matthew9219

A log to secure TLS which clients typically obtain over a TLS connection and whose violations they report over a TLS connection. It's a circular dependency.

CT provides a guarantee like: "hopefully one of those devices will eventually connect to a non-compromised network and report the prior compromise". By observing the lack of such reports, we can be reasonably confident compromises of size N>millions are not happening, but it's difficult to reason about what compromises may be happening at small N.

The fundamental difference is that with TLS you have to trust ALL certificate issuers, but with DNSSec you only have to trust your TLD and your certificate issuer. Most companies trust their home country as a matter of practicality.

Certificate transparency is cool, but it's not clear it really works for many classes of devices (particularly devices that only use one network like gaming systems or TVs). The global adversary just compromises the channels used to obtain the transparency logs and to report violations. It seems to work for mobile consumer devices like cel phones, because these devices naturally connect to many different networks, of which only some are compromised.

The US seizes the cryptographic material for a US based root, issues keys and certificates for the domains it wants to compromise and intercepts and modifies the traffic for targeted users. There's some additional asterisks around not getting caught and certificate transparency logs and browser reporting structure, but for many classes of devices, it will suffice to simply also hijack the domains used for requesting the transparency log or the domains used for reporting certificates that don't appear in the log.

Users who are concerned about a government like the United States can use DNSSec to prevent a threat like this by using a non-US based TLD that employs DNSSec, and by running their client in a mode that requires valid DNSSec records for their domains. Of course, such services would practically need to be located outside of the country of concern as well.

It seems like some folks are missing the motivation for DNSSec and suggesting TLS instead. If your threat model includes global adversaries, you have can't rely on TLS because governments can trivially compromise TLS providers and TLS exposes users to the lowest common denominator TLS. The lowest common denominator TLS (ACME DNS-1) and the mitigation to the TLS provider problem (CAA records) are both based on DNS.

So you either accept that TLS is the global maxima for security and world governments can basically permanently compromise the internet, or you build private PKI systems, or you want something like DNSSec. And DNSSec is something like DNSSec.

TLS security is rooted in DNS. It's ACME DNS-01. If your threat model includes nation states, this is a non-solution

I'm not the person you replied to, but in my native tongue (English), excessive repetition is also poor usage. Repeating the question too literally is indicative of unsophisticated (pre-college) writing, and repeating the same phrases word for word a signal that you don't believe your listener is paying attention to your words (as opposed to rephrasing, which signals that your prior explanation might have been unclear).

I've been a bit shocked how poor ChatGPT's usage is - it writes more like a very articulate 15 year old than like an adult - and how nobody else seems to notice. I can't help but think part of the reason nobody is noticing is that most of the attention is coming from engineers (for whom language is not a top skill).

From the guidelines:

> Eschew flamebait. [...]. Omit internet tropes.

I'm an IC. In Google terms, I was recently promoted to L6.

Your premises are deeply mixed into your argument here.

From an (conservative leaning) American perspective - the Alan Turing Institute is an perfect example of broken European thinking. Real innovative happens at highly motivated private companies, private companies who have huge profits to make if they are successful, and who pay huge salaries to talented employees, talented employees who desire to be rich. Government institutions more frequently pay mediocre salaries, reward politicking rather than excellence, and are undermotivated to solve problems, because they are unlikely to receive commensurate share of the benefits.

Now that Britain has left the EU, we Americans hope they will stop pissing money down the drain on useless government programs like the Alan Turing Institute and will instead reorient to a more business friendly environment, which recognizes that innovation happens mostly in successful businesses, and that governments role is to create that business friendly environment.

I'm a 10 year engineer at a FAANG. My promotion velocity is probably about average, maybe a bit above average, but not exceptional.

In Seattle, my girlfriend made $65k last year cutting hair for dogs. She has a college degree, but no PhD, but doesn't use the college degree.

I made $350k. I have a college degree in computer science, but no PhD.

Why would any top talent take a job at 50k?

Glassdoor indicates that the Alan Turing Institute pays senior research associates $49,015 per year, senior project managers $48k, and senior research fellows the same. I wasn't able to identify any roles there that paid above $50k/year.

Is it any surprise that when you hire people with PhDs and you pay them less than bartenders that you don't get the best people? Those people go to Google or Microsoft and make 10x as much.

They were still teaching that one decade ago, maybe never stopped.

My aunt once told me "Please don't think negatively of religious people."

Stallman would prefer I not use any closed source software to read his blog, including OS, drivers, web browser, etc.

People routinely ignore unreasonable requests. Asking me to not wear shoes in your home is reasonable. Asking me not to give a copy to Joe after telling me I can give a copy to whomever I want is unreasonable.

Pedantic: 0.03% of 1 million is 300, not 30.

