EQYV

Please can this not be true..

> because system vulnerabilities are solvable problems

If only…

> I hate that you are reducing my craft to just the end results and nothing else. No value in my expertise or knowledge, all of the hours slogging through blog posts, IT forums, stackoverflow and technical pdfs and you have reduced that to "well what can you build for me?"

Perhaps this comment spells the end of my account but I can’t not say this.

What you can create for your employer is and always was the ONLY reason they valued you. And why would you ever expect anything different? You are not hired for your suffering, your experience, the time you spent learning everything you know OTHER THAN insofar as it helps deliver your employer value.

By the way, I do not think your time has been wasted! Your knowledge and experience are extremely useful to avoid entire categories of problems that a naive LLM-only approach would produce in spades.

Concur. Have we forgotten about https://en.wikipedia.org/wiki/Therac-25?

This is beautiful!

This is a completely unacceptable vulnerability in any software purporting itself to be an identity provider. OP, name and shame this provider. I do not want to find myself using it.

Question: How does a subdomain get discovered by a member of the public if there are no references to it anywhere online?

The only thing I can think of that would let you do that would be a DNS zone transfer request, but those are almost always disallowed from most origin IPs.

https://en.m.wikipedia.org/wiki/DNS_zone_transfer

What do you mean by AI groups in this case?

Sounds kinda like Amazon..

Last I read, RPKI data gets stripped if it passes through an AS that doesn’t support it.. Has that changed?

Very much the same from me. I know +1 posts aren’t generally welcome here but I hope dang can forgive it.

Honest question, why is this your reaction? Why are people on this forum so unwilling to be happy for others? I have noticed that this attitude is extremely prominent in tech. Everything is either perfect (according to the person making the judgement) or it’s utterly worthy of ridicule. I am growing very, very tired of seeing this throughout tech.

I haven’t managed to get the built in tailscale route-through-exit-node functionality working on my router. Have you / others had success?

What about LTT is objectionable?

Well, maybe he shouldn’t but it seems he’d rather not deal with this problem at all and now we have the status quo. That has to be a situation you’re willing to accept, unless you’re saying Facebook should be forced to allow news, and be forced to pay for it.

Kind of stunning that people throw around “redneck” here on HN so casually with 0 condemnation, but also simultaneously quite predictable.

Isn't this more to prevent ISPs from modifying the results of your DNS queries? Also, in the future when we get encrypted SNI, users of websites behind CDNs like CloudFlare or similar (where the website you are visiting will not be discernible from the IP you're connecting to) will benefit from DoH + eSNI.

Thanks! Just switched to this for a project I'm working on.

Maybe I'm misunderstanding, but why would there be a boot time flag instead of just having two versions, seeing as a particular CPU could only run one version?

Yeah, no.

This is my main concern as well.

If the United States pre-emptively attacks a foreign country with a cyber attack resulting in the loss of human life, then yes, Russia or any state would be justified in retaliating. This is equally true for any such use of any weapon of mass destruction.

Then we should not be so meek as to do nothing. During the Cold War, nations did not sit idly by as their adversaries developed nuclear capabilities which, make no mistake about it, targeted civilians and civilian infrastructure. Of course, we developed our own defensive capabilities but then, as now, we faced a type of threat which hugely favored the attacker. So we kept pace with the offensive capabilities of our adversaries. If China or Russia (the states themselves) is identified beyond doubt as the source of this attack, then our policy must be to retaliate in kind.

Mutually assured destruction for the cyber-age.

If it's organized criminal hackers we're dealing with, then we should treat them how we would treat any legitimate terroristic threat. I would want our intelligence agencies to reach out and touch them.

This may not be a popular point of view on Hacker News. I unfortunately cannot fathom an alternative solution.

This is correct.

Absolutely true as well.

I didn’t say law enforcement. Maybe the intelligence agencies can do something useful.

If this attack results in actual loss of life, I firmly believe the US should ensure that there are real-world physical consequences for these criminals. They cannot be described as anything less than the worst humanity has to offer. A failure to respond with meaningful and severe consequences for those responsible (assuming this is attack can be confidently attributed to a particular threat actor) opens the floodgates. Time to find out how seriously the US takes its own cyber doctrine.

https://www.reuters.com/article/us-usa-defense-cybersecurity...