danarmak

The police could not exist if most people refused to help them. Arguing for people not to help the police is therefore arguing for the police to stop existing or to become less powerful or less effective.

I take "not helping" to mean not just not developing specialized products that only police can legally use, but also not calling the police in case of crime, not helping them with investigations as witnesses. Where the law permits, not selling them generic products and services (eg food). And where personal circumstances permit, not working for a company that does business with them, deplatforming them, etc.

But since we lack an individually actionable way of making the police better, doesn't the argument reduce to "we should not help the police as they are now"?

I'm not saying "everyone" should help the police. I do think it's alright that a few companies, in specialized professions, exist to help the police (and other governmental organizations).

Yes, a lot of the effect is harmful, including in helping police do harm. But an argument that no-one should help the police is basically an argument the police shouldn't exist.

Are you suggesting a locksmith should refuse to help the police open safes that contain too many valuables or PII inside?

The announcement says they have a new architecture. At the very least it's not a direct performance comparison to the same architecture implemented in Clojure.

> Storm 2.0.0 introduces a new core featuring a leaner threading model, a blazing fast messaging subsystem and a lightweight back pressure model. It is designed to push boundaries on throughput, latency and energy consumption while maintaining backward compatibility. The design was motivated by the observation that existing hardware remains capable of much more than what the best streaming engines can deliver. Storm 2.0 is the first streaming engine to break the 1 microsecond latency barrier.

> I miss Netscape days...internet wasn't a megacorp business playground :( !

You mean "this website is optimized for Internet Explorer 6" days? Or the earlier "this website is optimized for Netscape 2.0" days?

I think the nearest the web ever came to not being any megacorp's playground was when Firefox was at around 30% market share, and IE6 which had 60%+ market share had stopped moving. IOW, when MS still had the playground mostly to themselves, but chose to ignore it. And even then, the web / Firefox couldn't really innovate without breaking IE6 compatibility, so everyone was stuck.

Thanks, that's encouraging to hear!

Although I still worry about the case where fixing the deviance would break production apps. Potentially break them, since people won't complain until you release the breaking browser version. That's what's usually kept browsers from hewing to standards.

If I complain to Mozilla that they deviate from the W3C spec in some respect, will they treat that as a bug, or will they more likely say "no-one implements this, so no website uses this, so we have no reason to be the first to implement this because we don't think this is part of the spec is really important"?

But no browser maker recognizes the W3C standard or claims to implement it, so what good is it?

It could also be about Github private repos, which cost money, and therefore are a business relationship. If Huawei has a private repo on Github, is Microsoft now required to delete their account?

Disabling HT can't be done per-process. Since per-frame browser processes need to be protected from one another, you can't even run two browser processes on the same core in HT. And scheduling a browser process while leaving the second HT slot on the same core empty is even slower than turning HT off.

Some are there, yes, but they're insufficient to provide security. You need both them, and the microcode changes, and to disable HT. I'm not sure what if anything the software changes do alone, they may mitigate some of the attacks, but not all of them.

There aren't such mitigations to enable. There aren't even purely software kernel-level mitiations.

That must be recent. Good to know!

I meant that the "Allow personalized ads" in a Google account is on by default.

The problem is less with me seeing personalized ads, and more with the ad-server and/or the website getting my PII, and anyone who sees my screen or sniffs my traffic acquiring PII by observing which ads I get.

"Allow personalized ads" is on by default, which is iffy under the GDPR. Especially considering that, when it's enabled, they match you to your Google account even if your current browser isn't signed in to the Google account.

It's true that "backdoor" is sometimes used as you defined. I feel that some usage, like this article, implies a deliberate backdoor. But you're right that it's an implication and not an explicit statement.

One reason that I feel this implication here is that an 'unintentional' backdoor vulnerability can be exploited by any attacker, but the article focuses on this backdoor's exploitability by Huawei, and by implication their untrustworthiness.

A backdoor is a deliberate remote-access vulnerability that the creator intended to use for illegitimate access.

The same code, but intentional, is a bug and vulnerability, but not a backdoor. Same security implications, but a big difference wrt. culpability, appropriate punishment, and expectations of future behavior.

It doesn't matter if it's a deliberate backdoor or not. It's a door, and I want to be able to close that door if I'm not using it, and Intel won't let me. Reducing attack surface is a security best practice exactly because any software can have bugs.

An allegory: imagine if an OS ran an SSH server and there was no way to turn it off or to control the keys it accepts. Maybe it has no bugs (you can't see the source code). Maybe it has no malicious intent or backdoors. As a security conscious computer owner, I still view its existence as a negative. I would like to be able to provably turn it off or control the keys it accepts.

Why not both? Many routers have had remote access vulnerabilities, but there's a clear reason to write about 2012-era vulns about Huawei and not some other manufacturer.

The NSA is probably better at domestic surveillance because it's much easier and/or cheaper than foreign surveillance. If people of the same ability level work on both, the domestic results will be better. That doesn't meant the NSA is incompetent.

You're right! I wasn't aware of that.

If DoH is backed by e.g. Google, won't they just end up exposing DoH on the same IP addresses serving www.google.com? Similarly, what if e.g. CloudFlare expose their DoH on all their addresses? This seems like the obvious next step for them.

> Unfortunately, on our school network, we also allow BYOD (students with their own laptops and ipads), so we will have to have some strict rules to block DoH, the same way we block proxies and vpns.

How can you block DoH without doing MITM on all outgoing HTTPS? For that matter, how can you block HTTPS based VPNs like OpenVPN?

ETA: I understand you can block IP addresses of DNS resolvers that support DoH. I assumed that to make this work, Mozilla / Google / etc. would serve DoH from the same IPs as some big services, so you wouldn't be able to block DoH without blocking something like Google's homepage.

Title should mention the year, [2008].

> is there a more effective way to disable a cellular modem than removing its antenna?

Wrap it in aluminum foil as a Faraday cage?

As Scott Aaronson put it[0]:

> I’m not making the much stronger claim that this is the best possible use of $20 billion for science. Plausibly a thousand $20-million projects could be found that would advance our understanding of reality by more than a new collider would. But it’s also important to realize that that’s not the question at stake here. When, for example, the US Congress cancelled the Superconducting Supercollider midway through construction—partly, it’s believed, on the basis of opposition from eminent physicists in other subfields, who argued that they could do equally important science for much cheaper—none of the SSC budget, as in 0% of it, ever did end up redirected to those other subfields. In practice, then, the question of “whether a new collider is worth it” is probably best considered in absolute terms, rather than relative to other science projects.

[0] https://www.scottaaronson.com/blog/?p=4122

> Since JavaScript has an especially high burden for backward compatibility you can’t really remove old cruft

You can't remove features from JS runtimes (browsers or node), but you can certainly remove them from a new language version. "use strict" already did it once in JS. It can be replaced/upgraded with "use ecmascriptX.Y" for each language version.

And transpilers targeting JS and tools like packers and minifiers can enforce language versions without declaring them in each file.

As the Git FAQ [0] says:

> Git has a rename command git mv, but that is just for convenience. The effect is indistinguishable from removing the file and adding another with different name and the same content.

git diff, merge, and related tools have heuristics for detecting file moves (off by default, turned on with e.g. git diff -M) but they tend to break if a file is both moved and modified in the same commit.

[0] https://git.wiki.kernel.org/index.php/GitFaq#Why_does_Git_no...