Forgot your password?
typodupeerror

Comment Cue the TMC joke from the old doctors' TMB joke (Score 1) 20

So there's this well known chronic and fatal condition known as TMB. Already getting to me even though I don't self-identify that way... Too Many Birthdays covers all the bases.

And now we have TMC as in Too Much Complexity for lowly humans to deal with.

But what actually interested me in this story is tangential. (Of course.) I am guessing that this is the same Notion that was introduced to me by an AI-driven phishing scam. The first celebrity impersonation that had me going for a couple of rounds of email. This particular scam was driven off of YouTube on the rather cunning theory that people who comment on celebrity videos might be suckers for "related projects" that spin off of the videos. I wasn't as soft a target as hoped, but "Live and let spam" from the google and friends almost always saves the scammers from jail. But my current theory is that Notion is basically legit but the reason the scammer recommended it was probably because it was his tool for managing the scam. (Perhaps a team or gang of scammers, since I've noticed a couple of similar-enough attempts since then.)

So have you seen anything like that and want to share notes? Or maybe you want more specific tips and cautions? (As if Slashdot was still such a communication channel.)

Comment Re:Is this for legal support? (Score 1) 30

Please enable and use a spelling checker.

But mostly I think the entire discussion needs more consideration of the supposed economic safety and profitability of producing cheap sequels, which is most of how I'm interpreting this story. Another example would involve the publishing industry, but Amazon has made that moot...

Comment Re:Now can we trust Huawei? (Score 2) 47

No, so I guess that means I agree with you on that part of it? I think the problem is that we basically surrendered on the idea that we could detect the gun irrespective of whether it was smoking or not. Not sure if "we" should be limited to America or extended to the rest of the world. Or maybe even extremely limited to security experts.

Maybe I need a disclaimer that I am not an official security expert of any sort, just a somewhat educated bystander. My initial approaches involved considering hardware features that would be of use in supporting software-based attacks in the least traceable ways. In other words, the device would not contain any sort of gun until AFTER the target was identified and appropriate attack software was downloaded. And even better if the software would go away whenever not needed... However we seem to have reached a similar sad state of affairs via our smartphones, so WtH.

Comment Re:Shameless First Post Hijacking (Score 1) 47

I don't think you need to sound so apologetic in your Subject. You're just preventing propagation of the sock puppet tripe. But maybe it's better to be explicit about it? I just think it's better to ignore AC with substance, including a relevant and nonvacuous Subject, whereas yours is a metasubject.

On your actual topic, even the Chinese are standing on the shoulders of giants? (But that may have been intended as a personal attack on Hooke.)

Comment Re: A definite mix (Score 1) 73

I predict the AI sock puppet will respond in three... two... one.

And done.

Funny coincidence, but I'm just finishing a political sociology book focused on Japan. Gave me some new insights into the "level" problem. Short summary is that humans' high level programs are pretty much similar. I like writing as an example for the high-level programs, and you can find published authors representing almost any group of people. But at the low level most of the programs don't care much. For examples, the heartbeat and digestive programs don't even accept interference from on high. However some of the low-level programs are quite gender specific: (1) Ovulate each month until pregnant. (2) Nurse baby. (3) Resume ovulation ASAP. The ASAP was predicated on many of the babies dying quite quickly, but these decades many mothers override Step (2) with commercial formula as a high-level intrusion. (However rereading that made reminded me that modern medicine does include many high-level interventions into our lowest level programs...)

Comment Now can we trust Huawei? (Score 1) 47

Gimme Funny! Have to say it explicitly since Slashdot's sense of humor is so residual and twisted these years.

Leaving the Subjective joke behind because I still can't write funny, the story does make me nostalgic for the old days when Huawei seemed to be a relatively good source for my electronic toys. High performance and low prices. My dangerous assumption was that the non-Chinese security experts were still able to assess the security and privacy threats and therefore Huawei wasn't going to play any games that could be detected. There was a transitional period where the issue was unclear and Huawei might have been able to get away with claims like "It was just a joke" or "It's just a bug and we'll fix it" or even "The subcontractor did it", but the current context is different. I'm not assuming any more malice than I expect from American companies, but the problem is that America has surrendered and gone all in on the position of "We're sure it's dangerous to the point we can't even estimate how dangerous it is!" Sort of like AI?

I must have bought ten or fifteen Huawei devices over the years. I still have two that are "alive" and might be phoning home. Fortunately I'm of no interest to China so I don't care. But as regards this new made-in-China computer, I'm off the fence. Don't see and can't even imagine any path to trusting it. Can you imagine a reason to buy it, especially if it seems to be a great value?

Submission + - Infant Bleeding Surged as Parents Rejected Vitamin K Shots, Studies Find (nytimes.com) 2

fahrbot-bot writes: The New York Times is reporting that a study has found a 347% increase in infant bleeding cases as fewer babies received the vitamin K shot, which helps blood clot, since 2017.

For decades, the American Academy of Pediatrics has recommended that every newborn receive an injection of vitamin K, which helps blood clot and can protect against sudden and catastrophic bleeding that can occur even in otherwise healthy babies. The injection is not a vaccine, but as mistrust in medicine has grown and as Health Secretary Robert F. Kennedy Jr. and other prominent health figures have cast doubt on the importance of childhood vaccinations, more parents have started forgoing it.

