dx034

55 ms·

691.
by dx034 6y ago
I've been involved in debugging a bug in a software that occurred on Kubernetes cluster at the client site but couldn't be reproduced locally. Reproducing that is so much harder than a similar software installation. You have so ma
692.
by dx034 6y ago
> io2 also has a 0.001% annual failure rate, while the others have a .2% failure rate. Is failing once every 5 years really different from failing once every 1000 years? You should have disaster recovery plans anyway and configuration er
693.
by dx034 6y ago
Not sure how they determine that though? At that level, drive failures or single host failures (for which they have plenty of data available) won't cause issues. The risk remaining are botched deployments or config changes that bring d
694.
by dx034 6y ago
But you should also account for up to 100-200ms network latency (especially with mobile networks) plus some rendering time. A 200ms server response time can already lead to a perceived 500ms loading time.
695.
by dx034 6y ago
Most attackers aren't that smart. Rules like this prevent many from trying an attack as it's much harder to perform an attack if you have to take your baby with you. No one ever said the 100ml rule was good, it was just the best a
696.
by dx034 6y ago
Absolutely, even for large companies it's standard to have security regularly look for suspicious items.
697.
by dx034 6y ago
To be fair, they probably had to choose between taking risks they previously weren't willing to take (trust in consultants should always be lower than in your own employees in my opinion) but had no choice with Covid. The last months w
698.
by dx034 6y ago
And having two computers is just annoying. I dislike when companies prevent me from using my computer for personal stuff (esp web surfing). But if I was in charge, I also think I wouldn't take that risk and prohibit use outside work. T
699.
by dx034 6y ago
These protections never really work against people who really want to get data out. Worst case you could just take pictures of your screen and read text back via OCR. But most employees would never know how to do this and even if, the thres
700.
by dx034 6y ago
The paper is easier to read than Twitter: https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichu...
701.
by dx034 6y ago
They created urgency. A case otherwise could've taken years for a first decision and would've been purely theoretical. They now need a decision within 14 days and can prove significant damage if the courts rule in Apple's fav
702.
by dx034 6y ago
Those kids just create a new account. They're not businesses with thousands of employees that are dependent on TOS enforcement by Epic.
703.
by dx034 6y ago
You pay a nominal fee and can publish an App. There's no selection process. Consoles however won't just let anyone on their platform.
704.
by dx034 6y ago
AFAIK consoles were never open to any game. Phones only became walled gardens with Apples Store. And they remain completely shut off to external apps only on iOS.
705.
by dx034 6y ago
Already with new ARM-based Macs, or have they already published a fully working version?
706.
by dx034 6y ago
So that your legal rights aren't undermined. Especially companies dependent on single large companies have the legal system as their only protection against abuse.
707.
by dx034 6y ago
It doesn't work like that. As a business you cannot refuse serving customers just because they sue you (especially B2B).
708.
by dx034 6y ago
Or Epic hoped for that reaction as it shows Apple's reaction to be out of proportion. Just banning the game would've been a logical move but destroying other businesses not related to the 30% cut in Fortnite could give them a much
709.
by dx034 6y ago
And if they don't and courts side with Apple, Tencent might be willing to pay the damage. The upside across their companies is large enough to justify the damage. If courts side with Apple, Google might be next depending on their behav
710.
by dx034 6y ago
Jailbreaking uses vulnerabilities, there is no way to jailbreak a phone officially. Whereas Android allows sideloading apps officially.
711.
by dx034 6y ago
You could've probably reported this. Logging login times of everyone for all employees to see likely violates employees' privacy.
712.
by dx034 6y ago
But way more people would use md5 for password hashing than crc32. Of course someone could circumvent these tests, but the risk of someone copying an old tutorial where md5 is used for password hashing can be mitigated.
713.
by dx034 6y ago
And it's good! Code Reviews can't surface all issues. Independent audits should be welcomed by developers to find more bugs and potential security risks (even though I'm a bigger fan of penetration tests instead of audits).
714.
by dx034 6y ago
Even with VPN. I don't want any person on the vpn to be potentially able to read traffic between internal services. I think that would fail many audits.
715.
by dx034 6y ago
Which means if someone gets access to the internal network, they can read all traffic. And even dev systems can send confidential data. With letsencrypt and easy to generate certificates, https everywhere is very reasonable.
716.
by dx034 6y ago
I actually think that's valid. Sure, http on a dev machine isn't a security risk. But there is a tail risk that it ends up somewhere on a system that sends data between machines. Also, using http on dev and https on prod can lead
717.
by dx034 6y ago
I don't think any German cities bans you from having wild gardens. Quite the opposite, some cities consider banning people from replacing front yards with gravel.
718.
by dx034 6y ago
The problem is that many at Google don't necessarily see the problem in gathering data. That's not just Google, at many companies engineers prefer gathering more data rather than less, as it makes debugging easier and aides future
719.
by dx034 6y ago
That's how any company should act. If you stop spending money with the risk of no upside, you'll be dead in a decade or two.
720.
by dx034 6y ago
A valid point. Especially as self driving is nowhere close to bringing in revenue for any of the companies involved. Other than engineers working with batteries or metals which lead to actual billion dollar revenues.

More ›