kube-system

If you've got a place to charge at home. We need subsidies to encourage chargers in more places outside of garages in surburbs.

If you live in an urban area and want to charge an EV, it can be quite a pain

This is business as normal for most large automakers -- segmenting different parts of their product lineup for different regulatory markets.

Why BYD is cheap? They're heavily vertically integrated, they're ruthless about cutting production costs, they operate in an environment with more manufacturing talent than anywhere else, and they're a young company without many legacy costs.

Federal subsides weren't rolled back because the market was taking off on its own, they were rolled back for ideological reasons.

I never said it wasn’t. What is different in the US is a political reluctance to enact regulatory controls to protect rights proactively.

No, most of the activity or function of regulatory bodies is not litigation. Litigation would be the last resort.

It is simultaneously true that:

1. many countries have higher regulatory burden than the US

2. that does not mean regulatory gaps don't exist

The person above was simply pointing out that litigation is not the only way to solve a problem. Which is plainly true, you can simply require compliance via other legal means. For example, a government could create a regulatory standard for security and require vendors to follow it. Whereas in the US the political appetite is to be more hands-off and allow people make vulnerable products if the market allows.

Hospitals, in general, have an above-average IT security posture.

Some countries have regulatory bodies that are empowered to effectively regulate industry.

Monitoring for compliance is almost certainly easier to manage remotely, which is probably why they're connected in the first place. I would guess control was likely a nice value add. e.g. so someone could respond to an alert remotely

For the same reason any of them are adjustable? Different usage scenarios, different types of contents?

> Almost no companies farm their security out to third parties.

They do it all the time, piecemeal, that's part of what anything-as-a-service delivers. If you don't want to secure an app, buy a SaaS one. Don't want to secure infrastructure?, buy an IaaS.

> Most places have combined them at some boundary, for ease of access, but there is no case in which an authenticated application endpoint (even /login) has to allow unauthenticated network access to it.

> And in all seriousness, name a service that is not a public website, but cannot use mTLS or IP allowlisting.

Literally any SaaS software where the customer does not or cannot practically install a certificate for you or provide a list of IPs in advance? mTLS is almost never used in a browser unless you are connecting to a government website with a pre-shared smartcard. IP whitelisting is great if the end users only work from behind a VPN or in an office. But there's a whole big world of people who cannot or will not do that.

Yeah, nobody is doubting that people want to consume tokens. We're doubting that that Google, OpenAI, or Anthropic has a significant enough moat to keep people buying their tokens there. Over the past couple years the moat has been the model. As open models are getting better, that moat is drying up. Eventually the market for "tokens" will converge with the market for compute, which is a commodity with little to no moat.

And despite all of that ... Chewy is successful.

1. that's what this thread is about?:

> I think people will move back to their own hardware

> self-hosted pieces of software

2. arguably -- but lets set aside what you think the word means and respond to the obvious meaning of the comment you're replying to.

The point is -- doing shit yourself makes it your problem to do correctly and requires sufficient resource allocation

The reason we were talking about on-prem is because we're talking about the effort of doing these things yourself vs farming it out to a third party.

If you're a security engineer responsible for securing only:

1. a public website

2. stuff that can be ip whitelisted and/or use mTLS

Consider yourself very lucky. Most orgs need to expose a lot more than that.

You would inherently be rolling your own configuration when deploying something on-prem.

Yeah, most organizations need to expose something to the internet as a matter of normal operations -- at least some sort of a web app if not dozens. It would be great if we could all just have udp 56820 listening silently for a key, but that isn't reasonable for most organizations that have normal users expecting normal applications.

Yes, everyone is rushing to implement zero-trust principles for real now. It's getting harder to trust that your public facing endpoints don't have vulnerabilities, and it's getting harder to trust that your internal software and endpoints haven't been compromised from within your pre-existing trust boundaries. A lot of the increased workload is due to patching up the existing security infrastructure, and on top of that, building out new solutions to better fit today's threat landscape.

They aren't immune, but they almost universally have better security posture than any alternatives.

Unquestionably. They have top tier security operations that are well funded. They follow (or set) security best practices, they are audited, and they fix them quicker than you can. They have inside industry knowledge that is only shared among top organizations in this space, including government cyber ops. This gives them the ability to fix things before they are even publicly known.

You can get close if you have either:

1. the ability to spend hundreds of millions on security operations yourself

or 2. the ability to airgap the systems you are securing

There have been a lot of exploits for a lot of software on-prem tech stacks rely on just over the past month - proxmox, php, nodejs, palo alto, eMudhra, etc come to mind.

> But then, you're unlikely to be the top target of anything.

That would have protected you 3 years ago when a human had to bother to attack you. Today it doesn't protect you because it's trivial to deploy an LLM to act like an APT against any random target that shows up in shodan.

It takes more effort to secure on-prem software today than it did just a couple of years ago. Updates are more frequent, zero days are more frequent, attacks are more common, more persistent, and more automated.

I think most people responsible for securing production systems today will share the experience that their workload has increased.

Or there's some exploit in an endpoint device, and the problem moves laterally from inside your firewall.

LLM discovers exploit -- you don't realize it in time because you don't have a security team as big as the PaaS you used to use -- you get pwned anyway.

This has happened to many high-profile self-hosted pieces of software just this past month.

This is misguided thinking. You are less likely to hear about on-prem breaches in the news just because they are less likely to be newsworthy incidents, but they are even more likely to happen. Part of the reason people moved to the cloud is because it is much easier to have a team manage updates and security at scale.

Being a small target is not helpful these days, attacks on on-prem software today simply scans the internet, or uses databases by people who have already scanned it, and is automated.

On-prem software has not been spared from the recent spat of security incidents.

It's a lot cheaper than ipv4, for the most part.

I'm not saying that parents can't contribute, or help guide their children -- they should.

But the cultural problem we have today is exactly that parents feel that they are responsible to provide a college education for their kids. Doing well in higher education is something that cannot be handed to someone. A student needs to be invested in their education, they need to have some real skin in the game, they need to feel real-world consequences for their actions.

Young adulthood is a time of transition -- they should be transitioning fully away from accountability to their teachers and their parents, to an accountability to themselves and the realities of adult life. They need to learn to be responsible for real world things, not just a report card. Part of that responsibility is having some urgency, desire, and ambition to do something with your life.

Giving a undecided kid a mandate to go to school is the exact opposite of what they need. They don't need someone to tell them what to do. They need to learn how to tell themselves what to do. Parents instinctually want to "help", but doing this for them does not help.

It is nice for parents to help. But there are way too many parents who think that if they just enroll their kids in a good college, that college will magically give them direction in life, ambition, and life skills. But if they didn't have a good grasp on these things before enrolling, they're already set up their children for failure.

I know people who work in higher ed, and they thank god for FERPA, because they are inundated with more calls than ever from helicopter parents asking what their grades are, asking where they were on the weekends, why they won't call their parents back, etc. "I am paying for this education and I demand to know [x] about my child", etc.

Any student who is actually prepared for college should already have a pretty reasonable idea what direction they want to go with their studies, what it is going to cost, how it is going to be paid for, and generally what they're going to do with their education. If they don't have a clue, blowing $100k is not going to fix that problem -- it's going to make it worse.

In my opinion, undecided kids would be much better off dabbling in college at a 2 year alternative. There are fewer distractions and less impactful consequences for "figuring it out".

They're making more GPUs than ever, for the people who can afford to give them lots of money.

Intel and NVIDIA aren't hoarding GPUs in data centers. You can buy them if you have money, but billionaires are hoarding money.

Intel stopped making DRAM in 1985.

I'm well aware of the current situation. Costs are ballooning out of control -- not because affordable options don't exist -- but primarily because children are being told to go to college, and given blank checks in the form of loans, but are not being prepared to plan their own financial future. College should not be treated as high school 2.0 with a blank check.

The average price of attendance is being inflated because the average student is picking a school first and then burdening themselves and their parents with whatever gigantic loans it takes. Kids are picking a school based on campus tours or social pressures, but on the first day of class they still couldn't tell you how much it's costing them to go there. They are underprepared to begin with.

There are affordable 4-year schools if you are prepared and shop around. The US has more scholarship opportunities than anywhere else in the world if you are prepared in advance to get them. There are expensive programs that are worth financing. And there are dirt cheap 2 year options that are still affordable today, on an hourly wage income.

But there are also plenty of stupid decisions that are possible to make when buying a higher education, and the system is not set up to prevent you from shooting yourself in the foot.

If a student can't say what they want to study, why they want to study it, and how they're going to pay for it -- they probably aren't prepared to be making the decision to attend. Unfortunately, too many parents are uncomfortable accepting this transition of responsibility in life and pressure them to "just try it". Signing the loan docs are easy enough, and that's the recipe for disaster.