Hacker Newsnew | past | comments | ask | show | jobs | submit | slyn's commentslogin

Respectfully, I think 'individuals' is doing a lot more work in GP's 'But most of the "investors" buying up property are individuals purchasing investment properties.'

The average 21+ US resident may own 2+ properties but I'd be surprised if the median equivalent owns 1. It kinda hides the equivalent of the top x% of individuals owns y% of the stock market where y is unreasonably disproportionate to most.


Just had a system board replaced on a device in my org, Dell laptop.

As part of setting up a device in our org we enroll our device in Intune (Microsoft's cloud-based device management tool aka UEM / RMM / MDM / etc). To enroll your device you take a "hardware hash" which's basically TPM attestation and some additional spices and upload it to their admin portal.

After the system board replacement we got errors that the device is in another orgs tenant. This is not unusual (you open a ticket with MS and they typically fix it for you), and really isn't to blame on Dell per se. Why ewaste equipment you can refurbish?

Just adding 5c to the anecdata out there re: TPM as an imperfect solution.


When I replaced a motherboard (rest of the hw was OK) Microsoft was of the opinion I had a 'new computer' and would need to buy a new Windows 10 license (of IIRC 150 EUR → scoundrels). I went to G2A and bought one for 20 EUR. Then it hit me. This occurred before when my previous motherboard/CPU was broken, and back then I actually called Microsoft where they insisted on selling me a new license. I did exactly the same back then.

I've handled technical+legal concerns for licensing for a very small org in a different lifetime, and yes, that's exactly how Microsoft used to think of licenses. I don't know how it works these days, it's someone else's problem.

We had to archive invoices+servicing documentation for warrantied mobos from the supplier to keep a legal licensing chain.


I remember the path my license had: it was a free upgrade to Windows 10, from Windows 7 (right before they removed said free upgrade; I tend to be slow with adapter Windows versions). The original Windows 7 license was a pirated one, but that didn't matter (we know why: before GDPR, Microsoft could spy on Windows 10 users, and the pirated Windows 7 was already a lost sale).

Apparently the free upgrade was OEM, bound to the hardware. I did not know. Either way, I'm from Europe (EU), and here a software license cannot be exhausted via second hand market, so it stands to reason I can buy one second hand. That this isn't what Microsoft support is told to discuss, suuure (even when I explicitly asked for it, they insisted I had to buy it via them).


I've had quite the opposite experience with Microsoft.

One time their support just give me a licence for a newer version of Windows - I've replaced the HDD/SSD, cloned/copied it and it was not activated. I contacted their chat support from that laptop and when they asked me for licence on the sticker I mentioned I'll have to come back in 5 minutes since I'll have to turn off laptop, and take out battery to see the MS sticker/hologram.

Support said "No worries, here's a new activation key".

Can't recall if it was from XP to Win 7, or Win 7 to 10.

--

And after buying 2 or 3 licences from another website just like G2A (Win 10 was ~€10 on Instant-Gaming) - a bunch of new computers (even brand new assembled desktops) were automatically activated.


I think by "this kind of operation" he means extrajudicially removing a sitting president (legitimate or not) of another country for trial elsewhere. Not cyber attack or espionage.

Oh, so the commenter is not actually talking about the BGP anomalies at all? He's just hijacking the comment section to advocate for nuclear proliferation?

Used to work as a manager at a pizza place and we had a guy apply to deliver who had the same name as... their son.

Allegedly Jr. had a lengthy record including some drug offenses and something like a DUI / DWI. Naturally Sr. And Jr's records got crossed since they have the same First, Last, and Address, which caused Sr. many headaches including that we required a driving record check that would fail on a DUI / DWI.


>Saying MCP is vulnerable is like saying "Web applications are vulnerable”

Just for reference, this GitHub follows in the tradition of many an example project all of which have the explicit intent of demonstrating not that the underlying concept is inherently vulnerable, but that implementations can be.

Damn Vulnerable Web App is probably the best known, but there are others for REST apis, web sockets, GraphQL, and more. They’re educational reference implementations that are deliberately insecure to use as an educational tool.


Except that all the “vulnerabilities” listed are addressed (or can be only addressed) by treating tbr MCP server as a client application.

