rdl

Would be fun to do "smart clays" -- I wonder if you could make a clay which just shifted weights to affect flight path, something cheaper thna a full drone. Or you could fly a $300-500 non-expendable but not-end-of-the-world-if-hit drone trailing a target on a long tether, with no-shoot above a certain angle to keep the drones themselves mostly safe?

(and yeah, I have an M4 and 3 Turkish knockoff M4s (1 great out of the box, one I fixed up, one which doesn't love to eject but I can probably fix), and the 2 x 1301s I own are better.)

Yes, almost certainly HA was running a POCSAG network.

Assuming you aren't joking: Pagers are receive-only, which is why they'd use them in preference to cellphones, which transmit even when just idling to register on cells.

Seems more likely their explosive implant used a separate RF trigger -- makes the whole thing much simpler for them, less detectable. They could run a plane or drone overhead to send the radio initiate message.

Looked like 5-10g (maybe up to 20g?) of explosive, NOT battery. I think you could fit the whole package inside an AA battery, along with an AAAA battery, so you could do something crazy there, or just replace a rechargeable battery pack with something of smaller battery capacity containing the explosive, some electronics, etc. Or just use spare volume inside the case and hope no one does gross physical inspection.

Their visible cameras are $7k, I'd be surprised if this is less than $15k.

Assuming the Berlin patents have expired, a visible light or "night vision" near IR camera made from commodity sensors and on-device stitching is about $100-200 BOM which could be a $500 premium cat toy (and thus actually affordable as a tactical tool for users other than funded US/EU police). I've been finding gear for community safety guys in South Africa and it is amazing how much can get done with cheap consumer gear now.

Passkey support (I know it's a pain) would be great...

I went a few months ago -- was amazing how much better the Museum of Computing was, given it obviously had a tiny budget compared to Bletchley. Bletchley was mostly a bunch of school groups being bored and filling the space, empty buildings, etc.

Museum of Computing was extra amazing because some of the volunteers had worked on the hardware on display (and I'd worked on stuff 20 years after that), so we were able to talk about the actual hardware/OSes.

Having done startups in the national security space (and had to deal with clearances) -- it's a bad system from both directions -- overly onerous compliance for good people AND ineffective at addressing modern security risks. It made sense in the 1950s as a way to protect large development and operational programs with long tenure employment against penetration by an external adversary (USSR), and to a limited extent, ideological or financially motivated defectors. It doesn't work as well today where someone can become "radicalized" online, foreign/international contacts are routine, etc.

Just being a citizenship bar, even if it did nothing else, really complicates hiring in tech -- what you often end up doing is having as much work as possible done uncleared/commercially and then thrown over the wall to cleared people who can implement it with the client. Works well in infosec with mostly systems integrated with commercial stuff; doesn't work with jet engines or missiles as well

Clearances being handed out like relative candy to 18-28 year olds in the military (so, for someone like Manning, approximately zero information responsive to requests (as minor records excluded, and the 7-10 year lookback isn't relevant when you have far fewer adult years), extreme reluctance to suspend or revoke a clearance when granted), and ineffective reporting of incidents.

The hassle of holding a clearance to some extent depends on the issuing agency/level (DOD Secret is relatively non-hassle; law enforcement ones are more lifestyle focused on paper at lower levels; substantial travel restrictions for levels/programs come in above Secret too).

There is also the difference between official restrictions and reality -- given OPM hack and general government incompetence, it's safe to assume your info becomes public or at least known to adversaries, so even after a clearance expires, it would probably be unwise to travel to some countries for a much longer period. Also exposes your family/other contacts to hassle from both USG investigators and potential foreign adversaries.

For US and especially Las Vegas events: usually the venue has their own professional security staff, some with law enforcement status of some kind, mostly with just security guard accreditation, some armed, some medically trained, etc. Venue also provides other paid employee or contractor staff for some things like cleaning, food service, etc. Especially in Las Vegas, this is highly unionized and regulated (to the point where connecting network and power cables within your own booth at a convention center event is prohibited and must be done by venue electricians at something like $400/hr)

Then hacker conferences like defcon have their own volunteer staff of various kinds. These usually are doing crowd control and information, but occasionally get involved in attendee drunken or stupid incidents, usually with lesser consequences to attendees.

Some high profile attendees (NSA head, John McAfee, etc) have their own personal security; goons/volunteers then worked as a buffer between those people and attendees. (I did this for a McAfee event at BSides which was super fun because his armed security were also high on methamphetamine and erratic)

I don't understand how volunteer, non-sworn officer, non nevada licensed security guards (volunteer "goons", who are just private citizens at a private event in a public convention center) can use physical force to take a non-violent trespasser off stage without exposing themselves personally and their organization to substantial liability. Not super familiar with Nevada law.

(Obviously doing crowd control, providing information, and front line emergency response is absolutely fine, although tbh even that they should probably have guard cards in most jurisdictions for liability reasons. If someone is violently disruptive, as a private citizen go for it, but unauthorized speaking on stage is pretty far from that. Would be hilarious if dude makes more money from that than he was stiffed by his employer.)

Nuclear stuff uses more mechanically robust things like solder with a wire brush run through it and photographed over screws/joints.

(Also lol I did the 2013 glitter nail polish talk w Eric Michaud. I feel old now.)

DoE (Sandia iirc) was the premier defensive seals lab in the US but shortly after 9/11 they removed most of their open documentation from the internet.

CIA has the main seals defeat capability in USG.

That is one of the more clear (and opinionated, but IMO correct) summaries of how we got here that I've seen -- thank you!

Another aspect are all the cartel-like programs of banks overall (and the banking regulators) to keep even well-capitalized fintechs from offering these services directly. For e.g. Mercury they could probably be entirely fine without the high debit card fees.

How is discouraging people who don't actually need an ER from showing up at an ER a bad idea? If I have something urgent but not an emergency, I could either do ER or Urgent Care. If I'm pretty confident Urgent Care can handle it, it might make more sense to do 1-2h to go to an urgent care option vs. 10 minutes to ER and 4h wait (for care which exposes me to lots of other risks).

There are a bunch of things where I'd rather wait 8-24h at home, even in pain, than go to an overloaded emergency room.

I am intrigued to learn more if you post anywhere (nothing in your profile); this all seems intriguing.

I assume price would be the major factor. Also, as someone who knows nothing about e-bikes, but who knows "DJI makes good cheap drones and gimbals", they'd be pretty high on my list of "probably makes an ok product" without searching.

I'm super excited about how the apple private compute cloud stuff works -- I tried to build this using intel TXT (predecessor of SGX) and then SGX, and Intel has fucked up so hard and for so long that I'm excited by any new silicon for this. AWS Nitro is really the direct competition, but having good APIs which let app developers do stuff on-device and in some trustworthy/private cloud in a fairly seamless way might be the key innovation here.

If deploying this to end users, you may not want them to be able to footgun themselves/your org, and if you only partially trust the code, you might not want it to be able to easily turn these features on. It's not 100% (I'd rather isolate the password manager so it can't access the network, etc.)

This is obviously different for everyone (and the general problem is fundamental to finite human lifetime and other resources).

For me, I'm definitely putting more effort into things I'm relatively skilled in (both inherent, and due to prior work/historical advantage/access/etc.). Also stuff with the highest return on effort for the amount of effort I'm reasonably likely to put into it (so, something which requires 100 hours to get any result is still possibly ok, but something which requires 4000 hours/yr for 10 years to get any result is much less interesting; something which requires 4000h/yr for 10 years but with incremental rewards, maybe.

Also helps when interests are clustered -- I like hardware, and security, and infrastructure, and crypto, and finance, and satellites, and communications, and military/next gen drone stuff, and interesting legal and jurisdictional arbitrage, and there's a lot of crossover among those, more so than adding other interests outside of that galaxy like art.

Keeping enough spare time/other capacity to take advantage of opportunities as they come up is good, too. e.g. I'm interested in semiconductor fab stuff, but not at a deep professional level doing anything in it, but when I get a chance to work on (security, infra) in that context, I jump on it.

I didn't realize HDHPs were still available in the US post-ACA, due to requirements that all plans cover certain minimum services 100% from the first dollar, making them kind of silly (it basically means there's a doughnut of approximately $2k-$6k in cost where someone might be personally liable in a given year).

HDHP plus great price transparency (especially pre service, where one can potentially cross-shop providers, vs. being in a facility and given only one option) would be good for cost reduction; if you can't surface and measure the costs, you won't have any incentive to lower them.

I personally have a fairly mediocre $230/mo blue cross plan in Puerto Rico which largely only covers care within Puerto Rico (and which I've never actually used for anything), and rely on medical tourism where I pay 100% out of pocket, and until Amazon bought them, OneMedical for cheap clinic care which I also paid 100% out of pocket. I previously had a WA state HDHP for $100-200/mo pre-ACA which was great but ACA killed those/insurers left the state.

It didn't for me.

The annoying thing is the EDU versions (which allow programming) are substantially more expensive than the base versions (IDK if it's a constant ~$10-12k more, or just 3x the price -- I only have the EDU/ENT pricing on the Go2 dog, which I was going to happily pick up for $3k but I want to program it so I'd need to spend >$10k which is beyond impulse buy territory.)

Sendgrid ($2B exit) was one big one.

Now to find Vault alternatives.

TB is slow overall, mainly due to Defender. OWL also totally Broke last year when TB updated on a point release, fixed by OWL in days.

What I want is biometric plus 3 tries 4 digit PIN -- OR a long passphrase.

I'm a Thunderbird-on-Windows-in-VM-on-Mac user for one on-prem and one web-but-can't-access-on-non-managed-windows-endpoint VM account.

This will be nice; I've been stuck using OWL for this purpose (which I think is the main extension; IDK if there's anything else.)

The (US native, presumably) ATC staff speak worse English than the (presumably) non-native English speaker pilots, at least from all the ATC clips I've heard -- JFK and NY region being about the worst. Combining that with bad recordings and it's often difficult to understand, even as a native English speaker with a fair bit of familiarity with aviation (worked with pilots, although mostly rotary and military, working on a PPL)

I would assume a huge pump of some kind.