Hacker Newsnew | past | comments | ask | show | jobs | submit | lelandfe's commentslogin

https://github.com/anthropics/claude-code/issues/13371

> Additional bypass examples that all execute without permission:

> echo test ; git rm file.txt

> rm --force --recursive /home (if "rm -rf" is blocked)


It really is vibecoded.

I never really dug into the leaked code, but calling that there a security layer is a joke.

(And I really don't get why they give it actual shell access either, implementing a "fake" one for something like a honeypot takes a couple of days, not much more if it needs to persist/map to actual files.)


> Use CSS nesting to avoid writing “far reaching” selectors and style component-per-component

I view nesting as a footgun. I recommend trying to restrain all CSS to one selector, and to instead view additional qualifiers as an escape hatch where needed. Death to specificity.


Which part got you the most amped - "health crisis?"

DICE has poured gas on the NYC electronic music ticket scene and I loathe them.

The most bad thing they enable is increasing ticket prices for each ticket sold. It has ratcheted up show prices across New York dramatically.

Complaining about DICE (“all my homies hate DICE”) is a common thing in my friend group.


Going to be awfully hard to market rote machine maintenance as craftsmanship, but there are some suckers out there

If you've ever watched an episode of "How It's Made" and seen how incredibly customized these machines are, it won't be surprising that the people who build them are proud of their work.

My skepticism of the marketability of this idea deepens

What, you don't have a Tesla elevator on your street yet? https://www.youtube.com/watch?v=j70GvgXt-lE

My dad says, "But other than that, Mrs. Lincoln, how was the play?"

(Usually said jocularly when everyone is at their most upset, e.g. a vacation ruined)


A friend said at one of those moments, "And other than that, how was the play Mrs Lincoln?" And the 3rd person replied, "I don't know, I've never seen the play 'Mrs Lincoln'"

On my TCL TV, you have to connect it to read the Google policies you are agreeing to. If you don't, you agree to policies unread.

Thankfully, the blast radius of this is nothing without connectivity.


But it lets you continue without reading them? There's a lot of questionable terms of service rules but this one has to be unenforcable.

You must check a checkbox in agreement to continue. To read the policies one agrees to, an internet connection is required. You may check the checkbox without reading.

As far as I have found from a lot of menu spelunking, this agreement is irrevocable. If I ever go online, it will be used.


That's the kind of thing that doesn't always hold up in court.

The reality is, no one is going to take the companies to court over things like this.

Disney eventually walked it back due to bad PR, but this did happen: https://wdwnt.com/2024/08/disney-dismissal-wrongful-death-la...

That has very little in common with 99.999+% of people who don't experience a tragedy like that and just have their data used against them.

Sounds like a great reason to return a TV. It isn't like you must have a TCL TV.

If I don't connect to the internet ever, my agreement to Google policies is probably a moot point.

If you don't connect, sure. If a visitor connects the TV, all bets are off.

I have had to tell people not to connect the TV. It yearns for release.

If it has an Ethernet port I would use that then unplug it. It still gets to phone home once but you don't have to worry about it maliciously saving your Wi-Fi password for later

You can create a guest wifi with temporary password, I do that when I need to connect devices that might store the password like kindle or such.

3 years later. You are working on some old project that apparently is erroring.

Through a git bisect, you find a commit that references JIRA, though your company uses Linear.

You sigh, and start reading the diff.

(Adapted from real life events)


That's where something like Fossil is nice, because the tickets are part of the repo.

I hate that there's no "stop asking me" button.

I get those regularly in Chrome


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: