waste_monk

>I think that is a little entitled. They should be happy google isn't just straight up emailing full-disclisure.

Google has literally billions of dollars in profits (in part because they use FFmpeg in a bunch of commercial products like Youtube and Chrome), and one of the largest software workforces in the world, including expertise on secure software and vulnerability remediation.

If anyone can afford to contribute back a fix instead of just raising a report, and has the ethical responsibility to do so, it's Google.

>That way when your CA private key leaks (the key which we never ever rotate, of course)

As with X.509, any serious usage will involve a hardware security module, so that compromise of the CA host does not allow the key to be leaked. You'd still have a very bad day, but it can be mitigated.

I do think it's a fairly significant flaw that SSH CA doesn't support intermediate CA's (or at least didn't last time I looked into it) to enable an offline root CA.

>Bonus points if the same CA is also used for authenticating users.

The SSH CA mechanism can be used for both Host and User auth, yes.

Keeping in mind, in a real use case this would be tied to something like active directory / LDAP, so you can automate issuance of ssh keys to users and hosts.

Systems configured to trust the SSH CA can trust that the user logging in is who they say they are because the principal has already been authenticated and vouched for by the identity provider, no more manually managing known_hosts and authorized_keys, or having to deal with Trust On First Use or host key changed errors.

You can also set the CA's endorsement of the issued keys to fairly short lifetimes, so you can simplify your keymat lifecycle management a great deal - no worrying about old keys lying around forever if the CA only issues them as valid for an hour / day / etc. .

Overall I think you still come out ahead on security.

I just want the damn fridge to keep food cold, I never want it to do anything else .

It's bad enough I have to see ads outside the house and on tv/internet, I don't need to see them on my fucking appliances. We are living in hell.

I understand there is an "Exclude Top Choices" algorithm which helps combat this sort of thing.

Also worth noting that FTPS (FTP over TLS) exists and obviates the fuss around SSH TOFU and key management etc. Especially given we're in the era of free certificates via Let's Encrypt, this is a great option.

The main downside is people will sometimes assume you mean SFTP (not having heard of FTPS or realising they are different), and then get upset when it doesn't work as they expect. However good tooling will support both e.g. Filezilla.

I'm not a firmware dev but the one's I've seen working usually have all sorts of fancy test kits, debug instrumentation, Software (chip scope?), etc. to debug with, not just relying on print debugging.

Not to say it isn't a valid way to debug, but there are definately better options available.

♫ It's the most blunderful time of the year

There'll be much admin moaning

And servers not glowing

and the NOC crew in tears

It's the most blunderful time of the year ♫

That'd make for a decent heist comedy - a bunch of former professional athletes get hired to break in to a low-oxygen data center, but the plan goes wrong and they have to use their sports skills in improbable ways to pull it off.

This was part of what complicated the response to the Kursk disaster - they had a rescue buoy but it was welded in place so it couldn't deploy.

>You can't yell at an AI

You certainly can. Not productively, but you can.

>Can halon systems not put out lithium fires?

As the other commenter said, Halon hasn't been a thing for a fair while, but inert gas fire suppression systems in general are still popular.

I would expect it wouldn't be sufficient for a lithium ion battery fire - you'd temporarily displace the oxygen, sure, but the conditions for fire would still exist - as soon as enough nitrogen (or whatever suppressant gas is in use) dissipates, it'd start back up again.

Also as I understand thermal runaway is self-sustaining, since the lithium ion batteries have a limited capacity to provide their own oxygen (something to do with the cathode breaking down?), so it might continue burning even while the area is mostly flooded with inert gas.

I believe it would be similar to an EV car fire, that is, you'd have to flood the area with water and wait for it to cool down enough that thermal runaway stops. Maybe they can do better these days with encapsulating agents but I'd still expect the rack housing the UPS to be a write-off.

I see plenty of "glove box"-type lab equipment which has an airtight enclosure (often rated to some degree of vacuum), and gloves which allow handling of things inside. Surely it wouldn't be too hard to DIY such an enclosure, but pressurise it to 1 ATM instead? E.g. a small air compressor and a relief valve set to ~15psi or so?

