acdha

44 ms·

871.
by acdha 1y ago
That linked article says nothing of the sort, which is why it almost immediately switches to talking about stuff from half a century ago. The evidence so for doesn’t show them taking a strong political stance in general–note their Discord h
872.
by acdha 1y ago
You might want to reread more carefully. Using the OS security features to restrict what the code you just installed can do prevents immediate attacks and gives you a chance to notice suspicious activity. If the only way to read a file is f
873.
by acdha 1y ago
Quite possibly - there have been several incidents recently and a number of researchers working together so it’s not clear exactly who found something first and it’s definitely not as simple to fix as tossing a tool in place. The CEO of soc
874.
by acdha 1y ago
Think about how the three major recent incidents were caught: not by individual users installing packages but by security companies running automated scans on new uploads flagging things for audits. This would work quite well in that model,
875.
by acdha 1y ago
It’s the FCC as long as he makes important decisions there. There is no way you can honestly say that he wouldn’t influence others there, and the businesses who are currently facing FCC approval would have to take that influence into consid
876.
by acdha 1y ago
Yes, there’s widespread recognition that the small standard library makes JavaScript uniquely dependent on huge trees of packages, and that many of them (e.g. is-arrayish from last week) are no longer necessary but still linger from the era
877.
by acdha 1y ago
That would be an impossible expectation on the Go toolchain. The pull through proxy can’t magically avoid the need to transfer all dependencies to my device, especially including any native code or other resources. Large projects are going
878.
by acdha 1y ago
Fair, yes, I certainly agree that regulation needs to be a key part of this. In one case I was aware of, simply being able to rebuild an Android image after setting the flag to enable TLS >1.0 would’ve added years to the service life of
879.
by acdha 1y ago
They’re really cool and some people depend on them but working on apps which rely on them has had me thinking about e-waste and cost. Some people have devices which are old but still perfectly functional except that they’re falling out of d
880.
by acdha 1y ago
The key thing is that Nexstar’s owners are hoping to make a lot of money from a merger which the FCC is currently ruling on. That makes threats from the FCC considerably more real: https://www.poynter.org/business-work/
881.
by acdha 1y ago
That’s probably why they didn’t put up a fight but it doesn’t cancel out the illegality of the threat. If the local mob boss shows up and says “nice business, it’d be a shame if something happened to it” that’s still extortion even if you d
882.
by acdha 1y ago
> Actually it was a couple of big ABC affiliate owners that started the avalanche, and ABC followed…not any government pressure. This is highly misleading: those affiliates were responding to government pressure. The FCC is currently mak
883.
by acdha 1y ago
Which is describing a very different situation: if ABC decided not to renew Kimmel’s contract, that’s their right as a business. Their listeners didn’t ask for this, the government made an illegal threat to force their business to stop allo
884.
by acdha 1y ago
Here are the two specific criticisms in the article: > Phishing emails from “@google.com” made it into Gmail. > Google enabled Authenticator cloud sync by default. Both of these seem like fair points where one could reasonably expect
885.
by acdha 1y ago
Yes, trade wars suck but overall if you’re a young Chinese citizen today you’re doing better than your parents or grandparents could’ve dreamed: https://data.worldbank.org/indicator/NY.GDP.PCAP.CD?location... Yes, I’m
886.
by acdha 1y ago
There’s also a cost that installs take much longer, you need the full toolchain installed, and are no longer reproducible due to variations in the local build environment. If everything you do is a first-party CI build of a binary image you
887.
by acdha 1y ago
That’s fair, I can’t say I know their inner thoughts either. Personally I’m concerned about the political unity and lack of respect for other people’s freedom of speech. We’re healthier with a robust public debate.
888.
by acdha 1y ago
Ignoring the genocide topic for the moment, it’s relevant from a speech perspective: that’s an alliance of hard-right groups who have spent the last year conflating criticism of Israel with anti-semitism and trying to shut down voices which
889.
by acdha 1y ago
That doesn’t make sense: it’s like arguing that it wasn’t useful to have boat design switch to compartmentalization in addition to trying to avoid hitting things. You can spend a lot of effort trying to ensure bad code never arrives but unl
890.
by acdha 1y ago
I chuckled, too, but I’m a Python developer and it’s not like this doesn’t happen there either. If you want the shorter version: “laugh after you’ve hardened your update process”.
891.
by acdha 1y ago
I think those are both the case: they’re telling Chinese companies to invest in domestic hardware–implicitly also saying things like being prepared to stop using CUDA–and that means the hardware vendors know not to skimp on getting there (a
892.
by acdha 1y ago
I feel like a lot of things would benefit from that time delay and, perhaps, an in person check like the notary ID verification AWS used to use. About a decade ago I had suggested to Google at an identity forum that they embrace a local gov
893.
by acdha 1y ago
This is funny but ultimately a mischaracterization of a popularity contest. Node culture is extreme–perhaps pathological–about using many dependencies to work around the limited standard library but the same kind of attacks happen everywher
894.
by acdha 1y ago
They’re not the same problems. The Secure Enclave protects things like your biometrics, hardware-backed keys (e.g. on a Mac, WebAuthn and iCloud Keychain), and the integrity of the operating system but not every bit of code running as your
895.
by acdha 1y ago
Good thing neither I nor the author did that, then.
896.
by acdha 1y ago
The need was clear even 30 years ago when UTF-16 was standardized in 1996. UCS-2 was known at the time to be inadequate but there was a period from the mid-80s to early 90s where western developers tried to rpetend that they could only supp
897.
by acdha 1y ago
Yes, and the industry has been responding to it since approximately 5 minutes after Canter & Siegel started cranking out that green card spam in 1994. We have SPF, DKIM, DMARC, etc. _and_ more importantly, the victim in this case was us
898.
by acdha 1y ago
That's a very harsh position to take and one I struggle to find support for in the post. I hope that you are never in the position where you make a mistake and others apply that standard to your response.
899.
by acdha 1y ago
Yes, they made a mistake. They were honest about that. A little secret which will help you in life: everyone makes mistakes, even people who don’t think they will, even you. Looking all the way back to last week and 2 major NPM hacks ago, y
900.
by acdha 1y ago
How do they do that if you are incapable of giving them a valid authentication code? I don’t use Google but at least in the Apple world you also get a fairly different prompt for enrolling a new iCloud Keychain device than simply logging in

More ›