michaelt

26 ms·

481.
by michaelt 11mo ago
If you engage in “white hat security research” on organisations who haven’t agreed to it (such as by offering roles of engagement on a site like hacker one) there is indeed a risk. For example they might send the police to your door, who’ll
482.
by michaelt 11mo ago
One might consider this a supply chain attack because the title of the post is “We pwned X, Vercel, Cursor, and Discord through a supply-chain attack”
483.
by michaelt 11mo ago
A company has a graduate scheme, they might be hiring 4 graduates this year, they might be hiring 40. Only one job advert. External recruiters might then re-advertise the job with the company name removed, planning to funnel people to the c
484.
by michaelt 11mo ago
Have you ever changed a tyre on a car? If so, you may have noticed the jack you used didn't have several huge CNC machined aluminium parts, a seven-stage all-metal geartrain, or a 330v power supply and it probably didn't cost you
485.
by michaelt 11mo ago
Firstly, the attacker just wants to mine Monero with CPU, they can do that inside the container. Second, even if your Docker container is configured properly, the attacker gets to call themselves root and talk to the kernel. It's a sec
486.
by michaelt 11mo ago
1. Ship the product with automatic updates delivered over https 2. Product is a smart fridge or whatever, reasonable users might keep it offline for 5+ years. 3. New homeowner connects it to the internet. 4. Security update fails because th
487.
by michaelt 11mo ago
> 1. These might need to happen as emergencies if something bad happens Isn't this the whole point of intermediate certificates, though? You know, all the CA's online systems only having an intermediate certificate (and even
488.
by michaelt 11mo ago
If there's one thing I've taken away from Trump's successes, it's that there's no such thing as "political suicide". A massive tax hike on imported goods, making loads of things more expensive? Political s
489.
by michaelt 11mo ago
I'd be interested in hearing more - do you have a source for this? Seems to me CAs have intermediate certificates and can rotate those, not much upside to rotating the root certificates, and lots of downsides.
490.
by michaelt 11mo ago
Even when communicating ideas, there's a simplicity/nuance trade-off to be made. I could say "Trump's unpredictable, seemingly irrational policy choices have alienated our allies, undermined trust in public institutions,
491.
by michaelt 11mo ago
I'm quite surprised the CA/Browser Forum went for this. Nobody's paying for EV certificates now browsers don't display the EV details. The only reason to pay for a certificate is if you're rotating certificates manu
492.
by michaelt 11mo ago
> A running number also carries data. Before you know it, someone's relying on the ordering or counting on there not being gaps - or counting the gaps to figure out something they shouldn't. For example, if https:/&#x2F
493.
by michaelt 11mo ago
Interesting, it's a few years since I've used a Mac. Descriptions of this stuff online are pretty confusing. Apparently there's an "App Sandbox" and also "Transparency Consent and Control" - I assume from
494.
by michaelt 11mo ago
> This is not strictly true - most OS keychain stores have methods of authenticating the requesting application before remitting keys (signatures, non-user-writable paths, etc.), even if its running as the correct user. Isn't that
495.
by michaelt 11mo ago
Doctors should learn about new drugs the traditional way - physically attractive drug company reps taking them out for expensive dinners and gifting them branded golf equipment.
496.
by michaelt 11mo ago
If the orchestra performs less often because the violists have better paying jobs in a factory making the latest and greatest TVs, more homes will have the latest and greatest TVs. Of course, this relies on the assumption most work - and he
497.
by michaelt 11mo ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > How would you digitally sign a Json document and embed the signature in the document? Embedding a signature into the same file is easy enough. -----BEGIN PGP SIGNATURE----- Version: GnuPG
498.
by michaelt 11mo ago
> All vehicles that don't display their license plate for cameras of any kind are illegal, the spirit of this law is to make it so we can identify through the number assigned to the vehicle from the state that identifies it is obvi
499.
by michaelt 11mo ago
> Insurance is a capital management game. We’ll likely see a tech company try this, fail to cover a catastrophic liability due to lack of reserves, and trigger a massive backlash. Google, AFAIK the only company with cars that are actua
500.
by michaelt 11mo ago
> Second, stop moving the map when I search for things. When I search for 'chicago' I like having the map move to Chicago, even if there's a Chicago Grill, Chicago Pizza and Chicago Trading Company closer.
501.
by michaelt 11mo ago
> Why does your codebase generate hundreds of warnings Well, it wasn't my codebase yesterday, because I didn't work here. Today I do. When I build, I get reports of "pkg_resources is deprecated as an API" and "
502.
by michaelt 11mo ago
> Why is it that CI tools don't make warnings visible? A developer setting up CI decides to start an ubuntu 24.04 container and run 'apt-get install npm' This produces 3,600 lines of logging (5.4 log lines per package, 6
503.
by michaelt 11mo ago
If you're the sort of private person who doesn't want a big online presence - why bother to speak at a software conference? Especially a conference big enough they're selective about who they allow to present? About 90% of sp
504.
by michaelt 11mo ago
> What benefit would such a restriction offer to the business? You approve opex budget for the widget department because you know they can turn 10 cents of plastic into $1 of widgets, and you want them doing that in the forthcoming qua
505.
by michaelt 11mo ago
If Kroger operates the same was as Ocado does in the UK, then the drivers are paid by the hour, with the company providing the van and fuel. Agree a lot of modern delivery businesses involve "self-employed" drivers getting paid a
506.
by michaelt 11mo ago
It depends on your business model. If a basket of groceries brought online costs $15 more than the in-store prices, then you can pick in-store profitably, very easy. That's the instacart model. But if a basket of groceries brought onli
507.
by michaelt 11mo ago
Wasn't OpenAI a non-profit?
508.
by michaelt 11mo ago
Let's say there was a power cut and the backup generator failed. The corpse is gone. What happens to the money in the trust?
509.
by michaelt 11mo ago
Isn't the UK also the home of the "Rule against perpetuities" [1] specifically stopping dead people from exerting control over the ownership of private property? To stop some duke in the 1600s setting inheritance rules for &q
510.
by michaelt 11mo ago
Imagine you own a factory that makes plastic widgets. The factory has a widget-making machine. You'll pay rent on the factory and interest on the loan you took out to buy the widget-making machine whether you make one widget or a milli

More ›