Stefan-H

What part of that do you interpret as trusting the client?

I'm not sure what you're trying to say here. You are essentially saying that if you decrease the amount you read but increase the quality of what you are reading, the quality of what you are reading will likely go up. That is bordering on a tautology. In the situation you describe you happen to be able to consume less news but increase the quality. That is not the same as the increase in quality being a result of a decrease in news. You seem to be confusing correlation and causation.

If there is an increase in the quality of news consumed it is not the result of the quantity of news consumed decreasing. It would have to be the result of the consumers seeking alternate sources, or some other factor.

In fairness, there is no ethical consumption under capitalism. If you take that to its logical conclusion, then there is no ethical software development that supports capitalist endeavors.

"Okay, you can have a hypothesis, you have to have some evidence against or for that."

I view atheism as the null hypothesis, for which you don't need any evidence. It is the de-facto stance for when there is no evidence to suggest another hypothesis.

edit: "And so an agnostic would say, look, I have no evidence for God or any kind of god (What god, first of all? The Maori gods, or the Jewish or Christian or Muslim God? Which god is that?) But on the other hand, an agnostic would acknowledge no right to make a final statement about something he or she doesn’t know about."

Is this person also agnostic when it comes to Russell's teapot? I'm pretty sure that they would make the statement that there is not in fact a teapot circling the earth, just like there is not a god in heaven. His argument about the agnostic person not being able to make a final decision is a slide into solipsism.

I find the reporting of this as a "data leak", as opposed to a more aggressive term, rather concerning.

"UpGuard in its data estimated that up to 14 million customer records were exposed, but Verizon stated that data on 6 million of its users was affected."

I don't see how this would be considered a "leak" rather than a "breach". Are we starting to become desensitized to these security issues, leading to the reporting on them similarly weakening? Is the downplay of language a form of shielding the companies responsible from backlash?

Whoops, need this as well https://aws.amazon.com/fargate/

https://aws.amazon.com/ecs/ They don't tend to miss an opportunity.

"Not anything you will find in a dictionary" is a terrible bar to base something off of: https://www.merriam-webster.com/dictionary/faith Definition 2b. http://www.dictionary.com/browse/faith definition 2.

Using faith and belief interchangeably seems disingenuous and ignores the religious context that is part of faith. Faith implies a lack of compromise, a concreteness, and unwillingness to change. Using that term to describe evidence based science, and the belief that evidence ought to be presented before a belief is held is an attempt to reduce science to dogma.

So belief without evidence. Do you see how it is non-sensical to then say "misplaced faith in evidence"?

Can you elaborate on what you mean? What definition of "faith" do you think is meant here?

I disagree with that as an example of a "misplaced faith in evidence". That is coming to the wrong conclusion due to committing a false cause logical fallacy. Drawing the wrong conclusion should not be confused with a "misplaced faith in evidence". It seems that the religious really want to use the term faith in regards to science so as to imply that scientists "stoop to their level". That argument is seemingly often made that scientists have a blind faith in science. Certainly it happens that a scientist will hold onto beliefs against evidence, will doctor evidence to confirm their belief, and will cherry pick data to prove their belief that they hold despite evidence. But those are all actions that are antithetical to the scientific process. while and endemic to religion.

My point was not that you can't have misplaced faith. But rather can you have misplaced faith in the notion of evidenced based conclusions. If your conclusions are based on evidence, then it isn't faith. It may still be wrong, but it isn't faith.

Can one have a misplaced faith in evidence? Once there is evidence for something, it is not merely faith - faith is conviction without evidence. The whole point of the scientific process is to re-evaluate conclusions when new evidence is presented. I suppose historians may look back and find that some of our scientific beliefs were held in spite of evidence to the contrary, or that evidence was not sought out to disprove those beliefs, but I do not see how a full discrediting of data and statistics would one day happen.

A metaphor for you: If an individual finds that a door is unlocked, they should feel the right to search the whole house and catalog all the person's belongings?

I fully agree that there should be zero disincentives to RESPONSIBLE disclosure. Fully copying down a database, for example, to prove that there is weak authentication would not be responsible disclosure and opens the data to significantly more risk than the vulnerability alone did.

Assuming the poster is telling the truth, and they only accessed a couple other download IDs to prove their point, then they will likely be ok. But if the poster instead wrote a quick script to wget incrementally to see how high they could go, then they have gone beyond simply verifying the vulnerability.

I recall a similar case where the person who found a vulnerability in a banking site was shocked that legal recourse was threatened. They were later shown to have enumerated all possible account details.

I think that what would generally be construed as "car culture" would be "how they're used and how the automobile infrastructure (roads/highways/etc.) is constructed".

At first I thought this was likely to trigger the Streisand effect - but after looking through the document, if the bug exists in a separately installed application that cannot be used without registering, the statements by Ars Technica look to be quite misleading.

edit: To elaborate - the article seems quite sensationalist and attempted to imply that Win 10 by default "forces" an app on users that if used would expose their credentials. The users of the app are indeed at risk if they use the vulnerable plugin, however the article seems to imply a much more direct relationship with Keeper putting all Win 10 users at risk. This comes down to either bad journalism (not understanding the issue) or sensationalist journalism (trying to make the story seem bigger than it is). Either way I can defintiely see that this would cause harm to Keeper, and Ars continued to present the issue in a way that dramatized the risks, despite being presented with the facts.

Reinvent causes this to happen every year. And to be frank, AWS announcements generally have major impact on the internet as a whole, especially on how people do business on it. So, it's deserved, i would say.

Full disclosure: former AWS Employee

"Can you show that the existence of a skeleton key introduces risk beyond losing the key?" The fact that losing the key is a possibility is risk enough. Once PFS is implemented, the only way (barring crypto attacks) you can break an TLS session secured with it is to have compromised the systems at the time of the communication. A skeleton key now means that there is a possibility of offline decryption with just having a copy of the communication and the skeleton key. This key is handled by humans now, instead of machines and a protocol. That is far more than double the attack surface area.

Drive by downloads are very much an issue regardless of NATing. Taking advantage of browser exploits or bugs to download and execute arbitrary code/executables. note: this is common in compromised or malicious ad networks, so just safe browsing habits are not necessarily enough.

Serious science fiction does not need to be bereft of comedy. Satirical science fiction, like many of the works of Vonnegut, are hilarious and ludicrous, but no less science fiction for that fact.

2 rebuttals listed from Schneier's post mentioned in the article linked here are worth a read. https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... and https://www.lawfareblog.com/thoughts-encryption-and-going-da...

Neither are from security professionals, and both really downplay the risks associated with <insert 3 letter agency> having escrow of keys. The number of leaks and breaches across the various government orgs shows that it is near impossible to maintain the security of keys held in escrow.

And Google and Go-Daddy have a right to deny service to anyone they like. The constitution only protects individuals from the government infringing on their right to free speech.

Authenticated scanners that use key auth like Qualys' security appliances could have private keys that are valid across the organization, and if using an affected client version, could leak this information to a malicious system on your network.

Hardly - if you are not using HTTPS in the first place then sending the hash across the wire instead of the password are the least of your worries.

Using a JS lib would not mitigate any risk here unless the compromising of the server that hosts the JS is separate from the compromsing of your web server.

A malicious server doesn't need malicious javascript to do it, it already receives the password in the plain, but that is what is trying to be mitigated in these efforts.

As the page points at, the malicious website does not recieve a hash of the password, but rather a public key derivied from the password: "The worst attack a malicious server can mount is an expensive brute force attack, attempting to overpower the rate-limiting function and eventually guess a password that recreates the exposed public key." That is a very different attack to try to pull off.

If you read the mechanism, you'll see that this involves more than a site faking the UI - it requires browser integration. This mechanism does not protect a single site, but rather the ability to pivot from one site to another with the same password or key. You also breeze over "can fake any public information" - I have no idea what you are trying to say by the ability to fake public keys - that is not really a thing. HTTPS rides on having a trusted intermediary and so even a malicious MITM couldn't simply fake a public key.