rgj

Fastly changed it on purpose so they could distinguish between error messages from their Varnish and error messages from an origin customer owned Varnish.

I thought you said you tested it?

ProtonMail apparently also releases details about their customers email sending timestamps to the press. Very strange and not a good sign IMHO.

https://www.reuters.com/world/europe/email-bomb-threat-sent-...

Here in the Netherlands the tax authorities go a long way. They have demanded data from parking apps and even from a museum subscription. Judges have ruled that they are entitled to do so and use this information in court.

https://translate.google.com/translate?sl=nl&tl=en&u=https:/...

https://translate.google.com/translate?sl=nl&tl=en&u=https:/...

In TLS context, “secure” and “insecure” don’t just mean (un)encrypted, but also whether the connection is authenticated, i.e. whether you can be fairly sure you’re looking at the “real” website. This is a far more important property of a site using https.

Especially in a world full of disinformation, authenticity and integrity of information are often a much greater good than confidentiality.

In the mid nineties I worked in a research institute. There was a large shared Novell drive which was always on the verge of full. Almost every day we were asked to clean up our files as much as possible. There were no disc quota for some reason.

One day I was working with my colleague and when the fileserver was full he went to a project folder and removed a file called balloon.txt which immediately freed up a few percent of disk space.

Turned out that we had a number of people who, as soon as the disk had some free space, created large files in order to reserve that free space for themself. About half the capacity of the fileserver was taken up by balloon.txt files.

Never knew. Cool to know, thanks.

I love this

   function returnFalse ()       {return false}

and the fact that their home cooked date_val() function does not use their home cooked isLeapYear() and daysInMonth() functions, but uses its own, pretty much unreadable, leap year determination algorithm.

   var l_k=parseInt(l_y%100)
   var l_m=parseInt(l_y/100)
   if (l_d == 29 && ((l_y/4)!=parseInt(l_y/4)))
   {
    l_err=1 ;
    l_errstring = "Date is invalid.";
   }

   if(l_k ==0){
    if (l_d == 29 && ((l_m/4)!=parseInt(l_m/4)))
    {
     l_err=1 ;
     l_errstring = "Date is invalid.";
    }
   }

The reason for the ban is “revealing private information”. It seems to be related to a Dutch soccer player Memphis Depay.

https://twitter.com/OL_English/status/1371121328649076744

No, as in "firehose". https://mobile.twitter.com/abonin_DNA/status/136953802824345...

They did not have a fire suppression system, only smoke detection. So yeah, they missed something.

I think they failed to install it.

They only mention smoke detection: https://www.ovh.com/world/us/about-us/datacenters.xml

No, "destroyed" looks like this: https://mobile.twitter.com/abonin_DNA/status/136953802824345...

EDIT a picture from earlier this night https://pbs.twimg.com/media/EwGqV17XMAMF_wa?format=jpg&name=...

With water, they said.

Video here. This will be Disaster Recovery 101 material.

https://mobile.twitter.com/abonin_DNA/status/136953802824345...

Let’s not forget that the site probably was actually hosting malicious content. The problem is not Google blocking the site, that was the right decision. The problem is that Google is hard to reach in cases like this.

Shutting down complete access instead of holding back a few cookies is a bit of a stretch as well.

If you must fail, please fail-open then.

And if you decide to fail-close, don’t lie: We’re unimportant to you so you decided to fail-close, and you’re not “working” on anything. You think it’s ok and it can be left like this.

“ Our European visitors are important to us.

This site is currently unavailable to visitors from the European Economic Area while we work to ensure your data is protected in accordance with applicable EU laws.”

The GDPR went into effect almost three years ago. I guess we’re not that important to news10.com.

Best naming scheme I ever saw was at Harbinger in the late nineties. They used the periodic system. The last octet of the IP address corresponded to the atomic number, and you could use the full element name, or the abbreviation. So carbon.harbinger.com was x.x.x.6 and c.harbinger.com was a CNAME to carbon. oxygen or o was .8 etcetera.

I once almost got fired because my computer was called aphrodite, the CTO had to demo my webapp, and he couldn’t spell it correctly.

Even PHP finds null==“null” to be false.

When I started my job as an IT director 10 years ago I was in the customer support room and there was one guy who was known for solving all the hard problems. I was standing behind him when he was talking a call. He patiently listened to the client, then loudly typed random stuff on his keyboard for twenty seconds or so, making sure the client could hear the frantic typing, sighed, and then asked “Is it better now?”

It always was.

It’s a cool thing but come on, you bought it, you didn’t build it. Why are people proud on things they bought?

It was never “security by obscurity is bad”

It was “do not rely on security by obscurity”

“Working towards full PHP 7 compatibility”

PHP 7.0 was released in December 2015...

The fact that it is FOSS makes it _easier_ for someone to compile it with a backdoor or trojan. I would say the need for a certificate is _higher_ there. You don’t need to trust the developers, you need to be able to trust the people who have built the executable.

No, there is the Amazon Connect cloud contact center https://aws.amazon.com/connect/

Without reading the article: any kind of blacklisting is considered harmful in security.

In Nigeria people tend to paint the text “not for sale” on their houses to avoid it being ‘sold’ by scammers.

https://upload.wikimedia.org/wikipedia/commons/b/b2/2003_hou...