posixplz

I assume you mean "validated" and not "compliant" -- the distinction is important. Yes, it will be 140-2 validated. It's being submitted for testing before end of month to make the 140-2 cutoff. (September is the last month for 140-2 submissions. After September, all new FIPS submissions must be for 140-3 validation.)

It's fair to assume it will take about 12-18 months from submission to certificate issuance.

>> memory safe

> That's an incorrect assumption if you haven't audited the code.

Audit the code? Simply `grep unsafe`.

Spot on. Also worth noting that regulation and government administrative law are the only ways to restrict consolidation. (Anti-trust, FTC merger approvals)

Serve the same content over HTTP and HTTPS. Many web admins today don’t serve content over http, instead they HTTP/301 redirect all http requests to https.

I miss the days when punctuation marks were significant to google searches. And the days when you could use logic operands in searches like +&!

I’m glad I learned POSIX and especially Linux when searches were evaluated more literally. It was simple to locate relevant technical pages.

It’s a shame google doesn’t offer legacy search.

Really, slippery slope fallacy over employers providing food to workers?

The free food does a good job of keeping me in the building. I honestly can’t understand why anyone would be opposed to office perks.

PlantUML is an excellent tool for creating visual representations of system behaviors. Because diagrams are generated from plaintext, they’re easy to maintain and version control. I use it often when designing new features and systems. You don’t need to pay attention to UML semantics to create valuable diagrams.

“I’m sorry if I hurt you,” is a very different statement from, “I am sorry I hurt you.” One makes responsibility conditional, and the other takes responsibility.

It’s a fair inference given the size and rate of known Bitcoin black market busts. In one search, I found a paper that estimates $76B worth of Bitcoin is used in illegal trade per year.

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3102645

FYI, RF paints are poor signal attenuators, even when applied in multiple coats. There’s no RF paint product that can stop commercial cell communication across usable spectrum.

Yes.

Credit card companies do the same thing. They run ads stating you won’t be held liable for fraud. The implication is that the credit card company does this because it cares about you as a customer. The truth is federal law dictates cardholders can’t be held liable for fraudulent charges.

Are MikroTik access points still a royal pain to configure and maintain? I use their switches, but not their APs.

Decades ago, I was a network engineer working in production data centers. I’m used to setting up switches manually. But I have no professional experience with setting up meshed WiFi networks. I like that the Ubiquiti APs “just work” for the most part.

I’ve started to notice weird AP/client failures with my ubiquiti gear and debugging is a nightmare. It seems that ubiquiti has hidden a lot of useful information in an overzealous effort to streamline UX.

Does the cult of personality — its leader, followers, and traditional media amplifiers — bear no responsibility? In the context of this article, “big tech” seems only to be a convenient scape goat, given that this is hardly the first time masses devoted themselves to a truth-less strongman.

This article is filled with anecdotes and provides no real evidence to back its outlandish assertion. Mass delusion and political cults are not new phenomena.

I’m sure the printing press also “helped trash America,” by the author’s standard.

Why bother providing an anecdote like this when we have mountains of empirical evidence about the content on Parler? And that evidence directly counters your assertion.

Facebook and Twitter don’t make the determinations alone. They contract internationally recognized fact checking organizations. Is it perfect? No. Do we need to curtail online disinformation at a platform-level? Yes, clearly we can’t rely on the critical thinking skills of the reader to make a rational determination — if we could, we wouldn’t have this problem in the first place.

This and several posts on this thread seem to think it’s impossible to discern fact from fiction, that every opinion, even if false and presented as factual, deserves equal time.

I fear that if we cannot have factual, cogent policy debates, our democracies are doomed.

Having a manufacturer-curated channel of apps is great. That channel should not come at the cost of consumer choice or competition.

FireEye has provided their own evidence[1]. BBC has strong editorial guidelines for dealing with evidence from third-parties[2]. You, however, have provided nothing but conjecture and redirection.

Can you substantiate your claim? If not, it’s fair to classify your comments as obvious attempts to gaslight HN’s readers.

1: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Gh... 2: https://www.bbc.co.uk/editorialguidelines/guidelines/accurac...

Do you have any evidence that FireEye’s report is inaccurate or misleading?

You are making an outlandish claim, that the BBC is lying in conjunction with FireEye. Back it up with evidence, or abstain from gaslighting please.

Disclaimer: I work at OCI — Oracle Cloud Infrastructure.

> Within an hour of receiving the kit, SCI had OpenVMS V9.0 running in the Oracle High Performance Cloud inside an Oracle VM VirtualBox environment.

This is confusing. OCI doesn’t have a “High Performance Cloud” product. We do have high performance compute, but that is simply latest and greatest hardware via bare metal instances. High performance compute is a standard and long-time part of our portfolio. Perhaps SCI is referencing one of the legacy Oracle cloud products? (I doubt it, Oracle is sun-setting the previous generation of IaaS and migrating all customers to OCI.)

To GP, I don’t think choosing Oracle Cloud is a strange choice anymore. 5 years ago pre-OCI, certainly. Perhaps even two years ago when OCI was still new. But it has come a really long way. From feature, performance, and cost perspectives, it’s a compelling product.

IBMs cloud is on par? With whom? Certainly not AWS and Azure. Nor GCP. Not even with OCI.

Of what relevance is SOX other than dating the period?

For the first time ever, “FIPS to the rescue?”

The streets of San Francisco and Seattle.

Interesting, but no iOS client or WebDAV support. That would prevent me from using it.

Most developer/engineer types have a private server and that’s a great place to install Nextcloud. Nextcloud has cross platform clients, supports strong authenticators (U2F), and open protocols like WebDAV. I even use it to sync org-mode files across many devices with great success.

And all it cost was the inevitable total destruction of our climate and ecology! Yay!

5G has nothing to do with the problem you’ve described — a symptom of insufficient tower backhaul. It’s typical for 4G LTE operators to deploy a minuscule 100Mbit fiber connection per tower. We should be investing in 1Gbit backhaul of LTE.A, but that’s not a sexy message for consumer TV ads.

The farce of 5G is that it’s a pure marketing ploy. It’s not driven by technical need.

That’s definitely the case when thinking about security in a strictly limited scope. In contrast, my team is holistic — any issue that could affect ICA (integrity, confidentiality, availability) is in our purview.

My team engages in the earliest phases of design. Holistic security is our priority, but not a limiter for our engagements.

Software security architect here. Senior management strongly discourages writing code on my team. But this is because we work at-scale with hundreds of products comprised of thousands of microservices.

I don’t attend product teams’ standups , but our engagements run on the order of weeks to months.

We don’t micromanage development or design choices made by product teams. Yes, we review code and make (strong) suggestions, but we leave service teams free to make choices as long as the risk is low and commensurate with the threat model. It’s our job to guide major decisions and, occasionally, advise on the “least-bad” short-term solution, pointing out where, when, and why a re-architecture will be required in the future. Generally speaking, teams want our feedback on design proposals and concepts. It’s a healthy relationship.

Occasionally we have to force teams to reimplement, or block release, but that’s a very rare occurrence.

Unlike many comments on this thread, service teams leave us with pretty positive feedback. It’s very rare that teams leave negative feedback on our design engagements.

Oracle Cloud Infrastructure, actually. Oracle gets a lot of flak on HN, and some of it is justified. But the reality is that the team working on OCI is top-notch. And the product itself is quite compelling.

Oracle as an enterprise/legal behemoth is very different from the cloud transformation business unit.

Big data centers are also most likely to be executing customer input. They almost certainly have all side-channel mitigations applies.