I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it's not too easy, but probably this isn't happening because it would be a felony to even try. The bad guys are free to try though.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
parable 1 days ago [-]
As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
Buttons840 22 hours ago [-]
There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.
He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.
I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?
I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."
Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".
Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.
And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.
chias 16 hours ago [-]
IIRC they were part of a base64 encoded blob. IIRC base64 decoding was also referred to as an "advanced hacking technique". But your point very much stands.
watersb 8 hours ago [-]
> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure
Decades ago, I met someone at a conference who was red-teaming a NATO country's infrastructure: power plants, water treatment etc.
Said that things had improved dramatically since 1990s nethack days.
But the team had a secret weapon: a young woman in a short skirt with a laptop computer, pretending to be a systems software vendor. The Weapon had been able to compromise every site, had never failed. Never.
cpa 1 days ago [-]
It is absolutely happening, paid by your taxpayer dollars (if you’re American).
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
AdamN 22 hours ago [-]
I'm sure this is happening but I also wonder if ironically those systems are hardened by adversaries. I could imagine nation state actors, once they're in, hardening the systems themselves so they can keep their presence and exclude others.
Using that access is the kind of thing that is only done when there's a need and in the case of really critical stuff that can be years in the future - or never.
One could even imagine hyper-critical exploits being shared back to the host. For instance if Russian agents got access to critical nuclear systems (or vice versa), I could imagine leadership warning the other side and getting out of the system entirely in order to maintain the status quo at the expense of pretenders.
rlt 17 hours ago [-]
IMHO our best hope is some benevolent grey hat or government organization unleashes a well-aligned AI botnet to patch everything it can find before the black hats do.
mike_d 1 days ago [-]
> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
embedding-shape 18 hours ago [-]
I can't remember if it was the FBI or NSA or the exact details, but in the beginning of this year, they did runs a bunch of commands against compromised routers to "secure" them, which effectively would count as "hacking routers" were they not whitehackers. I think there was some huge Russian MITM campaign they disrupted by effectively hacking people's routers.
3 hours ago [-]
aslilac 1 days ago [-]
imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!
AlecSchueler 1 days ago [-]
Imagine if everyone had just stayed at home for a week in 2020.
jtolmar 1 days ago [-]
It'd take more than a week, but even now, if the whole world coordinated a simultaneous quarantine, we'd eliminate covid, the flu, the common cold, and a thousand nameless respiratory cruds.
yfontana 1 days ago [-]
No we wouldn't, most of those viruses infect other animals as well, and would just start reinfecting humans.
ykonstant 23 hours ago [-]
We just need the squirrels to coordinate as well!
mmwelt 1 days ago [-]
Everyone would be very difficult. You'd still need some people to make sure essential services are still functioning, and that still involves quite a large number of people.
fyredge 1 days ago [-]
That was my first thought as well. With COVID, we recognised that WFH was viable for white collar work. Perhaps a global 2 week cleanse will allow everyone to re-evaluate life priorities outside of the internet.
I see hope in what happened during the blackout in Spain/Portugal.
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
okeuro49 1 days ago [-]
Don't you think it is odd that the BBC led with this feature, for what would have been a critical failure of infrastructure for a Western nation?
Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.
The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.
The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.
fyredge 1 days ago [-]
I was not under the impression that it was a feature. I just googled the blackout and copied the first link to provide context. Could be a Spanish blog for all I care.
Emergency blackouts are a disruption for sure and I believe people were injured in that event, but the lesson I took from it is that nothing is more reliable than community. Technology comes and goes, but we will always have each other.
AlecSchueler 18 hours ago [-]
I know several people who were there at the time—both Spaniards and tourists—and I've only heard positive experiences.
> emergency generators have to turn on for hospitals
So, they still have power.
> the transport system stops.
And people have to accept being where they are or find other ways of getting around.
bertylicious 1 days ago [-]
I think they are referring to the reports of people suddenly meeting on the streets and hanging out together back then.
fodkodrasz 1 days ago [-]
Nothing, I guess, and that is a good thing, I guess: the world didn't even by a day (few days?) without electricity.
hnedeotes 24 hours ago [-]
[flagged]
AspireOne 1 days ago [-]
Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.
thatsabadlook 1 days ago [-]
AI is actually a big reason why there are so many vulnerabilities over the past year and a half. People don't even know what their code bases look like anymore. It's really bad so sayeth my friends doing consulting.
A lot of companies cyber security posture is asking Claude to "find all security issues make no mistakes".
lxgr 1 days ago [-]
That's certainly one reason, but frontier LLMs are also really good at finding existing vulnerabilities in completely human-authored codebases.
dannyw 24 hours ago [-]
That’s not backed by data at all. We’re discovering more existing vulnerabilities.
thatsabadlook 24 hours ago [-]
It's both.
synarchefriend 24 hours ago [-]
I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).
cowlevel 23 hours ago [-]
I would expect it depends on the language. Less unchecked memcpy, more forgetting to check the user is an admin.
lelanthran 23 hours ago [-]
> I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).
"If you write code as cleverly as you can, you are, by definition, too stupid to debug it."
Do you disagree with this? Because if you don't, then the rate of bugs/RCEs in a completely AI-written-software world will be exactly the same as the rate of bugs in a completely human-written-software world.
A combination of human-authorship + AI-review, with absolutely no AI-written code is going to have the lowest rate of bugs, because there is always one entity who understands the code (because they wrote it) and one entity who is smarter than the author who can find bugs.
The AI-generated code I see from SOTA models is absolute spaghetti, and they start running into problems spotting bugs after even a small number of refinements/changes to the software (say, 50).
The problem with all this spaghetti is that they are quick to write something that even they can't easily read. Even mediocre but experienced humans are not so eager to write something that they can't easily debug.
IOW, for any non-trivial problem, with AI-generated code you are guaranteed to get spaghetti that it cannot understand. With humans, it's only a probability that that will happen.
ModernMech 22 hours ago [-]
Well the AI machines don't have to rely on cleverness to find vulnerabilities, so maybe they're not limited by Kernighan's Law. Does throwing virtually unlimited sufficiently clever monkeys at spaghetti code find these vulnerabilities better than humans? Can you prove they can't?
lelanthran 21 hours ago [-]
At the point you starts asking to prove a negative, like "Can you prove that there's no God?", you should have the self-awareness to realise that no argument will convince you, because you are proceeding on the power of belief and belief alone.
If you don't have the self-awareness to realise that you are asking the same question as "Can you prove there's no God?", then I'm afraid no proof will ever be sufficient for you.
ModernMech 19 hours ago [-]
We're not talking about God, we're talking about a machine, here on Earth, we can poke and prod and explore and test. It's perfectly within the realm of logic to prove it can't do things. Can you prove the AI machine cannot solve the halting problem for arbitrary programs? Yes, that's a negative you can prove, so your objection about proving negatives needs qualification.
Asking you to justify a limitation you asserted doesn't mean I cannot be convinced. You're asserting Kernighan's law holds for AI, I'm saying there are other ways to debug than applications of cleverness. Does throwing more attempts at that spaghetti find vulnerabilities even when the thing that wrote it can't easily understand it? I'm not saying AI must be able to do it because you can't prove it can't. I'm asking what supports your claim that it can't.
thatsabadlook 24 hours ago [-]
A lot of people expect that. Apparently it's not working out so well in reality. My buddy who is big in this said something to the effect of, when a human codebase has human understanding it may have issues but it's strengthened by ai. When an ai codebase has little human understanding it's not strengthened by people very much. So his take was the most secure code bases he is seeing right now are human ones which use ai tools to help read and review rather then write. My guess is that's also cultural and industry specific. He is niched into businesses that actually care and usually doesn't take work from cowboy outfits.
Melatonic 1 days ago [-]
Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys
Elfener 1 days ago [-]
Isn't this that website that keeps coming up in my web search results, apparently having a pdf of the thing I searched, except it's actually a badly html-ed version of said pdf with no way to download the original one?
xandrius 1 days ago [-]
Yep, absolutely no feelings for that cancer of a website.
ykonstant 23 hours ago [-]
Can we, like, also have a pinterest breach plz?
AbstractH24 17 hours ago [-]
Tumblr too?
vdfs 1 days ago [-]
And you have to subscribe to view it, download maybe is a paid feature
x______________ 1 days ago [-]
Seems Scribd made the news 13 years ago for the same issue[0] [1] and an archive.org link of the original-now-deleted announcement[2]!
0 https://news.ycombinator.com/item?id=5493280
Scribd hacked – emails and hashed passwords leaked (scribd.com)
106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
1317 1 days ago [-]
So if someone's got into their systems can they put a dump of all the PDFs up somewhere?
smurda 1 days ago [-]
I only received this same email a few hours ago, Oct 30. Why not tell all customers at once, especially if payment information was involved?
The email received is a rehash of the linked article, nice find.
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
skinfaxi 1 days ago [-]
> Q: Am I affected? How will I be notified?
> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet
That doesn't answer why they are doing it in phases.
x______________ 1 days ago [-]
>That doesn't answer why they are doing it in phases.
Correct!
“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“
Call them up!
edoceo 1 days ago [-]
[dead]
throw10920 19 hours ago [-]
> last 4 digits of your credit card and country, credit card issuer, credit card expiry date
This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.
x______________ 18 hours ago [-]
> This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.
Also known as virtual cards, discussed here [0]. At the moment, the onus is up to the cardholder and availability of the service from banks. It should be requested if your bank doesn't provide it.
Mixed feelings. I feel sorry for the people whose info was taken but Scribd does not have my sympathy.
splatter9859 18 hours ago [-]
This. Scribd has absolutely no goodwill here. Can't say I feel sorry for them in the slightest.
The victims, absolutely. However; the organization not one damn iota. Perhaps if they sucked less, but they do not, so I do not.
neya 1 days ago [-]
Scribd is the most predatory site that steals people's content and then doesn't honor their promise (upload a PDF to download one..oops that one doesn't qualify, but we will keep your copy!). Fuck em, they built their entire model on predatory behaviour towards broke college students, hope they burn to the ground.
splatter9859 18 hours ago [-]
Whole business model is literally based off of reselling access to other people's content. No value add. Just grift.
vrotaru 1 days ago [-]
It looks like we all enjoyed "Security through obscurity", where obscurity was referring to existing vulnerabilities.
And also, that this is over.
parable 1 days ago [-]
Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".
ykonstant 23 hours ago [-]
My understanding is that companies tend do disclose the bare minimum they are required by law, and keep everything else to themselves.
AbstractH24 17 hours ago [-]
What actually is Scribd?
They were always just that thing that showed up in Google searches cause they scraped presentations and stuff that was unknowingly public. But I didn’t quite know why anyone found them of value.
Stevvo 17 hours ago [-]
It's a pdf archive; their idea is to scrape pdf that are public, then charge you to download when they are no longer public.
Lucasoato 1 days ago [-]
So here we are. We’re in the new era of technology. Whoever has the best agents will win. As airport security, this is an asymmetrical war: the effort to protect your systems is going to be much higher than hacking them in the future. It’s just my opinion, but I foresee this happening given the strong capability the models are showing in reverse engineering.
reassess_blind 1 days ago [-]
I run a few small scale SaaS products. This is a scary time.
kinard 19 hours ago [-]
Indeed. :(
avazhi 1 days ago [-]
> Not seeing anything posted about this anywhere
Because nobody uses this cancer scam website lol.
engineer_22 1 days ago [-]
Nice, I've been trying to hack scribd to download a pdf all day
isatty 1 days ago [-]
You’re saying sribd has actually worked for people? I just ignore it in my searches and just find the pdf elsewhere.
x______________ 1 days ago [-]
> I just ignore it in my searches and just find the pdf elsewhere.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
Al-Khwarizmi 1 days ago [-]
Yeah, in my view this is one of those sites that add negative value to the internet, by putting a paywall in front of PDFs that would otherwise be freely available. I have seen tech-illiterate people upload material there (and to its sister site slideshare) just because they didn't know better (I suppose it's what they got by Googling "upload PDF to the interwebs" or similar), and it's a pity.
Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.
phyzome 21 hours ago [-]
What's great about this is that the primary thing exposed (credit card info) is also one of the least worrying things to have exposed, as a user.
You can just get a replacement credit card.
bluecode 1 days ago [-]
No one is safe anymore.
dlt713705 1 days ago [-]
No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".
heresie-dabord 1 days ago [-]
"Your security is important to us.
Our saying so is in no way a pledge that we are good at security or diligent about anything but billing you."
steve1977 1 days ago [-]
Yes, but I think it also just shows the widespread ignorance and incompetence in many companies.
I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.
Razengan 1 days ago [-]
Hide yo apps, hide yo websites, hide yo hosts
totetsu 1 days ago [-]
How long until we all get cyber-war fatigue and this isn't even news anymore.
Razengan 1 days ago [-]
Man, people stopped caring about all the leaks and breaches and dark web data sales over 10 years ago
Avicebron 1 days ago [-]
Is resignation because nothing was ever fixed or done about it because it wasn't "economically viable" considered not caring?
Razengan 1 days ago [-]
Until the people in power start going to jail or losing their jobs, instead of just paying fines as "the cost of doing business" from the company accounts, probably nothing will be fixed
1 days ago [-]
DANmode 22 hours ago [-]
A bit.
DANmode 22 hours ago [-]
A friend asked me the opposite: would this be the moment things get serious?
As long as people are still using glass sliders and Schlage locks to protect their actual stuff, sec will continue to be looked at as black magic, like SEO, GEO, and unironically, CEO.
Beez2Fancy 1 days ago [-]
U WIN @ teh internetz comments 2 nite. congrats!
1 days ago [-]
collabs 1 days ago [-]
I don't see any email like this in my inbox.
Perhaps they are only sending this email
to those who have their payment information
saved on Scribd?
x______________ 1 days ago [-]
> I don't see any email like this in my inbox.
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card
expiry date.
rememo42 1 days ago [-]
How do we even know which credit card is affected by this if we want to cancel it?
x______________ 1 days ago [-]
>How do we even know which credit card is affected by this if we want to cancel it?
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."
kooi 1 days ago [-]
Not a security person, but are there standards for PII encrypted at rest?
Surely this is common? Surely?
mirashii 1 days ago [-]
This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.
waste_monk 1 days ago [-]
>It’s obvious the application server must be able to read the decrypted data
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
cuu508 1 days ago [-]
Let's say the application is storing user's phone number so it can send SMS notifications to the user. Encrypt it all you want, but when it is time to send the SMS you will need the phone number in plaintext so you can pass it to the SMS gateway.
phyzome 21 hours ago [-]
Since we know that essentially nobody is using homomorphic encryption, the original point stands.
8cvor6j844qw_d6 1 days ago [-]
Did some exploit get disclosed? HN frontpage is spammed with breaches.
wafflemaker 1 days ago [-]
Maybe the Cursor IDE compromise? It might be what got Binance.
