akerl_

31 ms·

751.
by akerl_ 1y ago
I’m pretty ok with cash ceasing to exist.
752.
by akerl_ 1y ago
Chick-fil-A is the best at this: you mobile order but they make the order once you’re in line, so the food is made chronologically.
753.
by akerl_ 1y ago
I enjoy talking with humans, but not the part where I’m reciting an order and making them record it.
754.
by akerl_ 1y ago
I’m shocked that anybody with a smartphone is still ordering by talking into a voice box, regardless of whether it’s a human or an AI on the other end. There’s a Starbucks near me that is pickup-only. You mobile order, and inside there’s ju
755.
by akerl_ 1y ago
I just stick all my DNS records in a normal DNS server. In my case I’m terraforming some Route53 zones. So I havd a subdomain off a real domain I own that I use for LAN gear and they all have real DNS. For ports, anything that can just be r
756.
by akerl_ 1y ago
How do you know it hasn’t been discovered by another attacker already?
757.
by akerl_ 1y ago
That seems to depend a lot on the vulnerability, and the company, and the users. I'm not suggesting in this thread that coordinating with vendors is bad. I'm suggesting that to frame any non-coordinated disclosure as inherently ir
758.
by akerl_ 1y ago
What if your assessment is that the user impact is already high enough that the right time to disclose is immediately?
759.
by akerl_ 1y ago
Usually yes, it would go to your ISP. And depending on the ISP they’ll forward it to you or not. This was way more prevalent in the era where movie studios were hiring firms to send bulk DMCAs to people downloading torrents.
760.
by akerl_ 1y ago
The market for this is people who are convinced that the research only proved most people are lazy and unproductive. Surely these wiz kids we’re backing are too jazzed about their startup dreams to have their output decrease after the first
761.
by akerl_ 1y ago
Ah. I don’t have much optimism that companies like Burger King will ever get that 2nd signal (mostly because I don’t think the average consumer-facing business suffers much impact from this kind of incident), but I agree with your premise.
762.
by akerl_ 1y ago
You’ve described a totally different “signal” than the comment I replied to.
763.
by akerl_ 1y ago
Who is getting that signal? Burger King is almost certainly going to experience no damage from this. Their takeaway will likely be entirely non-existent. They’ll fix these bugs, they’ll probably implement zero changes to their internal prac
764.
by akerl_ 1y ago
What about users who are affected by the vulnerability in the time it takes between reporting to the vendor and remediation?
765.
by akerl_ 1y ago
I’m saying out loud “I think rebranding coordinated disclosure as responsible disclosure has negative impacts and we shouldn’t do it”. Thats not putting my thumb on the scale so much as shouting my opinion. The rebrand puts its thumb on the
766.
by akerl_ 1y ago
As a nitpick, you’re describing coordinated disclosure. Branding it as “responsible” puts the thumb on the scale that somehow not coordinating with the vendor is irresponsible.
767.
by akerl_ 1y ago
This person seems to be fishing for a CFAA indictment?
768.
by akerl_ 1y ago
I did this as well. I have terraform interconnected so that I make TF entries in my Unifi repo which become DHCP reservations, and the AWS terraform makes DNS records for them.
769.
by akerl_ 1y ago
That generally suggests they’re not pointing at the resolver you have set to handle that domain. Otherwise your apple devices can’t tell a valid TLD from an invalid one: they just launch the DNS lookup and let the server tell them. The exce
770.
by akerl_ 1y ago
Are they? Browsers treat long-lived self-signed certs pretty much exactly how they always have, from what I’ve seen: if you’ve trusted the cert in your system trust store, it just works. If you haven’t, you get a red warning page and have t
771.
by akerl_ 1y ago
So, I'm of two thoughts here: 1. As parallel commenters have pointed out, no. Plenty of open source developers exist who aren't interested in getting paid for their open source projects. You can tell this because some open source
772.
by akerl_ 1y ago
I think a lot of this boils down to Procurement's good outcome generally being quite different than the good outcome for each team that wants a purchase. To draw a parallel: imagine a large open source project with a large userbase. Th
773.
by akerl_ 1y ago
On a Mac or Windows machine, you generally need something to get you a Linux environment on which to run the containers. You can run your own VM via any number of tools, or you can use WSL now on Windows, etc etc. But Docker Desktop was o
774.
by akerl_ 1y ago
What a strangely hostile reply.
775.
by akerl_ 1y ago
I touched on this in my parallel reply, but to expand on it: The usual way that procurement is handled, for the sake of everybody's sanity, is to sign a flat-rate / tiered contract, often with some kind of true-up window. That way
776.
by akerl_ 1y ago
Idk what to tell you other than that it is. Large companies do have ways to deal with this: they negotiate flat rates or true-up cadences with vendors. But now you’ve raised the bar way higher than “just use podman”.
777.
by akerl_ 1y ago
The problem isn’t generally the cost, it’s the complexity. You end up having to track who has it installed. Hired 5 more people this week? How many of them will want docker desktop? Oh, we’ve maxed the licenses we bought? Time to re-open th
778.
by akerl_ 1y ago
I think the question isn’t “why switch it to libuuid”, it’s “why is anybody ever setting it to a time-based non-CS PRNG”.
779.
by akerl_ 1y ago
Is this “embarrassment” going to cost them anything at all?
780.
by akerl_ 1y ago
Did the company ask for free pentesting?

More ›