975 karma · joined May 19, 2014
That is an exceptional talent retention mechanism that I don't think enough people consider when they talk about how the three-letter-agencies maintain their large talent pools. Once you are in in is very difficult to get out.
"Forcing Apple to extract data in this case, absent clear legal authority to do so, could threaten the trust between Apple and its customers and substantially tarnish the Apple brand"
This quote, granted taken without full context, seems to indicate a pretty clear stipulation of "clear legal authority". Not sure what to make of that, but I do think that in matters of privacy and surveillance the words are always chosen very carefully indeed.
> Surface area and complexity are a big deal. REST encourages creating a CRUD interface for every single resource. I've met people who have created literally 100 endpoints upfront for a small application - how is that maintainable?
I disagree, REST does NOT encourage a CRUD interface for every single SERVER SIDE resource. Your rest resources should be modelled after the resources your CLIENT needs. You should not be designing your client resource models based on the underlying server models regardless of using REST, SOAP or some kind of roll-your-own system.
Not defending the article here, but I don't see this as a problem at all. Yes, you API objects should not necessarily map directly to your persistence layer; that is a good thing. The problem domains of the UI and the persistence layer are completely different and should therefore be modelled differently. Your API mediates between the two, acting like a repository for your UI models and abstracting away the persistence layer completely.
As for grey areas, is it more humane to kill 1 to prevent them from killing 10? Or 2? Or 10,000,000? Two things that should not be spoken of categorically are war and humane/inhumane, they are routinely defined by their grey areas.
To censorship[1].
[1]: http://www.bbc.co.uk/newsbeat/article/33280133/apple-removes...
Besides, this pales in comparison to a yearly MSDN license and that new fancy macbook every couple years, or even that morning starbucks fix.
http://i.imgur.com/OAw6AOc.jpg http://i.imgur.com/Ti09xEh.jpg
IMO a better context for this would be: real software engineering requires compromises. There are a number of competing factors that need to be juggled in order to be successful: time, money, complexity, quality, etc. The point should be that you need to balance these factors, not focus on one above all else.
"For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack."
Firstly, this isn't a statement of evidence, it is an generalized example of the type of evidence the FBI apparently has. Given the lack of any further clarifications on this statement, I don't see how you can make and presumptions as to what the actual evidence is. there just is not enough data here.
Secondly, the statement is carefully worded to say that the C&C IP's have communicated with known NK infrastructure. This is massively different than saying that the C&C IP's are associated with NK infrastructure. What the FBI is saying is that they have been able to apparently collect evidence that shows NK was communicating with the C&C IP's, presumably while the attacks were going on. With what we know about the state of internet surveillance, is it really that unrealistic to think that US SIGINT is collecting every single packet that transits known KN networks? Seems right in their wheelhouse.
Point is, the FBI aint telling us squat about what evidence they may or may not really have. Maybe this is because they are making the whole thing up, or maybe it is because they just don't want to tell us how much evidence they got, and how they got it.