Veserv

144 ms·

1411.
by Veserv 6y ago
In general, having a fused instruction is beneficial for performance in that it gives you code size savings which helps with respect to the instruction cache. There are likely other microarchitectural benefits, but that is the obvious one.
1412.
by Veserv 6y ago
Maybe. These were vulnerabilities in every version of Exchange Server for 8 years since Exchange Server 2013 that were only detected because they were already being actively exploited. Unless Microsoft has two distinct Exchange solutions, o
1413.
by Veserv 6y ago
That is only accurate if they can provide a meaningful defense against expected attacks otherwise all you are doing is creating a single central target. Unfortunately, the cloud providers can not mount even a token defense against an attack
1414.
by Veserv 6y ago
Not really. GDPR establishes specific rules around data protection and retention, but what I am proposing is having them establish a contractual obligation to abide by their claims with pre-defined damages in the event of a breach of contra
1415.
by Veserv 6y ago
If they will not send data to their servers anymore, then they can easily regain trust by just introducing a contractual obligation to pay out a reasonable sum if they are found to be doing so that would disincentive them from doing so. Say
1416.
by Veserv 6y ago
The article has good points about the nature of attacks by a determined adversary. The concept of "The One Critical TTP" that companies tout to divert blame and that observers use to justify why they are not vulnerable to the same
1417.
by Veserv 6y ago
What do you mean by secure? Actually impossible? An attacker needs more than $100B to breach it? $1B? $10M? In my opinion, if Jeff Bezos, Satya Nadella, Sundar Pichai, and Tim Cook all got together and wanted to put together a team that shi
1418.
by Veserv 6y ago
If a company is large and low margin and does not care about security and they write in big bold print that they provide exactly zero guarantees about security and it is your problem if something happens and they never insinuate that there
1419.
by Veserv 6y ago
That is only a problem if you create mandatory fixed-cost liability requirements. You can solve the problem by allowing companies to opt-in to liability requirements for some benefit. As an example, we could require that any company that wa
1420.
by Veserv 6y ago
You use cases to determine if you need to react to stop spread since you get results faster. You use hospitalization to determine the time-lagged efficacy of your interventions since it is more precise. What is more useful depends on what y
1421.
by Veserv 6y ago
Youtube actually could manually review literally every video. [1] In 2019, users only uploaded on average 500 hours of video per minute. This is ~30,000 hours per hour. If you had people manually watching every video at 1x speed for their
1422.
by Veserv 6y ago
I happen to agree with that point of view, so just to elaborate from my perspective to head off a likely point of confusion, government censorship is not inherently bad. There are clearly cases where society in the US has determined, and I
1423.
by Veserv 6y ago
I was saying relative to the range I offered. $0.44 versus the low end of my range at $0.50 is not a very significant difference, so the numbers I was using in my original comment would still be largely valid. It is possible that the transp
1424.
by Veserv 6y ago
My research indicates it has not dropped significantly. Here is a report from last year on a winning bid to construct a new massive state-of-the-art desalination plant in Israel for a very low bid of NIS 1.45 or ~$0.44/m^3 [1] which th
1425.
by Veserv 6y ago
Desalination is not cost-competitive compared to piping [1]. The bulk pricing of desalination is between $0.50-$1.00 per m^3, which is approximately a ton. In contrast, piping is ~$0.05 per m^3 per 100 km, so it is cheaper to pipe water som
1426.
by Veserv 6y ago
The author appears to be trying to use error messages in their own code to debug it which is a pretty weird way to use error messages. Error messages are for humans and users. If you are developing your own code you can just use a debugger
1427.
by Veserv 6y ago
Invoking copyright law is unnecessary. It is far simpler and more narrow to claim that they are engaging in the willful destruction or concealment of evidence which is a violation of California Penal Code 135 PC [1][2]. How so? 1. There is
1428.
by Veserv 6y ago
The article does not mention the fourth individual involved, Glenn Hightower (one of the founders of APh Consulting), who from what I've been told was one of the ringleaders of the operation. Here is a third-party mention of Glenn High
1429.
by Veserv 6y ago
IANAL, but given that they are doing this in California, I would say Penal Code 135 PC [1], the willful destruction or hiding of evidence during a legal proceeding such as a criminal investigation. Police conduct during an arrest constitute
1430.
by Veserv 6y ago
I understood perfectly. I am just saying that such actions should be criminal and any reasonable lay person who was properly made aware of what is occurring would agree. Lowering costs is no excuse for engaging in criminal negligence and an
1431.
by Veserv 6y ago
It is not a business "need". These systems have functioned without remote access perfectly well for decades. It is a business "want" and thus must be balanced against any new risks relative to historical risks. The risk
1432.
by Veserv 6y ago
They can just turn off the internet connection. If that doesn't work then they can just destroy the transmitter/receiver if they are going to part it out anyways.
1433.
by Veserv 6y ago
From what I can tell as a lay observer, such schemes are likely illegal in the US. Excepting certain entities with specific legal carveouts or very careful navigation of the legal system such as Paypal and Venmo, every scheme that I am awar
1434.
by Veserv 6y ago
No, IANAL, but my reading of the relevant law indicates that such an arrangement is illegal in the US. Unions in the US are legally enshrined as the exclusive representative of all members of a "unit" which has a precise legal def
1435.
by Veserv 6y ago
Here is my math. 200TB = 200,000,000,000,000 B * 8 bits / B = 1,600,000,000,000,000 bits. 1,600,000,000,000,000 / 599,184,000 = 2,670,298 bits/s = 2.67 Mbps which I think is in the normal range, though maybe a little low. I t
1436.
by Veserv 6y ago
Obviously it would depend on the situation, but in this case we could probably use a metric of something like mean-time-to-discovery which is probably a useful metric for evaluating intrusion detection. Making simplifying assumptions, we ca
1437.
by Veserv 6y ago
True, but it is important to quantify that inadequacy. SolarWinds was actually attacked by an actual threat and their defenses were comically outmatched by that real threat who found real value in attacking them. We are not talking 10%-20%
1438.
by Veserv 6y ago
You do not need to be the best civil engineer in the world to recognize that a new bridge design falling on its first day is a totally inadequate bridge. Similarly, you do not need to be a security expert to recognize that 15 months of acti
1439.
by Veserv 6y ago
Oh good. The attackers were only in their systems since 9/4/19 before being detected on 12/12/20, so only 15 months of infiltration into SolarWinds' systems before detection. At least the payload was only deployed 2
1440.
by Veserv 6y ago
Because the current trend of private companies engaging in censorship is not really "voluntary" private action. A large contingent of the people pushing for censorship will not take no for an answer. If the companies will not &quo

More ›