omh

The C# app is built using WebBrowser Control[1] which is tightly integrated with the app itself. WebBrowser only supports IE11 but the webapps that it connects to are increasingly dropping support.

The vendor is reluctant to upgrade their app because the replacement options apparently (?) require extensive refactoring to get the same integration.

IE11 seems to be in a weird limbo. But the fact that it's still technically supported by Microsoft means that conservative software vendors aren't forced to migrate.

[1] https://docs.microsoft.com/en-us/dotnet/desktop/winforms/con...

But it looks like Microsoft considered paying about $8 billion back in 2016[1].

Slack held out, Microsoft built their competitor and Slack are still around. And now Slack are going to sell for $24 billion or more.

I'm not sure that puts Slack in too bad a light.

[1] https://techcrunch.com/2016/03/04/source-microsoft-mulled-an...

So if renewal fails you should have ~30 days to fix it.

But this does work best if your tools try the 2-month renewal. (I'm looking at you, wpengine!)

But in a non-technical organisation, who should those messages go to?

Often the initial LetsEncrypt setup will be handled, correctly, by some IT staff. Then it might break several months or years later for some odd reason.

The organisational challenge is to get the message through to someone who understands it and will act on it.

I think the difference here is to do with who's responsible for keeping things "working".

In a business environment there is a whole IT department who go to a lot of trouble to guarantee that their colleagues can continue working. But when Google take that control there's a clash, and it hinders the IT team's capabilities.

The frustration here is that Google are operating outside the way we're all used to for software updates. If we update the software, we know to expect problems. So we can test it and (crucially) roll back.

If Google make changes outside of that then it becomes far more difficult to manage.

Join the club!

> It might be worth to investigate whether there is some kind of host name that could be nullified on the network, of the server that the trials are loaded from.

It looks like they're downloaded from https://clients4.google.com/chrome-variations/seed

Blocking the entire hostname would cause problems with other features of Chrome. But I think blocking the particular URL would need SSL interception which isn't very appealing.

I've been at conferences where senior Google staff went to great lengths to present the benefits of switching to Chrome.

> The experiments are not exactly a secret program and have existed for a while

I've been responsible for managing Chrome in a professional environment for several years and looked in detail at many Chrome management settings. I was not aware of the experiments. They don't seem to be mentioned in the Chrome Enterprise documentation or policies.

> Both can be disabled

How can we disable them? This is on my to-do list for today, so would genuinely appreciate your help!

[1] https://cloud.google.com/chrome-enterprise/

The bug affected Citrix-style environments, where perhaps 10-20 users are running Chrome on the same machine. If 1% of users are running the experiment the chance of two of those 10 users running the experiment is tiny, and when they experience the bug it's unlikely to get reported back to Google.

We were affected and our version hadn't changed (in fact we weren't quite on the latest version - we were still testing it). We have updates disabled and are very much aware of how to manage this.

Google changed a feature flag that was automatically picked up by existing copies of Chrome and changed their behaviour.

This was not a new version of Chrome or a software update. None of our software was updated at all (and we spent a long time checking!). But apparently Google have an ability to change a setting and globally affect the behaviour of all Chrome browsers by enabling experimental features.

We carefully manage our software updates and patching so that we can test it and roll back if it impacts the business. Google had been good at understanding "enterprise" requirements - disabling automatic updates, setting policies etc. But this shows that they're really focused on consumers and business users will always be an afterthought.

https://www.amazon.co.uk/Geek-Atlas-Places-Science-Technolog...

There isn't much discussion of why it's expensive in the US specifically. In other countries insulin prices haven't risen in the same way and are still affordable. So why is the price gouging only happening in the US?

As a T1 diabetic in the UK, where the wonderful NHS covers all of my insulin costs, this is one reason why I'd never be able to move to or work in the US.

It lets you upload your own custom list of banned passwords but it's limited to 1000 words. My impression is that this is intended to blacklist common words and things like your company name.

I see that Troy Hunt is now working for Microsoft so perhaps there's something in the works related to this. It seems like linking this Azure AD service to the haveibeenpwned API would be pretty straightforward.

I'm using Active Directory and options for extra password checks are somewhat limited.

If you're using Google Accounts then they have a feature for this[1]. It detects when they enter their Google password into any other site then reports it and makes them change their password. I'd love a similar feature that somehow worked with Active Directory.

[1] Password Alert: https://support.google.com/a/answer/6197480

Somewhat related blog post which I like to refer people to: "Command-line Tools can be 235x Faster than your Hadoop Cluster" https://adamdrake.com/command-line-tools-can-be-235x-faster-...

If you use xDrip and stretch the life of the sensors and transmitters then the Dexcom isn't much more expensive than the Libre (at least for me, in the UK).

Scott is using the G6 now I think, and most T1s I read online recommend Dexcom.

You'd only get an average speed but that should be enough to catch the worst offenders.

Something like this[1] has been used on UK motorways for a while.

[1] https://en.wikipedia.org/wiki/SPECS_(speed_camera)

It looks like we may only have seen scanned copies of the documents, so any Office metadata would be missing.

I wonder if there is any other subtle metadata. Perhaps default tab stops or borders?

For example the MX300 quotes endurance of 200-300TB. The 5100 is several times that - up to 17PB.

If you're running a database server then you might need that endurance.

There were stamp duty changes in 2010. So for the right priced house you'd have paid signifcantly less tax on 1/1/2010 than on 31/12/2009.

That graph does seem to have a lot of "jumps" though, I'd be interested to know why. It may just be an artifact of how often different areas report?

Each of the trusted banks could be given access to the blockchain (rather than needing proof-of-work) and it would work as a distributed ledger without the need for VocaLink as a trusted intermediary.

Of course the question is how the costs of running VocaLink compare to those of running a blockchain type system.

But the XKCD cartoon is working on the assumption that this is exactly what the attacker is doing. Despite that, they would have to do more work than to crack the "Tr0ub4dor&3" type password.

I think Schneier just got the wrong end of the stick here. The XKCD reasoning seems valid to me.

On my system /usr/share/dict/words has ~45k words. That's 15 bits of entropy per word, significantly more than XKCD (which assumes 11 bits).

So I'd agree that there probably aren't many unique dictionaries. The strength of this password scheme is that it works even assuming the attacker knows your dictionary.

In practice, I guess that an attacker will use a concatenation of all popular dictionaries. This will make things slightly harder for them (e.g. if they have 50k words vs the 30k in your dictionary) but not by a huge factor.

A quick search suggests 8.9M sheep in Wales[1], around 430s/km^2 , NZ is only about 120s/km^2.

Per capita though NZ beats Wales, and probably any other country.

[1] http://www.walesonline.co.uk/news/local-news/sheep-lamb-popu...