raesene9

74 ms·

901.
by raesene9 7y ago
So the Chagosian situation didn't have individuals buying land, it was a state (the UK) insisting on a deal to a much less powerful nation and then evicting all the citizens by force. It's relatively clear from the wikipedia page
902.
by raesene9 7y ago
By the sounds of it, another breach from a well-known, not new web application security vulnerability, "Insecure Direct Object Reference". That vuln has been an explicit part of the OWASP Top 10 since 2007... Unlike other common w
903.
by raesene9 7y ago
I'm not sure what the connection here is to the Israeli situation, an entirely different and also complex situation. Here the UK government acted unethically and (according to the UN) illegally in displacing people who had been residen
904.
by raesene9 7y ago
how many generations of people have to live somewhere to be considered "native" then. In this case we're talking what 4-5 generations, depending on how you count it, that sounds fairly native to me. The UK acted poorly here a
905.
by raesene9 7y ago
I don't think that's necessarily true. The UK has acted badly here and the islanders should have a right to live on their native islands. Just because it would possibly help other powers, doesn't exclude the idea that the na
906.
by raesene9 7y ago
someone must be getting it, and it's not the islanders... so it's either the UK government, or someone they sold/gave the rights to.
907.
by raesene9 7y ago
Well whoever's getting the money, it's not the indigenous islanders who should be getting it.
908.
by raesene9 7y ago
I think the PDF link is a conference talk, so I'd guess that a more exhaustive review of options could be impractical in the time available.
909.
by raesene9 7y ago
For me, that comes down to threat model. Should every organization assume that every attacker has access to Linux 0-days that they can use to privesc on a box? My opinion is that that's not a realistic assessment for every attacker
910.
by raesene9 7y ago
So, play with Docker are trying to do something very niche and not something that almost anyone else would try in production, which is running Docker inside Docker, which they do in order to produce the very cool service they do. Their brea
911.
by raesene9 7y ago
So (as I'm sure you know) linux container isolation isn't just a product of namespaces, but namespaces+capabilities+cgroups+(SELinux/Apparmor)+seccomp-bpf. Each one of those layers provides some aspect of isolation and for a
912.
by raesene9 7y ago
The original point I was making what that dismissing container isolation with the trope "containers don't contain" is overly simplistic, not that I thought that docker/runc containers with a default profile had as small
913.
by raesene9 7y ago
Oh I'd agree and gVisor provides (IMO) a smaller attack surface than a default runc container. With that said both options, and indeed hypervisor based isolation, are generally one security flaw away from a breakout vulnerability, so t
914.
by raesene9 7y ago
So the runc vuln, only applied if you were a) running as root in the container and b) hadn't enabled user namespacing. (Also for completeness, it didn't work on RHEL based distros that applied their standard SELinux policy (IIRC)
915.
by raesene9 7y ago
This is a really interesting add-on to GKE and I'm glad to see vendors starting to offer a variety of container runtimes on their platforms. That said, I'm really not a fan of the opening line where it references the old trope of
916.
by raesene9 7y ago
Well like all things in security, that kind of depends :) What gVisor does is provide a smaller attack surface to a containerized process, when compared with a "traditional" Docker container using standard Docker setup (you can, o
917.
by raesene9 7y ago
I used to read Megatokyo back then but stopped visiting regularly as updates slowed, and eventually I stopped altogether. It's interesting that there's a different business model open to webcomics now, than there was back then, wi
918.
by raesene9 7y ago
and also PermitRootLogin, AFAIK
919.
by raesene9 7y ago
If you are running as a non-privileged user inside a container, which breakouts do you think can be used to escalate privileges to the hosting machine? All a container is, is a linux process with added security constraints. So, if you'
920.
by raesene9 8y ago
One thing the Guardian gets right (in my opinion) is their online subscriber model. I subscribed to it, the cost is reasonable (£5/month) and it was easy to sign up and is easy to cancel. Recently I wanted to get some news from a more
921.
by raesene9 8y ago
To quote https://www.kickstarter.com/terms-of-use "When a project is successfully funded, the creator must complete the project and fulfill each reward. Once a creator has done so, they’ve satisfied their obligation to
922.
by raesene9 8y ago
hey if you've managed to get companies to give you money with no contract and no requirement for a deliverable, then good on you :) But that's not what kickstarter is and not what their T&C's say. to quote https:/&#
923.
by raesene9 8y ago
So when someone uses the phrase (which is what I responded to) "remember that you’re playing the role of an investor, rather than a consumer" you don't take from it that this was meant as a short-hand for financial investor?
924.
by raesene9 8y ago
The comment to which I was replying implied that participating in a kickstarter was like being an investor (from context, in the financial sense of that word). So we're talking financial investments, not regular exercise. In the finan
925.
by raesene9 8y ago
Not in the sense of financial investment it's not, unless the defined return is actually bigger (in monetary terms) than the investment. you're referring to something like a bond, that pays back more money than is invested. Ki
926.
by raesene9 8y ago
I wouldn't say crowdfunding is in any way a financial investment. Investment implies monetary return. so if the thing you're investing in is financially successful, you actually make more money than you put in. that doesn&#x27
927.
by raesene9 8y ago
If anyone's interested in the financial side of things, as the companies involved are UK entities all their accounts are available for free through the excellent UK Gov site. https://beta.companieshouse.gov.uk/company&#
928.
by raesene9 8y ago
You're really not playing the part of an investor on Kickstarter or IndieGogo. An investor stands the chance to make a profit if a venture is successful. That does not describe the model of this kickstarter or any other one I've s
929.
by raesene9 8y ago
They tell you those things in safety notes, but then the marketing people at Tesla call it "Autopilot", a name deliberately designed to imply hands-off operation. To quote https://en.wikipedia.org/wiki/Autopil
930.
by raesene9 8y ago
This is a duplicate of https://news.ycombinator.com/item?id=19763413 .

More ›