616c

You can listen to their own description of their strategy and tactics. It was every different from the contemporary counterpoint. They reformed one system one subsystem at a time by working with the current owners and tech staff and teaching them their approach.

https://changelog.com/gotime/154

I knew contractors in their wake working at companies that grew out of their work in CMS, such as Ad Hoc (a name of the original team to not be called WHITE HOUSE HOT SHOTS or DOGE or something similarly jarring to thereby take agency away from the people who had to you know do the work once they knew they'd roll off) and Nava as they expanded beyond that one system 5 years later.

Let's see how the braggadocios we'll solve all the problems at once flavor of the moment goes, then judge the healthcare.gov teams.

What is this Pitchfork scale? Is it an actual one, searching didn't return any useful results.

Is there evidence for the rationale for five years or less for the age of a car?

I hate all the entertainment systems and believe anything beyond Bluetooth and no complex entertainment system to be a lethal distraction that makes cars just as unsafe as older or weaker safety controls.

Have you tried CBOR/CDDL tooling, nonlogical? What is your opinion of it?

It's amusing you can self identify this way without much hesitation. My personal experience with colleagues and family on both sides of the regional, religious, lijguistic, and cultural debate is that if you talked about being a non-Muslim supporter of political Islamists or up to including Hamas or similar groups, so anywhere in that continuum inclusive, few in Western or Israeli media will hesistate in labelling you in a way common with these talking points: a terrorist.

So good luck to you, but I'm not surprised you'd stay private But my anecdata (or some may call life experience) tell me you'd be fine and fare well where a similarly extreme position on the opposite end of the spectrum would cost you a lot personally and professionally. I wish we all reflected in the West or in tje region or conflict area, well, why is that?

For the record since I inevitably get routinely called an anti-Semite anyway: I think Hamas and groups like them are vile, but many in the region opposing them don't take the high road by comparison either. Im nkt sure if its recent or monitoring that become easier and more economical, but that means their opponents with this crap and other tactics have really screwed up. This HN post further supports my cynicism and disappointment.

This may be the first time I had that "well, that's enough Internet today ..." reactions on HN from a cybersecurity/cyber-physical protection perspective, and not something gross on Reddit.

So, my hat off to you, Internet stranger.

I went in the last few years to Porugal with my partner and it was so beautiful and modern history was so dark and rich and self aware. I loved Lisbon and Porto. I immediately went back to the site of what I call the Museum of Torture in Lisbon which was essentially the old political prison with the worst rep. They did a fantastic job breaking down torture and the collapse of the end of Portuguese colonialism and fascist rule. Now that I think of it maybe one of my top three museum experiences. Do go if you ever have a chance.

https://www.museudoaljube.pt/en/

I for one would like to see you write more about this.

There is always someone on each of N sides of these longstanding conflicts in the region saying "Y is really the problem (because I support X; all who support X know Y is the real problem)."

That foreign powers abuse that to their own advantage worse than even the local factions do is the true stain on humanity. Why support this?

Also CAB Forum has started to require private keys in HSM only for code signing certs.

I traveled some in college to not so tourist friendly places and then worked as an expat in IT and I feel so fortunate for the same takeaways I am bitter and cynical as an American but defend the other at home and abroad because it made me keenly aware of our shared perspective It always makes me often wallow in guilt it took a privileged family to kick that off and let me learn it far away and not build up such empathy at home.

When I read shared experiences like ours on the Internet it reminds me of what I think is the one true value of this tool for humanity I wish it was used for that the majority of the time by most people but oh well!

This is truly inspiring, thanks for sharing your experiences.

Point made, I meant this take threw me for a curve (not that it this too was spicy), re your point 3. I didn't make that clear. I just know your other takes so I was being cute about it. I don't know you that well so 1-4 are valid, and I am famously not a Mac user in my personal life. I know I am full of anecdata and that shit doesn't matter, but I appreciate the detailed follow up to confirm: 616c, your choices are great but not so empirical, here is what I think.

You've been known for your hot takes past and present, but this one threw me for a curve.

Is there empirical data on this? I think many in the security industry believe this. I ironically use FF if we can accept personal beliefs since I believe people attack the Chrome sandbox as a badge of honor and I can use containers to isolate state to different personas. That said also anecdata bullshit take on my part.

Would love to see such a resource, would a static site for a leaderboard be enough to maintain a top 10 list, even for drama and protest?

> I think this bug is probably a contender for the top 3 practical cryptography vulnerabilities on the Internet. Its close cousin, Vaudenay's CBC padding oracle, is a lock for #1. Then it's just down to whether nonce reuse is #2 or #3.

Is this top 3 list from some public resource that exists and I am a noob who missed the reference and how the community knows what the Top 3 are? If not a resource would love to see it or help make it.

P.S. Been loving SCW podcast from time to time when I can list, keep up the good work!

Sounds like you're doing Gods work for mere mortals. How can we support that work?

They become a very high value target though and I have learned "security software" devs are as fallible as all devs, sometimes more.

Thycotic had some vulnerability with a symmetric recovery key a few years ago. But comprehensive product like this or roll your own this is frequent so I'd rather do keys and certs like others suppose

As I learned from the a blackboard when doing my study abroad year for Arabic that engrained my respect for teachers, formal or informal: من يعلمني حرفا فصرت له عبدا. Read your bio and thanks for the book, looks interesting Will download and read when I can.

Very exciting I shall as I was a fan of your prior project!

Perhaps you should read about what Haganah did to the British before the establishment of Israel in 1948.

Perhaps having lived close to Saudi Arabia, your comment is asinine and reflects a true a true misunderstanding of the region and the US government and other Western powers influence within it, past and present.

I lived there six plus years, why don't you go there and report back what you learned?

This is akin to speaking lazily about hardware and software engineering lazily on this site contradicting many available resourced and not expecting to be called out. It is expected though by me here and elsewhere. Studying languages and regional politics is just as much a speciality as computer science, but many in the US write it off, especially for Arab studies. It's why I pivoted from that expertise into IT and security since people with that expertise especially are not in government influencing or implementing sound policy based on that discipline. So this year's news has not been a surprise to me or my colleagues at all.

I wish RCS could somehow be merged with IETF MLS specs but I know that is apples and oranges and not so possible.

The RCS proprietary encryption bit is very sad. Oh well.

Re Merkle trees, that is what emerging IETF specific citations in the SCITT working group are about.

https://scitt.io/

Have you been following the emerging RATS and SCITT specifications in IETF? Someone with your work and knowledge could be a great contributor.

Any lawyer or cyber insurance rep can tell you yes it already exists, and it is called cyber insurance. Lol

If you're bursty and only run 1000 invocations every few days or weeks and otherwise you run it 0 or 1 times per increment then you can end up spending a lot less than that estimated server cost with fly.io no?

This context you provide is interesting. Where can I read more in this specific perspective?

As cute as the implication I just read several of the articles and see no specific evidence about the terrorist groups, just the leak. I'll finish the last one but that's a weak association if I've ever seen one.

Please tell me you write your security packages with automated LaTeX templates using Overleaf and make my day!