NLnet Labs (@nlnetlabs@social.nlnetlabs.nl)
In case you’re wondering: while not as extreme as illustrated by ISC (we don’t offer a bug bounty program), NLnet Labs suffers from a similar situation, in particular for Unbound.
Handling vulnerability reports, both valid ones and false positives, has now become a full time job for the entire Unbound team.
You can argue that it ultimately makes our resolver more secure, it also means we cannot work on building and releasing new features, like:
https://github.com/NLnetLabs/unbound/pulls/wcawijngaards
https://social.nlnetlabs.nl/@nlnetlabs/116418470657329812
In case you’re wondering: while not as extreme as illustrated by ISC (we don’t offer a bug bounty program), NLnet Labs suffers from a similar situation, in particular for Unbound.
Handling vulnerability reports, both valid ones and false positives, has now become a full time job for the entire Unbound team.
You can argue that it ultimately makes our resolver more secure, it also means we cannot work on building and releasing new features, like:
https://github.com/NLnetLabs/unbound/pulls/wcawijngaards
https://social.nlnetlabs.nl/@nlnetlabs/116418470657329812
GitHub
Pull requests · NLnetLabs/unbound
Unbound is a validating, recursive, and caching DNS resolver. - Pull requests · NLnetLabs/unbound
Forwarded from 层叠 - The Cascading
🔴 Vercel 遭骇，部分用户数据被泄露。
- Vercel 称已通知数据遭泄露的用户，并建议其重置密钥。
- 被骇原因是有员工在使用 Context.ai 时，由于后者被骇导致员工 Google Workspaces 凭据泄露。
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
seealso: HackerNews:47824463
#Vercel
- Vercel 称已通知数据遭泄露的用户，并建议其重置密钥。
- 被骇原因是有员工在使用 Context.ai 时，由于后者被骇导致员工 Google Workspaces 凭据泄露。
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
seealso: HackerNews:47824463
#Vercel
Vercel
Vercel April 2026 security incident | Vercel Knowledge Base
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems.
Forwarded from Laoself
Vercel啊Vercel……
攻擊切入點是個「第三方小AI工具」的Google Workspace OAuth app，居然給到這麼大的權限，大到能獲得足夠的資訊訪問客戶資料……
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
攻擊切入點是個「第三方小AI工具」的Google Workspace OAuth app，居然給到這麼大的權限，大到能獲得足夠的資訊訪問客戶資料……
https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
Vercel
Vercel April 2026 security incident | Vercel Knowledge Base
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems.
Forwarded from HAT's Public Channel |
Laoself
Vercel啊Vercel…… 攻擊切入點是個「第三方小AI工具」的Google Workspace OAuth app，居然給到這麼大的權限，大到能獲得足夠的資訊訪問客戶資料…… https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
TL;DR, 对于此 Vercel 数据泄露事件，你需要做的：
P0. 立即检查你的 Google Workspace 中是否向 OAuth App:
P1. 检查 Vercel 账号绑定邮箱中是否有 Action Required 邮件，如有则需要立即轮换被影响的所有 API Key 等凭据 (e.g. npm token, github pat, AI secret key, DB Connection URI...)
P2. 检查是否使用过
Src: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
P0. 立即检查你的 Google Workspace 中是否向 OAuth App:
110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com 授权过权限，如有需要立即吊销P1. 检查 Vercel 账号绑定邮箱中是否有 Action Required 邮件，如有则需要立即轮换被影响的所有 API Key 等凭据 (e.g. npm token, github pat, AI secret key, DB Connection URI...)
