tatersolid

“Safari can’t open the page because it couldn’t establish a secure connection to the server.”

Irony or satire?

> I really wish Microsoft would ship the IANA database with Windows, and the IANA-Windows mapping table too, and provide APIs to query them, and keep them updated with Windows update.

I think they have done exactly what you describe for several years at least:

https://learn.microsoft.com/en-us/dotnet/api/system.timezone...

> since the vast majority of broadcasts are still 480p and 720p.

I don’t think I’ve seen anything below 1080p on Xfinity cable in the USA for at least 10 years. Even older content is typically upscaled at the broadcast source (e.g. Seinfeld reruns)

Are you referring to over-the-air broadcasts? Or cable/satellite broadcasts?

SRP, even the latest version, is unfortunately pretty bad in comparison to modern PAKE protocols: https://blog.cryptographyengineering.com/should-you-use-srp/

That’s a choice made by your tenant admins, it is not the default.

That’s actually pretty easy these days with a reasonable UX… you just choose “use a different authenticator app” instead of Microsoft Authenticator when enrolling MFA.

According to current docs all business-oriented Microsoft Entra ID accounts support only device-bound passkeys. So the Microsoft Authenticator app isn’t absolutely required, a FIDO2 hardware token like a Yubikey or even TPM-backed Windows Hello is supposed to work for these passkeys too.

Software-based “syncable” passkeys (such as Bitwarden) have been on the roadmap for 18+ months but are still not available for business MSFT Entra ID accounts for some reason.

HMAC requires two calls to the underlying hash function. In this case one is with a block-size input and the other is smaller (key size plus output of the first call). When called per-block this approach is much slower than any modern AEAD (which typically requires simple polynomial math on each block plus a single AES/ChaCha/whatever finalization call).

It might be “fast enough for line rate” in your situation but even then you could be saving CPU cycles for other work by using a more efficient construction.

Outlook also recently changed the default “report message” action in the UI to be “report phishing/malware” instead of “report spam”. This was a terrible design choice; phishing reports from my org’s own user base has increased 4x since the change which is a lot of false positives.

So maybe folks mean to “report spam” on your emails but “report phishing” instead…

Two calls to SHA-256 for each block would be very slow compared with a modern AEAD.

We had this happen to one of our apps which redirected to a third-party identity provider which used a different domain name. Basically the app looked like a phishing site to those who clicked on the email links and ended up on a login page on a domain they didn’t recognize. So these users reported the email as phishing in outlook. Microsoft confirmed these user reports were the source of the blocking.

The fix was our own MSFT support case opened via our own E5 subscription which took two weeks to get the app unblocked. To prevent future reports we put a custom hostname on the IdP. So app.example.com now redirects to login.app.example.com

Every request contributes to server costs. Every byte contributes to the 95/5 pricing. Wikipedia can’t afford private peering with every ISP in the world.

In my experience Marketing causes most product and feature naming issues. Technical folks want to name it something obvious, and marketing overrules them.

Viewing distance matters. ppi isn’t the target metric, it’s pixels-per-degree-of-vision that determines if a display setup is “retina”. 60 ppd is equal to 20/20 vision in a human.

My 34” monitor is only 4K but is “retina” at the viewing distance in my home office according to this calculator: https://qasimk.io/screen-ppd/

> This protects me against…malware attacks

Are you sure about that? Many ransomware attackers do recon for some time to find the backup systems and then render those unusable during the attack. In your case your cloud credentials (with delete permissions?) must be present on your live sou ce systems, rendering the cloud backups vulnerable to your overwrite or deletion.

There are immutable options in the bigger cloud storage services but in my experience they are often unused, used incorrectly, or incompatible with tools that update backup metadata in-place.

I’ve encountered several tools/scripts mark a file file as immutable for 90 days the first time it is backed up, but not extend that date correctly on the next incremental, leaving older but still critical data vulnerable to ransomware.

> Costco is a subscription business.

I don’t think that’s accurate. The membership fee is a trivially small percentage for most members, and can’t be a significant margin driver. Especially for those members who have a pack of kids and shop Costco regularly, spending hundreds of dollars per visit.

I personally think the membership fee exists as a gating function to keep less-prolific customers out of overcrowded stores on weekends.

> Again, I don't think people are stupid. I do think they'll say one some things in mixed company to hide their racism.

This continued labeling of all fiscal conservatives as racists is a key reason Democrats keep losing to an obviously crazy person. Nobody’s going to vote for the party which calls them a racist.

A lot of fiscal conservatives are “middle class” undecided voters who have mortgages and kids to worry about. Unsurprisingly they voted for the party who promised lower taxes over the one which did nothing but accuse them of racism.

Every Trump voter I know wanted exactly one thing: lower taxes. That’s it, at whatever cost. That’s the Republican base.

My org doesn’t host a security.txt file because the security@example.com email address been standardized since 1997:

https://www.rfc-editor.org/rfc/rfc2142

> whether Apple has caught up to Qualcomm

My very recent Qualcomm-equipped phone sucks in every stadium, train station, shopping center, and high-rise I’ve entered in the last year.

I’m not sure if that’s Tmo or the modem but Qualcomm is not a panacea for crowded 5G in my experience.

I learned the hard way (major outage) back in the 1990s that no accounts payable or accounts receivable should ever be tied to a single person’s email address. You should use a shared mailbox account like ap@example.com when signing up for all services, or supply that as a separate billing address if the vendor allows. Then you make sure there are always at least three employees monitoring that mailbox, even as people come and go.

Where exactly? Land on the north shore isn’t empty nor is it cheap.

Thank you for the background. Unfortunately, none of those references seem to cover the systems that actually originate the alerts. They only seem to cover the bureaucracy and the transport protocols.

This incident has the appearance of a queue recirculation bug (or maybe a state reset in a Kafka-style consumer) but it’s unclear where I could even report the bug. The FCC site for complaints does not seem to cover this system.

Don’t all modern server OS choose a deterministic interface ID based on the network in the router advertisement? (As I recall this is usually via hashing the MAC with the RA prefix plus some system-wide but stable seed, to avoid using the MAC directly as the interface ID)

Post-edit window, the above should read “…completely skip authorization…”

> At least my experience is that ChatGPT goes super hard on security, heavily promoting the use of best practices.

Not my experience at all. Every LLM produces lots of trivial SQLI/XSS/other-injection vulnerabilities. Worse they seem to completely authorization business logic, error handling, and logging even when prompted to do so.

> Weren't they the one that neutered GSM encryption such that it was essentially ineffective from the get go?

The A5 cipher used in GSM came from France, but supposedly the Brits were also happy to have it be weak.

> It’s not a subsidy, but a hold back from taxation.

These are exactly the same thing in the end unless a subsidies were to exceed tax revenue.

> I have never once dealt with their government in any way shape or form.

It’s likely you have and didn’t know it. The “political officer” or otherwise-embedded party official often has another title or “non-official cover” as they say. Communist governments have operated this way since 1918.

There have been plenty of wild fires in California for millennia. The incompetence is draining the LA river wetlands to build houses, building millions of houses where fires occur, building where water is in short supply, and not building fire breaks and fire suppression systems because they’re “ugly”.