Veserv

68 ms·

961.
by Veserv 3y ago
You seem to be extremely fixated on the exact number of 12. Any number short of 100 junior dev-days does not even warrant considering the word “crazy”. Multiply all the numbers by 8 for all I care, it does not affect the conclusion that you
962.
by Veserv 3y ago
You called my number absurd even for SV. As you now see, it is reasonably accurate. That you thought it was absurd instead of reasonable shows you are missing key information in the cost-benefit calculation. It might be prudent to re-evalua
963.
by Veserv 3y ago
I was using 10 K$ as the baseline. Junior devs make 100-200 K$/yr in salary. The fully burdened cost including overhead and benefits is usually around double that at around 200-300 K$ (higher base compensation usually results in lower
964.
by Veserv 3y ago
Is 12 junior dev-days a lot of money for a software development tool? A single junior dev costs 20x as much per year. Is having 5% more junior devs on your team better than better tooling for the other 95% of the team? I can see how it migh
965.
by Veserv 3y ago
You have incurred a 50 K$ debt to the company. Where are you getting the income to pay it? Are you claiming a company can just expunge employee debt willy-nilly? Then instead of a paycheck I can just take a loan from my employer that they e
966.
by Veserv 3y ago
If a company is giving you “50 K$” of training and you are “paying it back” through your work over 5 years then you are actually getting paid 10 K$ more and the company is withholding the amount from your paycheck like how you might elect t
967.
by Veserv 3y ago
Yes. Domestic use is a tiny fraction of all water usage. However, as you point out it is necessary to incorporate the food water to determine actual water independence. 600 AUD/ML is ~400 USD/ML. The Sorek B plant in Israel is pro
968.
by Veserv 3y ago
Yes. And yes that is one of the ways to solve it. You could also do something like have a clean mapping table (i.e. the code with no breakpoints installed) that you install for just the thread doing the step. You then revert back to the nor
969.
by Veserv 3y ago
You missed a zero. 5 million people by 50 gallons/day is 250 million gallons/day. So they only missed by ~25%. Australia uses a estimated ~16T liters of water per year [1] for all uses including personal and agricultural. That is
970.
by Veserv 3y ago
Can you please fact check that statement? No source or quote was provided and I see no mention in the regulation. Here is the regulation they are talking about: https://unece.org/sites/default/files/2022-05&#x
971.
by Veserv 3y ago
I am blaming them for selling products that are inadequate for the threat environment they are expected to operate in and lying and/or insinuating that they are adequate for that threat environment, especially when they know for certai
972.
by Veserv 3y ago
Yes, various degrees; we are discussing three distinct levels. Why on earth would they all demand the same degree of formal methods? Up to EAL4 all you need is a informal specification; what is basically useless paperwork. It is only at EAL
973.
by Veserv 3y ago
So what you are saying is that EAL >=5 does not imply secure, it is the formal methods that imply secure? Well good news, that is not a mistake. EAL >=5 implies formal methods of various degrees. The standard demands the thing that wo
974.
by Veserv 3y ago
No. The Separation Kernel Protection Profile (SKPP) defines a model for a operating system kernel at EAL6+. So all I am really saying is that safe operating systems are safer than non-safe operating systems. You could also look backwards to
975.
by Veserv 3y ago
EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect agai
976.
by Veserv 3y ago
Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?
977.
by Veserv 3y ago
You said that I was arguing the certification is useless. I was arguing that certifying to low levels is useless. Those are not even close to the same argument. For example, a squat test is a reasonable measure of leg strength. Only squatti
978.
by Veserv 3y ago
The AVA_VAN (vulnerability analysis) Security Assurance Requirement (SAR). AVA_VAN.4 requires “resistance to penetration attackers with a moderate attack potential”. AVA_VAN.4 is only required for EAL5 and higher. You could individually inc
979.
by Veserv 3y ago
They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. I am judging them by their maximum ability ever demonstrated under th
980.
by Veserv 3y ago
Low certification levels certify low levels of security. High certification levels certify high levels of security. EAL4 is known to be too low against modern threats that will attack commercial users. We know this from experience where EAL
981.
by Veserv 3y ago
Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack poten
982.
by Veserv 3y ago
EAL4+ is useless against the prevailing threat actors as can be seen time and time again. There is no point at aiming for inadequate; even if you get there you still get nothing. EAL6-7 certifications are basically the only known, existing
983.
by Veserv 3y ago
Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed i
984.
by Veserv 3y ago
They failed. Repeatedly. For decades. They spent billions trying. The failed so much that the standard writers determined the only logical conclusion is that it must be practically impossible to retrofit a system that failed EAL5 certificat
985.
by Veserv 3y ago
No. The US government briefly had procurement requirements for high security deployments. They were forced to relax them because Microsoft could not make bids that met the minimum requirements for DoD and high security projects and that mad
986.
by Veserv 3y ago
Sure. The Common Criteria for Information Technology Security Evaluation [1] is the foremost internationally recognized standard (ISO 15408) for software security that most large companies certify against for at least some of their product
987.
by Veserv 3y ago
I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of th
988.
by Veserv 3y ago
Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: &q
989.
by Veserv 3y ago
You and Tesla have not provided any evidence. All you have done is point to self-reported numbers with absolutely no supporting data. You can not even tell me the number of accidents reported or the number of miles driven on Autopilot in Q4
990.
by Veserv 3y ago
I am not talking about individual airframes. I am talking about quality of service over the entire fleet. Note that I will be using terminology more fit for IT than actual safety-critical system terminology to highlight the analogous elemen

More ›