fc417fc802

Meanwhile the US certainly appears to consider API access to constitute a form of export so misunderstandings are understandable. Or perhaps it would be more accurate to say that China isn't currently restricting that form of export.

Regardless of the OS, kernel, or program you select there will inevitably be holes in your stack. A VM will always provide better isolation and more flexibility. In this instance it would mean being able to patch the box running the service without messing with the driver for the backing storage.

Or perhaps this illustrates the value of running all web services under KVM rather than bare metal.

Well yes, the entire point of a link aggregator is to surface content of value to the readers so that necessitates passing judgement on it. It seems that most of us don't come here for slop so that receives negative responses. Everything working as intended I guess.

Someone very obviously being an incompetent moron does not serve as a defense against blatantly defrauding him. You must conduct yourself with integrity regardless of any idiocy exhibited by the other party.

Without taking a position I will point out that your stated reasoning doesn't hold due to how much momentum these systems have and how slowly they respond. It seems entirely plausible that this outcome would still have happened if temperatures had plateaued several years ago.

When it comes to PE there are myriad examples of shareholders taking a short term view. So are you suggesting then that shareholders of publicly traded companies are somehow different? I think that would be on you to justify but you've instead chosen to attempt to mock me for wrongfully assumed ignorance.

> Shareholders are looking for sustainable projections of growth.

Then why are there so many examples of PE destroying things to make a (relatively) quick buck?

As a native speaker from the US who knows it as two syllables, what region of the US are you referring to? Is this a deep south thing?

If france wants to institute their own great firewall then they should just do that rather than engaging in twisted extra-national half measures that make liability confusing for everyone.

Sure, but "must never leave the HSM" is much easier to audit for and much more difficult to screw up. This entire thing (allegedly) happened because of faulty logic; categorically disallowing as much logic as possible seems like the straightforward fix to me.

If transfer were to be allowed I'd think it should be entirely facilitated by the hardware itself and that capability audited as part of the approval process. (I assume the HSM used in this context is already subject to approval?)

You seem to be agreeing with me. I said it's an open question so expecting me to rigorously answer it in an HN comment is quite absurd, no?

There's nothing unfalsifiable about pointing out that we don't know something.

Closely related, "is this machine conscious" is an important question when it comes to ethics yet runs into the exact same problem. Yet you can hopefully see the issue with blindly deciding in either direction on that one.

> This is a Swiss company offering services to French users.

If I operate a bookstore physically in switzerland and a few of the books I sell are illegal in france I'm not required to check passports or whatever, am I? I can just sell books to whoever (subject to swiss law) and if a french national illegally imports one to france that's a problem for customs or the local police or whoever (analogously the french ISPs) to deal with. Not me, the swiss bookstore operator.

Now consider if I were handing out pamphlets for free rather than selling anything. At that point I'm arguably not even doing business because no money has changed hands.

I realize that the current legal reality might be that quad9 needs to block french users in practice but the entire thing is a farce if you stop and think about it.

Not at all. It's an open question and it's also probably semantically ambiguous. It's cliche to the extent that recently it comes up repeatedly. Regardless of all that it's nonetheless a valid question.

> you must acknowledge consciousness can arise in an agglomeration of human brain cells

That doesn't follow. You could, for example, be a substance dualist. Alternatively you could suspect that there exists some special as yet undocumented property of the human CNS that is required as a prerequisite. Or etc.

In the case of nuclear arsenals that's perfectly fine - MAD simply needs to be plausible, not robustly demonstrated. In the case of CAs I'd argue that the description doesn't really fit since they're getting stress tested by malicious parties on a daily basis. By that logic you could describe linux kernel security as a potemkin village due to the steady stream of zero days. In reality a potemkin village is something intended from the start to deceive everyone else. It's not impossible that's what happened here but that's a very serious allegation to make (ie theorizing that the weak keys were intentional with a conspiracy afoot).

The entire system (CAs and ICANN DNS) was never good to begin with; it's just become that much worse due to the shifting situation over the years. It's an inherently centralized design with no way to verify that example.com is operated by the same entity from one day to the next. The namespace is global and effectively an exercise in rent seeking.

At absolute minimum any sensible system would have a TOFU element whereby the site operator of example.com changing from one day to the next would result in all the tooling across the entire stack screaming loudly (in other words what ssh does). And that's just the absolute bare minimum change that's needed.

I was about to reply with "they didn't have a choice" but on second thought perhaps CAs are important enough that they should never be allowed to export keys from an HSM and should instead be required to physically deliver and install the HSM wherever it needs to be in the world. Inconvenient and expensive but likely for the best.

Doesn't that also fetch the content directly? So depending on the logic of the filter it likely won't make any difference.

Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.

If only a reverse plea deal gambit were realistic. Counter with an offer to accept $10k and an apology for malpractice in exchange for her not going after those involved. Unfortunately a decent chunk of the justice system here doesn't appear to have any real accountability for poor conduct.

You're not entirely wrong but I think that description of the situation is rather heavily colored by partisanship. Being lenient about a very limited subset of crime that "the system" is particularly ineffective at dealing with (to the point that it is arguably racist/classist/etc) is viewed favorably by certain (primarily urban) demographics. When you have broad support for an elected official who is exercising a great deal of discretion to not enforce the law that should trigger fundamental changes to the system as opposed to impeachment.

No, the state should fine them directly just as it would with any other civil offense. In technical terms, any directors active during the duration of the offense should be held jointly liable. This works because we aren't talking about rank and file employees here.

Stuff like this is highly context dependent. It is a good thing that apt asks about each step. I voluntarily add more of this by opting for things like listbugs. If I then decide to override such protections with a -y for whatever reason that's a choice on my part to prioritize convenience.

Either way it's got nothing to do with security - I was never going to catch a vulnerability in the central debian repos by reading a list of dependent packages.

> Do you also have examples? I admit mine are anecdotally

As I pointed out, the reasoning you expressed doesn't work. Your examples do not support the position you were advancing.

As to disputing the accuracy of individual points you'd need to be specific about what you're taking issue with. It's not on the other party to provide evidence when merely voicing agreement with something someone else said (or rather my expression of agreement is itself the evidence of my claim that I agree).

> Developers bring projects accordingly, and the local residents veto 12 story apartment buildings built on current strip-malls 2 blocks away from train stations.

This one kills me. It's so common and yet there's wide agreement among the local populace that there's a housing shortage.

Petty criminals are not the only black hat hackers that exist. An immediate monetary payout is not the only motivation for breaking into the computer system of a service that's essential to society.

If we're unable to constructively reform the regulator a genuine (though politically untenable) alternative would be to remove criminal penalties for intrusion and publication of private data provided that no physical damage was done and no disruption to daily operations occurred. Effectively legalizing blackmail of data breach and cryptominers.

There's approximately three possibilities that could lead to you believing that. Either you haven't formed close relationships with such people (unlikely), you lack the awareness to realize who they are, or you are one yourself and lack the self awareness to recognize the patterns.

I look at it from a close but slightly different angle. I think the spinning wheels and jumping around that you describe is an aesthetic of being productive as opposed to actual productivity and that the drugs can genuinely fuel it. So many people (here I refer to other topics in addition to productivity) think they're doing A when really they're doing B which merely has a strong aesthetic that resembles A.

> it seems they want criminals to make $0 so they stop doing that

And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.

Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.