X-Istence

Yes.

https://docs.projectcalico.org/v3.2/usage/configuration/ip-i...

This is used when there is source/dest filtering happening on the network (such as in certain cloud providers where you can't send packets from 10.0.0.1/32 to 192.168.1.2/32 because 10.0.0.1/32 is not valid, so you pack it into another IP packet that makes the source seem like 192.168.1.3/32).

NOAA scans the earth like a big scanner and sends the data down for anyone to pick up and get an image of the globe. It's not encrypted.

There is no requirement for all of them to be under the same domain. It's not made clear in the article, but the documentation shows how you can run all of them under different domains too.

sso-auth allows you to authenticate against Google once, and then any other requests that come to it can be redirect back to the calling application without first hitting Google.

If you registered each new app directly with Google, every time the user visited a new app, they would be redirect to Google to provide permission to the app to log them in, and then be redirected back.

This is described in: https://tech.buzzfeed.com/unleashing-the-a6a1a5da39d6

Absolutely, but the original commenter was stating that it would allow either endpoint to their their IP easily (and thus making load balancing easier). I was disputing that.

My firewall doesn't do NAT yet is still stateful for IPv6.

Also, most firewalls on end-point devices (think built-in to the OS) are stateful firewalls.

Client changing their IP address is fine, the comment I was replying to was stating that it would allow both sides to change their IP at will (and allow for better load balancing). I was disputing that.

Not unless you want to get through firewalls seamlessly. UDP "state" tracking is a thing, and if my firewall sees a UDP packet destined for it without knowing the remote IP address it's going to drop it.

> What you're saying that if an attacker is willing to physically dismantle the machine, he can then, using SPI-flasher HW, replace the UEFI firmware on the machine with a custom UEFI firmware which does not enforce secure-boot...

Yeah, that's kind of the classic evil maid attack, and it is not unheard of for various spy agencies to dismantle devices to gain access or install bugs.

> If that's the kind of attacker you are trying to protect against

That is exactly what the T2 chip is designed to protect against, and more.

The T2 chip also runs all of the encryption/decryption for the integrated storage, this way all data on the flash is encrypted at all times.

I can imagine that the T2 chip over time will be able to do much more to help provide extra verification and security to the device and help keep users safe.

> And if we're going down that lane: what prevents an attacker this sophisticated from doing the same with the T2-chip's firmware?

Because the firmware on the T2 chip is signed and the way the chip is designed the only way to get firmware on it is to decap it because it is stored internal to the chip itself.

With your stock standard x86 motherboard that is not the case because the firmware is loaded from an unencrypted and unverified flash chip.

> What Apple offers with the T2 chip, for most people, has almost zero value

We'll have to agree to disagree, because the T2 chip also does full line-rate encryption/decryption of the storage with no OS involvement at all. This means if your laptop falls in the wrong hands, now people can't get at the data even by reading directly from the flash chips.

----

You are the one that claimed that the article was fanboy-fluff, I just described a feature that no other machine has... and you immediately consider it a money-grab rather than something to laud Apple for. Yet SecureBoot is good enough? Why not keep improving upon the status quo? Why not make it easier for people to keep their data private and secure?

It's all about defense in depth, and Apple added one more depth to their platform.

Let's not attribute to malice what can easily be attributed to incompetence.

> Basically Secure Boot is not a full security solution

Which is what the Apple T2 chip is... which is why it is being lauded as such.

You are missing the bigger picture in your attempt to immediately discard the original articles premise because you feel like it comes off as fanboy-fluff.

No other device on the market currently provides a secondary processor that runs full validation of the UEFI firmware before allowing the processor to start booting.

It's not just secure boot, which has been around for a while, it's everything around it.

On almost all other devices you could write new data to a flash chip and that now becomes the UEFI boot loader that is used (and can bypass secure boot). There is no verification of the UEFI boatloader that is possible because it's sitting in NVRAM or Flash... and you can't trust it to self-verify because it may have been tampered with.

Bootcamp will also install Microsoft's root for UEFI so that Windows 10 can run fully secure.

Whenever you feed your sourdough starter, or add locally bought flour, or anything along those lines you are introducing locally available microbes.

A sourdough starter from SF won't be a SF sourdough for long just because of the microbes in the air/flour as you continue to feed it.

It becomes it's own living and breathing organism that you have to take care of or it dies.

Why?

Mix flour and water, let it sit for 5 days, adding a little bit of flour and water daily to feed it.

You don't need to purchase a starter.

This is where the Client Subnet edns extensions come in handy. This allows the DNS provider to pass along the /24 the users IP address is in.

With an extra caching key, this can even be cached.

See https://developers.google.com/speed/public-dns/docs/ecs

I really wish Apple to stick an A-series chip in a MacBook Pro with an Intel co-processor.

Best of both worlds.

Don't need x86? Don't spin up the Intel chip, doing something that requires x86, spin it on up.

This way you get software compatibility with the power sipping of the ARM CPU.

Completely agreed, just setting expectations for those that think this will adequately come and replace their current MacBook Air or something along those lines.

It is slow. Browsing the web is almost annoying because JavaScript is such a big part of it these days.

The keyboard isn't the greatest, and the touchpad is really bad, and support for something other than the OS it came with is still non-existent, although that is getting somewhat better.

But it is a fully functional laptop, it works, and lasts quite some time on battery and I have been mainly using it to SSH to various servers/devices and doing work from the terminal and for that it is quite adequate.

It's fun to play with, but I wouldn't consider a serious device, not yet at least.

The amount of work that was done at the last two ISP's I worked due to being out of RFC1918 space and thus needing to do overlay networks, and all kinds of fun translating and gateways and overall making a HUGE mess of everything...

Because while there is a 10/8, once you start subnetting that and advertising it from multiple sites and start running labs that look and act like production that /8 goes quick.

Give me IPv6 any day.

Except that in many cases the BMC does not exposed to the internet, especially in situations where you get a dedicated server from somewhere and they want to give you low-level access to make changes to the server you are renting.

I know of at least 2 places where this is still the case (that or a remote IP KVM...).

The BMC should be on a trusted network, but most likely isn't.

Sure... but "Slack buys Astro" means absolutely nothing to me. What does Astro do? How will this affect how I use Slack? What new features am I likely to get as a Slack user?

I just went to Astro's site to see what they do and why this makes a difference for me... but all I can see is their acquisition announcement and I am not any closer to understanding what it is they do for Email :/

Riders ride on the sidewalk because it's far more dangerous to ride on the street... cars are already not paying attention to bicyclists/motor cycles, are we to expect them to pay attention to scooters?

Upgrading to Safari 12 fixed it for me too. Not sure why it was broken on Safari 11.

SameSite is supported by many more browsers than just Chrome these days:

https://caniuse.com/#search=SameSite

I am familiar with shortcuts, but I didn't think that there was an actual SSH action that was shipped with it, I thought there was an SSH action that an application may be providing.

I'll have to check it out.

Every year there are tens of changes to various time zones/calculations/all that fun stuff that get compiled into the tz updates that your OS vendor will ship and install.

This is nothing new.

Which app is providing the SSH action?

My Subaru WRX would beg to differ... 60 Mph in second gear, then shift to 6th to do highway traffic, just fine.