https://twitter.com/premqnair/status/1948420769945682413

You have been misusing the D-sub connector terminology, and we're guilty of it, too.

“DRIVERS LICENSES AND FACE PICS! GET THE FUCK IN HERE BEFORE THEY SHUT IT DOWN!” the thread read before being deleted.

Free LLM API pricing comparison. Compare GPT-5, Claude, Gemini & DeepSeek costs instantly. Updated daily with official prices from OpenAI, Anthropic & more.

https://www.starlink.com/us

I want to present you with two narratives about AI. Both of them are about using this technology to automate computer programming, but they point ... Read more

In a world where corporations have detached buying from owning, one man attempts to do something radical: build his own cloud.

The fundamental principles needed to get a functional vehicle in your game.

Explore one of the world's largest and most discussed duopolies, from the origins of the credit card to its combined market value of $850 billion.

Google has updated Android's Terminal app to let you run full graphical Linux programs. Here's why that's a big deal.

This is a furry blog, where I write about whatever interests me and sign it with my fursona's name. I sometimes talk about furry fandom topics, but I sometimes also talk about applied cryptography. If you got a mild bit of emotional whiplash from that sentence, the best list of posts to start reading to…

MDN turns 20! Let's look at how we started, how MDN became the most trusted resource for web developers, the impact it's had on the open web, and yes, there's cake, too.

Google will deprecate all links created with its URL shortener on August 25th, 2025. All links made with the tool will return a 404 error message after that date.

https://academic.oup.com/pnasnexus/article/4/2/pgaf022/8016019

Google DKIM重放攻击技术分析

攻击概况

本文通过一个真实案例，剖析了一次针对Google用户的高度复杂钓鱼攻击。攻击者成功伪造了一封看似来自 [email protected] 的邮件，通知用户其账户因法律传票而被要求访问。该邮件在表面上极为逼真：发件人地址、品牌标识、专业语言均无可挑剔，无明显语法错误或可疑附件。

技术核心：DKIM重放攻击

攻击者实施了 DKIM重放攻击，其核心步骤如下：

1. 获取合法邮件：攻击者首先获取了一封真实的、来自Google并包含有效DKIM签名的邮件。
2. 保存原始签名：他们提取并保存了该邮件的完整头部和正文，确保由DKIM签名的部分（特定头部和正文）未被修改。
3. 重放邮件：攻击者通过自己控制的基础设施（如Outlook账户）发送这封未被篡改的邮件。由于DKIM签名保持完整，当邮件经过多个中间邮件服务器（如自定义SMTP中继、Namecheap的PrivateEmail服务）转发时，原始签名依然有效。
4. 通过验证：最终邮件送达受害者Gmail收件箱时，因原始Google DKIM签名与发件域对齐，导致SPF、DKIM和DMARC验证全部通过，使伪造邮件看起来像合法通信。

攻击链条细节

攻击者精心设计了邮件流转路径，增加了欺骗性和溯源难度：

• 发件：从Outlook账户发出。
• 中继：通过自定义SMTP服务（如 jellyfish.systems）进行中转。
• 转发：利用Namecheap的PrivateEmail服务进行转发。在此过程中，虽然添加了新的DKIM签名，但因其未对齐而不用于DMARC评估；SPF也因返回路径重写而通过但未对齐。
• 送达：最终邮件抵达Gmail，所有认证均显示通过。

利用Google Sites实施钓鱼

攻击者滥用 Google Sites 这一免费建站工具，在受信任的 sites.google.com 域名下创建了仿冒的Google支持页面。该页面用于伪造登录界面或凭证收集表单。由于页面托管在谷歌域名下，容易降低用户的警惕性。

攻击重建与关键利用点

文章成功重建了攻击流程，揭示了攻击者利用的关键漏洞：

1. 注册域名：攻击者通过Namecheap注册了与Google相关的域名。
2. 设置邮箱：注册Namecheap的PrivateEmail邮箱。
3. 创建OAuth应用：在Google Workspace中创建OAuth应用，并在应用名称字段中填入“Google Support”等误导性名称。
4. 触发通知：当用户授予该应用访问权限时，Google会自动生成一封来自 [email protected] 的合法安全警报邮件。
5. 转发篡改：该警报邮件被发送到攻击者的PrivateEmail邮箱。利用该服务的邮件转发规则功能，攻击者将发件人地址（From）显示为 [email protected]，而将回复地址设置为任意地址，并将邮件最终转发给受害者。

安全意识与防御建议

• 切勿互动：对任何可疑邮件，尤其是包含紧急行动要求或登录链接的，切勿点击链接、下载附件或回复。应在沙盒环境等安全隔离的环境中进行调查。
• 理解攻击原理：DKIM重放攻击难以防御，因为它依赖于已签名的合法内容，而非破解加密。SPF和DMARC在此类攻击面前防护有限。
• 防御措施：
  • 定期轮换DKIM密钥（建议每30天或更短），以缩小被重放邮件的有效窗口。
  • 加强用户意识：教育用户警惕紧急语气、伪造的法律通知或账户警报；在输入凭证前仔细核对URL；建立鼓励上报可疑邮件的文化。
• 法律文书辨识：了解真实的法律传票（subpoena）通常由法院、律师或政府机构通过正式的个人送达、加密邮件（需事先同意）或注册代理等渠道发出，而非通过一封普通的邮件通知。

Teams across Anthropic use Claude Code for everything from debugging production issues and navigating unfamiliar codebases to building custom automation tools. Here's how. ‍

Lip-Bu Tan announces 15% workforce reduction

Deep-diving on the load performance of F1 websites.

