clinta

Food safety is a much more significant risk, yet we seem to be doing fine without requiring licenses for every restaurant cook.

And it sucks to get a bad meal at a restaurant, or poor quality customer service. So we have yelp and google reviews for businesses to try and avoid these situations. We don't need government licensing protect us from every having a bad experience with a business.

Liability should be motivation enough for any business to not let unskilled barbers handle a straight razor.

Not sure if they are, but it could be done by having the device measure the round trip time of the signal, and refusing to answer if it's too long.

Their profitability depends on being able to dedupe and compress data across all customers. They would need to raise prices significantly to make client side encryption a built in feature.

It is 2 weeks old, but that's also the latest tagged release on github, so it's not out of date. I'm not seeing how to actually get KBFS on linux today.

This does not make any sense. Advertisers paying per view do not get charged for a view if crome prevents the user from viewing the page.

The good news here is we now have official admission by google that allowing adsense ads without filtering is dangerous. And those of us who do not have sophisticated techniques that can detect deceptive ads have no choice to but to block the entire network serving them, if we want to be secure.

I was not defending SystemD, I was defending the hardware manufacturers against the accusation that they're "shipping faulty boards".

I think SystemD is in the wrong here. Operating Systems should be protecting users from bricking their hardware.

Harware manufacturers should not be shipping hardware that's nearly impossible to brick, because it results in hardware that is nearly impossible to update.

The protocol only tells your computer which program and protocol should be used to communicate with the server. The server server name itself is the destination. If you tell your ftp client to connect to ftp://www.example.com it's going to try and connect to the IP address returned by an A lookup to www.example.com. It has no way of knowing you actually want the IP returned by an A query to ftp.example.com.

SRV records could clean this all up, but there seems to be stubborn resistance by web browsers against doing srv lookups.

What looks less technical and more user friendly on a business card?

http://hisham.hm or www.hisham.hm

Personally, I think www is. And it's shorter.

Well, I agree that users shouldn't need to type it, but it should still be advertised, especially in print.

www makes it immediately obvious that you're looking at a url, which is especially important with gtlds. A line at the bottom that says dog.spa is meaningless. www.dog.spa fixes that with only 4 characters.

You could print http://dog.spa, but now you've added 7 characters and it looks even more technical, which is stupid if the goal of removing www is to simplify things.

We've been living in a world where you couldn't brick the firmware from the OS for a long time, and it's been terrible. I'm perfectly happy to take the risk of being able to brick a board from the OS if it means I never again have to try boot to a dos disk and run a proprietary exe to update the BIOS.

Some boards do have something of a "factory reset" in the form of dual bios so that if one is bricked, the backup can still be booted. But it's not a bug that not every motherboard has this feature.

Take a look at google's certs. They're only valid for a few months. A system that tracks certificates encourages site operators to share the same cert and key across many servers and to allow it to live for a long time. With the sorry state of certificate revocation this is not ideal.

On the server side it's better for each server to have it's own private key and certificate which is valid for a short period of time and frequently renewed. So the compromise of one server does not compromise certificates on any other servers and the useful lifetime of a compromised key is very limited.

I think DNSSEC and DANE is the best solution. Allow the certificate thumbprints to be published securely in DNS. At least then we reduce the number of trusted authorities to the TLDs and the scope of authority for each one is automatically restricted to it's own TLD.

The ACME protocol is open and as a result there are several alternative clients which do not require root. Here's a few:

https://github.com/diafygi/letsencrypt-nosudo

https://github.com/kuba/simp_le

https://github.com/lukas2511/letsencrypt.sh

Or you can go a more manual approach via https://gethttpsforfree.com/ but you will need to manually renew your certificate every 90 days.

Unless it's using Privacy Extensions in which case it will change it's outbound IP in a matter of hours and once again be lost in the huge address space.

Unfortunately privacy extensions are not enabled by default on most linux distributions and server operating systems.

I've had the same struggle. I'm moving my network to use a vxlan overlay for VMs so I ended up building a vxlan driver for docker networking which lets me do the same thing for containers. That project is here: https://github.com/clinta/docker-vxlan-plugin

Docker seems really intent on NATing containers behind the host, which IMO is not acceptable from a security perspective when I want to firewall outbound access based on a containers role.

Kubernetes is another option which creates a unique IP per container pod on the same network as the host. Not as flexible as a vxlan approach where containers can be micro-segmented into specific networks, but more like BSD jails that you're used to.

Go get does not start with a git clone. If you go get example.org/pkg/foo go fetches https://example.org/pkg/foo?go-get=1. So coordination between go and github could implement something for deprecated repositories without changing anything in git.

More details here: https://golang.org/cmd/go/#hdr-Remote_import_paths

Fortunately GitHub now has competition in the free offerings. It's no longer a question of being good enough. If GitLab is better, and OSS projects start moving to GitLab in large numbers, those OSS developers will start asking their employers to pay for GitLab instead of GitHub when they need the paid offerings.

GitHub not improving the free offerings while competitors do will affect their income.

One concern would be around tools that fetch from github automatically. go get for example would need some sort of structured metadata if it wanted to surface an error to a user that a library is deprecated.

IE uses HTML5. In fact, IE and Edge and Safari are the only browsers that can play HTML5 Netflix videos in 1080p.

https://help.netflix.com/en/node/23742

True, I should have said it can use lxc (which they used to use by default) or their own libcontainer to manage kernel namespaces. And I'm not sure what they're using to manage containers on Windows.

I don't think the biggest complaints about systemd are the consolidation of tools into a core. Nobody complains about coreutils. It's about the consolidation of tools into a few monolithic binaries. And about the piroritization of desktop use cases over server use cases.

Author here.

I'm just now diving into docker. Docker is really about the images. Docker can run on lxc or in kernel namespaces. And there is ongoing work to port Docker to FreeBSD where Docker images will run in jails.

But apparently it took Docker image format and registry to make it popular enough among developers to make contanerization the old new big thing.

That's the point. It's crazy that instead of getting IPv6 working in AWS, Amazon chose to build a NAT gateway service instead.

The forward thinking way to deal with IPv4 shortages would be for Amazon to support IPv6 end to end, and offer IPv4 connectivity via ELB or a NAT64 Gateway so that the non-IPv6 internet can reach your servers.

In my experience, 10 years ago the policy was "Don't use it". It was treated as untrustworthy, despite other encylopedias being acceptable. I haven't been in school in a while so I can't say if attitudes have changed. But I'd hope that modern instructors would consider any encyclopedias to be too generic for citing in research, but acceptable for understanding the basics of a topic.

I've seen parents argue for more homework so that homework would make up a larger percentage of the students grade in an attempt to make up for the fact that their child is a "Bad test taker".

It always bothered me because a grade should reflect the percentage of the material you actually learned. Not be just an accounting of how many hours you spent trying to learn it.

I also love pass. My problem now though is what to recommend to family and friends. I've been evangelizing lastpass to them for a while, but I'm not comfortable telling anyone to trust them anymore.

With 1500 Byte packets at 1Gbps you're pushing 83,333 packets per second. If 1% of those (833) are corrupted and 1 in every 2^16 corrupted packets has a valid CRC then you have 1 corrupt packet with a valid CRC every 78 seconds.

Still not something to ignore, but not nearly as bad as the author indicates.

This is half Amazon's problem, and half Apple's problem for not giving their computer models unique names. Type iPhone 6s and you get much more clear results.

The browser could submit a special query to get the hash for victim.com/evil.js before running it. If victim.com returns the same hash, it's clean, if it doesn't respond, or responds with a different hash, fail in the same way as if a CDN had modified it.