johngalt

It's true that the ability to coordinate and harness human talent is the fundamental task of civilization, but I think the author is missing a step where they accurately link that to successful left wing policy. The author doesn't appear to address counterexamples.

Using his own 'man landing on the moon' scenario. Why did the USA beat the USSR to the moon? Then subsequently pull ahead technologically? Was the USA in the 1950-1980s more or less left wing than the USSR? Was East Germany more or less 'left wing' than West Germany?

Has China's swift rise coincided with a shift to the left in their economic system or a shift to allow market forces?

>I am writing this on a laptop produced by a chain of activity stretching across the planet. Thousands of people were involved in turning sand, rare metals, aluminium ore, petroleum and electrical energy into the slab of silicon, metal and plastic sitting in front of me. Engineers designed its processors. Miners extracted its materials. Factory workers assembled its components. Software developers wrote the systems that allow me to use it. No single person knows how to turn the raw materials into a computer. Once again, no one needs to.

No one needs to, because it's much easier to coordinate a market economy according to self-interest than it is to centrally plan every step of the process. "I, Pencil" is usually a defense of market economies, and their ability to coordinate the world.

https://en.wikipedia.org/wiki/I,_Pencil

That is not the way human beings typically evaluate risks. 'Acceptable risks' are more about psychology and not a statistical calculation. A self driving car that is twice as safe as the human average would be considered an unacceptable risk.

Add something that is new/unknown + lack of control, and you will have to clear a very high threshold to be considered 'acceptably safe'. My guess is a minimum of a 0.1x.

Think of it like SSH authorized keys but automated for the web. Instead of storing the keys in a file; it stores them in a hardware security module (yubikey, or TPM).

Registration generates an asymmetric key pair between your passkey, and the website. Login is the usual challenge/response process. The biggest step forward is phishing resistance. A fake login page can relay a TOTP code, but not the passkey challenge/response.

If you want a consistent, and seamless authentication experience, then one party has to own that experience. Go federation/SSO. Sign into everything with microsoft, or google as your identity provider, and live with the privacy implications.

Passkeys are great, and they take a significant amount of work away from the user, and make them much less prone to phishing attacks while also not turning their entire online identity into the property of google. I've had much more luck with onboarding non-technical people into a yubikey vs a password manager. Platform authenticators tend to trip people up. However, the process of adding a new key is getting much more consistent, and legible to people over time, and things will settle on platform authenticators rather than external physical keys for most use cases.

The largest disconnect between then and now, is the degree to which the internet was many things (telnet, ftp, usenet, finger, gopher, http, irc, mail, etc...), and not just webpages. Each with their own specific flavors. The article is trying to recapture that to a small degree.

Over time, almost everything has been compressed into this HTTP/HTML/JScript agglomeration. When the original thought was that there would be dozens of protocols for various uses, and a lot more client applications than the browser.

The best analogy I can think of is, imagine that plays(theaters), movies(bigscreens), novels(books), operas(concert halls), art(galleries), museums, etc... All disappeared in favor of delivering that content through games on your Xbox. All of that experience compressed into one method. Then the next generation says:

"Why would anyone miss physical art galleries? I can see art much faster on the 'Louvre 2026-season pass' on my Xbox? No travel, no walking, no lines."

FYI, the included cartridges in a new printer are typically a 'low capacity' type. This has been true for 20+ years. You may find yourself both spending a large amount of money, and generating a significant amount of e-waste if you pursue this strategy.

It is important to check consumable cost when buying a printer. They aren't all the same in this regard.

Probably not, but some games it is better to lose.

This problem is why so many organizations will do an SSO tax.

The strangest part to me about the current trends: why do all these business leaders all do the same things at the same time? E.g. Layoffs + micromanagement + cost focus etc... Is this truly about macroeconomic forces that every business is responding to? Or is it just following the latest fad?

There seems to be significant opportunity to zig as others zag. Imagine the Intel letter saying "we are going to take advantage of the current hiring environment to scoop up talent, and push forward on initiatives."

Intel has been cooked for years. Observable back in 2017, but more visible today.

https://news.ycombinator.com/item?id=14588429

The top of the market will go GPU and the bottom will go ARM, and the middle will be an ever shrinking x86 market share. The few places that will need heavy CPU resources will be the same people who can apply pressure to Intel's margins.

The process of chip making will look very similar in the future, but the brand of the CPU will matter less every year. Intel's not "dead in five years", but Intel will definitely cross the point of no return in that timeframe. Shifting a big company's focus is more difficult than growing another company who already has the right focus.

We can certainly imagine a limiting factor based on our prior development. Imagine a world where large amounts of coal or oil never formed, or formed in a manner that made it inaccessible to a pre-industrial revolution society. Without easily accessible chemical energy, the technical progress made during the industrial revolution probably takes 1000 years instead of 100.

The age of discovery was a similar scenario. Imagine a different world where 2/3rds of the continents are uninhabitable desert/tundra/arctic, and there was no economic benefit to better ships, clocks, astronomy, cartography. Delays social development of joint stock corporations etc...

Organized crime would be more... organized. There would be servers, infrastructure and documentation. Designed to say exactly the right thing to whoever was looking.

This is garden variety, SMB fraud.

"We trust Tim, and never had a problem so we don't need to invest in all these controls. Tim is really vehement that the controls are useless and he's refusing to participate. No we won't make him comply. No we don't see any conflict here. Please continue to fix the problem anyway."

What sort of fraud in 2008 would be similar to just wiring millions of dollars out of the bank to a personal investment/scam?

The most egregious stuff in 2008 was mispricing MBSs. Incorrectly pricing risk is pretty far from stealing money from investors/depositors.

No problem at all with the concept of price discrimination. The economics make sense. In any scenario where unit costs are low, but development costs are high, the ideal situation is where everyone gets the benefit of having the product at a price they are willing to pay. Maximizes total value to all parties.

The problem with the SSO tax is that it wedges itself into the pre-existing cracks in most organizations. Security practitioners are already in conflict with other departments. What happens when a department head has pitched a new SaaS as being 1x price, but then it becomes 2x price after the security team's requirements are added? It is not seen as the [application is expensive], it seen as [security team's requirements have doubled the price]. Conversely a price discrimination strategy which locks specific user facing features behind a specific tiers means that the same person championing the software, would also advocate for the appropriate payment tier.

Price discrimination is a valid strategy. Responding to organizations who are actively making the security practitioners job more difficult is also valid.

>If you look at a state like Colorado, the energy usage is vastly different than Florida or Texas with lots of heat and humidity.

Electricity usage yes. Energy usage no. Household energy usage is lower in the warmer states, and higher in colder states. I would expect that CO household energy consumption would be higher than FL or TX.

The connection not drawn here is about capability and flexibility.

You can make a drill without the clutch/torque adjustment, and it will be simpler to use but less capable. Or using the car example, knowing how to manually select gears gives a greater level of control over the vehicle, but most modern drivers don't know/care enough to learn.

The trend is moving decisions/control away from the user. Precisely because it's easier to allow Apple or Google to make all the decisions, rather than learn, manage and maintain things. Users don't understand a CLI any more than they understand a manual transmission. If we want these things to exist, education must be in the mix.

100% That is exactly how it is playing out. People do not register (2passkeys * 20 services). They sign in with Google or Microsoft and call it a day. Privacy implications ignored.

Even more true in Corp IT. People will learn to use passkeys with SSO at the office and take those habits home.

Draw a square around the X or O.

Startup locked in haphazard political power struggle. Microsoft is executing at high speed over a weekend.

Next week: Chrysler cars now more reliable than Toyota.

If you are involved parents, it is difficult to make a wrong choice.

There is nothing wrong with homeschooling and it works best when you have a network of people who are doing the same to add-in social opportunities. The only thing that I would be a little concerned about in your specific situation is the timelines. Transitions are the hard part. Setting up the homeschooling methods/practices/habits, and then switching back to traditional school methods/practices/habits. Homeschooling for just 1-2 years eats up a lot of time in transition.

If you have a decent public school option. Consider participating in it. Get involved, volunteer, give feedback in the school board meetings. Take however much time you planned to spend on homeschooling and invest it there. Both your child and others will benefit significantly. However, don't sacrifice yourself or your kids to try and save a bad situation. It also means that socially there will be some pre-existing friends for that first year of high school.

> stop splitting the job of dev and ops into separate roles

Specialization is the key to managing complex projects effectively. Effective teams will increase specialization where possible, and improve the feedback mechanisms between specialists.

Take a look at other complex industries like aircraft. We do not have simple "Airplane Professionals" who design/build/maintain/fly planes. But rather each of those categories are divided into subcategories with specialists.

Mechanisms like this exist, but they probably aren't integrated into whatever system you are using, and delays which involve an approval workflow add a lot of overhead.

In most cases the engineering time is better spent pursuing phishing resistant MFA like FIDO2. Admin/Operations time is better spent ensuring that RBAC is as tight as possible along with separate admin vs user accounts.

Off-the-cuff; there are certainly more categories.

Notes related behavior is a good place to find ideas, but not a good goal itself. 'Notes' is where information lands which isn't being specifically captured. Looking at your organization's notes will draw the outline of the system which isn't present, what feature the present system is missing, or what training doesn't cover.

It's not about hierarchy or flexibility, but the ill-defined nature of what 'notes' are. Ask people to share notes and you'll observe several different types with disparate goals:

1. Shorthand: A memory mechanism to simplify/summarize a complex text.

2. Logbook: Record a series of events which occurred and what order.

3. Planner: Todo lists, upcoming meetings, due dates.

4. Whiteboard: A worksheet for working through a complex problem.

5. Time-capsule: Long term memory about why we decided to do [thing].

If you take someone who treats notes like a Whiteboard and try to sell them a system which looks like a Logbook, they will think it makes no sense.

Looks... Noisy. Giant engines next to the passengers with an angled pocket reflecting sound back towards the cabin.

-Not an aerospace or sound engineer

Excellent checklist. Anyone who is directly accountable for operations but only a non-voting advisory role for platform selection will have flashbacks reading this list.

At a certain point, you aren't doing a cold restart, but a high speed recreation of the system based on prioritized needs.

Berkeley Open Infrastructure for Network Computing (BOINC)

https://boinc.berkeley.edu/

https://boinc.berkeley.edu/projects.php

Has a unified management experience with the ability to subscribe to various projects, and set priorities/schedules for work units.

Agree 100% with this and your other comments. These frameworks often create risks by obscuring reality behind procedure. Sucking up all the air that would go towards more direct security objectives. Businesses think they are done with cybersecurity because they are done with the checklist. Believing we are safe because a non-technical auditor said so, can be a risky spot. Specially if that is used to overrule subject matter experts.

NIST CSF = The encyclopedia which breaks security down into as many areas/steps/sections as possible. If you are planning a 500-person security department, this is how you give them all something to do. The idea is to accomplish the task with manpower rather than elegance. CSF itself is mostly just a pointer to NIST 800-53. For truly large-scale operations it can be an ok fit, but for most organizations it is overkill that your cyber-insurance vendor will still expect you to do. Otherwise, best used as a reference not a guide.

ISO 27001 = Not super familiar with this one.

COBIT = The management/process focused version of NIST CSF. Great if you have an executive suite CTO, CISO, CRiskO, CPrivacyO, and want to coordinate their efforts in a program that divides responsibilities among them and associated committees. Includes maturity modeling, which gives it a +1, but it is distant from anything technology related. Instead, it is all about which committees should be formed to decide on risk management strategies etc...

PCI-DSS = You'll do this one because VISA makes you do it. Much more actionable than NIST or COBIT, but it depends on the third-party auditor who is issuing your attestation of compliance. "Your label maker has it's default password?" = audit finding.

CIS18 Controls = The most actionable/lightweight framework now that they have incorporated maturity levels (aka implementation groups). Not as thorough as NIST or COBIT. Well implemented, CIS18 is enough for most organizations provided they do not have a specific security standard or requirement in their industry.