yan (@bcrypt) header
yan (@bcrypt) profile picture

security engineering @brave / helped build Let's Encrypt, Privacy Badger, and HTTPS Everywhere @eff / physics alum @mit / rabbit enthusiast

Joined November 2012
what if instead of sandboxing the agents we sandboxed ourselves
121
345
65
5,630
168,408
Day 2 of voting on randomly-selected songs on SoundCloud until we collectively find the best one: tracks with 37 plays are outperforming ones with 15k+! azuki.vip/bse/
3
12
2,762
HELP NEEDED: please vote at azuki.vip/bse/ so we can determine the best song ever uploaded to soundcloud (songs are picked completely at random)
3
3
9
2,650
Replying to @KentonVarda
vanta had a widget that did something similar! it always assumed on my home network that i worked at anthropic presumably because my housemate actually did
1
14
1,624
Replying to @ZixuanLi_
i would submit some if it did not require write access to repos
94
planked for 9+ minutes continuously today to win a contest and now am regretting my hubris in even looking this up…
4
2
115
6,892
Replying to @BraydenWilmoth
whoa cool, so it's a local browser mirroring what browser run is doing? i tried a similar thing but starting from a local browser controlled by an LLM using cf workers for tasks that don't require the browser to be open
1
4
959
Replying to @thdxr
october 2023
20
1,115
target.com prices delivery items based on your local store setting, not your delivery address, so if you live in SF just set your local store to Missouri or something lol
5
15
2
217
15,004
between this and the two “hide my email” buttons on this form (one of which loads the email hiding feature, the other of which autofills the string “hide my email”), apple has been killing it lately!
1
4
39
4,909
i need to know more about the 38 pics classified as “rabbit” but not “Rabbit” by the apple AI
6
2
70
7,186
Replying to @bcrypt @_tijay @MIT
actually i noticed they are using the mobile client. indeed on mobile gmail does not show the `via` indicator for dmarc failures!
1
3
788
Replying to @nicolas09F9
yes, there is a completely separate issue where lack of DMARC allows anyone (not just mit.edu authenticated accounts!) to send emails that look like this. but fixing DMARC wouldn't fix the original issue from this thread. many universities have this issue too
3
1
14
5,240
turns out i can just test this :). here's an email sent via emkei.cz spoofing [email protected]. it makes it into the inbox without any warnings, but it shows the "via" message and a dmarc fail upon opening the original
1
2
946
Replying to @fdzdev
a lot of ppl have been saying (1) so i finally just tested it. yes the email goes to my inbox (gmail) but it's clearly marked as suspicious, even though mit.edu's DMARC policy is none, because it fails SPF and DKIM.
5
1,136