And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.
ipsum2 1 days ago [-]
The exploit is called AI (or LLMs)
AlienRobot 19 hours ago [-]
I guess this is the new normal.
paaloeye 1 days ago [-]
I'm wonder how many users are exposed
prodigycorp 1 days ago [-]
i'm probably going to spend next or next next weekend having an ai agent go thorugh my old accounts in 1password and have them delete 75% of them. Any surface area on the internet is risk nowadays, and cleaning up after the fact is a bigger headache.
xvector 1 days ago [-]
It's so interesting seeing all of these breaches and then going back to the old threads on Mythos and seeing the widespread skepticism and denial on HN.
22 hours ago [-]
gwei 22 hours ago [-]
[flagged]
pquigley 1 days ago [-]
[flagged]
PeterHolzwarth 1 days ago [-]
@dang, always been curious about this: why are posts like this grey text vs dark test? It's difficult to read, being so low-contrast. I assume it's based on numbers, the poster, up/downvotes etc - but it seems a poor use of those systems given it sacrifices readability. Is it just a light mode thing? Is it just me?
avree 1 days ago [-]
As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.
I think the color actually got lightened a few times.
dang 17 hours ago [-]
(@dang doesn't work - but someone emailed this to hn@ycombinator.com)
It's nothing so sophisticated - I've just been reluctant to change things for a bunch of reasons, some perhaps better than others.
I still have the idea of letting users upload their own preferred CSS to make HN look how they prefer. Perhaps little projects like this will become more feasible as AI tools are flattening the development curve. Is this something people would consider helpful?
Sn0wCoder 1 days ago [-]
Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??
PeterHolzwarth 1 days ago [-]
It's been 22 mins since I left my comment - the original post is still light grey (that doesn't mean much, but as this post accumulates upvotes, I don't yet see any change in test color).
Barbing 1 days ago [-]
It’s way, way too low contrast.
Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com
dozerly 1 days ago [-]
I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not
vigilantpuma 1 days ago [-]
I think that’s true for comments but not posts.
wecideApps 21 hours ago [-]
[flagged]
nilail 22 hours ago [-]
[flagged]
22 hours ago [-]
TZubiri 1 days ago [-]
[flagged]
coldfloor 1 days ago [-]
Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
TZubiri 1 days ago [-]
not even worth disclosing nowadays, almost entirely public info
derwiki 1 days ago [-]
Great reason to use privacy.com virtual cards wherever possible and online
parable 1 days ago [-]
This is good advice for anyone who lives in the USA, but there are hardly any adequate alternatives for the rest of the world, as far as I know.
x______________ 1 days ago [-]
OP> Great reason to use <...> virtual cards wherever possible and online
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
parable 1 days ago [-]
My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago. A shame.
x______________ 1 days ago [-]
>My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago.
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
parable 1 days ago [-]
I did some research and corroborated with Claude. No banks in my country offer anything akin to Privacy.com. There are a few "virtual card" services but they have limits that make them virtually unusable.
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
tjwebbnorfolk 1 days ago [-]
yea, until privacy.com gets hacked
aliasxneo 1 days ago [-]
What would they do with my bank account and routing number?
AdieuToLogic 1 days ago [-]
> What would they do with my bank account and routing number?
Use it for money laundering and fraud.
derwiki 11 hours ago [-]
The numbers that are on every check I’ve ever written? I presume that info is public knowledge, and that if there’s any fraud, my bank will reverse it.
aliasxneo 14 hours ago [-]
That sounds a lot harder to do then putting a number on a page.
fnord77 1 days ago [-]
I don't even think they actually pirated book pdfs. Just previews to get you to sign up that lead to no where
LordGronk 1 days ago [-]
Scribd has a ton of oop but copyrighted licensed content, which I highly doubt they pay licensing fees for.
Rendered at 10:29:10 GMT+0000 (Coordinated Universal Time) with Vercel.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.
I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?
I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."
Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".
Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.
And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.
Decades ago, I met someone at a conference who was red-teaming a NATO country's infrastructure: power plants, water treatment etc.
Said that things had improved dramatically since 1990s nethack days.
