Hacker News new | past | comments | ask | show | jobs | submit | larkinrichards's comments login

Exploit chain--

1. zendesk allows you to add users to a support issue and view the complete issue history by sending a response email to a guessable support email from a person associated with an issue and cc'ing the person to add.

2. Zen desk depends on a spam check for inbound email validity. This check does not appear to catch instances where sender email is spoofed. Zendesk claims this is bdue to DKIM/SPF/DMARC config but I have trouble imagining that 50% of Fortune 500 would get this wrong. There are many automated checks available.

3) Apple issues an Apple ID account to anyone who can receive a verification email Sent to the mailing address (support@company.com)

4) Slack allows you to sign in to a workspace using any Apple ID associated with the workspace domain (e.g. support@company.com)

This researcher reported #2 to hackerone and was declined. Researcher later discovered full exploit with 3 and 4. Did not update hackerone, contacted affected companies directly.

it would have been prudent to update hackerone on the additional finding, but it feels like an easy oversight for a 15 year old after getting rejected on the first round.

Zendesk should take the higher ground and recognize the mistake and correct it. Not get all "ethical mumbo jumbo."


>it feels like an easy oversight for a 15 year old after getting rejected on the first round.

I'm not 15, but since you ignore(d) me - game over.


Based on the Oct 12 change log, "changed flight 4 to "starship super heavy" -- this reads that they can perform multiple flights with the same mission profile. So they can do a few quick test catches and avoid relicensing?


The previous license also allowed multiple launches, so this license allowing multiple launches would be consistent.


As I understand it, only if the test article is identical. Any modification, new permit required.


unlikely. They'd already created the prototype decks. They had the fabrication know-how in house. Sure they have in house VFX experience, but rigging the scene and trying to match lighting to reality and ultimately disappointing customers? It's a no brainer to use the real deal when you can.

Many would hire an agency to create an ad for you but that would 10x the cost, not to mention dealing with the opinions of an outsourced creative director...



Pretty much, discussion: https://github.com/ndjson/ndjson.github.io/issues/1

Also when you're using this with GeoJSON there's https://stevage.github.io/ndgeojson/ which has an actual RFC (https://datatracker.ietf.org/doc/html/rfc8142)


Which itself is based on an earlier RFC for not-specifically-Geo-JSON, RFC 7464. Both do things a little different than the others: they use the "record separator" character at the start of each line and actually split on that separator when parsing.

The GeoJSON one pretty much seems to exist just to hang an "application/geo+json-seq" media type registration off of. Part of me wants to say this really should have been more of a "all json subtypes are also json-seq subtypes" situation but maybe that's not really feasible with the standards/registration processes.


Yes -

> Two terms for equivalent formats of line-delimited JSON are:

> Newline delimited (NDJSON)[4] - The old name was Line delimited JSON (LDJSON).[5]

> JSON lines (JSONL)[6]

https://en.wikipedia.org/wiki/JSON_streaming


It's strictly worse, actually.

ndjson specifies sane newline handling, since it works with terminators.

jsonlines works with separators and thus fails to detect truncated values. As a result, it can silently produce incorrect numeric values.


This is only an issue with plain numbers, however. If you'd have the number in an object or array, you'd detect the truncation just as well. Since using jsonl for a plain list of numbers is... overkill, I'd say it's not an issue.

On the other hand, requiring line terminators in the standard would inevitably lead to incompatibility issues. Most software would accept unterminated files, because text libraries do; and so some files will not be terminated. Some applications do not line-terminate files even on Linux (hello VSCode), and it would be even more problematic on Windows


It makes it incompatible with concatenative streaming, requires O(n^2) reparsing on every new chunk instead of just scanning for \n.

And if you have to parse values to detect end of record anyway, there’s no point in having jsonl standard at all, since you can just try to parse until the matching brace and repeat on success.


VSCode has the ‘files.insertFinalNewline‘ setting to configure this.


What’s the difference between terminators and separators here? The ndjson spec [0] doesn’t say anything like that, and it seems that ndjson and jsonlines are identical in what documents they accept.

[0]: https://github.com/ndjson/ndjson-spec


A separator separates two records, where as a terminator terminates a record.

You can detect and error out if you see an unterminated record at end of transmission. With separators, the producer might not put a separator after the last record, because there's nothing to separate it from there.

There's no justification for not using terminators, it's just a bad spec. Unsurprising story: the variant with better marketing has less technical chops.


im guessing: all values must always end with a terminator, but a separator doesn't need to be present after the last value

i.e. a documemt without a newline at the end is valid jsonl, but invalid ndjson


What would be the impact of this style of motor on regenerative braking?


If designed well, this type of motor could do regenerative braking too. It's a matter of proper control of current in the stator and rotor and their phase difference, thus mostly electronics.


Insufficient sample size to support this article.

Cruise can only operate in a small region between 10pm and 5:30 am when bus service is limited and there will be few interactions to report.

Waymo rides are still significantly limited. No clear data on service rates or range.

All other programs have a safety driver in the car who is able to quickly react and prevent reports of an incident.


> Cruise can only operate in a small region between 10pm and 5:30 am when bus service is limited and there will be few interactions to report.

This is wrong. One of the incidents referenced in the article happened during the day (driverless cruise rear ending a bus.)


Oh, that timeframe really puts things into perspective. No wonder it's not a problem.


Catan: the only game which has caused me to jump screaming out of a window and run around the house in anger.

And then come back and keep playing.


My best friends are those I play catan with regularly. There is no other game so enjoyable, which can inspire such anger towards friends for their transgressions, yet allow such easy forgiveness. Rest in peace, Klaus.


This is hardly the "passing lane," it's just following a left lane exit onto treasure island. the entire bridge is a splits into three different freeways when it touches down in Oakland. You pass in whatever lane is moving fastest.

The tunnel is not curved. it's straight.


Touchscreen designs can be fast. I'd still prefer physical controls because of tactile recognition -- you can find the control without looking, but I ended up choosing a new Volvo over other makes partially because I prefer the simplicity of the interface.


Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: