lol768

The advantages of OCSP were that you got a real-time understanding of the status of a certificate and you had no need to download large CRLs which become stale very quickly. If you set security.ocsp.require in the browser appropriately then you didn't have any risk of the browser failing open, either. I did that in the browser I was daily-driving for years and can count on one hand the number of times I ran into OCSP responder outages.

The privacy concerns could have been solved through adoption of Must-Staple, and you could then operate the OCSP responders purely for web-servers and folks doing research.

And let's not pretend users aren't already sending all the hostnames they are visiting to their selected DNS server. Why is that somehow okay, but OCSP not?

Two years ago we were told:

> We're going to build it right, and that means rewriting large pieces of our codebase. We'll ship the remaining stuff when they are ready.

I'm not sure how much more of the designs have actually been realised since then?

[1] https://news.ycombinator.com/item?id=36664515

https://bugzilla.mozilla.org/show_bug.cgi?id=1481298

World Travel & Tourism Council says international visitor spending is going to drop by $12.5bn this year (down 22.5%).

The team I'm currently working with are using Gotenberg for things which we can afford to take a little while, and C#/Skia for things which need to be reasonably quick.

This is really poor. And why is a Virgin Media address the closest best thing here? https://www.o2.co.uk/.well-known/security.txt should 200, not 404.

To be clear, I have no problem with disclosure in these circumstances given the inaction, but I'm left wondering if this is the sort of thing that NCSC would pick up under some circumstances (and may have better luck communicating with the org)?

https://m3.material.io/blog/building-with-m3-expressive#what...

Thank you for using a colour-blind friendly palette; as someone with deuteranopia :)

TfL may have been innovative a long time ago, but they haven't moved with the times at all. Hell, the Oyster POMs only got contactless payment readers in the last couple of weeks. Prior to that it was "chip 'n' pin" - y'know, the technology introduced back in 2004.

> You will regret using this data. You will regret using this API.

> It serves data from individual arrivals boards, which all spell stations differently.

> It describes train status in free text that varies between stations. “Approaching Barnet”, “Near Waterloo”, “Heading to Bank”, “Departing Southgate”, “Leaving Hampstead”, etc.

I'm not sure what you expected from an organisation still offering nothing but SMS-based MFA to its "customers" and one that got massively disrupted by a 17 year old in a cyber incident which seemed to paralyse the entire organisation a few months ago...

I appreciate they had to move for other reasons but I also really don't like the idea that the DevTools and browser chrome itself now has all of the same security issues/considerations as anything else "web" does. It was bad with Electron (XSS suddenly becoming an RCE) and makes me pretty nervous here too :(

So many areas where resource-based conditions just do not work with particular GCP product offerings and you're forced to give out much broader access than you should be giving out. It's half-arsed and prevents you implementing PoLP.

AWS has a steeper learning curve here, but I've never been unable to constrain down e.g. access to an SNS topic in the way I want to.

The shingles vaccination programme (for older adults) has existed since 2013.

The JCVI recommendation from 2023 took into account new evidence that had emerged since the original decision in 2009, using a new model to evaluate cost-effectiveness and better evaluate the impact on QALY from infection.

The original 2009 reasoning's decision is available here: https://webarchive.nationalarchives.gov.uk/ukgwa/20130107105...

In the industry I work in, between 96%-97%+ of revenue is the cost of the sale and is immediately handed over. Many purchases don't make a profit at all (fixed costs, commission doesn't cover them so it's loss-making - but you need to be able to offer them anyway).

I found the article title pretty misleading. There's perhaps an interesting conversation to have around the possibility of wanting to be able to scrub training data after-the-fact and how (or if) that could work - but that's not what the article's headline tried to convey.

I think the key difference between Directus and Sentry is that the restrictions Sentry put in place are directed at folks who want to build and sell their own error reporting service to software companies (and obviously commercially exploit the work they have done). In the same way that Redis went down the route of SSPL with the aim of impacting cloud services with their own Memorystore product that just resold Redis. That meant that most users were unaffected and your 10-person company using Redis as a cache to power their website could continue to do so. We continue to self-host Sentry and we're incredibly grateful that that's something we do have the option to do.

I don't have much of an issue with companies taking that approach. I actually genuinely wouldn't have an issue with an AGPL Directus, or SSPL (and releasing all of the plugins we developed internally). But that's not where Directus ended up and so we'll eventually either move to something written internally or an alternative that actually is FOSS.

> With an delayed-open-source-license w/ a usage grant that allows all the community members that historically contributed to use it for free, we found a balance between keeping it as open source as possible, while making sure large companies that make a lot of money using it are required to contribute back.

I do want to reiterate that a specific "total revenue"/"total funding" figure != "making a lot of money" and I don't think your license captures this nuance at all, today.

Same, it was a real shame to see it change in this way.

I'm also not impressed with how they've gone about doing it; no transparency on pricing for the self-hosted solution, you have to be subjected to a sales call to even get a quote. They're clear that they use "total finances" for trying to determine how much to charge you, which has its own issues with some business models.

The money also seems to be going towards lots of activities that have very little to do with actually .. building the core of the CMS. This whilst there's still fairly fundamental missing validation logic, even in the now-paid SaaS product [1]. How much of the now-$500 a month plan for 10 users goes towards the "Directus TV" (with content such as "Live scenes from our team with ambient music to help you get into the flow when you're coding") nonsense?

It was enough to put me off.

[1] https://github.com/directus/directus/discussions/2993

I sort of get why, but not really a fan of how they went about doing it (and arbitrary "revenue-based" thresholds really don't work for businesses that operate on a commission/agent basis - you can have a massive turnover but huge cost-of-sales - it's a very blunt instrument). For that reason I've kept self-hosting the older, actual-FOSS versions and they're just sat behind auth. I've not looked at alternatives yet but would be interested in any suggestions

I'd be curious as to what had happened internally here.

I'm pretty happy with them offering this based on my understanding of BACS, as a shareholder.

Do US fintechs offer something similar? Perhaps, but I bet it works pretty differently to BACS where the bank already knows about the money transfer.

I feel bad for folks who live in countries without a GDPR equivalent.

The ICO's guidance says "You can rely on legitimate interests for marketing activities if you can show that how you use people’s data is proportionate, has a minimal privacy impact, and people would not be surprised or likely to object"

I refuse to believe people would not be surprised or likely to object to this sort of marketing. It's creepy and invasive, and preying on people who may have lost their possessions or the house they've lived in for decades. I would be completely outraged if I received a visit of this nature after making a call to the _emergency services_. That's completely insane!

Without being able to rely on legitimate interests, there would not be an opportunity for data to be legally shared and processed in this way. None of the other lawful bases would apply, in my view.

I get the point about it not being ideal for self-hosted runners, not having ephemeral storage etc. But I disagree that the hosted GitHub Actions runners don't provide a good experience. If your build needs it - e.g. you're building something to deploy to your K8s cluster, use your Dockerfile and build in Docker. If you just want to compile some code, what's the point?