xorcist

The actual revocation needn't be secure. False revocations are an oxymoron.

The practice around revocations need to be secure of course, but that's more on an engineering problem than a cryptographical.

The argument here is kind of hard to follow. Who is the "owner" of the phone, "the user" is also mentioned and it is not clear if these two are the same. Is the owner of the phone in the controlling-software sense, Google, or is it the end user? Both fits, and both are commonly used.

Because if it is the end user, the strong version of the argument would be as follows: The end user signs a document, baked in is an attestation that Google guarantees that this device is an approved Android device with a clean boot chain and a Chrome web browser. Then the end user contests the signature in court, either because they didn't understand what they signed, or they did not sign it at all, or did it under threat. How could the attestation help here?

I do not have experience with all EU countries, of course, but more than one, and nowhere is this an issue today. Countries use a wide variety of electronic identification, from soft certificates and mobile phones to smart cards. But as far as I know, all countries accept signatures made even with normal Windows PCs. You can contest a signed document in court for a multitude of reasons, but that's not specific to electronic signatures.

That seems like a weak argument to require attestation? What would attestation prevent that scenario, specifically?

Scary is the understatement of the day. I can't imagine the environment where someone think that architecture is a good idea.

> senior citizens and tried to explain how to parse the domain

Why would you want end users, senior citizens or not, to mentally parse URLs?

The rule is: If the bank, or paypal, or your landlord, or anyone else really emails you that you have to complete some information to your account or pay the latest bill or whatever, you GO TO THEIR WEBSITE and login normally. If it is important they will have the same information there.

The same rule also applied to unsolicited phonecalls, but it might be harder to follow: If your bank, or the police, or some other important person calls you and asks for information or for you to do something that feels the least bit off or hurried, you take their contact information, you look up whatever it is they want you to do and you CALL THEM BACK at the official telephone number of the bank or the police. You probably already have the number and if you don't it's on their web site. Do not call back on any other number.

People working the phone generally have much worse protocols than people working over email, so they may be less prepared for you to do this, but I have never heard of anything important that was emailed that wasn't also easily available when logged in to the website.

The only time it is appropriate to click a link in an email is when you are verifying your email address with them. Not for any other reason.

> the operation was in no way sponsored by the Saudi state,

We do not know this. There are plentiful evidence to suggest direct involvement of the state itself, and the bin Ladin family is certainly hard to untangle from the Saudi state. That is just from what we can know from unclassified sources.

> except by Trump, Hegseth & co

Do not underestimate the current administration. They have other reasons for this conflict, and so does Netanyahu.

"Military action", perhaps, but that is a very vague term. You replied to someone about "fighting foreign troops on own soil" which describes a ground invasion. 9/11 was something else.

It is USA did not respond with any military force. The response, if any, was behind closed doors and we may never know the details. The only thing we know is that relationships with the Saudis are closer than ever. Journalists aren't even allowed to question why they chop up their regime critics in small pieces and put them in a box because that is considered "impolite".

The public response was largely within domestic policy. New laws, new government agencies, more money spent on the military. It was also alluded to when fighting the continuation war with Iraq, but nothing was ever said explicitly about that.

Isn't verifying sources a much harder problem than just searching the list of works in the first place?

Especially in cases such as this. For well known works of literature and music structured data exists already.

And least one of those environment can contain template strings that are expanded with arguments from request headers when run under popular enterprise java frameworks, and by way of the injection patching could hot load arbitrary code in runtime.

A joke should be funny though, not just a dry description of real life, so let's leave it at that. We've already taken it too far.

You don't. We lost the war already. [1]

You may not store your personal data with the surveillance companies computers, but your friends will store your data there. Your mail, your chats, your contact information. Without even asking you, because our society has during the past two decades completely normalized this. Your local hospital and your police force does this too, at least to some extent, even where legislation disallows it.

The largest companies on our planet is now aligned with the largest governments. I am not sure those alive today will own our data again in our lifetimes.

In a perhaps desperate hope for ironic turnaround, I now put my hope with laws such as Chat Control and Age Verification. It is a hard sell with techies and Internet aligned people these days, so I tend to stay low about it. But my feeling is that legislative overreach may be one of very few things that can normalize self hosting again. Because in practice, these laws are only enforcable for companies. If I chat with my friend by way of my our own computers only, nobody complains and everyone is happy. I will not fight for these laws but I will be honestly happy when they pass.

In fact, having given it a bit of thought, I do not feel it is entirely unreasonable for the surveillance companies to take responsibility for things like CSAM and encouragement to genocide. They do own our data, after all, and they already police it to influence elections and shape consumer trends, to take two well-documented examples, so why should they not also police it in legal ways?

Those were my soapbox minutes for today. I will not take questions about how legislative overreach will create moats and economic incentives for centralization, benefit Facebook and hurt Tik Tok, because that already happened and is too late to change now. The outcome of that particular race between competing evils changes nothing.

[1] Gonggrijp, 2005. https://media.ccc.de/v/22C3-920-en-we_lost_the_war

"Free trade" is one of those euphemisms that seldom is free and only sometimes concerns trade.

It's mostly about leverage to create a stronger position for negotiations.

The same NSA that publicly states "We kill people over metadata"?

If that's the type of things they say publicly at conferences we can only imagine what a more sensitive comment would look like. How anyone can underestimate the importance of that is beyond me.

You are absolutely right. It is a good feature, but it must be a concious decision. It should not be default. You should set it in your shell alias or environment, just like you have something like

  LESS="-FQMR"

(no bell, more status, raw characters, exit if less than one page).

Those are also completely reasonable to use, but they must set conciously, otherwise the might give results that confuse the user.

Right. But more often than not, the problem that's being solved is "we have gotten money to throw at things", so the answer of throwing in many more people to busywork kind of makes sense.

That's before we even think about all the consultants and similar roles where busywork really is work. Then all the organizational or agile roles.

The fact that some product gets shipped and we still have customers is good, because that's what pays for it all, but that is just the foundation we all rest on. Almost like background noise.

Newspeak is the trademark of oppressive regimes. Can we please not overexert ourselves in trying to please the global tech companies by pre-emptively changing our language?

Google details new process to install unverified Android apps. The sentence is much more clear using established language. Not "side-load", whatever that means.

What exactly is your argument here? That organic chemistry is all wrong and oxidization is unfalsifiable, or that the fossil industry itself is fudging the numbers to make it look life we're oxidizing less organic matter than we think?

The big cloud providers are perfectly happy to use GPL'd stuff (see: Elastic, MySQL). They don't need to use embrace-and-extend, they're content with hosting.

The ones pushing for permissive licenses are rather companies like Apple, Android (and to some extent other parts of Google), Microsoft, Oracle. They want to push their proprietary stuff and one way to do that in the face of open source competition is by proprietary extensions.

That used to be my joke! Given that most large organization spend (much) more time with the administrative work around code changes than the actual changes themselves (planning, deciding, meetings) then before we let Claude write our code we should let it write our Jira tickets. It was a great joke because while it was obviously absurd to many people it also made them a bit uneasy.

Cue a similar joke about salary negotiation, and the annual dance around goals and performance indicators. Is it really programmers who should be afraid to become redundant, when you think about it?

I should know better than making jokes about reality. It has already one-upped me too many times.

But your XML document also has syntax! You just pushed it up one level of abstraction.

Your proto-math XML dialect of:

  <subtract><minuend>5</minuend><subtrahend>3</subtrahend></subtract>

instead of:

  5-3

still has higher level syntax. What does:

  <subtract><minuend>5</minuend><subtrahend>i</subtrahend></subtract>

mean? Is it a syntax error? Or does it subtract imaginary numbers? What about exponential notation?

You will have a parser anyway, whether you like it or not. Given that, perhaps "5-3" is the simpler notation after all, even though it requires a specialized (albeit trivial) parser to be carried along with it.

> Charging may seem like a minor inconvenience,

It won't once they're five years old!

I'm not against battery powered headphones, but I won't even take a second look at them if they don't have a battery type that is likely to be available in a decade or two, and isn't inconveniently glued shut. That leaves me very few options.

When I find a pair of cans I like I'd like to keep them. The idea that my tools have planned their obsolensce in advance seems completely ridicolous to me. I would never buy a nice guitar if it had a lifespan shorter than my own, for example.

The "real impact" of AI being gargantuan spending, or something else?

That's .. not at all how interest rates work.

Is the Git Book part of the git repo?

Is the Linux Doc Projec part of the kernel?

No. For good reasons. The only people who insists all doc must live in the same repo as the code are the ones who does not value documentation.

Note, that in both examples above there is a documentation in the main repo, but not all documentation lives there.

"Identity theft" is newspeak right up there with "intellectual property". It serves the sole purpose of diminishing real theft. If someone says "we gave all your money to this other guy, but it's not our fault because he had stolen your identity" doesn't make it so. There are cases of mistaken identity, and with criminal intentions, but there is also an enormous majority of not checking identity because someone was lazy.

See also:

Impostor Syndrome (noun), pathologic avoidance of identifying mediocrity in oneself, e.g. "I'm not mediocre, I just have impostor syndrome!"

You may not like the trivial answer: The same way as we do everything else. How do we get people to show up for work? How do we get people to respect data security boundaries? None of these are questions of technology. The answer is culture. We need to create a strong shared culture of caring, by hiring people that care and putting them in an environment where caring is appreciated.

I have (the start of a) solution, but it's a boring one:

You have to have people who care about this stuff.

If you don't care, the rest does not matter. It does not matter if, when and how you outsource if you don't care about the outcome. You can't just pay someone a salary, nor a consulting bill, check the box and say you've done your part.

And the other way around: These huge consulting conglomerates would get very few jobs if purchasers cared about the details, and not just that all the boxes are checked.

That does not match with my, very much anecdotal, experience.

Real subject matter experts are generally very clear about where their expertise ends. Less experienced people, not so much.

> “EMBRACE FAILARE”—charitably put, to pass through the valley of incompetence as it’s the only path to the slopes of mastery

Instructions unclear. Have pushed secrets to github. When will slope to mastery commence?