P2. 检查是否使用过
Context.ai 及旗下相关产品，如有则需要立即检查在其平台下是否有敏感资料，如有则需要立即处置Src: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
Forwarded from 竹新社
市监总局4月20日刊《利剑斩“幽灵” 铁拳护民生：依法查处7家电商平台“幽灵外卖”系列案纪实》。
“寻梦”“转单宝”作为服务商接入了拼多多、美团、京东、饿了么、抖音、淘宝、天猫7家平台，为裱花蛋糕店铺提供一键转单给其他经营者的服务，此事违反《网络餐饮服务食品安全监督管理办法》。此外，相关店铺无裱花蛋糕经营资格，未上传或批量伪造食品经营许可证。
市监总局专案组2025年12月3日进驻拼多多取证，首日未能取得进展。执法人员趁当晚23时的“上下班高峰期”意外发现并设法进入了拼多多的一个真实办公场所。在争夺办公室房门时，执法人员的手被挤压骨折。此后12月4日23时，拼多多安保负责人突然情绪失控，带人冲击办案现场。随后，拼多多技术总监突然自行倒地，送医检查心脏无碍。
最终，拼多多被认定9463家蛋糕店无食品经营资质，交易额9780万元。没收平台抽成所得584万元，另处罚款15.1亿元。
美团7031家无资质，交易额4.0亿元，没收平台所得3626万元，另罚6.9亿元。
淘宝闪购（饿了么）6329家无资质，交易额2.1亿元。没收平台所得1954万元，另罚5.3亿元。
京东43190家无资质，其中4858家有实际交易，交易额7729万元，没收平台所得670万元，另罚6.2亿元。
（中国质量报）
“寻梦”“转单宝”作为服务商接入了拼多多、美团、京东、饿了么、抖音、淘宝、天猫7家平台，为裱花蛋糕店铺提供一键转单给其他经营者的服务，此事违反《网络餐饮服务食品安全监督管理办法》。此外，相关店铺无裱花蛋糕经营资格，未上传或批量伪造食品经营许可证。
市监总局专案组2025年12月3日进驻拼多多取证，首日未能取得进展。执法人员趁当晚23时的“上下班高峰期”意外发现并设法进入了拼多多的一个真实办公场所。在争夺办公室房门时，执法人员的手被挤压骨折。此后12月4日23时，拼多多安保负责人突然情绪失控，带人冲击办案现场。随后，拼多多技术总监突然自行倒地，送医检查心脏无碍。
最终，拼多多被认定9463家蛋糕店无食品经营资质，交易额9780万元。没收平台抽成所得584万元，另处罚款15.1亿元。
美团7031家无资质，交易额4.0亿元，没收平台所得3626万元，另罚6.9亿元。
淘宝闪购（饿了么）6329家无资质，交易额2.1亿元。没收平台所得1954万元，另罚5.3亿元。
京东43190家无资质，其中4858家有实际交易，交易额7729万元，没收平台所得670万元，另罚6.2亿元。
（中国质量报）
❤2
This whole thread is a good explainer for people who still wrongly think Bluesky is a resilient/user-run/federated network like Mastodon is.
The reality is that Bluesky requires infinite VC money to fully replicate, whereas Mastodon can run totally self-sufficiently on a Raspberry Pi.
https://mastodon.neat.computer/@jonah/116418336248927824
The reality is that Bluesky requires infinite VC money to fully replicate, whereas Mastodon can run totally self-sufficiently on a Raspberry Pi.
https://mastodon.neat.computer/@jonah/116418336248927824
Mastodon
Jonah Aragon :MN: (@jonah@neat.computer)
This whole thread is a good explainer for people who still wrongly think Bluesky is a resilient/user-run/federated network like Mastodon is.
The reality is that Bluesky requires infinite VC money to fully replicate, whereas Mastodon can run totally self…
The reality is that Bluesky requires infinite VC money to fully replicate, whereas Mastodon can run totally self…
Forwarded from 维兰的存储间
#阅览
预测市场的反身性开始在天气市场显露明显的痕迹
如果你关注那些天气交易员的话，最近有很多人贴出了气象站气温异常的数据
其原因不是世界的某种规则变了，更有可能是有人在操纵气象站获取的数据
特别是中国地区的数据，似乎已经成为气象局内部职工的游乐场
https://fixupx.com/alrescha_1107/status/2044576879202431287
预测市场的反身性开始在天气市场显露明显的痕迹
如果你关注那些天气交易员的话，最近有很多人贴出了气象站气温异常的数据
其原因不是世界的某种规则变了，更有可能是有人在操纵气象站获取的数据
特别是中国地区的数据，似乎已经成为气象局内部职工的游乐场
https://fixupx.com/alrescha_1107/status/2044576879202431287
FixupX
Alrescha (@alrescha_1107)
自从首尔、深圳两大黑盘以后，连🇫🇷巴黎也开始有一点黑盘性质了😂 这是我第二次见到巴黎机场的传感器在某个时段异常升温的情况了，而且今天升的更可怕，在当地时间晚上进行升温！#polymarket
Quoting Harnisch (@Harnisc08225444)
@Polymarket there are obv. strange Things Happening in the Paris Weather Market.
