Hacker Newsnew | past | comments | ask | show | jobs | submit | zovin's commentslogin



Looks like a line ending problem. RejectsInvalidChunkExtensions seems to be the unit test that covers the actual concern.


This is a dumb way of scoring the bug.

The bug itself doesn't enable any of those. An app using the library might have that vuln.


It's a generic problem with using CVSS to score library vulnerabilities. CVSS is designed around complete systems, so it's totally crap to apply it to libraries.

I see a lot of critical (9+) supposed JavaScript "remote code execution with no authentication" CVEs being posted...

Right, if you are running it in an NPM server exposed to malicious user input with no authentication. Actually it runs client side in the browser and at best it's a prototype pollution vuln with a much lower score.


> This is a dumb way of scoring the bug.

The above is a motto for the entire vulnerability industrial complex.


Score which is based how someone could theoretically use the tool.

It might be right, but it also feels so wrong.

I would in reality probably rank this issue lower. And in some more properly engineered systems it would have lot less criticality.


But:

> someone could theoretically use the tool

makes every single logic error a 9.9


When they discontinued the line in 2021, they explicitly mentioned they would maintain support of the SoundTouch app. I have a Wave IV and thankfully didn't buy into the multi-room playback system, so at least the radio, CD player, and airplay will still work. Except I primarily used it as an alarm clock with a streaming service, so this really sucks.

They gave a consolation prize of 25% off on some Bose speakers, but why would you want more Bose speakers if you can't trust them to keep their word?


I sideloaded Marvel Unlimited so I could read comics on my surface. It was genuinely a great experience, because its the biggest tablet I own and the android app was far better then the web app. Rip WSA.


Especially since moving to SDK-style projects, I haven't even thought about assembly bindings in a long time. I've come to really like nuget.


Capital One credit cards have the virtual card feature built-in. You can use the Eno extension to use them. It even allows for scheduled lock outs of the specific virtual cards. I use it for every subscription service I use.


Do you know by any chance - Is this feature available only in US, or for the Canadian customers too?


You can do this with privacy too. That’s free for 12 debit cards a month


I don't understand your answer, sorry...


just signed up!


Is there a way to use the feature without their browser extension?


Yes, the website (where you manage your card, check spending, etc) can create and manage all your virtual cards. In fact it gives you a lot more customization over the virtual cards than the browser extension. But the extension is more convenient, it automatically offers to generate a virtual card on shopping cart pages for you. But I use a combination of both.

This is how I manage subscriptions too. I give every subscription a unique virtual card and I set it to “expire” or deactivate after 24 hours. That way the cards stays active for the initial charge/verification, but then it will not work if the card gets charged at the end of the trial. If I decide to keep the subscription then I just log into the capital one site and reactivate the card (it’s just a simple little iOS style toggle switch) before the trial ends so that it continues.


I have this card, and never used the extension, because I don't want to use a one time use extension.

Now they have added some of the features, in app. You can generate exactly one virtual credit card in app, can lock it from future use, and can delete this card (& thus can get a new one). Can't set the spending limit, can't get more than one virtual card in app, can't limit it to one seller.

The only thing it is good for is, your actual credit card number will never be with seller.


I use it without extension, it’s just more effort. You can use either browser or mobile app to create them.


Same here. I love using pwsh 7 on windows, but on Linux it was a whole different experience. Granted I was trying to use it on an Arch instance, which isn't technically supported, but I couldn't even get PSGet or PsReadLine to work. However, I was pretty great to run the same scripts cross OS with basic commands like Invoke-WebMethod/Invoke-RestMethod


Here's a postmortem comment from a Cloudflare engineer: https://github.com/npm/cli/issues/836#issuecomment-587019096


[deleted]


How's your day going?


If that was true, then "Invoke-WebRequest -Uri https://appleid.apple.com -UserAgent '(Linux)'" would return a 200 status, but it returns a 502 Bad Gateway


You're right, that's blocked. User-agent "(Linux)" is blocked, however User-agent "Linux" is not, while "X11; Linux" is blocked.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: