How to survive in dark forest (P2P Network)?

TBD

Useful/related links:
- https://petsymposium.org/2019/files/hotpets/slides/coordination-helps-anonymity-slides.pdf

The internet is broken, again

https://medium.com/@vesirin/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab
https://blog.npmjs.org/post/175824896885/incident-report-npm-inc-operations-incident-of
https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident
https://www.bitdefender.com/blog/hotforsecurity/supply-chain-attack-detected-in-pypi-library/
https://twitter.com/pypi/status/1562442188285308929

The solutions are WASM/etc (hardened by fixed ABI) or L4Re/etc (hardened by isolated env/vm). Docker is not a solution.

Update 1:
- https://reproducible.nixos.org/nixos-iso-minimal-runtime/
- https://tests.reproducible-builds.org/debian/reproducible.html
- https://reproducible-builds.org/

Update 2:
- https://deno.com/manual@v1.33.2/basics/permissions is kind of solution too, but little bit weird. we need something like usage profile for imported modules. Example: I'd like to import axios only to fetch example.com:80 and nothing more. (import axios from "axios" with {"network": {"multiaddrs": ["/dns4/example.com/80/http"]})

Update 3:
- You should be scared every time you do curl http://site.com/install.sh | bash

nice list of playgrounds (much more there):
◦ Floating point: Float Exposed by Bartosz Ciechanowski
◦ Unicode: Unicode analyzer from fontspace
◦ Unicode: What unicode character is this? from babelstone
◦ CBOR: CBOR playground
• Nginx: Nginx playground

Understanding Modern Storage APIs: A systematic study of libaio, SPDK, and io_uring
————————————————————————
TLDR: nice research, SPDK still faster than io_uring

https://en.wikipedia.org/wiki/Legality_of_euthanasia the good map of migration destinations, wanna move on

Thanks you, mrs. ¶¶¶¶¶¶¶¶¶¶

You may need this one https://t.me/addemoji/blankEmj

Just added "Taxonomy of procrastination" to "Reading list" (literally, never read it latter)

NEAReans, be careful with browser-based authentication (not ledger), for example even wallet.near.org can send your private key to sentry.io (cloud bug analytics system).
Where the admins of sentry and the developers of wallet.near.org will have access to it.

I reported to NEAR:

Hello.

I have another bug (minor this time) in wallet.near.org (previous still unpaid for more than one year)

During the auto-import process, the sentry was logging the # part of the URL (with the secret key). You have connected sentry, which by default sends.

When I open https://wallet.testnet.near.org/auto-import-secret-key#kalloc.near/SECREY_KEY_ENCODED_BASE58, I found that the app sends to sentry full URL with # part.

You connected sentry.io, the cloud version of a very cool bug analytics service. But, you send users private keys to the cloud version, I think you should add middleware and replace important (to users) data with placeholders. Sentry administrators and your developers with access to Sentry would be able to steal users' keys.

And got reply

Hello!

Thank you for submitting your report.

The mentioned issue may be exploited only if the Sentry service will be compromised, so the impact of this issue is highly theoretical. The report will be closed as Informative with additional reputation points.

Have a nice day and good luck with future findings.

Update: issue accepted, and a fix is scheduled.
Update 2: previous bug paid, respect to NEAR!