These are the attitudes we get when we have a WebPKI cabal drunk on power.
174 karma · joined August 25, 2023
If someone else did this, Mozilla would be threatening to remove them from their trusted roots.
IP address certs sound like a security nightmare that could be subverted by BGP hijacking. Which is why most CAs don't issue them. Does accessing the ACME challenge from multiple endpoints adequately prevent this type of attack?
Cool article but the author seemed especially indignant that they have to use a wood stick to switch off hundred year old equipment or use a rotary phone. Was he expecting a smartphone app?
It's more of a testament to its durability, the phone works just as well nearly 60 years after it was installed.
Nothing like being trapped 40 feet underground with an Android phone that can't dial 911 properly, at least you can play sudoku as you await your demise.
This is also solved by using $8 earbuds and not shoving overhyped $200 hazelnuts into your ears.
Picture going into a restaurant, and before the hostess seats you she says "I'd like to remind you that I love black people".
That's out of place it is. It doesn't offend anyone, it's just an odd thing to say. You may not perceive it so if you're inside the bubble.
You're making the assumption that most of that isn't performative nonsense that in reality doesn't help anything.
Also known as slacktivism.
It got to the point where I would see pronouns and flags and URLs to DEI policies (Click here to stop racism now! Really?) in people's email signatures that I would immediately assume they were insincere and phony.
One person I knew had "LGBTQ Ally" in their professional signature. It's one step removed from writing I HAVE GAY FRIENDS and frankly I found it all really weird, fake, and reminiscent of 1940s Germany where people had to wear their pins to proclaim their allegiance. None of this has place in a professional setting.
To those I suggest they move on to BlueSky, where the preshared blacklists and ability to inform on others they despise would be more to their liking.
Alternatively, they could go touch grass.
That's because there are people behind every product, and the people behind computers tend to be the paternalistic, nanny-state type. Just read through the histrionics in any HN thread about leaf blowers, they want every landscaper locked up and their tools of the trade taken away. Someone once suggested they should be forced to use rakes. Imagine if some landscaper insisted what laptop you should use.
As you wouldn't expect to find many in-the-Army buzz-cut guys roaming the Google campus as you would at a gun company, you wouldn't expect some blue-haired face-pierced sales engineer selling you table saws.
It's a cultural thing, nothing more.
But web developers have done their best to wreck this. Have you ever had to explain GDPR cookie dialogs to elderly parents? I've watched them Google recipes only to blame the chef when the site was broken or unusable, which was more often than not.
The CueCat.
The study looked dated but wasn't presented as such, and didn't caveat it with any updates. It's hard to know if Peet's changed their ways in response to the report, and if that was the case I think a disclosure is warranted.
In the end I was presented with conflicting information and didn't know who to believe. Was the data old? Was it a false positive? Did Peet's decaffeination supplier pull a fast one and was secretly using a cheaper method? (Nearly all decaffeination is outsourced.)
More info here:
https://www.usatoday.com/story/life/health-wellness/2024/05/...
The Clean Label Project, a nonprofit that fights for food labeling transparency, found that several popular coffee brands including Kirkland Signature, Kroger, Maxwell House and Peet's Coffee included traces of methylene chloride, a liquid sometimes used for paint stripping that in large doses can cause a slew of health issues. (A representative for Peet's told USA TODAY the brand switched to a different means of decaffeination more than two years ago.)
The true hack would be to purchase a mechanical water filter, probably much higher quality for the money spent, and have it attached to the plumbing. Bonus is it works when the power's out.
Aren't these water dispensers built into most fridges nowadays?
What does this protect you from? If a private key is stolen from a device? If it went unnoticed for 45 days, the device is probably still compromised, and the threat actor will just steal the new key. If you can automate issuing certificates, you can automate stealing them too.
Sounds like a great way to garner more business for Big PKI.
Unless you run an enterprise CA, in which case Chrome doesn't check for revocation AT ALL. Google went rogue and made up their own rules. The whole of PKI should be ripped up and not left up to those who can shout loudest.
Google, MS, and Apple already handle their own CA trust. So this conspiracy theory would already be true.
The reality is the CAs could tell Mozilla to go pound sand and they would have no recourse. Is there not a governing body for certificate policies with voting members?
CA trust should be handled at the OS vendor level. Mozilla having its own trust anchors is a relic of the past. If CAs refuse to comply, they at worst inconvenience 2.5% of their customers temporarily until they find a better browser.
I've seen Energy Star logos for 30 years and never knew there was a public database, never thought to verify, and I don't think anyone else has either. The only thing Energy Star has been useful for is extracting rebates from utility companies and buying shitty dishwashers which were certain to be worse than what they were replacing.
Verification is useless if no one knows about it, or if the data isn't actionable. I have verified UL mark numbers for questionable products, but they often resolve to some Chinese ODM you've never heard of like 'Xionshang Industrial Electric Company' whose name certainly doesn't match the product label. Do you know the components haven't been swapped out since certification was achieved? Was the product actually sourced from there or counterfeit? You have no way to verify any of that.
UL issues holographic stickers but I've seen those like 10% of the time and probably just as easily faked.
Not that it matters, posters on this very site who claim to care will continue buying stuff off AliExpress, proud they got it for pennies on the dollar.
Look ma, a mini PC for $22! And they didn't even charge for the preinstalled malware!
Has anyone ever considered this junk is sold at a loss as a price of doing business, to expand a PRC-controlled botnet?
But GM already has this capability with OnStar. Stolen vehicles can be slowed down then stopped and and disabled remotely.