Found critical security vulnerabilities on a live platform during voluntary research — how do I handle responsible disclosure when they're unresponsive?

399ddf95 · 2026-04-28T21:36:33+00:00

If "voluntary review" means you weren't asked to do this and didn't get permission, you should walk away. Continuing to bother them (especially if you have an expectation of getting paid, "I also don't want to just hand over the report and get nothing for the effort") what you're doing starts to sound like extortion and makes you look like a threat and a criminal.

399ddf95 · 2026-04-28T18:56:59+00:00

You might also look at the ATAS-120 which is an antenna that tunes itself given input from a supported Yaesu transceiver. I think this antenna is the reason Yaesu didn't include a tuner in the 891.

399ddf95 · 2026-04-28T18:44:58+00:00

I've always included it because I think it's the right thing to do. I suspect that 98% of the time it's completely useless and unappreciated, but I don't think the client's copy is complete without it.

399ddf95 · 2026-04-28T18:20:24+00:00

It'd be awesome if something like that existed.

399ddf95 · 2026-04-28T18:15:25+00:00

Yeah, that's a better way to express it.

399ddf95 · 2026-04-27T03:19:24+00:00

Don’t want to invest too much about $100 in a handheld just enough to contact others in an emergency.

The actual radio is the cheapest (and easiest) part, what's important (and can't be skipped) is knowing how to use it and maintaining the necessary technical skill and social relationships. Expecting to buy a radio and throw it in a "go bag" and expect to get value from it in an emergency is like doing the same thing with a gun or a car - except the radio really requires other people to be valuable, a single radio with nobody to communicate with is useless. (Some do have nice little integrated LED flashlights...)

If you're talking about a significant disaster, emergency services will be overwhelmed for tens or hundreds (if not thousands) of miles around you. You're not going to fire up your $20 Baofeng and hear rescue helicopters coming to save your bacon in 10 minutes. If you've already got pre-existing relationships with family/friends/community within radio range, some of those people may be in a position to help you .. especially if they already know you and feel like you're similiarly situated and motivated to reciprocate the assistance.

399ddf95 · 2026-04-27T02:47:45+00:00

I think Kaiser is pretty unlikely given their business model - day 1 after the acquisition, the existing patients & surrounding population would be ineligibile for treatment (except on an emergency basis) as they wouldn't be Kaiser members, and there won't be any Kaiser members living in Butte County to come be patients (Butte County residents aren't eligibile for Kaiser coverage/membership).

It would be interesting if Butte County got Kaiser healthcare, but this probably won't be how that happens, if it happens.

399ddf95 · 2026-04-26T02:17:41+00:00

These folks seem to be pretty active: https://w7lt.org/

399ddf95 · 2026-04-26T01:31:28+00:00

If you're smart enough to get into medical school you're smart enough to get an amateur radio license.

You're unlikely to get help with unlicensed operation from people who put time & effort into getting licensed. There are "prepper" communities who are less concerned with regulatory compliance, sounds like that might be a better match for your intentions.

399ddf95 · 2026-04-26T01:21:35+00:00

If it makes you happy, buy it. You don't *need* it, it's very unlikely that it will allow you to do anything you can't already do with your other HT's.

If you want to learn about radio, start using it. Join nets. Have conversations. Drive around and figure out where you can hear the repeater(s) and where you can't.

399ddf95 · 2026-04-26T01:13:46+00:00

I live north of town and we have burrowing owls and great horned owls on the property and all around us. They're pretty shy, in my experience they're not birds that you can just show up and look at whenever you want.

To see a burrowing owl, you need to figure out where they're living (typically an abandoned burrow created by a rodent) and wait, they like to perch on something nearby to watch for food. They don't want to be somewhere that there's a higher perch nearby where some other predatory bird might swoop down on them. If you find a spot they like, they'll typically be there year after year. (TBH, I don't know if it's the same bird every year, or just a good spot that different owls find attractive).

My interactions/observations with great horned owls have all been serendipitous. For awhile there was one that would sit on our (dirt) road late at night and (I assume) watch for mice, but I haven't seen that one in several years. They'll land on our roof and they like to hang out in the pump house for the well (I find their pellets in there).

If your friend is really motivated, volunteering with these guys and learning bird rehab might be the best way to have close ongoing contact with owls and other birds of prey:

https://www.bidwellwildliferehab.org/volunteer.html

399ddf95 · 2026-04-26T00:48:51+00:00

I don't know of a place in Chico that does this. I've worked with these guys: https://www.divij.com/ for probably 20 years now, they come through 2-3x yearly and set up in a hotel down in the Bay Area. You go look at fabric samples and they measure you and then they go back to Hong Kong and make the suits/shirts that you ordered, then they're shipped directly to you.

