They literally raised $870 million this month. It's like people think the hype cycle = success of business for some reason. I'm sure a couple of months later, they're going to release something new, hire a lot of PR, and the same people will be "man, Jev had fallen but this new [xyz] brings them so back! [xyz] industry will now be dead!"
I mean, it's the brain, not the world around it. Our brains haven't really evolved much while civilization and technology have been growthmaxxing. Same reason why certain social media posts can trigger a physical, emotional reaction, even though for 99.99% of the time there were no cellphones or social media.
Hell, just throwing in some syncopation into a pop song would make it wildly more interesting.
"Triplet-flow" in rap took the genre by storm after Migos and Future popularized it a while ago, and the initial appeal was the rhythmic novelty of it. (It obviously got stale after the novelty wore off.) Pop music in many of the big genres is in general, however, quite reticent to move away from perfectly riding a 4|4. Even using a 6|8 would be interesting.
There is a decent amount of pop music in 6/8. I always joke that it's like a hack to making a song better because 6/8 is rare enough that it makes the song sound interesting but common enough to not alienate the listener. It ends up sounding mostly like a hard swung 4/4 but then fills and some melodic lines are just a little bit more rhythmically spicy.
There's actually no proof or claim of XSS vulnerability in this bizarre article. Username url confused with special url is a common bug, I've seen it "exploited" on facebook.
The exploit I read in the vice.com article is the attackers username or a post could contain "" and be unescaped and automatically sign users that loaded that page out. If you don't want to call that an XSS, what would you like to call that?
The claim regarding username is 'i can make my username "signout" and it signs people out when they click my profile', not that it can contain , so no html injection here.
Visiting https://superlogout.com/ logs you out of gmail with a cross-site GET request and it's not considered a vulnerability by google [0]
Posts could contain a safe subset of html (no scripting) including as a feature - that used to be an acceptable design choice. In connection with the /signout it did allow for some unfortunate shenanigans - the kind of bug you just add additional sanitization for and move on, nothing indicative of a below average code quality.
>If you don't want to call that an XSS, what would you like to call that?
I would call the version you described a HTML injection to CSRF, but as Dylan16807 noted apparently it does fit OWASP's wide definition of XSS: "Since then, the term has widened to include injection of basically any content." [1] But that's not what happened, there was no HTML in usernames and HTML in posts was intended.
> OWASP considers the term cross-site scripting to be a misnomer. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.[2]
They were referring to the comment they were replying to, which claimed that the original code was written (by humans) as poorly as AI does today. But AI today wouldn't write bugs that basic.
Yes but that means it is trivially exploitable today since anyone can get access to a LLM and where to point it towards. 2-3 years ago, things were different, that is also correct but that doesn't mean things stay frozen in time.
Yep, I probably won't bother switching to them now as Chase provides a good service as far as I know, though I do get a bit twitchy about its U.S. links. However, it's headquartered in the UK and is a division of J P Morgan Europe, so I hope that provides some level of distancing from the inevitable economic collapse of U.S. A.I. companies.
For what it's worth, JP Morgan specifically is probably the best positioned of all the major banks to endure any political and/or economic instability that might arise in the near-ish future. Not that this should necessarily drive your decision on who to bank with, but having spent the last decade or so working at various large US banks I have a lot of respect for the way JPMC operates
- The vast majority of their infra (at least as of ~3 years ago) is self-hosted in data centers that they own, and a lot of their other key cloud infra is/was multi-cloud (i.e. operations could fail over to GCP in the event of an AWS outage)
- Financially they have the healthiest balance sheet of any non-state-owned bank (like, in the entire world). Over the last ~20 years JPMC has acted as a sort of lender of last resort several times, most recently when they bought out First Republic.
- Politically, after navigating the aforementioned instability Jamie Dimon has almost carte blanche support from the shareholders, and everyone knows it. As a result, he can afford to be a lot less... compliant with the current US regime than other major players have been recently.
Thank you, this is great insider info. I only wish they had free checking accounts; they have all sorts of requirements in order to waive their monthly fee. Then I’d switch in a heartbeat because of your post.
reply