If a Damn Vulnerable Web App demo was just 10 or 20 different “there no authn/authz on this endpoint”, it would be a crappy demo


How will this work when people are talking about third party MCP servers(e.x. booking.com, GitHub, etc.)


The same way you'd write a third party client to any software/API.

The MCP uses some kind of identity to talk to booking.com or GitHub. That's your security boundary. You assume that anything the MCP has access to (including that identity), the user has access to. If you add a `list_available_hotels()` tool to your booking.com MCP, that tool needs to run with the same identity as the person talking to the LLM. It doesn't have any more permissions or access to your system than the booking.com react app does.

Think of the MCP server as a natural language interface to your application. Like a CLI or a WebApp. Instead of writing specific commands to a cli, or following a series of clicks in a GUI app, you "chat" with it.


I think one major issue here is with the "server" terminology in MCP. It honestly just seems like the wrong word for what these things are, to me.


If you're authenticating the exact same way you would to an HTTP api(put an API key in the config), why does MCP need to exist instead of just plugging in the API key + link to openapi specs in an "Agent API Config"?

I was responding to you saying that the security model is different because servers can be treated as client applications for the security model, but that doesn't make sense for third party servers that you aren't hosting and just sending/receiving data from.

From the client PoV, booking.com could return malicious information to my prompt telling it to do unauthorized things with my computer(e.x. upload banking cookies to a remote endpoint). This doesn't sound secure, and just saying "it's part of the client" doesn't change that.


If booking.com is malicious then it wouldn’t matter how you connected. This is a different problem entirely unrelated to the implementation of MCP.

Like, what if google decided to blow their multibillion dollar company to steal my banking cookies?!?!


May have been true when Instagram was a photos app with a chronological timeline of only the accounts you follow + a few ads. If you wanted to seek content outside of your personally curated feed it was in a different tab or you would need to search for it.

Now it’s a meme-shorts first platform that constantly suggests content outside of your follows and non-chronologically. You can’t opt out of “suggested content” pictures or videos in your feed for more than 30 days at a time and there is no option to permanently opt out. It’s not possible to opt out of shorts (reels) suggestions in your feed. It’s not possible to opt out of meta “threads” suggestions in your feed. I just opened the app and 5 of the first 11 items in my feed were sponsored ads, and 1 of the 11 was suggested “threads”.


Plenty of those memes and reels ARE focused on 'IRL' activities, though. Obviously the full experience depends on your feed, but a lot of content is created and shared around restaurants/activities/vacation etc and many millennials and Gen Z find inspiration there, whether from influencers or peers.


Agreed, big fan of codenames in general but it plays its best when you’re playing against / alongside people that you’ve known for a while. The metagaming aspect of structuring clues to who your partner is really takes it to the next level.


I like to use Edge on occasion when I need to read something dry but necessary because I find following along with the TTS it’s auto-highlight of text helps me stay focused and retain better as well.

Is there any equivalent program for ebooks? If not can someone build one? The dream would be to plop in an arbitrary document (pdf, docs, tex, epub, and so on) and have it read to me by a reasonable TTS at a speed of my choosing and have words / lines highlighted as the TTS goes along. Bonus points if you can regularly identify and skip things that are not necessarily relevant like page numbers, headers, footnote markers, and so on, which is something that Edge TTS within Edge struggles with when reading PDFs.


I've been using https://readest.com/ lately. It's FOSS and just recently got this feature. The TTS voices are pretty natural and text is highlighted one sentence at a time. Plus the design of the product is great.


https://www.naturalreaders.com/, is has a free tier I think


If anyone else wonders, naturalreaders provides no API.


The ReadEra app for android supports this, and I use it for reading/listening to ebooks during commute. It works well.


You can use a screen reader. Most of them have a focus highlight feature and use local tts.


Calibre does this.


can you use TTS models?


Autocad doesn’t even have a Linux version.


Used to have AutoCAD UNIX, but died around 2000.


How about the Microsoft Surface Pro 9 being x86 while the Surface Pro 9 with 5g being ARM. My conspiracy theory is they did it on purpose to submarine ARM into enterprise environments


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: