After the recent eMudhra CA incident, I wondered why my system trusts over 150 root signing authorities, most of which I don't need?I decided to scratch my own itch and make a tool to block the long tail of unwanted CA certificates.distrust is a policy-based tool that aims to simplify the management of the mess of root stores: browsers (NSS, Chrome Root Store), OpenSSL/GnuTLS consumers (curl,...
According to the Department for Transport's report, there were 41 pedestrians and 7 cyclists killed in traffic collisions in Greater London in 2022. Pedal cyclists were listed as the "other vehicle" involved in fatal collisions 0 times, while cars were listed 39 times, and goods vehicles 23 times. As stated "other vehicles" does not directly describe who is to blame for a collision, but it's a proxy measure for it. https://content.tfl.gov.uk/casualties-in-greater-london-2022...
To compare two examples, you can pick out Richmond Park in south-west London due to the low number of collisions in it. But this is actually a highly popular location to cycle. The relatively low amount of vehicles, 20mph speed limit, ban on large vehicles, high visibility, and few junctions, makes it a great place to cycle.
There are also a low number of collisions in the boroughs of Bromley and Bexley in south-east London. But this is not because they're safe, but because very few people cycle there. There are loads of fast roads in these boroughs and little cycle infrastructure, and more of an hostile attitude from drivers compared to many other places in London.
Yes while some challenges overlap, we also explore more deeply the mathematics of cryptography, as well as its practical use in protocols like TLS. We recently added challenges on lattice-based post-quantum cryptography. In this way we think it makes a great complement to CryptoPals.
But it's not all harder, our introductory section gradually introduces concepts like base64 encoding and the modulo operator one challenge at a time.
Choosing between preserving the life of one cat vs one lobster seems straightforward enough. But the trolley problem was asking whether one cat was more valuable than five lobsters. According to the stats, many people agreed, but how about one cat vs a million lobsters? Or one cat vs all the lobsters on earth? Most people would think that making lobsters extinct would be very bad (unless they really hate lobsters).
The difficulty is when we can no longer rely on intuition and have to come up with a precise exchange rate of when one being's life is more valuable than another's, which, like you say, is impossible to do in the complicated world we live in and our limited understanding of consciousness and neuroscience. In absence of that, deferring to the first law "whenever possible, do no harm" seems sensible.
If you choose to do nothing and ignore the drowning child, are you really not morally responsible in any way for the child's death?
I didn't say that, I only said that we currently have two Internets, but that there has been a shift towards the walled gardens of identified accounts over time. The proponents of the law probably would end up creating loop holes just because their main beef is with the big tech firms, and it would be challenging for a single country to enforce legislation on the rest of Internet.
> Verified accounts, as I understand them, on the social platforms are only for people who publicly want to build a brand around their identity. While people have to use a "real name" on Facebook and Google, there's nothing requiring to get verified.
We may be getting mixed up with the meaning of "verified", I'm talking about accounts where the platform has associated you with your RL identity through some method, not just the process to get a public blue tick.
And, while there may be nothing formal requiring verification, there are many reports of people suddenly getting locked out of their accounts and being required to provide ID or at least a phone number shortly after registration. In fact a phone number is a pretty widespread requirement and it's getting harder to obtain a phone number that's not linked to your identity in some way. I don't see the contradiction in what I wrote, I have simply pointed out trends, not absolutes.
It's an interesting question, but the point isn't as clear to me. First of all I believe most people are able to see through misinformation. The biggest blame should be laid on algorithmic feeds that optimise for engagement, and are therefore designed to lead people into self-reinforcing loops where their ideas never get challenged. That's the main bad "innovation" that social media platforms brought; the arguments about dangerous ideas, censorship, and bad actors echo all the way back to the dawn of the printing press.
> But I also think you can’t ignore that misinformation from anonymous actors has pushed democracy to the brink of collapse, and “that wasn’t the original idea of the web” isn’t the best rebuttal.
I think this is overstating the role of "anonymous actors" - plenty of misinformation comes from well-known politicians and simply normal people. Are you referring to FB's concept of "coordinated inauthentic behaviour" and troll-farms in authoritarian countries? This is definitely a problem which platforms have to tackle, but again I don't think it's as huge a factor as people make it out to be and certainly has not pushed democracy to collapse on its own.
Google, FB and other tech giants changed the norms around this completely for most Internet users. Once these platforms realised it was easier to monetise their users, and control abuse when dealing with real identities, they pushed hard for verified accounts (e.g. Google Plus) even though this is antithetical to the founding ideas of cyberspace.
Today we have two Internets, one where anonymity is still possible but you can reveal your true name if you want (e.g. HN), and another of walled gardens with verified identities. The UK government is proposing to enshrine the fully identified concept of the Internet into law. While this will prevent some abuse it's a sad reflection on how some of the early values of cyberspace have been lost, where people could be who they wanted to be, and freely discuss topics they might not wish to have associated with their real names forever. Politicians whose main interaction with the Internet is through their Twitter accounts just don't get that.
> In her book Operatie Vula, Conny Braam explains how one of her people met a guy, by the name of Floris, in a pub in Amsterdam, who allegedly had developed the PX-1000 [5]. From him they learned that the device had been taken off the market as its encryption was too strong. It had been replaced by a calculator but he suggested to find the older version with built-in crypto.
In all I would say it was a pretty good backdoor for the early 80s, showing how far ahead the NSA's internal understanding of cryptography was. I wonder if they would have anticipated the world we live in today where state-of-the-art cryptography is available and used by everyone on the Internet.
To add to your counterpoint, the OP's praise of going cashless as opposed to the problems of cash is another fine example. It's certainly more convenient to use your card everywhere, but if everyone did it then just a handful of payment processors would gain immense power, with the ability to track, monitor, and censor all transactions. Plenty of dystopian fiction like The Handmaid's Tale covers what can happen when this infrastructure is abused. Cash may have problems but it plays an important role in an open society, and redundancy when a major payment network goes down (as Visa did across Europe on 1st June 2018, causing retail chaos). But many vendors no longer accept cash and this will only accelerate as more people never use it. In praising going cashless as protecting ourselves from being our own banks, the OP misses the forest for the trees.
Surely he can look back over the last few decades and feel proud of his work and the benefit it has brought to so many users. The tech treadmill can cause us to lose focus on the things that really matter or that really inspired us to begin with, so this is a refreshing perspective.
> PostgreSQL 14 extends its performance gains to the vacuuming system, including optimizations for reducing overhead from B-Trees. This release also adds a vacuum "emergency mode" that is designed to prevent transaction ID wraparound
Dealing with transaction ID wraparounds in Postgres was one of the most daunting but fun experiences for me as a young SRE. Each time a transaction modifies rows in a PG database, it increments the transaction ID counter. This counter is stored as a 32-bit integer and it's critical to the MVCC transaction semantics - a transaction with a higher ID should not be visible to a transaction with a lower ID. If the value hits 2 billion and wraps around, disaster strikes as past transactions now appear to be in the future. If PG detects it is reaching that point, it complains loudly and eventually stops further writes to the database to prevent data loss.
Postgres avoids getting anywhere close to this situation in almost all deployments by performing routine "auto-vacuums" which mark old row versions as "frozen" so they are no longer using up transaction ID slots. However, there are a couple situations where vacuum will not be able to clean up enough row versions. In our case, this was due to long-running transactions that consumed IDs but never finished. Also it is possible but highly inadvisable to disable auto-vacuums. Here is a postmortem from Sentry who had to deal with this leading to downtime: https://blog.sentry.io/2015/07/23/transaction-id-wraparound-...
It looks like the new vacuum "emergency mode" functionality starts vacuuming more aggressively when getting closer to the wraparound event, and as with every PG feature highly granular settings are exposed to tweak this behaviour (https://www.postgresql.org/about/featurematrix/detail/360/)
> Though my relationship to time fluctuates, the gravamen of my disclosures remains constant. In the past eight years, the depredations of surveillance have merely become more entrenched, with the capabilities that used to be the province of governments now in the hands of private companies, too, which employ them to track and tether us and attenuate our freedoms.
"An atmosphere of blame risks creating a culture in which incidents and issues are swept under the rug, leading to greater risk for the organization."
I've seen numerous explanations for this, one being that there is a strong incentive for US politicians to look "tough on crime", a greater emphasis on retribution than rehabilitation, historic racial injustice, and a sizeable for-profit private prison industry. But other developed countries also have these factors to some extent, for example the UK's private prisons house 18% of prisoners compared to the USA's housing 8%.
In my view, understanding the cause of why these long sentences are considered normal is essential to preventing a lot of pain and suffering. There are several examples of harmless people given life sentences for marijuana possession under three strikes laws, but that's just the tip of the iceberg. A society that is obsessed with freedom yet incarcerates more of its citizens than Cuba or Russia, and hands down disproportionately severe sentences for transgressions that would be viewed much less seriously in other countries, is a bizarre phenomenon with a huge human cost.
On the other hand, security researchers are finding vulnerabilities that weren't previously known. They've discovered specific exploitable bugs, rather than introducing new ones. Following disclosure, the company can patch the vulnerabilities and users will be safer. Which makes that a laudable thing to do.
For example, a webapp may have been designed such that authorisation needs to be explicitly added with a line or two to each controller. A semgrep rule can be written to match all the controllers which are missing this line. Then these controllers can be manually reviewed to assess whether unauthorised access should be allowed. Depending on what you are trying to match, this is something that may be very complex or even impossible to implement accurately in plain grep. Some languages like Ruby have powerful static analysis tools (Brakeman) that can also do this, but the benefit of Semgrep is the flexibility across multiple languages and how readable the rulesets are. [1]
[1] https://blog.includesecurity.com/2021/01/custom-static-analy...