mrmondo

Yeah that's a good one, hope they keep it updated / link to new info / posts as they come out.

Thanks for clarifying Mike, should be interesting to see how this actually pans out.

"AMD chips are affected by some but not all of the vulnerabilities. AMD said that there is a "near zero risk to AMD processors at this time." British chipmaker ARM told news site Axios prior to this report that some of its processors, including its Cortex-A chips, are affected."

- http://www.zdnet.com/article/security-flaws-affect-every-int...

* Edit:

From https://meltdownattack.com/

Which systems are affected by Meltdown?

"Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, every Intel processor which implements out-of-order execution is potentially affected, which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown.

Which systems are affected by Spectre?

Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors."

If you want a thicker phone, why not put a battery case on it?

I’ve been using OpenCL for some neutral net image optimisation recently, I’ve actually found it very efficient (citation obviously needed), I personally welcome the competition of AMD and it does seem like Nvidia is digging its own grave (not that I think it’ll die).

As someone else stated it is the measurement of the totally battery capacity, NOT the number of cycles. While I don’t want to defend anyone here this is not planned obsolesce, it is a mitigation strategy to prolong the general use of a device as it degrades. However yes, Apple probably should have given a notification to users of degrading / worn batteries of their state and that performance may be affected.

Android as an OS is far less power efficient than iOS, vendors combat this by supplying hardware with larger batteries while often sacrificing the quality of abilities of other components with the applicable space on the PCB / main board layout.

Used to set off car alarms all the time when I had ‘quite hotted up’ Type R Integra years ago, never house alarms though I think.

I’m willing to be the guy/gal next door has those broken window alarm strips installed, one part of the strip is loose and when the cars RPM drops as the clutch is let out while in reverse it slightly vibrates the window causing the contact to short (or break) and thus the house alarm goes off.

Good fun :)

As an ops engineer - yes, very much so. I hardly ever have problems with applications written in go, but there’s no way in hell you’ll see me installing something written in nodejs, mono or php.

Likewise, I have had the 13” since it was released and absolutely love the keyboard, it’s never failed me once.

You don’t need intel ME for full disk encryption? Or is that a Windows only requirement I’m unaware of?

We still have a huge number of the dev environments running on .dev, needless to say we were pretty pissed off when Google were able to buy the TLD to use as they wish. Anyway, not much we can do about it now other than start the process of setting up a new subdomain and reconfiguring all our CI/CD, Apps, Docs etc... I know we should have done it ages ago, there’s a ticket there for it... but resourcing.... sigh

Now that title confused me, if you’re not the USA - FYI: they’re not talking about the ‘Telecommunications Industry Ombudsman’ as I thought.

>> Citation needed.

> Has there been an update released yet? I wouldn't know, I don't use OS X.

I think you might have misunderstood what I meant when when asking for citation, it's based on the statement you made in relation to citing sources for what something that could be opinion stated as fact.

https://libguides.mit.edu/citing

> Is it a bad way? No!

OK this is where I stop feeding the troll.

> "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet."

Citation needed.

> "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update."

Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not before a patch would have been released.

--

Further to previously provided examples:

https://www.cloudflare.com/disclosure/

https://access.redhat.com/security/team/contact

https://www.xenproject.org/security-policy.html

https://about.gitlab.com/disclosure/

https://help.github.com/articles/responsible-disclosure-of-s...

https://www.kernel.org/doc/html/v4.10/admin-guide/security-b...

https://www.drupal.org/drupal-security-team/general-informat...

https://www.cisco.com/c/en/us/about/security-center/security...

https://www.juniper.net/us/en/security/report-vulnerability/

It’s not an example of security by obscurity, it’s a straight out security flaw and bug.

If it’s not publicly known and is a security risk it is far more effective to directly contact the developers / companies security team so they can immediately work on actually protecting people by developing a patch. If they don’t respond quickly (subjective, I’d call it within 12 hours) or fail to issue a fix in a timely manor (subjective, I’d say 24 hours) then yes - go public, start by logging a bug report and link to that bug report or if you can’t - the bug number / reference.

1. Ensure you always have FileVault enabled (you should regardless) and shutdown after work until the bug is fixed.

2. Add a complex root passphrase and clean this up after the fix is released.

3. Reflect on how irresponsibly this serious security bug was ‘reported’, he didn’t just potentially miss out on $200,000, he put an enormous number of people at risk of local intrusions when instead if it was properly reported there’s a good chance Apple would have released a bug fix for this quicker thus reducing the potential impact and spread of misinformation.

https://en.m.wikipedia.org/wiki/Responsible_disclosure

https://support.apple.com/en-au/HT201220 (See ‘Security and privacy researchers’)

Yes absolutely terrible drop in speed over VDSL over distance or noise.

