombinator.com/item?id=44532682

Points: 1

# Comments: 1

New comment by new23d in "Why I no longer have an old-school cert on my HTTPS site"

new23d — Sat, 24 May 2025 19:32:48 +0000

Use AWS Route53?

New comment by new23d in "Living-off-the-land Dynamic DNS for Route 53"

new23d — Tue, 25 Mar 2025 19:20:48 +0000

Making a dynamic DNS client with aws and jq CLI, with a least-privilege IAM role and a SystemD service.

Living-off-the-land Dynamic DNS for Route 53

new23d — Tue, 25 Mar 2025 19:20:48 +0000

Article URL: https://www.new23d.com/living-off-the-land-dynamic-dns-for-route-53/

Comments URL: https://news.ycombinator.com/item?id=43474817

Points: 1

# Comments: 1

New comment by new23d in "Why are UK electricity bills so expensive?"

new23d — Fri, 20 Dec 2024 23:00:08 +0000

Exactly the same happened with me. Picking up the phone and responding to email (in weeks, not hours or days) didn't lower my bills. This sort of marketing is perhaps deflection.

New comment by new23d in "An analysis of CRL sizes from various CAs"

new23d — Wed, 24 Jul 2024 19:38:28 +0000

We'll be working on that in the coming days. Thought the data at this point was a good start.

New comment by new23d in "An analysis of CRL sizes from various CAs"

new23d — Wed, 24 Jul 2024 16:06:23 +0000

Some initial observations:

• Google's CRLs from the same intermediate CA (same public key) have different URLs and different content when pulled from different hosts (google.com, youtube.com).

• DigiCert has sharded according to 'assurance' class, algorithm, year and acquisition's name.

• Sectigo also has sharded according to 'assurance' class [1].

• GlobalSign has sharded by the yearly quarter presumably.

• HTTP Cache-Control maxage (or s-maxage), 'Expires' and 'Next Update' within the CRL file are not in sync.

• Some CAs other than Let's Encrypt also do not publish CRL URLs in the leaf certificates.

[1] https://www.sectigo.com/knowledge-base/detail/Sectigo-Interm...

New comment by new23d in "Intent to end OCSP service"

new23d — Wed, 24 Jul 2024 15:40:14 +0000

We collected some data [1] on the viability of only CRLs as the future (phasing out OCSP) - motivated by Let's Encrypt's announcement today [2].

Data is on CRL availability, number of entries, expiry & refresh times, etc. from various x509 leaf server SSL certificates.

[1] https://news.ycombinator.com/item?id=41058138 [2] https://news.ycombinator.com/item?id=41046956

New comment by new23d in "An analysis of CRL sizes from various CAs"

new23d — Wed, 24 Jul 2024 15:36:12 +0000

We collected some data on the viability of only CRLs as the future (phasing out OCSP) - motivated by Let's Encrypt's announcement today [1].

Data is on CRL availability, number of entries, expiry & refresh times, etc. from various x509 leaf server SSL certificates.

[1] https://news.ycombinator.com/item?id=41046956

An analysis of CRL sizes from various CAs

new23d — Wed, 24 Jul 2024 15:36:12 +0000

Article URL: https://chasersystems.com/blog/an-analysis-of-certificate-revocation-list-sizes/

Comments URL: https://news.ycombinator.com/item?id=41058138

Points: 1

# Comments: 4