akerl_

15 ms·

271.
by akerl_ 6mo ago
It looks like the expected thing happened. The kernel devs patched the kernel. The kernel devs have a pretty known, straightforward stance in how they ship fixes for anything, because anything in the kernel can be a security problem. Distro
272.
by akerl_ 6mo ago
What does that have to do with this comment thread? Copying from the comment I was replying to: > But publishing a working exploit together with the disclosure before patches are available is really really irresponsible, maybe even crimi
273.
by akerl_ 6mo ago
What the heck is up with people today. Using quotes around something where you’re actually doing a strawman paraphrase of another commenter you disagree with is bad form.
274.
by akerl_ 6mo ago
Yes, you could. Thats the core of my point: there is no Right way to handle vulnerability disclosure. There are many competing factors, most of them have major elements of uncertainty because you can’t know who knows what or how various pro
275.
by akerl_ 6mo ago
… I used quotes to wrap something that I was saying. I even called out that it was something I was saying, as a more accurate variant of what you’d claimed I meant.
276.
by akerl_ 6mo ago
Idk why you felt the need to use quotes to wrap something I didn’t say, and that is a pretty uncharitable attempt at reframing my question. If you wanted a quote, here’s what I’d say: “Because we can’t know if there was exploitation by exis
277.
by akerl_ 6mo ago
If you wanted to somehow make coordinated disclosure into a legal framework, that would be an interesting and complex project. But it’s not the law anywhere I’m aware of today, and I’d not support it becoming a law.
278.
by akerl_ 6mo ago
I asked a question and you replied with a statement. Your statement didn’t frame itself as an opinion but as fact. The hilarious bit is that the idea that they needed to coordinate is clearly broken even in just this example. They did give
279.
by akerl_ 6mo ago
It’s your opinion that it’s irresponsible and that it makes something worse.
280.
by akerl_ 6mo ago
> maybe even criminal What’s your theory here? What crime?
281.
by akerl_ 6mo ago
Who knows how many attackers had found this vulnerability and had already been using it prior to this research finding it?
282.
by akerl_ 6mo ago
I don’t know if “cool” is the word I’d use, but there isn’t an established “right” way to disclose a vulnerability that you found outside of a contracted security review or other employment/contracting arrangement.
283.
by akerl_ 6mo ago
I only refer to my kids by their social security numbers until they do something suitably remarkable. I guess it’s a good thing I’m not a SovCit or I’d just have to call them Traveller Three and Traveller Four
284.
by akerl_ 6mo ago
Might be more illuminating to look at Ethereum Classic. How’s that doing after the fork led by the central owners of a decentralized blockchain, initiated to reallocate a big pile of money that the devs didn’t think was in the right spot?
285.
by akerl_ 6mo ago
You were talking about actual commerce, though. Is that revenue actually tied to something in the market, or is it just all of these companies and investors blowing air into the bubble?
286.
by akerl_ 6mo ago
> Their valuation is backed by actual commerce. Is it?
287.
by akerl_ 6mo ago
Well yea. But so much of the bitcoin/crypto was specifically built on the idea that technology and “decentralized” blockchains were the right and necessary solution to protect us from this kind of centralized human manipulation.
288.
by akerl_ 6mo ago
Ah yes, cryptocurrency: built on an immutable ledger so that your money is safely secured by your private key until the project devs decide it’s not.
289.
by akerl_ 6mo ago
How does an experienced teacher or pilot differ from an experienced game designer?
290.
by akerl_ 6mo ago
It’s not unreasonable to ask but they can and are saying “no”.
291.
by akerl_ 6mo ago
This assumes that the intrusion is persistent until Sentry catches it, that Sentry notifies me, that I successfully track all the places I have long-lived tokens that need to be rotated, etc.
292.
by akerl_ 6mo ago
> Long-lived production SSH keys may be copied around, hardcoded into configuration files, and potentially forgotten about until there is an incident. If you replace long-lived SSH keys with a pattern like EC2 instance connect, SSH keys
293.
by akerl_ 6mo ago
This sounds more like a reason to automate token management than an argument for long lived tokens.
294.
by akerl_ 6mo ago
Why would this work? If the legal stance is that clean room implementations are not derivative works, even if done using AI, I don’t see how adding a license clause would override that. You may as well include a clause saying that anyone wh
295.
by akerl_ 6mo ago
What’s the right way to take this?
296.
by akerl_ 6mo ago
These are two totally different articles.
297.
by akerl_ 6mo ago
I think the point was that people are willing to be happy about this happening to tech CEOs but would not express the same about a gang shooting.
298.
by akerl_ 6mo ago
> Rather, only stating that such indifference does logically follow in those circumstances. This is exactly what I’m talking about.
299.
by akerl_ 6mo ago
The title of this article seems muddled. If I'm reading the actual court documents correctly: 1. This wasn't an appeal. They had to make their motion to both the federal district court and the circuit court. 2. This was a motion f
300.
by akerl_ 6mo ago
This is the waffling again. You made the pitch earlier that explicit condemnation felt hollow. Your comments here (and the many from other people saying similar things) are what look hollow to me. When you say things like "it's ea

More ›