janosdebugs

I'm not surprised at all, there is an astounding amount of lefacy stuff around, such as this issue from 2021: https://github.com/golang/go/issues/46899

Anecdotal evidence: I play at 4k if I can manage, and I sport a 2060S.

I'd consult a lawyer before doing that. Al Capone got busted for tax evasion, not murder. If they want to get you, providing a false identity may or may not become a problem. Also, having the card shipped to your home address makes it super tracable.

> Post-setup, disable Bluetooth. This is important because Bluetooth signals can be intercepted by third-party devices within range, and that allows hackers to access sensitive information, such as your phone’s contacts and messages.

Yes, dem hackers who type really fast on the keyboard to get into the FBI. They can totally steal your contacts that you shouldn't have on this phone anyway purely by Bluetooth being enabled. /s

On a serious note, you should disable it, but it's more due to tracking than some elite hacker stealing your data.

IANAl, but this would still be compliant if they use legitimate interest as a justification. In that case the user just needs to be informed and have the opinion to object via separate means.

I'm not entirely through the RFC, but here are a few snags I see:

1. The QUIC RFC is primarily intended to be implemented in user space. In other words, each application needs to bring their own QUIC stack, which includes TCP-like semantics and TLS. I'd be very surprised if we didn't have a decade of security holes ahead of us.

2. Corporate routers are going to have a hard time dealing with the UDP-based protocol, especially as NAT is concerned. Connection migration to a new IP will also be a challenge.

3. The same goes for network load balancers, which section 5.2.3 talks about. Basically, you now need stateful/application LBs if I'm reading this correctly, or you need to disable connection migration. Also, accidentally exposing your backends via the preferred address will be a fun time if it accidentally happens, not sure how likely it is though.

4. Section 8.1.2 says that the protocol is vulnerable to a traffic amplification attack. In order to avoid it, an extra round trip must be done, which gets rid of the advantage if QUIC being quick in establishing connections.

Maybe someone with more know-how could chime in.

The server returning the next nonce sounds like a huge headache when requests are run in parallel.

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipping the jarring cookie banner experience.

This has nothing to do with cookies, the banner is required if the site is processing data that is not just technically necessary. In this case the site needs to ask the user for consent or at least inform them of processing due to legitimate interests.

This. Any time I saw a more complex doc work with several editors and reviewers, it was in Asciidoc.

I made use of the right to be forgotten extensively, thank you. Before that most accounts were undeletable.

I have to say, I recently got a push into the direction of agreeing with "the EU" a whole lot. The CNCF was organizing a "security slam" where they surveyed CNCF project users what they would want for security compliance in the projects. See one such post here [1]. As you can see, we got some high profile users: Epic Games, the Space Force, and I personally know of two household name telcos who use it.

I asked the organizers about potential funding for the work that needed to be done since the project wasn't a commercial endeavour for us. They didn't even consider this before making demands for work that would consume several days if not weeks. The funding they had amounted to some gift cards and t-shirts. (They are very nice people, but there is not much they can do either.)

I am personally very frustrated with FOSS as it stands today. It's disingenuous: either the project is almost unusable on its own and you need to buy services from the people creating it (Kubernetes), it's missing parts you need, you get a pseudo-OSS license (BSL), sometimes funded by a foundation that has to do a whole lot of extra work to get donations and more often than not pays entry-level salaries or you run a project because you love doing it where you are expected to do the compliance work ... Why exactly?

And about 95% of the changes requested are basically paperwork to check off the boxes, ship material of bills, etc. Not the fun kind of problems. (Note: the CNCF doesn't pay its contributors anything, at least I didn't get a dime so far. The only thing I got was a truckload of paperwork, requests for more free work besides the project reviewing conference submissions for KubeCon, and more.)

I think, if you are a commercial FOSS user you should absolutely be on the hook for getting your wallet out and paying for people doing the ridiculous about of slog required for compliance. Pay a foundation for the compliance work, or hire the people working on the project to get it done. Does the EU get it right? No clue, but something has to be done. Supply chain security is important and the work needs doing, which somebody has to pay for.

[1] https://github.com/orgs/ContainerSSH/discussions/574#discuss...

Do politicians elsewhere?

Yeah, but just getting a hold of a valid certificate doesn't automatically mean a MITM. For that the network connections need to be intercepted too.

If that were the case, they wouldn't have seen weird connectivity issues/behaviors.

There's always an alternative. One can also live under the bridge as a measure of saving rent (obviously exaggerating), but it's not a choice most people would make. The reason why we work is so we can support the lifestyle we want, not the bare minimum to survive.

If you work in a big org, there is probably a process for getting software/etc approved. Since JetBrains is hopefully already approved, you may have an easier time to get it through. At least that's how it worked for me in telco-world.

If I disambiguate from Musk running the show, this is not a bad idea. When I was working on payment gateways a good 10 years ago, it was stupidly hard to get live cards accepted for live testing. (Because of course the test API was different.) At some point all our test cards would be blocked based on the transaction volume.

That's why you do symlink-based deployments with PHP. It works just fine and is also not a problem unique to PHP.

PHP itself doesn't follow filesystem-based routing, your webserver config does. PHP just executes what th webserver tells it to. Most PHP applications written in the last 10 years use a single entry point and are no longer prone to the attacks you are describing.

I'm all for rehabilitation, but the serious amount of criminal energy that went into this scheme would have been better spent building something useful. A thought clearly lost on this individual. Furthermore, he used his ill-gotten IP addresses to house spammers, which was actively causing harm beyond just hoarding addresses.

I guess you missed this part:

> Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist.

As far as quality if life is concerned, microwaved food doesn't quite have the same appeal for many.

> Many commercial entities anyway need your actual identity (like banks)

I wish. Digital signatures (Handysignatur) have been available to the masses in Austria for 10+ years, but I have yet to see one of the big banks being able to accept a digitally signed document. It's still the "visit your bank in person" process.

I've been test driving the new system (ID Austra/Digitales Amt app) for a few months now and for the most part it seems to be a replacement for the old "Handysignatur" system that let you digitally log in and sign PDF documents. This system was and is much better than you needing to manage your own certificates and made the whole thing accessible.

The new app basically just unifies various online forms that were already present, such as changing your address registration. None of this stuff is new and you already needed to sign in with Handysignatur to use these forms online anyway. More importantly, nobody in Austria forces you to use these services, you can file literally all of these on paper. They even have a service to fill out the forms digitally and then print them. The app also doesn't request stuff like location information and doesn't do anything nafarious as far as I can tell. It is also worth noting that ID Austria supports FIDO instead of a phone too.

That's why I have a paid workspace account for the important stuff. Even if not impossible, it's less likely to get blocked on a whim.

When I explain this to people, they are usually very surprised.

Can someone versed in legal matters please explain how this one will be different? The US presumably hasn't changed its laws on the matter.

X forwarding over SSH always struck me as a bit of an edge case. I used it maybe 5 times in the last 20 years. Most people probably never knew this was a thing.

If you could cook the same or better food at home for 10-15$ (which was my experience) them yes, employers are the reason for the extra spend.

This is an interesting topic that comes up time and time again. I'd like to understand, if we abolish copyright and I make a computer game, pour all my money and time in it, what's to stop EvilBigPublisher Co from simply taking it, rebranding it and killing my company with their might?

Or, if I came across a copy of Unreal Engine, what would stop me from using it and not paying Epic a dime?

This is going to leave so many people by the wayside. (Pun totally intended.) Late 2020, my jaw dropped on the floor when a developer from CERN showed up and said that X11 support was needed in ContainerSSH for their use case and then developed it. (The LxPlus service, which acts as a dev host for researchers.) I thought X11 forwarding was well and truly a thing of the past.

Yes, I know that waypipe is a thing, but it needs to be installed on both ends and I haven't seen any mention of non-Linux support either.