I checked and I don't think so. Artificial Condition includes "blending in" as someone of "indeterminate" gender named "Eden" with longer-than-short hair and longer-than-normal eyebrows, which seems to be a careful non-gendered description.
392 karma · joined July 1, 2023
Working on stuff outside of the top 99%+ of effective solutions deserves to be questioned.
As an alternative, they could have been investing time in a form of capabilities-based security for packages like Deno has where not every pip package can spawn info stealer processes at install time or runtime. That would address both the build compromise attacks and actually-common attacks like vulnerability exploitation.
The vast majority of breaches are caused by credential theft, phishing, and exploiting vulnerabilities.
It doesn't matter that you can cryptographically verify that a package came from a given commit if that commit has accidentally-vulnerable code, or someone just gets phished.
> I was preparing for my last major standardized test, the Graduate Record Exam, or GRE. I had already forked over $1,000 for a preparatory course, feeding the U.S. test-prep and private tutoring industry... I wondered why I was the only Black student in the room...
> The teacher boasted the course would boost our GRE scores by two hundred points, which I didn’t pay much attention to at first— it seemed an unlikely advertising pitch. But with each class, the technique behind the teacher’s confidence became clearer. She wasn’t making us smarter so we’d ace the test—she was teaching us how to take the test....
> It revealed the bait and switch at the heart of standardized tests— the exact thing that made them unfair: She was teaching test-taking form for standardized exams that purportedly measured intellectual strength. My classmates and I would get higher scores— two hundred points, as promised— than poorer students, who might be equivalent in intellectual strength but did not have the resources or, in some cases, even the awareness to acquire better form through high-priced prep courses. Because of the way the human mind works— the so-called “attribution effect,” which drives us to take personal credit for any success— those of us who prepped for the test would score higher and then walk into better opportunities thinking it was all about us: that we were better and smarter than the rest and we even had inarguable, quantifiable proof.... And because we’re talking about featureless, objective numbers, no one would ever think that racism could have played a role.
> Excerpt From How to Be an Antiracist, Ibram X. Kendi
I think the theory is people edit more if pages load lightning fast. I can attest to that, especially if you use tools for partially-automated mass edits like https://github.com/wikimedia-gadgets/JWB
Seems just way too many different systems have the ability to modify those flags.
The absolute worst offender is "Don't give choices with unexpected or unclear outcomes". Almost every decision has unclear outcomes, some with devastating consequences on later phases of the game.
It's an impressive game with a great story and great combat, but only the most hardcore players are exempt from the mandatory save-scumming and wiki-reading IMO.
If done correctly, it could allow you to perform restic backups and restores without granting the ability to delete backups.
One feature I feel is lacking is better handling of database credentials. I see there's a "copy to clipboard" button next to the password, which tells me we're still using the same single, static, plain-text DB passwords that we've been using since the 90s. I'd love to see some kind of cross-platform RBAC system that uses rotating credentials or asymmetric crypto or something.
It's a summary judgement essentially saying that even though the FTC has a long-established history in both the law itself and legal precedent for making rules to protect people from "unfair methods of competition" apparently that was all an illusion and the FTC has no power to do that at all. This was based on (IMO) flimsy reasoning that a 1975 law[1] that granted the FTC some new, explicit rulemaking powers over warranties (including a provision that says something like "nothing in this law is meant to restrict powers already granted by the FTC Act") actually caused the FTC to lose all other implicit rule-making power, even though obviously that wasn't Congress's intention and isn't supported by the text.
The judge went further to claim the rule was "arbitrary and capricious", even though the rule was published alongside 570 pages of analysis[2] (that I also read), and the relevant Supreme Court decision[3] explicitly requires judges to defer to the expertise of federal agencies in these matters.
Once again, we can't have nice things, even if the law literally says we can.
[1]: https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...
[2]: https://www.federalregister.gov/documents/2024/05/07/2024-09...
[3]: https://en.wikipedia.org/wiki/FCC_v._Prometheus_Radio_Projec...
- Create threat models that identify weaknesses in the design of your self-hosted setup.
- Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering.
- Deploy an intrusion detection system to know if you've been compromised.
- Perform all OS and app patching automatically, or regularly without fail.
- Follow CVE feeds in case a zero day needs to be fixed before the next patch window.
- Arrange for an expert to perform regular penetration tests.
- Deploy a tool that detects and alerts on things like firewall misconfigurations.
- Regularly test your backup and recovery methods, since if you also store 2FA codes and backup codes in there, you could be permanently locked out of your accounts.
Is that true?
> having the same connotations, implications, or reference
> to runners, Boston is synonymous with marathon
But if you buy someone non-refundable tickets to a concert they already have tickets for, you aren't owed compensation.
It's wild to me that it's so normal to install software like this on critical infrastructure, but questions about how they do code signing is a closely guarded/obfuscated secret.
Linux provides eBPF and macOS provides system extensions.
I'll also add that Windows itself heavily prioritizes backwards-compatibility over security, which leads companies to seek out third-party solutions for stopping malware instead of design-based mitigations being built into Windows.
If you blindly rebalance meetings based on "caucus score", you'll get less ideas from the loud people and more ideas from the quiet people ("A"). You won't necessarily get better ideas overall ("B").
IMO, the "floor" should be given primarily to people with a track record of clearly and concisely expressing novel and good ideas, no matter how loud or quiet those people are. Figuring out who those people are is hard and probably can't be nicely described in a blog post.
No one has a meaningful contribution for every topic, and most people don't have the self-awareness to know whether their contribution is meaningful or not. Any good meeting structure has to be able to handle that common situation in a safe and healthy way.