bad416f1f5a2

I think you're both wrong :-)

GP is wrong because Magnus won this tournament – but he did lose to Pragg three times along the way. But I don't think you can say you are "losing well" when you congratulate the silver medalist while holding gold.

You're wrong because, what flex? Pragg is 17 and Alireza Firouzja (the third place finisher) is 19. His comment reads more as a hat tip to two young rising stars than anything else.

> The article is interesting and the solution great but saying it is safer because Rust is misleading.

Using Rust (without unsafe) precludes memory management bugs being turned into exploits. That closes an entire category of attack.

Sure, “safety” can be defined along different axes, but Rust handles one entirely. How does that not make it safer than using a memory unsafe language?

Environment variables are an easy first pass at ensuring a script at rest isn’t dangerous.

> A non-productive worker is probably worse than no worker at all.

There's no "probably" to it. Offering a fired employee the right to stay around until their time is up is a mindbogglingly stupid idea. It's a recipe for massive negativity from them & for your existing teams.

Having participated in a RIF before, the two most common questions are 1) "why me?" and 2) "why my friend and not someone else?" Keeping someone who you've clearly said has no future around & asking them to contribute to the future of a company is ... what?

Do you really think you'll get quality work from someone who knows the clock is ticking & they'll be out in 12 weeks? From someone who is going to be busy looking for their next move?

And that's ignoring the chance that one of your employees isn't too happy at losing their job and decides to make your company a bit uglier in the process.

This analogy is likely based on a pair of complimentary theories in criminology. The first is that criminals commit crimes in an area they know, so their activity is distributed close to home. The second theory essentially says “yeah, but not /too close/“ - and that criminals will leave a buffer zone around their home.

So, plot a torus with the center on the offenders home, and most crimes will occur on the disk. This would also work with the pattern a radial lawn sprinkler would make.

Unfortunately, while neat theories, the reproduction crisis is happening in criminology as well and I can’t find a good systemic review that says either theory is particularly good. But criminologists believe them, so the show isn’t that far off in those regards.

It’s this: western standards of living are fueled by armies of child laborers picking our cacao, coltan mined and smuggled out of conflict zones, abused sweatshop workers sewing our clothes, and barrels and barrels of oil to move the machines forward.

I doubt many of us will give that up voluntarily. Most people don’t want to walk away from Omelas.

I think my step zero would be to pause and ask myself how I got myself in a situation like this.

Go to any gym with a focus on weightlifting (ie: not a Planet Fitness). Lift weights. Strike up a conversation with other people who lift weights.

Soon a new world of injections and supplements will be yours if you want it.

I did phone support for a dial-up ISP 20 years ago. I can still remember their IP for www., as well as ns1. and ns2.

And I’ll probably take the root password to their RADIUS server to my grave.

> I'm also kind of curious what you mean by "parasocial" outside of the context of media.

I actually went back and forth on using it - even considering a hedge with a "quasi-" prefix. But it felt apt: plenty of my past "work friends" exist as little beyond a persona that I interact with via LinkedIn. I give a thumbs-up for their job change, we exchange polite offers to get a coffee that we both know neither will accept, and we go on.

Funny, I have always seen “work as community” to offer an illusory connection at best. At its worst it is exploited by employers.

My coworkers are my colleagues. I don’t mind sharing a beer with them once in a while, but apart from “work” we have different interests, values, and experiences. That doesn’t lead to community, it leads to having acquaintances. And if you doubt that, ask yourself how many of your “work friends” from a job you’ve had more than a year ago do you still interact with?

The pandemic has been a joy for me because it’s let me separate my parasocial interactions from my true friends.

I would be very interested to see how this analysis controls for human factors: plenty of generals in the US civil war were, with the evidence of historical analysis, incompetent (think: Buell) or borderline sympathetic to the enemy (McClellan)

Might “I’d’ve attacked had I heard them!” be a convenient after the fact rationalization?

Oh man, this is been my exact experience. You can pretty much chart the growth of a company by watching how much marketing is done with in house teams and how much goes to external agencies.

And as soon as the external agencies are involved, they want as much control as possible. I don’t blame them: setting up DNS entries for some stupid marketing site rarely rises to anyones priorities. So they route around internal controls. Everyone is happier, and everything gets slightly worse.

An acquaintance of mine is a US Attorney. We got talking “crime and criminals” once and his comment stuck with me: essentially, all criminals have two full-time jobs. First, you have to advance your criminal enterprise. But second you have to not get caught. And just like your typical salaryman, criminals have off days, get lazy and phone it in, or get cocky and think they’re pulling one over on the boss. And all the while he has dozens of highly paid investigators with one job: to catch people slipping.

Most importantly, while the criminal has to be perfect all the time, his investigators just have to be right just once.

I’ve heard the idea of “competing jurisdictions” advanced here: run your own Wireguard VM in China or Russia and route traffic through that box, with the goal of essentially introducing unfriendly international borders in your traffic. Ideally your Russian VM provider would be uninterested in responding to an American subpoena.

The other concept I’ve heard put out is to add layers - your traffic hits Vultr, then Hetzner, then etc etc. Conceivably if you cross enough jurisdictions you can make it very difficult for a legal adversary to attack your traffic.

Would I bet on this for activities I needed to remain exceptionally private? No - but if I needed relatively consistently low latency traffic and a decent baseline of privacy it might just work.

I recognized his name from providing hosting for the outages.org list[0] – if you haven't subscribed, and you do anything operations at all, go hit the button now.

[0]: https://puck.nether.net/mailman/listinfo/outages

Morally speaking? Yeah, you should probably not use those banks if you care about the ramifications of money laundering.

Practically speaking? HSBC laundered $881 million in 2012 – but they had trillions of dollars of assets under custody. They may have to pay a big fine, but your ability to get at your money will not be impacted.

And even if you deposited your money into your account at "Money Laundering Bank N.A." where everyone but you was a specially designated national, you still have legal recourse to those funds backed by decades of case law. That same case law might help you if you keep money from a mixer in stablecoin that becomes frozen, but it's going to get way hairier.

"I'm the compliance officer for a crypto mixer" sounds like a job you do in purgatory.

> now they are being punished by the US.

The US didn't mandate deletion of their Github account. The US isn't punishing them – you can tell because they didn't put them explicitly on the SDN list.

Microsoft made the choice to remove their accounts. Their compliance team likely looked and said "$ we make from these devs < $$$ we'd pay to our lawyers to simply decide if we should keep them on our platform."

> Probably not to GitHub or the courts. If in a few years it is discovered that GitHub missed something they can tell the courts "We did our best to comply, look at all the accounts we killed [and other evidence], so go easy on us for an honest mistake." In general the courts look kindly on someone who tried their best to obey the spirit of the law but missing one hidden detail.

This matters a great deal when it comes to OFAC sanctions. The value of sanctions isn't "OFAC chasing down people on the SDN list", it comes from companies following federal law and blocking transactions that legally need to be blocked. And OFAC recognizes this – just look at their enforcement actions[0] and you can see examples where companies that build internal compliance programs and self-disclose violations come out with limited to no penalty[1], whereas companies that skirt compliance regimes place themselves at much more risk[2].

[0]: https://home.treasury.gov/policy-issues/financial-sanctions/...

[1]: https://home.treasury.gov/system/files/126/20220721_midfirst...

[2]: https://home.treasury.gov/system/files/126/20201020_berkshir...

> Imagine if, say, A foreign electronics company is sanctioned by the government - does this mean that anyone who has previously worked with them or bought their electronics has done so illegally? If so, that sounds like a significant impediment to commerce, since nobody can predict who will be sanctioned in the future.

That's not what's happening here. What you're seeing is a US company evaluating its ongoing business relationships, and making the decision that continuing to associate with principals of a designated company isn't worth any potential legal risk.

> US federal law, of which Microsoft must follow as a US company.

One interesting and under-appreciated fact about OFAC: they take an, ahem, expansive view of where US law applies.

CSE TransTel was a company based in Singapore who was sanctioned in 2017[0]. They had a bank account with a Singapore bank. TransTel did business with Iran, in violation of US sanctions. But neither the company nor the bank were in the US; how did OFAC make that fly?

Because TransTel did transactions with a US dollar account, OFAC argued the settlements of that account caused banks inside the US to incidentally violate sanctions. Essentially the presence of US dollars created a nexus and allowed OFAC to enforce US sanctions against what would appear to be an entirely foreign entity.

Any wonder MS is treading lightly?

[0]: https://home.treasury.gov/system/files/126/20170727_transtel...

It’s a gray area. These sanctions went against Tornado Cash, the entity. Does that extend to core devs? Anyone who did a PR? That’s the question GH’s counsel has to interpret.

> deletion of accounts seems more like a CYA move than a strict obligation.

Microsoft is prohibited from giving any good or service to a blocked entity. It’s very possible their lawyers will say “the easiest way to meet this obligation is to delete accounts related to the blocked entity.”

The legal system is CYA, after all.

That license binds people who use the code you wrote & protects you from their legal claims. OFAC isn’t using your code. No open source license is going to protect you from US sanctions.

From the Twitter thread it appears that the devs whose accounts were nuked were core contributors to a sanctioned entity. That feels fairly sensible & what a company who wants to comply with sanctions would do.

Because others are answering you in much more detail, I’ll give them more generalized answer –

This is quite simply not how a sanctions regime works. The US government does not make a list of all the sanctioned persons’ assets, then start going after those in court.

Instead, it goes the other way: any company with a US nexus watches those sanction lists carefully. When someone is listed they look at their internal records for hits and denies them service. So no one told Microsoft anything; they self-enforced a sanction that applies to everyone in the US. And I mean everyone: if an individual knowingly violates these sanctions they’re breaking federal law - it’s not just companies.

Dad’s hate “Chinese crap tools?” Say it ain’t so!

The average person that says “I need a chainsaw” will likely be well served by renting one from a home store, or buying a cheap one from Harbor Freight. They’ll probably use it a dozen times at most.

Is your cheap chainsaw going to hold up as well as the Husqvarna my dad has been using since the late 80s? Absolutely not. Do you live on a 70 acre orchard? No, so a consumer grade tool will do.

Drafting “right to repair” legislation strikes me as tricky, but this feels like a perfect example of what it should be pushing.

Consumables like this should be standardized; if they aren’t, they should be manufactured for a guaranteed minimum period of time by their manufacturer. Maintenance should be something I can do myself, or I can take it to an independent servicer or a dealer.

Statistically speaking, police work is safer than logging, farming, roofing, garbage collecting, and tons of other jobs out there. It’s riskier than my job, sure, but not nearly as risky as many think.

In reality, “death is around every corner” is an intentional training method pushed by the police themselves. Evidence-based training would likely go a long way to making police public servants again, and improve community relations a great deal.

I see your article mentions this, but I love to highlight this one story:

Strategic air command opposed the installation of these locks. Their stated concern was they would interfere with a launch order, but some think they just resented civilian control.

So they allegedly worked around them. For years, the passcode keeping nuclear war at bay was 00000000

https://web.archive.org/web/20120511191600/http://www.cdi.or...