Author: Naveen

A simple loophole discovered by Alex Birsan and Justin Gardner

Last year, security researcher Alex Birsan came across an idea when working with another researcher Justin Gardner.

Gardner had shared with Birsan a manifest file, package.json, from an npm package used internally by PayPal.

Birsan noticed some of the manifest file packages were not present on the public npm repository but were instead PayPal’s privately created npm packages, used and stored internally by the company.

On seeing this, the researcher wondered, should a package by the same name exist in the public npm repository, in addition to a private NodeJS repository, which one would get priority?

To test this hypothesis, Birsan began hunting for names of private internal packages that he could find in manifest files on GitHub repositories or in CDNs of prominent companies but did not exist in a public open-source repository.

The researcher then started creating counterfeit projects using the same names on open-source repositories such as npm, PyPI, and RubyGems.

Every package published by Birsan was done so under his real account and clearly had a disclaimer in place, stating “This package is meant for security research purposes and does not contain any useful code.”

Researcher hacks over 35 tech firms in novel supply chain attack

Now here’s the kicker

Birsan soon realized, should a dependency package used by an application exist in both a public open-source repository and your private build, the public package would get priority and be pulled instead — without needing any action from the developer.

Researcher hacks over 35 tech firms in novel supply chain attack

Yikes!

The english version of “Shaadi ka laddoo jo na khaaye woh pachtaye, jo khaaye woh bhi pachtaaye“

If you marry, you will regret it; if you do not marry, you will also regret it; if you marry or if you do not marry, you will regret both; whether you marry or you do not marry, you will regret both. Laugh at the world’s follies, you will regret it; weep over them, you will also regret it; if you laugh at the world’s follies or if you weep over them, you will regret both; whether you laugh at the world’s follies or you weep over them, you will regret both. Believe a girl, you will regret it; if you do not believe her, you will also regret it; if you believe a girl or you do not believe her, you will regret both; whether you believe a girl or you do not believe her, you will regret both. If you hang yourself, you will regret it; if you do not hang yourself, you will regret it; if you hang yourself or you do not hang yourself, you will regret both; whether you hang yourself or you do not hang yourself, you will regret both. This, gentlemen, is the sum of all practical wisdom.

Either/Or: Kierkegaard on Transcending the Tyranny of Binary Choice and Double Regret

I recently watched the episode ‘Diamonds Aren’t Forever’ of Bad Billionaires: India on Netflix. This statement from James Crabtree stood out for me.

There’s a very clear double standard in the way that we view corruption in the world. People look at countries like India and say, “these countries are corrupt”, but, actually, much of the worst corruption would not be possible without seemingly respectable international finance. Somebody like Nirav Modi needed international banks in order to funnel his money abroad. He needed international lawyers. He needed tax havens in order to host his shell companies. And so, the corruption, the grand corruption you see in countries like India works hand in glove with a different and much more anonymous form of corruption, which is entirely created in rich countries like Britain or Switzerland and America.

It’s also a history lesson. The first four years of your life. Do you remember them? What’s your earliest memory? It is fascinating watching your child claw their way up the developmental ladder from baby to toddler to child. All this stuff we take for granted, but your baby will painstakingly work their way through trial and error: eating, moving, walking, talking. Arms and legs, how the hell do they work? Turns out, we human beings are kind of amazing animals. There’s no better way to understand just how amazing humans are than the front row seat a child gives you to observe it all unfold from scratch each and every day, from literal square zero. Children give the first four years of your life back to you.

On Parenthood

A wonderful article for all the new parents and the ones who are on the fence about becoming a parent.

As we sit here over six months after the initial lockdown provoked by COVID-19, the United States has moved out of a brief period of national unity into distressingly predictable and bitter partisan division. The return to this state of affairs has been fuelled by a cognitive trait that divides us and that our culture serves to magnify. Certainly many commentators have ascribed some part of the divide to what they term our “post-truth” society, but this is not an apt description of the particular defect that has played a central role in our divided society. The cause of our division is not that people deny the existence of truth. It is that people are selective in displaying their post-truth tendencies.

What our society is really suffering from is myside bias: People evaluate evidence, generate evidence, and test hypotheses in a manner biased toward their own prior beliefs, opinions, and attitudes. That we are facing a myside bias problem and not a calamitous societal abandonment of the concept of truth is perhaps good news in one sense, because the phenomenon of myside bias has been extensively studied in cognitive science. The bad news, however, is that what we know is not necessarily encouraging.

The Bias that Divides Us

A fascinating article by Keith E. Stanovich on what myside bias is. Highly relevant in these divided times and may help in understanding other person’s perspective. A bit more succinct explanation later in the article.

…people evaluate the same virtuous act more favourably if committed by a member of their own group and evaluate a negative act less unfavourably if committed by a member of their own group; they evaluate an identical experiment more favourably if the results support their prior beliefs than if the results contradict their prior beliefs; and when searching for information, people select information sources that are likely to support their own position. Even the interpretation of a purely numerical display of outcome data is tipped in the direction of the subject’s prior belief. Likewise, judgments of logical validity are skewed by people’s prior beliefs.

The Bias that Divides Us

That’s it. That’s what I learned today.

Parachute is an iconic brand. And it’s safe to say most people have heard about Parachute coconut oil. But the interesting bit is that the product oil isn’t sold or marketed as hair oil. Instead, Marico classifies them as edible oil. The reason is quite simple. Edible oil carries a low tax rate. Cosmetic hair oil is taxed at a higher rate.

When Sachin wasn’t a cricketer (Don’t get misled by heading of the article)

I did a double take when I read this and had to rush to see my Parachute hair oil bottle to confirm this.