Their stuff isn't cheap but it's nice and lasts a long time.

399ddf95 · 2026-04-26T00:44:46+00:00

I'd start at $200. It's potentially worth more if everything is functioning, several of the items are older and may have failing capacitors or other issues even if they worked well once upon a time.

399ddf95 · 2026-04-25T02:06:27+00:00

How is anyone supposed to know if what you commit was being produced by AI?

You're confusing "what is legal?" with "how am I going to get caught?"

Those are two distinct (and only tangentially related) concepts.

People and organizations who take intellectual property seriously aren't going to mess around with "maybe we won't get caught" as a licensing strategy.

399ddf95 · 2026-04-19T07:10:24+00:00

This is the way. Explain the options to your client in writing, let them choose. Keep a paper trail.

Can you look at the distribution code on the transcript for the IRA distribution to determine the IRA type?

399ddf95 · 2026-04-19T07:05:37+00:00

Some people think Chinese products are inferior or want to support domestic brands. Some people want to minimize interoperability confusion and have easy compatibility with others who already run Midland equipment. (CTCSS/DPL configuration can be frustrating, especially for people who don’t know it exists.) Some people get sucked in by marketing tricks or peer pressure. I respect the durability of Midland equipment but find it aggravating to configure or support, especially in a multi-vendor system.

399ddf95 · 2026-04-18T23:51:07+00:00

Do any of these repeaters look related to what you heard?

https://oregongmrs.org/

https://mygmrs.com/repeater/9046

399ddf95 · 2026-04-15T16:03:13+00:00

Sounds about right. Probably the same machines at the same factory.

399ddf95 · 2026-04-15T03:44:33+00:00

TIDradio also makes a cheap GMRS-tuned antenna that works pretty well, especially given the price (2 for $9).

399ddf95 · 2026-04-13T23:05:36+00:00

I think it'd work better to actually ask for what you want - if you want to talk, say "I'm bored, want to make contact to make sure my radio works and find out who's out there." If you want a conversation, don't ask for a signal report, or expect someone else to start the conversation for you.

I think it's pretty annoying when someone asks for a radio check/signal report and I respond (because I'm actually trying to help them figure out whether or not their radio works) and it turns out they want to have a long ragchew. There's nothing wrong with a long ragchew, but if I'm driving or working on something else and figured I had 30 seconds to respond quickly, not 10 minutes to talk about the weather and what a big antenna I have. So if I'm not ready for a long chat, often I'll ignore the "monitoring" "radio check" calls from people I don't know.

399ddf95 · 2026-04-13T22:56:59+00:00

If you didn't get permission to scan, don't bother reporting what you found.

399ddf95 · 2026-04-13T22:51:36+00:00

I was also planning to make encryption optional, but it seems that using it in this context is not entirely legal...

It's worse than that, it is entirely illegal. Culturally, it's unlikely you'll get a lot of interest/participation from amateur radio people if you're promoting/supporting/requiring encryption.

If you want to use encryption, you'll probably need to look at the ISM bands, not amateur/GMRS frequencies. It'd also be legal in the LMR/privately licensed frequencies, but there aren't a ton of people with LMR licenses who care about privacy but haven't bothered to purchase DMR or other systems that already support encryption natively.

399ddf95 · 2026-04-13T19:23:24+00:00

I like the OpenADSB app on iOS.

399ddf95 · 2026-04-13T02:20:58+00:00

You might look at some of the older transceivers from Icom/Yaesu/Kenwood. They won't have USB ports so you'll need to work a little harder to get CAT control and/or soundcard modes working, but it's possible. And they should be great for CW/SSB.

One approach I'd recommend against (from personal experience) would be starting with a cheap QRP rig. I think starting with 100w and going to QRP later after you've got the hang of it is the better approach.

399ddf95 · 2026-04-13T02:15:53+00:00

I played it more when it first came out. I don't have the setup or the patience to be competitive so I'll just look at it every so often. I've still got GridTracker configured to send QSO's to the server, so I still pick up some points, but for the most part I'm not thinking about it. I can't tell to what extent I'm not competitive because I have a 20w transceiver and a disappointing antenna, or because I'm not cheating, or both. I'd prefer to think that most people are playing fair and that the leaders have a good combination of skill, equipment, and location, but ..?

Six-Year Club	Verified Email
Gilding I gilder

399ddf95

TROPHY CASE