Hacker Newsnew | past | comments | ask | show | jobs | submit | davidsong's commentslogin

Thanks for doing this.

It's a pretty big file, so I compressed it down to 11mb:

https://www.docdroid.net/A5g0tzk/les-animaux-compressed.pdf


When I was six I learned that variables are little boxes, strings are made of bunting and there was some kind of octopus called INKEY$ that grabbed keys from the keyboard.

I think the most important thing to learn is enthusiasm, if you've not got that then proper methods are of no use. This book looks like it'll be great tool for nurturing that.


Theft is illegally depriving someone of something. Burglary includes an unlawful entry component.


Where would you point the upstream? Doesn't it just push the problem up one server?


If you run your own recursing DNS server, your "upstream" is ICANN and the various registries that run the top level domains.


suppose a local government blocks a global gambling or betting platform, will ICANN happily serve the IP one seeks to a end-user installed DNS server? What is then the legal perspective? Is ICANN then in contempt of local law?


Because of how recursing works[1], ICANN only serves the IP for the dns server responsible for the tld. I doubt that would run afoul of any laws because ICANN doesn't even know what the actual domain you're looking up is.

[1] https://en.wikipedia.org/wiki/File:Example_of_an_iterative_D...


> I doubt that would run afoul of any laws

Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y. Whether country Y has the jurisdiction to demand ICANN comply with their laws is a different matter, but I believe that technically serving "blocked" domains is probably against the relevant laws.


>Sure it does. If the law says that domain X is not accessible in country Y, then ICANN has to scrub domain X from the list of domains when queried from country Y.

But thing is that ICANN doesn't have a list of domains. All it has is a list of tlds and the dns servers for them. So if www.example.com. was blocked in some random country, the conversation with ICANN would go something like this:

    client: what's the IP for example.com?

    ICANN: I don't know, but you should ask verisign (the operator of the .com TLD)
You could argue that ICANN should have responded with "I don't know" (which will cause the recursion to stop), but that's sort of pointless because if you really wanted to know, you could ask ICANN to resolve some random.com domain and you would get the response that you need ("go ask verisign"). The company you want to block/sanction/threaten here is verisign (the actual company that controls the .com zone), not ICANN (the company that controls the root zone).


I once dropped my work laptop and snapped the plastic housing on the charger plug. I only discussed it verbally with my manager and said that I, as a consultant, would replace it at my own expense. Before I'd had chance to search for and price one up adverts for laptop chargers started following me around the web.

It could have been that she then searched for a charger and being a small company we all shared an external IP address, that we also shared the ads... or it could have been that spy software on my phone had sold our conversation to advertisers. Either way, mic privileges were locked down and ad and tracker blocking efforts doubled after that.


I don't think that's a fair suspicion when you shared the same IP address


There are several ebooks that have been uploaded to libgen that contain PDF exploits, and from what I understand there's no way to remove them.

The way that their library database works is by linking a book number to a file's md5 sum. On the filesystem they are stored something like `$drive:\$batch\$sum` where `$drive` is a Windows drive letter, `$batch` is the primary key of the document rounded to the nearest 1k, 10k or 100k depending on collection and `$sum` is the `md5sum` of the file data. The archive's file data is shared via torrents, usenet and other means in those batches, and to keep that in sync they have a policy of the primary key and sum of each file being immutable.

So if you do happen to download the literary works of mankind via their torrents, you have to do so with your antivirus turned off and hope nobody has uploaded anything too illegal over the last decade.


I could be wrong but I think technically a PDF exploit only affects a single viewer program, like Acrobat on windows, right?


Well yes, and in this case we're talking files that contain an exploit for a version of Acrobat from 2006 or so and an infection vector that only works on Windows XP, and connects to a botnet that is either long dead or now an NSA/CIA asset.

But Windows Defender quite rightly still quarantines the file.


It would depend on the exploit. For a simple example, an exploit that was a result of a flaw in the file specification could result in it being cross platform.

It's going to be rarer to find something of that scope, maybe even to the point of you being effectively right.


Also dodgy files can contain multiple exploits, potentially for different platforms. Problem here from the malicious actor's point of view is that each vector for attack is also a vector for detection, so rather than a cesspool of exploits it makes more sense to use single new and mostly unknown exploit that targets software used by the greatest number of victims.


It depends on the exploit and on the reader. If, for example, the reader supports javascript then it can be attacked, apart from other weaknesses. Chrome on Linux executes javascript in PDF, while Firefox does not.

Here is an example file: https://we.tl/q90gXERGmx

Built with https://github.com/cornerpirate/JS2PDFInjector


Or don't use a vulnerable PDF viewer, or OS.


Or put it anywhere a vulnerable PDF viewer or OS might stumble upon, where an overzealous scanner has write access to, or where some snitch might grab a copy from and blacklist your domains.


Entertaining? This is deadly serious. I think you might need extra diversity training.


A little over two more orders of magnitude price increase before the next two halfenings and it's guaranteed to cause a world energy crisis.


Since Coinbase fees dominate mining rewards, each halving event also halves the equilibrium energy consumption. Since mining is speculative and capital intensive, you don't see a concomitant jump in hash rate, but the overall effect is obvious.

In other words, it's worth remembering that mining is currently massively subsidized through inflation, and as such future market dynamics must account for this.


It's nice to believe and even nicer to talk about, and that's what's important when it comes to writing fuzzy, warm feeling fluff.


Call me a tinfoil hatter but I've always assumed that the likes of Cloudflare, knowingly or not, are a key part of the Internet surveillance state.

It would be relatively easy for the likes of the NSA to infiltrate DDoS protection companies, then DDoS dark target sites until they choose cheap DDoS mitigation and bring their users' traffic into the clear.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: