It wasn't a 9 year old reported bug that took 9 years to fix. It was a 9 year old undetected bug that took... I'm not sure, it looks like a 1 week from discovery by the Ethereum team to a fixed released by the Go team.
3,401 karma · joined December 8, 2010
Linux sysadmin
http://www.antoncohen.com/
For example are you worried that a real human at your home security company will be invading your privacy? When they do are you worried that real human will take personal action against you? Or are you worried about automated systems building knowledge about your life based on home security data? Or are you worried about your home security data used in aggregate? Maybe you are worried about attackers getting access?
Internal infosec and privacy controls/policies are required to protect you from some of these. Some of these threats may be more likely from Google, but I'd say some of them are more likely from other home security providers (keep in mind that a lot of home security products are actually intended to have another human monitoring your home).
That is why Comcast pushed hard into home security. Is there a significant value to home security companies, or is the whole industry a scam?
[1] https://cloud.google.com/blog/topics/inside-google-cloud/ann...
In the short term I expect that to be problematic. First party packages in the distro's package manager will be fine, but I expect it might be hard to find some third-party software compiled for ARM Linux. And any Docker containers in the Linux VM will need to use multi-arch or ARM Docker images.
It would be much harder make that mistake with Google Cloud Storage, at least in the web console. GCS also supports disabling bucket ACLs permanently at bucket creation time, and that is the option they recommend[1].
AWS does scan and alert for some public bucket issues. But with all the public S3 issues, I think it is clear there needs to be more prominent warnings in the AWS console, the command line, and with tools like Terraform.
That is why he says:
> Before you embark on a piece of enterprise, ask yourself whether it’s really going to be worth the investment, And if an idea doesn’t turn out as envisaged, be prepared to spike it and move on. A week or two spend on source-building, without any story published, is often a much more valuable use of our reporters’ time.
https://opensource.google/docs/thirdparty/licenses/#wtfpl-no...
Unlicense[1] and CC0[2] have better legal wording.
Such a low percentage of people in CA voted for Trump (2nd lowest after Hawaii) that a middle of the pack Democrat will be high in the default sort. The same for senators from Hawaii, who are 4th and 5th with the default sort.
The Bill of Rights (first ten amendments to the constitution) is all about protecting us against abuses of government officials. It presumes people in government could be bad, and we need protecting from them. By allowing a government official to seize all our private conversations it could allow a bad government official to go fishing and find things things that they can use against their enemies. There are many, many laws. Many of them aren't enforced, but could be.
For example in some states adultery is illegal, even a felony in some states. Not just in small states, but in New York, Massachusetts, and Michigan. In Massachusetts there hasn't been an adultery conviction since 1983. But if law enforcement was allowed to decrypt an iPhone, and find private bedroom things, it could be used as an attack on a political enemy.
It isn't only "bad people" that should be worried about the government. I think pretty much everyone agrees Martin Luther King Jr. was a good person. But the government at the time didn't think so. When he was killed the first people on the scene were the police officers who were doing surveillance of him from across the street. That is the kind of government we need to be protected from.
The three political spectrums are:
- Progressive <-> Conservative
- Liberal <-> Fascist (Authoritarian)
- Left-wing <-> Right-wing
Progressive is someone who pushes are for change, major change, and rapid change. Conservative is someone who likes things how they are, wants to make changes slowly and carefully. People can be progressive on some topics (like pushing for civil rights), and conservative on others (like being careful about changing fiscal policy). But lots of people will default to one or the other.
Liberal is to allow, a true liberal would allow things they disagree with. A fascist (authoritarian) forces everyone to be like them, and passes laws to force everyone to do as they believe.
Left-wing and right-wing is less a spectrum and more clustering of ideologies.
Left-wing ideologies generally favor the community as a whole over the individual, and support those with less power or who are less well off. That results in things like pro environment, minority rights, and social welfare. Internationally left-wing could include going to war overseas to protect people from oppression and powerful aggressors.
Right-wing ideologies tend to favor the individual and those in power, more everyone for themselves. This could mean freedom to make individual choices that hurt the environment, pro big business, lack of social services. In the extreme it can be racism against minorities. Internationally it could result in isolationist policies.
I think if people actually understand the terms, and they are well defined, people can thinks about how they as an individual feel. And maybe that can help us break away from the two-party fighting we have now.
I think if people actually analyze there beliefs, they may come to better understand themselves, and people can better understand each other. For example I think some people that call themselves "Progressive Liberals" will find out they they are "Progressive Left-wing Fascist", and some people who call themselves "Conservative" will find that they are "Conservative Left-wing Liberals".
Then in looking for dealers, police go to lower income neighborhoods. If you look for something you will end up finding it, if you don't look you won't find it. This leads to things like pretext traffic stops, where someone is stopped for a minor violation that wouldn't normally get someone stopped. The police can then detect something else, like the smell of drugs or drug paraphernalia in the car, which they use as cause to search the car. In searching the car they find something that can lead to criminal charges.
This leads to lower income people receiving fines for minor traffic violations, and minor drug violations, at a higher rate the higher income people. The same lower income people struggle to pay those fines more, which puts them in a worse place, possibly leading to more desperate crimes.
Policing is punitive, and doesn't help solve underlying problems. Imprisoning and fining poor people doesn't help them or society.
I don't think this is as much of a racial issue as people make it out to be, it just happens that in the US the low income urban housing projects are predominantly non-white. Low income people in rural areas are less likely to be over policed because there are physically less police per squeal mile in rural areas. And with less people in rural areas, things are more likely to go unnoticed.
If you look at somewhere like the UK, where low income urban council estates (housing projects) are often predominantly white, you see the same over policing, profiling, and pretext stops. But instead of profiling young black males in hoodies driving around a lower income neighborhood, they profile young white males in hoodies driving around a lower income neighborhood.
Hey is currently only for individuals, there is no free option, every user must pay.
(I'm not defending Apple taking a cut of subscriptions. Just pointing out a difference.)
Sometimes when states fail to prosecute, or fail to get a conviction, the Feds will prosecute. But the original crime might not be a federal crime, so they prosecute under something else (there are ~3000 federal laws to choose from).
For example, sometimes when police kill citizens, and DAs don't prosecute, the Feds will. But the murder isn't in federal jurisdiction, so they charge them with "color of law"[2][3], which is a federal crime.
[1] https://en.wikipedia.org/wiki/Murder_(United_States_law)#Jur...
[2] https://en.wikipedia.org/wiki/Color_(law)
[4] https://www.justice.gov/crt/deprivation-rights-under-color-l...
For example you can use sops (https://github.com/mozilla/sops) to store encrypted secrets in Git, using AWS/GCP KMS to encrypt/decrypt them (or encrypt/decrypt the encryption key), and have infrastructure automation that gets the secrets from sops and exposes them to applications as environment variables.
I think the Rachel by the Bay blog post does a good job of explaining what event loops are doing under the hood, and how that can lead to bad tail latency for web requests.
According to AWS's documentation, none of the supported dependency resolvers will fetch the new password[1][2][3].
If they were capable of automatically fetching the new password without human intervention, it would mean they have credentials for generating credentials. If this isn't on an EC2 instance (where an IAM role can be used), that means there are long-lived credentials (probably written to disk) used to generate short-lived credentials.
This would be the case if you are using a hosted CI service that doesn't run on your own EC2 instances. You would probably be providing an AWS key and secret, which would then be used to generate the short-lived credentials. But the key and secret won't be short-lived, and will have at least the same access as the short-lived credentials (probably more access).
> Your source code may reference a shared library at a specific version from a trusted source to build. This trusted source is CodeArtifact.
HTTPS is what forms the trust between you and the artifact repository. Short-lived passwords don't do anything to ensure you are talking to the real trusted source. They may make it so the artifact repository can better trust you are who you say you are, but I don't see what they has to do with safely getting a specific version of a library.
[1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co...
[2] https://docs.aws.amazon.com/codeartifact/latest/ug/npm-auth....
[3] https://docs.aws.amazon.com/codeartifact/latest/ug/env-var.h...