I know a lot of people on "family" cell phone plans beyond their family. Doesn't seem to bother Verizon.

Why do you assume making a bunch of cheap but potentially impactful bets is an ineffective strategy?

30k is 0.01% of 300m, or 1 part in 10,000. It was also just a small part of 900k of grants given out to many different works.

This is how art grants work. They are tiny - in the 10k to 50k range, a few thousand are given out. Some of these artists produce great works and some don't. But it's cheap as heck compared to other things, and if we spend nothing on art, we don't get any great art. Are you also one of those people that hates federal arts funding?

Btw HPMOR is also pretty good. Harvard probably spent more than 30k on their sign and got a lot less.

Fwiw, the finder here is not completely correct in their assertions. Locking the Bing CMS down to single tenancy would have meant that instead of the whole world having access, only about 180,000 Microsoft employees would have access. The actual number of people who should have access is about 50. Maybe 500 the way Bing is bloated. The problem here is that Bing CMS didn't implement the authorization half of authentication and authorization - they simply allowed all authenticated users to access all data. Multi-tenancy expands the scope, but it's not really clear what portion of the 25% of apps the finder surveyed that were multi-tenant similarly lack any authorization whatsoever.

> When you think of an interesting idea like this, please don't assume you've discovered something new that the entire public health field is unaware of.

From the guidelines (https://news.ycombinator.com/newsguidelines.html):

> Please respond to the strongest plausible interpretation of what someone says

Parent didn't say they had come up with the idea or that it was novel, just that they were aware of it.

Did you build Apple's sort-of OpenID Connect implementation?

I'm glad you're doing better these days, but it's not at all clear to me how your experience relates to my original comment. In that comment, I suggested that parents should use the restriction of privileges to incentivize a non-compliant child to get the appropriate treatment for a substance abuse disorder. You indicated that your father restricted your privileges for such a long time it had a negative impact on your development but that your father was not aware of your substance abuse disorder. Then, the restrictions couldn't have been to incentivize you to get treatment. So how was your dad's strategy similar to my suggestion?

Can I ask - if you had the choice between attending treatment or being grounded, why did you choose to be grounded?

I was required to attend alcoholics anonymous for three months to continue in university after passing out from intoxication on the quad. Hearing those stories led me to stop experimenting with new drugs and reduce my drinking - I didn't want to become those people. I don't know that such cautionary tales would necessarily have helped this child, but they might have.

Let's not forget that attending substance abuse classes is the recommend medical treatment for substance abuse, a medical problem. Doctors wouldn't recommend it if it didn't work sometimes. Imagine if the story was about a broken leg instead of substance abuse and the child similarly said they didn't feel like anything was wrong with their leg, and so it similarly went untreated.

Seems like blog link would probably be better: https://www.wiz.io/blog/azure-active-directory-bing-misconfi...

The article places a lot of blame on the state of Texas:

> Directing blame at Mexico is also a way to avoid looking at how Texas fails children.

But also includes anecdotes like:

> When Noah awoke from his coma, he was tearful and apologetic. He thought only a few hours had passed; it had been four days. Janel and her husband called treatment centers, but none would take Noah without his consent, and he insisted that he didn’t have a problem. Even so, Janel was hopeful; that summer was one of the best they’d had as a family. Noah was dating a sweet girl, and when he wasn’t with her he seemed happy enough to hang around the house doing TikTok cooking challenges. Then, the first week of school, sixteen days after Janel gave birth to another son, Noah overdosed at his girlfriend’s house.

It seems to me that if a child overdoses, but refuses to accept their parents demand to seek treatment, they should be denied privileges - forbidden from spending time with unapproved friends, denied a cell phone, denied allowance, etc. This case (and a few others) seem to be clear cut cases where a parent could have forced compliance, but choose not to - I can't imagine any kid choosing no friends and no cell phone to avoid going to one hour per week of narcotics anonymous.

From the reference you replied to:

> Effective May 1, 2019, China officially controlled all forms of fentanyl as a class of drugs. This fulfilled the commitment that President Xi made during the G-20 Summit. The implementation of the new measure includes investigations of known fentanyl manufacturing areas, stricter control of internet sites advertising fentanyl, stricter enforcement of shipping regulations, and the creation of special teams to investigate leads on fentanyl trafficking. These new restrictions have the potential to severely limit fentanyl production and trafficking from China. This could alter China’s position as a supplier to both the United States and Mexico

> Notice how Barnett has zero empathy when he thought it was just an Austin thing, then did an about face after the subsequent deaths in Kyle.

I didn't see this in the article. I read that Barnett didn't realize the trend until after a few events - but I didn't see anything indicating a lack of empathy. It's possible to both be emphatic and think an unfortunate event is a one-off caused by external factors, for which a policy change is not necessary.