Should have used monero, virtual cash with a little less privacy

By the way all the comments in a thread like this will look like bots

Launch HN: Integuru – Reverse-engineer internal APIs using LLMs

https://news.ycombinator.com/item?id=41983409

Thanks! I bought you a coffee

Your idea gave an idea itself, i will integrate this with all canva domains

https://static.canva.com/web/images/8439b51bb7a19f6e65ce1064...

i dont know how to message you besides this website (Hacker News), but i ask you to please drop me a line on my youtube channel so that i can get your user test and makes it a reality.

Drop a comment here: https://youtube.com/@cristoxlucifer

Or please mail me as a contact letter to justo@outlook.sa

I do really want to get in touch with you breck

You got a real question or is all about your iOS18

Sorry for the time loss! It's a PC browser app

Just go to app.clipchamp.com (linked on this post) and you can edit from mobile

You just need to "register" a subdomain. So basically any google employee has potentially full access to your system?

You’re likely severely underestimating the amount of internal paperwork and review that is required to launch a new google.com subdomain.

I did one on my local network and didn't fill out anything

But only you have access to your local network.

Good thing all networks everyone connects to are always known by that user to be secure

Do these APIs not require https?

The case here was just injecting a domain. There's another thread for this post pointing out you would also need to inject a malicious root cert for https traffic, which is correct, but not impossible (and given some bad/lazy practices I've seen places do when they sign their own certs for internal infrastructure, not a far stretch)

If they can do that, they can spoof or proxy any website and collect your passwords, auth cookies, and anything else sent over the network. At that point, who cares if they can also see how much CPU you're using?

I've unlearned over my years that trying to come up with what malicious actors can do under what scenarios and conditions isn't worth the effort, because they are many, know more than me, have different goals than me, and I am one. There's endless permutations of environments and additional weakness or scenarios or a particular sensitivity of information that you don't or can't consider that make some attack really painful. For this case, maybe CPU usage or aggregate changes in CPU usage tips off an attacker on what someone is ramping up internally that can be used for espionage or even timing attacks.

What I have learned in place of that is plug holes to minimize attack vectors.

That's not necessarily true.

is your local network google.com ?

I can tell my pc what ca to trust, so yes i can make it to…

So if you can just trick someone into trusting a bogus root CA, take control of their DNS resolution, and get them to open an attacker controlled domain in Chrome then you can... Use this API to get information about their current CPU utilisation.

Wow some attack you got there.

Maybe they don't need a new subdomain, something unused could do the trick.

Probably a 'something.google.com'...

But you could have teams with DNS zone delegation who can.create.anything.like.this.google.com

Or anyone who controls your DNS resolution which has a number of paths (for example a local hosts file, possibly a router, changing your config or how you get your config to a malicious DNS server, etc)

Won’t work with https.

If that malicious actor can install a custom ca too, they can already install whatever spyware they want.

Not that easy with HSTS.

Also need a cert which is tricky

or public wifi access point

In what world does "system / tab CPU usage, GPU usage, and memory usage" mean "full access to the system"? Any Chrome extension can access this info easily, the point that the tweet makes is that there's a built-in Chrome extension that shares this info with Google's own websites without any confirmation.

What about anything on sites.google.com?

Is it really that easy? I just kind of assumed that devs could create subdomains under a dev TLD like googdev123.com, but not google.com until it was a fully-fledged product release.

Nothing at Google is that easy. It is a large and slow-moving bureaucracy.

Agree. I work at Google. I promise nothing happens quickly. It can take over a week to set up a new SQL database & client. Half coding (don't get me started on boq...) and half data integrity and criticality annotations for the data...

I don't know what setting up a new domain is like but I can't imagine it's something you "just do".

I have no idea what complaints you could possibly have about Boq. It makes you more productive, haven't you heard?

Drive.google.com links also work

Social media really changed a lot of things

Marquee has text as innerHTML, why can't people read that without vision?

For context this is the type of use https://laputatrampa.com