But the team had a secret weapon: a young woman in a short skirt with a laptop computer, pretending to be a systems software vendor. The Weapon had been able to compromise every site, had never failed. Never.
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
Using that access is the kind of thing that is only done when there's a need and in the case of really critical stuff that can be years in the future - or never.
One could even imagine hyper-critical exploits being shared back to the host. For instance if Russian agents got access to critical nuclear systems (or vice versa), I could imagine leadership warning the other side and getting out of the system entirely in order to maintain the status quo at the expense of pretenders.
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
I see hope in what happened during the blackout in Spain/Portugal.
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.
The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.
The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.
Emergency blackouts are a disruption for sure and I believe people were injured in that event, but the lesson I took from it is that nothing is more reliable than community. Technology comes and goes, but we will always have each other.
> emergency generators have to turn on for hospitals
So, they still have power.
> the transport system stops.
And people have to accept being where they are or find other ways of getting around.
A lot of companies cyber security posture is asking Claude to "find all security issues make no mistakes".
"If you write code as cleverly as you can, you are, by definition, too stupid to debug it."
Do you disagree with this? Because if you don't, then the rate of bugs/RCEs in a completely AI-written-software world will be exactly the same as the rate of bugs in a completely human-written-software world.
A combination of human-authorship + AI-review, with absolutely no AI-written code is going to have the lowest rate of bugs, because there is always one entity who understands the code (because they wrote it) and one entity who is smarter than the author who can find bugs.
The AI-generated code I see from SOTA models is absolute spaghetti, and they start running into problems spotting bugs after even a small number of refinements/changes to the software (say, 50).
The problem with all this spaghetti is that they are quick to write something that even they can't easily read. Even mediocre but experienced humans are not so eager to write something that they can't easily debug.
IOW, for any non-trivial problem, with AI-generated code you are guaranteed to get spaghetti that it cannot understand. With humans, it's only a probability that that will happen.
If you don't have the self-awareness to realise that you are asking the same question as "Can you prove there's no God?", then I'm afraid no proof will ever be sufficient for you.
Asking you to justify a limitation you asserted doesn't mean I cannot be convinced. You're asserting Kernighan's law holds for AI, I'm saying there are other ways to debug than applications of cleverness. Does throwing more attempts at that spaghetti find vulnerabilities even when the thing that wrote it can't easily understand it? I'm not saying AI must be able to do it because you can't prove it can't. I'm asking what supports your claim that it can't.
0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments
1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...
2 https://web.archive.org/web/20130407114005/https://support.s...
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet
That doesn't answer why they are doing it in phases.
Correct!
“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“
Call them up!
This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.
Also known as virtual cards, discussed here [0]. At the moment, the onus is up to the cardholder and availability of the service from banks. It should be requested if your bank doesn't provide it.
0 https://news.ycombinator.com/item?id=50313747
The victims, absolutely. However; the organization not one damn iota. Perhaps if they sucked less, but they do not, so I do not.
And also, that this is over.
They were always just that thing that showed up in Google searches cause they scraped presentations and stuff that was unknowingly public. But I didn’t quite know why anyone found them of value.
Because nobody uses this cancer scam website lol.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.
You can just get a replacement credit card.
Our saying so is in no way a pledge that we are good at security or diligent about anything but billing you."
I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.
As long as people are still using glass sliders and Schlage locks to protect their actual stuff, sec will continue to be looked at as black magic, like SEO, GEO, and unironically, CEO.
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
0 https://news.ycombinator.com/item?id=50313006
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."
Surely this is common? Surely?
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
I think the color actually got lightened a few times.
It's nothing so sophisticated - I've just been reluctant to change things for a bunch of reasons, some perhaps better than others.
I still have the idea of letting users upload their own preferred CSS to make HN look how they prefer. Perhaps little projects like this will become more feasible as AI tools are flattening the development curve. Is this something people would consider helpful?
Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
Use it for money laundering and fraud.