I am thinking that you would put a kettle of water inside, pressurise the container, and then boil the kettle (would need a power or gas line installed) and make the coffee using the handling gloves. Then depressurise the container and retrieve the beverage.

I'm no engineer so I would be interested to know if this would set me down a path of "you'll accidentally maim yourself", but I wouldn't think you'd need anything fancy or hazardous in terms of materials or engineering, given most human-made structures exist at 1atm.

Would probably need to be careful to let the coffee sit for a few minutes to avoid flash-boiling it though, unless you're adding cold milk.

>My lay understanding of export is that the information would somehow have to leave the country;

It's not just physical items like munitions, but also things like transfers of information (blueprints, technical data, documentation, etc.) or services being performed, regardless of where (inside or outside the USA) or how (paper, electronic, verbal, etc.) it takes place.

Have a look at [1] § 120.50 (Export) and § 120.63 (definition of Foreign person).

>if someone looks at the T-shirt and transmits it out the country they'd be the exporter, not the person wearing the T-shirt.

I believe the person wearing the shirt would be considered the exporter, as that is the point where the information moves from (I'm assuming for the purposes of conversation) an USA citizen to a foreign person.

But again, I could be wrong. Safest bet is not to print the shirt to begin with :)

[1] https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M...

> Hypothetically it would be legal to display that in public in the US

Would it? I'm certainly not a lawyer or ITAR expert, but I would think that if you walked through a public space where you couldn't positively confirm that everyone present (and everyone who might view it transitively via video recordings, live streams, etc.) was OK to access the materiel on the shirt, that would be considered an export and you'd be in big trouble.

Indeed, this already exists with record types such as TLSA, SMIMEA, and CERT.

However I don't believe I've ever seen it used "in the wild".

>This is meant to be an egg-sized quantity of butter, but what was a normal sized egg in 1905?

This site [1] has some interesting info:

[1886] "The average weight of twenty eggs laid by fowls of different breeds is two and one-eighth pounds. The breeds that lay the largest eggs, average seven to a pound, are Black Spanish, Houdans, La Fleches, and Creve Coeures. Eggs of medium size and weight, averaging eight or nine to a pound, are laid by Leghorns, Cochins, Brahmins, Polands, Dorkings, Games, Sultans. Hamburgs lay about ten eggs to a pound. Thus there is a difference of three eggs in one pound weight. Hence it is claimed that in justice to the consumer eggs should be sold by weight." ---The Grocers' Hand-Book and Directory, Artemas Ward [Philadelphia Grocer Publishing:Philadelphia] 1886 (p. 67)

With similar figures given for 1911 as well. Which would suggest a normal egg in 1905 would be approximately 56g (1 pound/ 8 eggs = 0.125lb per egg).

[1] https://www.foodtimeline.org/foodeggs.html

Presumably they mean something treating it more like renting a car.

E.g. if a game console manufacturer wants to retain owner-level control of their console, they can rent it to you for $X per month, which would include a Y% sales/VAT/GST/whatever tax.

And correspondingly if the device is sold to you, they should not be able to do things like disallow you from running custom software, remotely brick the device with a soft fuse, etc. and otherwise stop you from using it freely.

I think there is a middle ground (e.g. you can buy the console and either have it in "secure" mode as it ships from the factory, or choose to "root" the device and gain the ability to run custom code - perhaps this would invalidate the manufacturer's attestation keys from the secure enclave or burn a soft fuse as part of the process, so it no longer passes checks for DRM and so on). However that may not be economically viable as I understand the consoles are often loss leaders on the hardware and the profit is made on game sales and licensing.

>It originated in China, but in recent months and years, it has gained traction as a talking point in tech and startups.

I thought I saw something about 996 being made illegal in china a while back, and at a quick search it appears that was the case back in 2021.

Why is it suddenly becoming popular outside of China?

Well, it's not like it's in short supply...

It's simple, efficient, and saves space in memory. While not as big a deal these days where most systems have plentiful RAM, it's still useful on things like embedded devices.

Why waste a whole byte on a bool that has one bit of data, when you can pack the equivalent of eight bools into the same space as an uint8_t for free?

My university offered (not sure if it still exists) a software engineer degree that was part of the school of engineering, had a mix of courses from the school of engineering and school of math and IT, and at the end of it you would be eligible to take the local equivalent of the PE exam and become a Real Engineer (I think technically you would be in the field of mechatronics).