The Abbot / Turnbull govt stopping the rollout of fibre in favour of using copper.

While the Australian right wing govt scrapped all the fibre to the home work that was underway and decided that copper from the node to the house was a great upgrade. The internet in Australia is so bad I had significantly better in New Zealand a decade ago.

As someone in a systems / ops engineering role it frustrates me endlessly when someone sends me information / data in the form of an excel spreadsheet or a word document.

My only are the applications slow and buggy (unless I’m guessing you’re running Windows?) the file format is very hard to work with / from if you want to do anything with it outside the vendors application, data quickly becomes stale and it’s not easy to populate automatically using standard tooling let alone share the information generated there from in an accessible, digestible format.

I find the exact opposite, the UI latency of macOS seems to me a lot lower latency and more 'snappy' that Windows 7/8/10, especially with Metal2 under High Sierra.

Bit of an odd comment but - as an observation around the branding - when Australian's pronounce 'DeX' it sounds like 'Dicks'.

I'm not having a go but I did also find it genuinely funny.

I know three people with them, two of them now have them sitting in a box somewhere the other one said he doesn’t use it for anything other than the weather or time but is now seriously concerned about it’s privacy implications so is considering unplugging it. Personally I use Siri on my phone probably more than 20 times a day on average and find it very useful, it helps me set reminders, events, send quick messages etc... without the full cost of mental context shifting.

That’s not at all correct, without deduplication enabled I have observed massive memory usage across BSD, Linux and ZFS on macOS.

Congrats to all involved, I’m especially proud that the choice was made to delay the release in favour of quality. To me that says so much about the motives and dedication of the people working on the project(s). Compare this say to Debian when they released Jessie - it wasn’t at all ready for release, missing packages, a broken SELinux ecosystem and some of these they classed as release critical - apparently not when it came down to it.

Anyway, fantastic work all - a fantastic distro that I believe in many ways sets an example for others (especially security wise). I look forward to all the hard work making its way into RHEL & CentOS in time to come.

Not alone here, I have my work phone unplugged or permanently on do not disturb (straight to voicemail which gets converted into text in an email), likewise on my cell phone I reject almost all calls and an automatic reply via text saying “I’m sorry, I’m not able to take your call or you’re calling for an unknown number, please email or iMessage me instead”, if the number calling is a land line my carrier converts this to a robo-voice and calls them back to say this, if the number is blocked - tough luck.

Not only are 99% of phone calls a waste of time, you’re inefficient with no written log of the conversation (not even for security but also to improve workflow and prioritisation / memory recall), furthermore the impact of the context shifting from what I’m currently working on / deep in thought over to a jarring phone conversation at the time that suits the caller - is incredibly disruptive.

I truly love RSS, combining Feedly with Reeder makes for a fantastic experience. I wrote a brief post on how I use RSS recently: https://smcleod.net/thoughts/return-of-the-rss/

“... to reflect our brand and our design principles”

Out of interest - What does IBM’s brand mean to you? (Serious question)

By that, I think I mean - what does IBM make you think of and what emotions does it instil in you when considering the company and brand?

Infoxchange | Development Team Lead | Melbourne Australia | ONSITE | Full Time

--

Infoxchange is a not-for-profit social enterprise that has delivered technology for social justice for over 25 years. With over 100 staff across Australia and New Zealand we tackle we tackle the biggest social challenges through the smart and creative use of technology.

We work with community, government and corporate partners to solve family violence, homelessness, mental health and issues facing ageing, disabled and Indigenous communities.

--

This role is responsible for process and people management of that team, as well as performing development activities on those products / codebases.

Delivering functionality enhancements, technical maintenance, and resolving defects on Infoxchange's Directory, Referral, Open Data, and Website products / infrastructure.

- Primary language used across modern products is Python.

- Open source tooling pretty much across the broad and very much promote public contributions and engagement.

- Highly automated environment with strong CI/CD capabilities.

- Lots of interesting tech across our applications and hosting (ElasticSearch / ELK Stack, GitLab, Puppet, Docker, Kubernetes, PostgreSQL and the list goes on...)

- We give and actively participate in lots of talks / meetups.

- Absolutely minimal bureaucracy and I'd say that everyone in the organisation truly cares about what we deliver and our impact.

- Ops team (my team!) works very closely with developers and there's a very social atmosphere.

--

Infoxchange | Senior Ops/Systems Engineer | Melbourne Australia | ONSITE | Full Time

We'll also shortly be seeking an experienced Ops Engineer to join the team I lead, so if you know of us via the work we do or the technologies we're involve or contribute to it's probably worth getting in contact if you're more in the ops / devops (with Systems / Ops focus) space.

--

Contact us here: https://www.infoxchange.org/au/contact or email recruitment (at) infoxchange.org