With fewer babies getting these injections, doctors had already begun to see more infants with serious hemorrhages. The new studies, published Thursday in the journals JAMA and JAMA Pediatrics, provide some of the first concrete data on this pattern. One found an especially sharp increase from 2024 to 2025, with cases of vitamin K deficiency bleeding roughly doubling in that time.

The JAMA study looked at more than five million infants. In 2017, 3.1 percent of these newborns went without a vitamin K shot; by 2025, it was 6.8 percent. The infants who had not received the shot had significantly higher rates of bleeding in their first six months, including more than double the risk of brain bleeds, which are especially deadly: 33 brain bleeds per 10,000 births, compared with 13.2 per 10,000 for babies who received vitamin K.

The JAMA Pediatrics study, on which Dr. Woolf was a co-author, looked at more than 11 million infants and found similarly that the rate of infants going without vitamin K more than doubled from 2017 to 2025. The overall rate of vitamin K deficiency bleeding rose nearly 350 percent, to 107.4 cases per 100,000.

The vitamin K injection is very safe, but more parents started declining it in the 2010s, citing, among other things, a belief that the shot was unnatural or unnecessary.

Dr. Elizabeth Wolf, an author of the JAMA Pediatrics study and an associate professor of pediatrics at Virginia Commonwealth University, said she hoped the results would break through to parents who may not realize the severity of the risk of going without vitamin K.

Comment You're too slow! Stole your secrets! (Score 1) 24

That was my main reaction to the story, which was actually interesting enough to keep me reading all the way to the end. I'm mostly focused on time these years, as in time >> money, but the details about how long this has been going on were pretty surprising.

Not surprised by the ineffectiveness of the slow humans in getting any attention to the matter. But that's also an ancient problem. All things support are classified as costs to be minimized. Most profit from ignoring complaints and hope they go away or at least become moot.

My own theory of support when I was doing the work was hilarious. I thought support was my opportunity to make customers happy while learning more about their real problems. Sometimes I even learned about the services we needed to offer, which upper management found even more hilarious. Suffice it to say I didn't last so long in the customer-facing role... (And no, it didn't make me feel better just because the company went away after I walked. There was a time when I hoped we were building something that would last.)

AI

Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub (thehackernews.com) 24

Be careful with the file .claude/settings.local.json, warns The Hacker News: Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work. One company the researchers notified earlier this week confirmed its key had been live...

Removing [the file] from a project does not undo the leak, because older versions stay in git history and in forks of the repository. The researchers' advice is to rotate first: change every password, token, and key the file has ever held, then clean up...

Claude Code tries to keep the file out of git. The first time it writes the file in a git repository, it adds the file to the user's global git excludes, its settings documentation says. Git on that computer then ignores the file in every repository. That protection stays in one user's git settings on one computer. It does nothing for a file that was already committed, the researchers say. Claude Code never adds the file to the project's own .gitignore, so the protection does not travel with the project. In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file. They take this to mean Claude often commits the file itself.

Apiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories, its research write-up shows. About 1.1% of them, or 1,122 copies, hold at least one secret. Together they hold 1,379 different secrets... ]And "in half of those repositories it had been there for at least 217 days."] More than a third of the secrets open a database directly, including 379 database passwords. Others include 43 SSH logins for public servers, 42 tokens for GitHub, GitLab and npm, and 23 AWS keys. Among the owners of these files are 63 organizations, mostly software companies of all sizes. The strongest cases include a database vendor's own admin-level cloud key and the owner password of a medical-records database, the researchers say.

Boris Cherny, Anthropic's head of Claude Code, responded to the story in a comment on Hacker News:

"Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this.

That said, a few thoughts:

1. .claude/settings.local.json is meant to stay local. This is not a file you should check into source control. We automatically gitignore it when Claude creates the file, so in this case the files were manually created and checked in (docs: https://code.claude.com/docs/en/settings)

2. Permission rules are old hat. Everyone should be using auto mode instead. It is safer and also does not require manually maintaining finicky allow/deny lists. Auto mode is enabled by default and is included for free in all plans.

3. Regardless of what agent you use, you should have secret scanning enabled. GitHub and other source control hosts offer it. There are many threat models that it protects against and you should absolutely use it if you can. (see https://github.com/security/plans)"



Cherny also named approaches Anthropic plans to prototype, Apiiro notes in an update, citing Cherny's goal of "making sure auto mode catches this, building in basic secret scanning," and, when a reader noted the same can happen in auto mode when it asks about a sensitive command, answered "good catch."

Claude Code users had already filed a bug report on the issue on August 11, 2025, notes The Hacker News, but "An automated bot closed that report as 'not planned' on January 3, after 60 days without activity."

Three more bug reports were then filed, according to the researchers. "None got a reply from Anthropic, and three were closed automatically as inactive or duplicate."

Slashdot Top Deals

My sister opened a computer store in Hawaii. She sells C shells down by the seashore.

Working...