Having recently gone through this exercise with our IAM vendor to secure our MCP service, OAuth DCR scares me in that context. With redirect flows, which are usually what you're using when you're plugging your MCP into an agent, the spec says nothing about how to secure that. I really don't want to allow just anybody to register a client with an arbitrary callback. That's opening us up to phishing. Register your client with a malicious callback url and then trick users into clicking a link that initiates that flow. Our legitimate idp will authenticate them and then send then hand their access tokens off to an attacker.
The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.
Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.
Because Etsy is not a general second-hand marketplace. Its niche is artisans making small batch items. And making your own thing at the scale of ebay is not exactly a small feat.
Etsy used to have strict limitations on what was allowed to be sold. I'm not sure how effective it was, but since that restriction has been removed, you're right, they'll list anything. Etsy has become a graveyard for dropshipped garbage, and the odd CD key, apparently! CD keys I can get behind.
I actually like when that happens. Like when people "correct" me about how reddit works. I appreciate that we still focus on the content and not who is saying it.
That's not really what happened on this thread. Someone said something sensible and banal about vulnerability research, then someone else said do-you-even-lift-bro, and got shown up.
This happens over and over in these discussions. It doesn't matter who you're citing or who's talking. People are terrified and are reacting to news reflexively.
I am going to ask a question that I’m a little scared to ask because I suspect it’s really dumb, but here goes: is it at all feasible or practical to have a way to jettison a runaway battery from the aircraft? I guess most of the time the problems happen because nobody knows there’s a problem before it’s gotten too out of control for that.
You’d have to devise some sort of fire proof mini airlock, large enough for a laptop or whatever the largest device you expect to deal with. This would be pretty expensive and not very practical, but even if it was, then you’d have to deal with the ethical and legal issues of where it lands and whether or not it might cause a fire there too, to say nothing of injuring someone or damaging property.
Sure, I wasn’t trying to imply that it couldn’t be done, only that it would be expensive and impractical for civilian aviation, especially when there are good alternatives.
I'm familiar with this strategy but there's one thing about it that I don't understand: After death, the loans are an estate liability, right? Doesn't the estate need to be settled before heirs get their inheritance? If i had an outstanding $1MM loan, wouldn't the estate need to liquidate some of that $RIVN at the $67 basis in order to pay the loan? and then whatever $RIVN was left over would go to the heirs at a stepped-up basis?
The step up in basis happens when you die, so the estate has no capital gain. Then the debts are paid, then the heirs get whatever they're supposed to get.
I conflated the two, since it all happens pretty quickly, but the estate is actually the recipient of the updated basis. So the estate sells @ current price, pays the negligible difference on gains from appreciation while the estate settles, if any happened, and then passes out the rest.
Do we need to wait for a tragedy before we do something? Good on the airlines and regulators for recognizing a burgeoning problem and taking action before (hopefully) it leads to unnecessary deaths.
> Do we need to wait for a tragedy before we do something?
Yes, absolutely. It isn't pleasant to think about, but laws and regulations are meaningless if they aren't based on actual numbers. If I wanted to propose some new feature at work, people would understandably want to see some numbers and not just “feels nice” lol
The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.
Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.