IMO this should be the standard - software engineer should be a protected title, and everyone else would be titled some flavour of software developer or similar.

It's an open access book, you should have a "open full book pdf" button (a couple down from the blue "export citation" button).

I haven't the time to read it myself at the moment, but the gist appears to be about "attention economy" and how technology affects our lives. There's a blurb and some discussion on goodreads [1].

[1] https://www.goodreads.com/book/show/38364667-stand-out-of-ou...

I thought the issue is more the batteries and weight distribution. That is, EVs usually have the batteries along the length of the chassis to spread the load out, which is not practical to retrofit onto an ICE car.

And if you fill the engine bay on an ICE car with battery packs during the conversion, the weight distribution will be extremely uneven and cause trouble with the suspension and related components, poor handling, etc.

>but entering the Konami Code on the steering wheel to unlock the ignition is quite plausible.

The left, right, left, right part I can see, but surely up, up, down, down, would be difficult on most steering wheels :)

As I understand there's still challenge/response stuff going on when you use a physical key or similar means to unlock the car or start the ignition (as that is how the alarm system and immobiliser distinguish a real key from someone picking the lock or hotwiring the car).

I don't know the details of the attack in the article, but my speculation would be that it would be vulnerable.

>We can go outside and see a sun again

At least until they figure out how to put ads on it.

>A Raspberry Pi outperforms a Cray-1 supercomputer, for instance.

In terms of compute power this is true. However in terms of design and aesthetics I still find the Cray much more charming than the Pi (even if you start adding fancy cases and so on).

> If they're going to do this "suspicious account" locking, they must make MFA mandatory beforehand.

This should probably be the case - I am not a big fan of passkeys [1] but hopefully this will help make non-SMS, phishing resistant MFA available to the masses.

Still, Google are in a difficult position where on the one hand they have people angry about being locked out, and yet if they didn't they would have people angry about their accounts being compromised.

> If that means my account gets compromised, that's my problem.

It is also the problem of everyone on your contacts list, the operators of other services which use Google OAuth for login, anyone who might recieve spam from your compromised account, and so on.

Reducing harm by temporarily restricting the account when heuristics indicate it may be compromised is not unreasonable IMO.

>Note that there is no question who owns the account. That's what the password is for!

This is unfortunately not as true as we would like it to be.

Have a look at the list of compromised services on Have I Been Pwned [2] - not all of these include passwords, and many that do would be hashed (and hopefully salted) rather than plaintext, but it still happens often enough to be of great concern.

[1] WebAuthN / Passkey technology is fine in the general sense, and I am quite happy to use it with a hardware security key (such a Yubikey or Titan) or emulated in a password manager.

However I think the recent push towards having it tied to a TPM on a device such as a phone is a bit short-sighted, simply because these devices are prone to being lost or damaged. If you set up passkey MFA on the phone and don't enrol a backup method, then lose your phone, you have also lost the account. Probably these services should require 2+ MFA methods configured.

[2] https://haveibeenpwned.com/PwnedWebsites

It is true that google's (lack of) customer support is awful.

>it’s well-documented that sometimes, even if you don’t have 2FA turned on and you know your password, they simply won’t let you log in without some sort of additional verification

However, this isn't quite fair on google - it's not arbitrary "sometimes", it's that accounts get locked if there's been unusual or suspicious activity that may indicate an attempt to compromise the account, such as failed login attempts or logins from a new location. The account is locked from single-factor (password only) authentication for a period of time to prevent compromise (which isn't disclosed but as I understand can vary and is usually a week or two), but will allow login with an MFA challenge.

If the account is locked and there are no MFA methods set up or other means of recovery like backup passwords, how are they meant to verify that it's you recovering the account and not an attacker?

Supposing you did manage to talk to a live google support agent, you'd still have the same problem of not being able to verify ownership of the account.

How does medical care factor in to your plans? Do those places have equivalent access to care if you stay in or around the main cities?

Even something like living in the countryside domestically would worry me (that is, longer times between calling for help and it arriving, then time to be transported to a medical centre or hospital, and then probably getting transported to the city anyway for access to advanced medical care).