jfoutz

31 ms·

331.
by jfoutz 5y ago
well log4j will be old enough to drink in a few weeks (January 8, 2001). It's way older than bcfg2 or ansible, chef, puppet, etc. I'm not sure when the functionality was added. I'd bet it was the bees knees at the time.
332.
by jfoutz 5y ago
yes that would be true. Unfortunately log4j doesn't get configuration exclusively from config files on the server where it's running. this doesn't look like no access to full RCE like the first few rounds. But this might let
333.
by jfoutz 5y ago
I've just started looking, and I'm not an expert. The key point here is log4j can get configuration a lot of different ways, including a network request. Based on https://logging.apache.org/log4j/2.x/manu
334.
by jfoutz 5y ago
The thing that's great about this model of support is it's auditability. When the normal channels don't work, and you just sorta know a guy get problems fixed gives me a lot of comfort. The main thing is, there's no way
335.
by jfoutz 5y ago
OH Yes! 100% this. The JVM itself is a huge, sprawling beast. Adding in an extra 1000 libraries makes that surface area 1000 times worse. There is probably a way to exfiltrate a list of loaded classes via the exploit. (I can't think of
336.
by jfoutz 5y ago
Deep down, I think we're pretty much all fucked. We've gone too far and there's no way back. And I think you agree. But, hey, there is a glimmer of hope. It's not going to do a damn thing, but cycling instead of driving
337.
by jfoutz 5y ago
I've really enjoyed your comments on this page, your blog, and the sample code you're pointing people at. This feels so much like a 90's java/flash bug, it's kind of hilarious and awesome. I think there are 2 key th
338.
by jfoutz 5y ago
So, kinda? I don't have a spectacular source, but there's this [1] Deportations were highest at the end of Bush's term. Obama gradually ramped down internal deportations. You may recall there was a pretty strong emphasis on D
339.
by jfoutz 5y ago
aside from the massive adoption of a global distributed communication network enabling communication between almost everyone on the planet, coupled with a vast repository of saved knowledge, I can't really think of anything that might
340.
by jfoutz 5y ago
How are people with multiple jobs counted? I’d imagine the gig thing is generally not primary.
341.
by jfoutz 5y ago
A former landlord and friend lived in Aspen when Thompson would ride around on his harly, with a beer in his hand. My friend explained, this was quite impressive, your hands have a lot to do on a motorcycle, throttle, breaks, clutch and ste
342.
by jfoutz 5y ago
Neat! I didn't know, thank you!
343.
by jfoutz 5y ago
I like to point at the signal fire in lord of the rings. Absurdly elaborate communication system that can only one shot a single bit. But it's far far faster than any alternative. And if both sides understand the meaning of the message
344.
by jfoutz 5y ago
I'm not an economist, I'm far from it. It sure seems like the big three these days are housing, food, and gas. Housing is complicated, because it's less elastic. Moving sucks, is expensive and kind of emotional. It's sor
345.
by jfoutz 5y ago
From time to time I've been good enough to think I'm a master of a language. But that skill fades so fast. For some reason the mountains of trivia just sort of fade away without pretty regular use. Once upon a time, I could tell y
346.
by jfoutz 5y ago
You are spinning pretty fast on the side of the planet, but you don’t go flying out into space. Same deal, I’d guess as a layman.
347.
by jfoutz 5y ago
because machine learning is finding and descending the steepest gradient in lots of dimensions.
348.
by jfoutz 5y ago
I have some tangential experience with a big sprawling old university network. It's a hard job. On the one hand, you need to protect academic freedom. Someone really is writing a paper about sexuality and needs access to crazy port sit
349.
by jfoutz 5y ago
Excess power from any source. California has imported power from hover dam forever, for example.
350.
by jfoutz 5y ago
Kahn was from the 90’s, cryogenically frozen and set off in space at slower than light speed.
351.
by jfoutz 5y ago
I vouched for a few of his comments as well. I definitely think about how a quirk of biology or environment could flip the wrong switch in my brain. There are millions of sob stories. I don't do as much as I could, but I do more than n
352.
by jfoutz 5y ago
I believe it. Parents can't be around all the time. Doctors and nurses are busy. Having someone stop by that just checks in is comforting, maybe a social worker or psychologist. I get that the robot seems dystopian, but it's steri
353.
by jfoutz 5y ago
For a few glorious years google was amazing at this. the difference coming from altavista was unreal. at this point, I think I'd prefer boolean queries like altavista so I can search the word vectors myself. maybe some meta info so I c
354.
by jfoutz 5y ago
One of my ancestors father was wealthy. They took long trips over the summer. One year, she came home and they had electricity. One year, they had a telephone. She saw one of the demonstrations of flight by the wright brothers. A global pan
355.
by jfoutz 5y ago
I'm still confused by google's "Chromebook Megathread" ads. with comments disabled. It's vexing.
356.
by jfoutz 5y ago
I'm pretty sure a perhaps 2B of those ~7.55B don't have electricity, or loss of electricity would be an inconvenience. Electricity may not be the best proxy for stability, but it's a huge deal in my life, and I think importan
357.
by jfoutz 5y ago
It’s a lot easier to come up with a down payment on the cheaper house though.
358.
by jfoutz 5y ago
I think it's just hard. a few hundred people will sort themselves out into a structure. Monarchy was unquestionably shitty, but it was a really great path to say, I work for a guy who works for a guy who works for a guy who works for t
359.
by jfoutz 5y ago
That was probably true in the U.S. even 40 years ago. But that time has passed. Good on your Grandpa! Lots of historical systems only work because the whole system is trustworthy. I imagine it would take some serious courage in any of Cambr
360.
by jfoutz 5y ago
I feel this is a little harsh. There are plenty of wealthy or politically connected or just very charismatic people in the US that do the same thing. I can think of 5 peers that followed a similar path. Not at this scale, as far as I know,

More ›