It is common for developers to use Git to store source code, in a hosted service like GitHub. It is common to use SSH keys to access Git. Frequently those SSH keys are generated without passphrases. Those are non-expiring credentials stored on disk. If HTTPS is used to access Git, it will likely be with non-expiring credentials.
I'm not saying short lived credential are bad, not at all. I'm pointing out how this service differs from similar services, requiring a change it workflow, which might be annoying to some people. Not everyone is operating under the same threat model.
GCP has a similar offering[2]. And GitHub[3].
[1] https://docs.aws.amazon.com/codeartifact/latest/ug/python-co...
In California it is illegal for a regular non-law enforcement officer to have a gun in public or in the passenger compartment of their vehicle. Open carry, concealed carry, unloaded, doesn't matter, all illegal. Open carry used to be legal in California, but was banned after the Black Panthers used that right to protect black people from police abuses[2].
In the 1960s the National Guard and federal law enforcement were used to protect protesters against the police abuses[3].
Now only the police abusing us are allowed to carry guns, and the National Guard and federal law enforcement are being sent in to help the police abuse us.
I think the police need to give up their guns before the public have any more of their gun rights stripped aware.
[1] https://medium.com/s/story/fearing-for-our-lives-82ad7eb7d75...
[2] https://en.wikipedia.org/wiki/Mulford_Act
[3] https://en.wikipedia.org/wiki/Selma_to_Montgomery_marches
No one is saying stop solving crimes. Minneapolis may disband their police department, and get out of the union contract. But they aren't going to stop solving crimes. The lack of crimes being solved currently is explicitly mentioned as a reason for disbanding current police department, and looking for smarter solutions.
Some examples of why police departments should be dissolved and something new created:
Ever day when I walk to work (pre-COVID) I pass the same two police officers. They walk along the same stretch of sidewalk waking up homeless people. Ever day the walk up the same homeless people, while being armed with firearms and wearing bulletproof vests. They aren't solving a problem. The people they wake up are still homeless the next day. If instead San Francisco had a dedicated homeless department that solved end-to-end problems, they could actually solve problems. They could wake up the homeless people and talk to them, understand the root problems, and work to come up with solutions to the underlying causes of homelessness. While also finding compassionate short term help for them.
Another example is from couple days ago, when the Alameda police arrested a man, throw him to the ground and handcuffing him -- for dancing in the street outside his home[1]. Someone called called the police because they thought he might be drunk or have mental problems. But because it was police that responded, instead of community focused mental health professionals, they arrested him and used excessive force. That is when police do.
This morning I saw and recorded[2] a white women sitting on the ground have two AR-15 style rifles, two handguns, and a shotgun pointed at her. That is routine level excessive force used by cops in America. It is the type of force that escalates to killings when the white women is replaced with a black man.
At the same time the police don't investigate actual crimes. Every year tens of thousand of cars are broken into in San Francisco, and the police do nothing about it.
Here is what I want:
- No armed police officers on the street.
- Dedicated non-police departments to solve common problems, having end-to-end responsibility, with real solutions. Homeless, mental health, whatever is a big enough problem to have a dedicated departments.
- Investigators that investigate and solve crimes that impact people. They don't go looking for crime. They don't carry guns. They don't roam the streets.
- Armed response teams at stations and sub-stations. Like fire departments don't roam the street looking for fires, instead they respond from their stations. Armed police can do the same. They will only response to calls involving firearms or other imminent threats to human life. They will be highly trained, and unlike current police they will not be trained to fear the public[3]. They will be trained to stay calm, deescalate, and not use force unless truly required to save another life.
- Community liaisons. This will be like current police, but they will not be unarmed and maybe not be sworn officers (i.e., maybe not have arrest powers). Their job is to walk around and talk to the community, get to know them, understand their problems, and be a face for the government.
[1] https://abc7news.com/society/exclusive-unarmed-black-man-han...
[2] https://www.youtube.com/watch?v=4NnvPJnRAl0
[3] https://medium.com/s/story/fearing-for-our-lives-82ad7eb7d75...
And the magical accent corrector wouldn't fix bad grammar.