You should just Switch the Airport as…
Quoting Harnisch (@Harnisc08225444)
@Polymarket there are obv. strange Things Happening in the Paris Weather Market.
You should just Switch the Airport as…
New policy from #Atlassian:
Unless you opt out by August 17th 2026, data from Jira and Confluence will automatically be used for AI training. Some data cannot be opted out at all on some plans.
https://mastodon.social/@kepano/116437577915147647
Unless you opt out by August 17th 2026, data from Jira and Confluence will automatically be used for AI training. Some data cannot be opted out at all on some plans.
https://mastodon.social/@kepano/116437577915147647
Mastodon
kepano (@kepano@mastodon.social)
Attached: 2 images
New policy from #Atlassian:
Unless you opt out by August 17th 2026, data from Jira and Confluence will automatically be used for AI training. Some data cannot be opted out at all on some plans.
New policy from #Atlassian:
Unless you opt out by August 17th 2026, data from Jira and Confluence will automatically be used for AI training. Some data cannot be opted out at all on some plans.
Forwarded from YCombinator News
At long last, InfoWars is ours
351 points by HotGarbage ago | 129 comments
https://news.ycombinator.com/item?id=47837611
351 points by HotGarbage ago | 129 comments
https://news.ycombinator.com/item?id=47837611
Forwarded from cclvi256's channel
NodeJS 26 release delayed to 28 April 2026.
https://github.com/nodejs/node/pull/62526#issuecomment-4282061307
https://github.com/nodejs/node/pull/62526#issuecomment-4282061307
GitHub
2026-04-28, Version 26.0.0 (Current) by RafaelGSS · Pull Request #62526 · nodejs/node
TODO:
Nightly macos15-release-pkg builds failing to build libffi #62787 ffi not in proposal
deps: update V8 to 14.6 #61898
src: workaround AIX libc++ std::filesystem bug #62788
aix: add requir...
Nightly macos15-release-pkg builds failing to build libffi #62787 ffi not in proposal
deps: update V8 to 14.6 #61898
src: workaround AIX libc++ std::filesystem bug #62788
aix: add requir...
Forwarded from 异样的漩涡中心
大事发生，2027 年起发售的三星非日版智能手机将支持 Welcome Suica。
用户将能够直接在 Welcome Suica Mobile 应用中使用 Samsung Pay 进行充值、购买绿色车票或折扣票。
https://news.samsung.com/jp/welcome-suica-mobile202604
用户将能够直接在 Welcome Suica Mobile 应用中使用 Samsung Pay 进行充值、购买绿色车票或折扣票。
https://news.samsung.com/jp/welcome-suica-mobile202604
Samsung
Samsung Wallet、JR東日本と訪日旅行者が便利に使える「Welcome Suica Mobile・モバイルSuica」の協業を開始
～ Samsung Walletとの連携によるSuicaサービスの拡大 ～
🤔3❤1
Git 2.54
- git history reword <commit> 重写 commit message
- git history split <commit> 将一个 commit 分成两个
https://github.blog/open-source/git/highlights-from-git-2-54/
- git history reword <commit> 重写 commit message
- git history split <commit> 将一个 commit 分成两个
https://github.blog/open-source/git/highlights-from-git-2-54/
earth: feeling good
https://chitter.xyz/@Vordus/116442024839274347
https://chitter.xyz/@Vordus/116442024839274347