aksss

So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

So where are all the compromised sites? I was sorta expecting some kill lists today, but not seeing anything. Does this mean APTs rather than defacement/ransom? Or has this been a nothingburger?

I think the ubiquiti edgerouter admin interfaces use PHP. I don’t know about mikrotik, but wouldn’t surprise me if there are a lot of those devices hanging off the internet on some nonstandard port.

Haha you’re right, but the skill you need to be good with is probably eye strain tolerance. But must needs and all. :) If you don’t use a WAF of some type, the risk is probably sufficient to warrant firing up the laptop tonight or worst case use the phone.

The exploits seem to rely on multipart form submissions. In a normal setup, I don’t believe PHP’s multipart parser processes GET requests.

Therefore, a temp mitigation that runs short of shutting your site down is to temporarily block POST requests until you can get the patches in place. This will screw up any form functionality, including your WP login form, but keeps your site presence up. A failed form submission is probably a better look than no site presence. You can affect this with Apache config or by using a WAF. For instance if you have cloudflare caching your domain, use a free security rule to block all POST requests until your patches are in. Something like `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

Rather than taking your site down tonight, if you have cloudflare handling your DNS, orangeclouding your domain, you can use its free security rules to just block all post requests until tomorrow rather than taking your whole site offline. Drop this into a rule: `http.request.method in {"POST" "PUT" "PATCH" "DELETE"}`

Of course you can do this with web server (eg Apache) config as well, but the CF rule is something you can do now on your phone.

I’m not saying I know this works as a mitigation, but it seems like it could at least contribute to a temporary guard until you get patch in place. Everything I’ve seen about the exploits seem to revolve around multipart form submissions.

“PHP is the cockroach of the internet”

K, global oil demand is expected to keep rising towards 120m bpd between now and 2050. We are not plateaued, much less reducing reliance on fossil fuels. We are actively leaning into our use of it every day of every month of every year. The production and retailing of the computer you used to type that message above and the energy demand to power it makes you complicit in that. In all of it. So you can talk all you want about dreams and fantasies, but every aspect of your life is impacted by society's capacity to meet energy demand. We almost drove whale species to extinction and nearly deforested many states for biomass fuels before we discovered how to refine fossil fuels at scale and employ them. Hardly a world I want to return to. Fossil fuels are here, they're queer, and not going anywhere without massive tradeoffs that the global population is not willing to accept. The choices to back off energy demand are so bleak they're unrealistic. Sorry I don't have solutions that haven't already been thought of (resilient solar, nuclear), but really all you and I can do that's effective is vote for new energy generation and storage solutions and the policies that enable them and lead the way. The talking part doesn't do much except use more energy.

Those aren’t mutually exclusive - time and money were spent to dump tons of dispersants in an effort to actually clean it up. This comes after the Exxon Valdez spill where it was learned that hot water and high pressure hoses to clean areas did more damage than good - the untouched beaches recovered faster via natural breakdown than the beaches that were cleaned. In deepwater, they skipped the scrubbing and cleaning and emphasized dispersants (y’know, solution to pollution being dilution) and it probably hurt the ecosystem more than letting natural enzymes and such take care of it. The bottom line is that every major oil spill clean up effort is an experiment. But sometimes the instinct to “do something” causes more harm than good. Would the public tolerate an “all natural” approach or a light touch of beach cleaning? Probably not, even though there’s good reason to think the ecosystem (exclusive of human needs) may be better served by that.

I don't know why - they said there was a significant chance of failure, they have quite mature technology for it to be driverless. What's the point of putting a meat puppet in there?

To add some clarification - the event has caused general anxiety and risk of panic attacks, such that even driving down streets or flying on planes as she's done a thousand times before starts filling her with anxiety and panic. It's the panicking about panicking which has expanded the scope beyond just being in the identical scenario as before. That's the part that she recognizes as illogical - driving down the street shouldn't cause anxiety, as she's done it without incident many times before. There are no new identifiable dangers or risks. But it's a combination of intrusive thoughts, physical reactions, all that, which can spiral. Being on the outside it's very hard for me to comprehend, but there's a sense of no control over the chain reaction. There are techniques she has adopted, like using the DARE app regularly and other therapy techniques which have helped unwind this, but it takes a long time. Time is a damn good healer though.

Yes, the panic attack thing is pretty real. Know someone that had a severe allergic reaction, basically started choking to death, paramedics involved, all that. The experience imprinted itself deeply, such that she's deathly afraid of it happening again, and gets triggered with panic attacks. She's like two years on from the experience and through a lot of work she's much better, but it's pretty crazy how broadly it has impacted her life as an anxiety disorder. She knows it's not logical, but describes it as a fear of death and of a spiraling nature such that if she can't arrest it in the moment it compounds very badly, which reinforces the phenomenon - panicking about panicking. Anxiety over a panic reaction. So to be clear, it's not an allergic reaction she's experiencing but trauma from one in the past.

>"'Show me the man and I’ll show you the crime' is the fact of how western legal systems work, the rule of law is a tale that they tell to impressionable schoolchildren."

>"three felonies a day and the way China does it are fundamentally the same thing"

These are the statements that are incorrect for the reasons above.

Constraining the scope of those statements after the fact to narrowly apply to cases where individuals come to the particular attention of severe national security concerns in the respective countries allows for some "correctness" to the statement. But you have moved the goalpost if we are to read those comments so narrowly now - congrats! With appropriate qualifications your statements have become less wrong!

As mentioned, in contrast to the US, in China, social order and political security are scoped into the definition of national security - meaning that even if the mechanisms are the same, your ordinary Chinese citizen is far more constrained by the boundaries of the "national security" box than the US citizen. That an average citizen can successfully navigate the boundaries of their smaller box isn't the useful measurement when contrasting systems - all that fact does is convey that touching a hot stove gets you burnt and people learn from that. It does not change the fact that the Chinese legal system is fundamentally different than the western legal tradition in how it perceives rights and individual liberty and what recourse the average citizen has to challenge their encounters. This speaks directly to both of your claims at a high level.

I can see your point of view, though "those targeted by the system" implies a lot of circumstance and conditions.

It's very true that both citizens' experience with their legal system changes drastically when state interests and national security are implicated. Like China, western legal systems recognize national security and public order as compelling state interests.

The difference is that an individual in China is far more likely to find themselves at an intersection of state and political interest with their individual activity (be it art, speech, action, association, religion, property) than one would find in the west. In China, the NSL structurally defines political security and cultural and social order as being within the national security framework. That's intentional and sits in contrast with the western tradition where the state generally needs to justify restrictions on protected individual conduct with a claim of state interest, and those claims are frequently subjected to an adversarial review process.

As you say, technology has already made surveillance far more intrusive and effective than anything available in the 20th century. Of course, the effect of the Stasi wasn't simply the surveillance, it was the uncertainty of never knowing if your colleagues, neighbors, or even family could be personally trusted - that environment of uncertainty was an intentional social control element. In a similar but not identical way, uncertainty is leveraged in the Chinese legal system: one may not necessarily know when their activity (or even past activities) have suddenly fallen on the wrong side of the national security line. This variability is not a bug in the system but a deliberate feature, and stands in contrast with the western legal systems.

Once entangled, there are bright line differences in the structure of those systems - opportunities to appeal are far fewer in China as a foundational difference, but opportunities to challenge the basis of the laws themselves and the justification for a claimed state interest essentially border on being non-existent. In contrast, individuals or classes of individuals bringing facial or as-applied challenges to overturn regulation or a claim of compelling state-interest is a frequent occurrence in US (for instance).

If we consider it a given that the state naturally seeks greater control of individuals (and I do), then the western legal system and particularly the US legal system, has been uniquely effective at constraining the state. In China, for example, it's not even a consideration that CCP leadership can be curtained through administrative proceedings.

But there's no arguing that in the US, if the stakes are high enough, they'll "get their man". On the flip side, the surveillance of the state itself by the citizens has also restricted the ability of the government to act with as much impunity as they did, say, sixty years ago. Specifically, policy body cams, ubiquitous cell phone video, one-party consent laws, legal clarity on recording public officials in public spaces, FOIA laws, etc. Nonetheless, it's disturbing and frustrating how inscrutable some very public events remain.

Perhaps only in a very abstract sense of the power of any state dwarfing that of an individual, but not in any practical or “as-applied” sense. The reality of the general individual experience in China vs the US legal system is a very stark contrast (which we can get into but is also an easy AI convo).

After all, when you refer definitionally to “the legal systems of the west”, to what alternative cohesive system of legal theory are you contrasting it to? There aren’t many, and they have differences we can measure. For example, those emphasizing divine revelation (Sharia) or subordination to the state interest (Chinese legal thought). Leave personal value judgements aside - it would be incorrect to think these systems operate the same way in practice or are “fundamentally the same”.

Outside of the few cohesive systems of theory and tradition that we can identify, the alternatives are systems characterized by capriciousness and corruption - the absence of the rule of law.

It's certainly not unique to western legal systems, and I'd even say not generally(!) a characteristic of them. That quote comes from the Soviet Union and is more associated with totalitarian regimes where nebulous thought crimes are on the books and laws spun out of whole cloth. Think China.

Sure, when the state wants you, they'll get you. Read Three Felonies a Day: How the Feds Target the Innocent. I'm not one to say otherwise (quite the opposite), but for most people, most of the time, in most of their lives, western legal systems are pretty top notch in protecting people from arbitrary and corrupt application of the law.

In systems that truly embrace arbitrary and corrupt enforcement, it's quite a bit different system than largely objective traffic laws which society has agreed upon but which are rarely enforced (e.g. turn signals, lane merging in intersections, etc.) which turn into selective enforcement. I say this as someone who firmly believes that selective enforcement is ripe for abuse and has inherent problems, but on the balance I prefer the latitude I have as a driver in today's system than one where all traffic regs are enforced through automation at scale (which may be where we're headed in the next few decades, honestly). The reality is that as drivers, we probably curse the fact that these laws aren't enforced more often until we're the ones cited.

> "enough or often"

Yes, there is an "enough or often" limit in the USA as well. State driver's licenses are based on a point system and too many infractions will result in a suspension of your license if your points dip below a given threshold. Your margin of speed vs limit increases the point deduction. Fines vary down to individual localities, some of them being annoyingly high. In most places (I believe) driving with a suspended license is a criminal offense.

One big difference may be that most places in the USA have been able to resist photo radar/LPR automation of issuing speeding tickets, so the odds generally favor you in most areas until they don't. There's also this tacit allowance for "going with the speed of surrounding traffic". If all the traffic on the freeway is going 10MPH over the limit, you're generally safe in the herd like a zebra.

The USA is a big place with a very diverse set of driving conditions and jurisdictions, so the more you know an area the better you can navigate the character of that area's enforcement. Some places you'll deal with flagrant enforcement pushes at the end of the month as police try to meet quotas. Some places use traffic law enforcement to subsidize their budgets. Our mapping apps can alert us to speed traps if other drivers report them. Drive an area long enough, you'll know where the common speed traps are, and understand the patterns in road design that facilitate them. Generally, we have the luxury of being able to flout speeding laws to such a degree that we can feel indignant when we're caught, but the law is the law.

> "'There now follows a sequence where Wallace and Gromit build a rocket.' It was just a paragraph. I started on that paragraph, and a year and a half later, I actually finished the sequence!"

Very relatable experience.

Or they use software for which there is no Linux build or version with feature parity. That still exists.

Or they prefer the GUI in Windows like some people prefer the GUI from Apple. Those preferences still exist.

Heh, less like an episode of Black Mirror and more like LOTR. We hobbits have a duty and can't afford to not care about the world outside our shire.

VLANs, people. And firewall policies.

There’s no recognized inalienable right to keep and bear models/GPUs.

The prompts were awful and really distracted from an otherwise cool project concept. Also, testing the next model by iterating on the first model’s crappy foundation. Why not start from the original each time?

The biggest benefit in the update is the right of refusal on FDI in Greenland, e.g. Chinese port investment, etc. After that, survivability after Greenland independence which surely is inevitable.

My impression is that this infrastructure investment was underway, US said no way, Denmark was coy about it and future opportunities, US had a red line -> thus began the bluster. Now here we are with the US getting ability to 'advise' on any FDI.

This tracks with US activities and motivations in Panama, Venezuela.

His storage unit may have HVAC and electricity, plus is paying for some warranty of security.

I'm sure you know more about this than me, but EF works fine with SQLite for a project I work on. There are limitations, but I think there's a difference between the idea of EF deliberately not implementing some features for SQLite and SQLite itself not having support for some EF features (which is the reality I'm familiar with).

SQL Server is the flagship database project on the Microsoft side and that team surely has some imperative to facilitate the EF vision. It simply must be less of a priority for the PostgreSQL and SQLite maintainers to do so. Is that really a valid dig on the .net ecosystem, though?

One thing to be careful of is email hosts that dump your account after x months of inactivity. Logging in once in a while is good, got burned by this once.

Incremental domestic capital investment, good.

The level of cynicism, shit-talking, and schadenfreude wish-casting in response to this is crazy. Start cheering on successes. Resist the deconstructionist mindset.

Funny, wasn't getting the reference. https://en.wikipedia.org/wiki/Billy_Mitchell vs. https://en.wikipedia.org/wiki/Billy_Mitchell_(gamer)

THE (Col.) Billy Mitchell was actually a badass. His time in Alaska alone, running telegraph lines in the wilderness, made him a legend even before his forward thinking during WWI and beyond.