This is Part 1 of a series examining techniques used in game graphics and how those techniques fail to deliver a visually appealing end result. See Part 0 for a more thorough explanation of the idea behind it. High dynamic range. First experienced by most consumers in late 2005, with Valve's Half Life 2: Lost Coast…

https://asciinema.org

https://www.ipnsig.org

As a technology matures, the focus tends to shift from qualitative achievements, such as who was the first individual or organization to achieve a certain goal, to more quantitative measurements, such as how much resources and expertise are needed to complete a single instance of a task, and how much environmental impact and risk of harm is generated. This is a necessary transition in order to scale up the technology from proofs of concept to mass adoption.

For instance, in the early days of powered flight, the emphasis was on milestones such as the Wright brothers' first powered, controlled, heavier-than-air flight in 1903, or Lindbergh's first solo non-stop transatlantic flight in 1927. But it required the decades of boring but important and sustained development in jet aviation (as well as the attendant infrastructure and logistical support) from the 1950s to today to lower the cost of (say) transatlantic air travel while simultaneously improving safety standards to the point where it became both safe and affordable (albeit not particularly luxurious) on a regular basis for a middle-class individual in a developed country.

In contrast, the Apollo programs famously led to the milestone of crewed missions to the Moon in 1969, but at prohibitive expense. Unlike the situation with aviation, there have not been significant advances in cost reduction; NASA's Artemis program, for instance, is estimated to require tens of billions of dollars to perform a single such mission (which, to be fair, involves heavier payloads and longer time periods than the Apollo missions). (Also, the future of this program may be in doubt due to significant budget cuts.) (1/3)

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

People tend to put a lot of trust into their phones. Those devices have access to no end of se [...]

https://ziglang.org/devlog/2025/#2025-07-23

https://djpardis.medium.com/revisiting-moneyball-074fc2435b07

18-year-old Ewin Tang has proven that classical computers can solve the “recommendation problem” nearly as fast as quantum computers. The result eliminates one…

Emory University researchers identified that psilocin, a byproduct of consuming psilocybin, the active ingredient in psychedelic mushrooms, actively delays aging in cells and organisms.

While the incident on a base in Wyoming remains under investigation, all service members in the Air Force’s Global Strike Command unit will pause use of the New Hampshire-made M18 pistol.

“The call is coming from inside the house. If this happened to these big banks, to these Fortune 500, brand name, quintessential American companies, it can or is happening at your company,” said U.S. attorney Jeanine Pirro.

文档类型与目的： 该内容为一个GPU计算工具的技术说明文档，旨在指导用户通过交互式界面，根据不同计算任务（如模型训练、推理、渲染等）的需求，快速估算所需GPU的型号、数量及成本。

核心结构与功能：

1. 输入参数：用户需指定核心任务参数，包括：

   • 任务类型（如深度学习训练、推理、3D渲染、科学计算）。
   • 模型/场景规模（如神经网络的参数量、图像分辨率、复杂度）。
   • 性能目标（如每秒处理样本数、目标延迟、总渲染时间）。
   • 内存需求（显存容量、带宽）。
   • 预算或成本约束。

2. 计算逻辑与输出：

   • 工具根据输入参数，结合内置的硬件性能数据库与任务经验公式，进行实时计算。
   • 主要输出包括：
     • 推荐GPU型号：列出满足要求的若干候选GPU（如NVIDIA A100、H100、RTX 4090等）。
     • 所需GPU数量：估算单卡或多卡（如需要分布式训练）方案。
     • 关键性能指标估算：如预计训练时间、推理吞吐量、渲染FPS。
     • 成本分析：提供硬件采购成本或云服务租赁费用的初步估算。

3. 关键特性：

   • 场景化匹配：区分训练与推理场景，因为两者对算力、显存和带宽的侧重点不同。
   • 可扩展性考虑：在涉及多GPU或多节点时，会估算通信开销（如NVLink、PCIe带宽）对整体效率的影响。
   • 参考基准：内置常见基准测试结果（如MLPerf、3DMark），使估算更具参考性。
   • 简化决策：将复杂的GPU选型过程（涉及架构、显存、计算能力、互联技术等）转化为基于用户具体任务的量化推荐。

总结： 这是一个面向AI开发者、科研人员及内容创作者的实用决策辅助工具。它通过将具体的计算需求与GPU硬件规格进行匹配，提供量化的性能与成本估算，从而帮助用户在复杂的GPU产品中做出更合理的选择，优化资源投入。

            We successfully exploited two discontinued network devices at DistrictCon’s inaugural Junkyard competition in February, winning runner-up for Most Innovative Exploitation Technique. Our exploit chains demonstrate why end-of-life hardware poses persistent security risks.
        

dwl - dwm for Wayland

Wrestling legend Hulk Hogan has died at 71 years old, TMZ Sports has learned.

https://mtmc.cs.montana.edu/