lordlimecat

In my world "just works" means "we blew away all of the security controls and best practice to get this thing hobbling across the finish line."

I see COTS products using ldap memberof queries without LDAP_MATCHING_RULE_IN_CHAIN and stating definitively in their documentation that nested groups are bad (despite decades of best practice).

I see product documentation recommending authenticating against LDAP instead of kerberos, despite the underlying libraries having full kerberos support.

I see sslverify: no, and flags to ignore SSH TOFU warnings, and recommendations to avoid SSH gssapi-keyex (WHY?????), and security approached by buying ever more products creating ever more complexity.

Yes, things "just work" in a horrible, 'youre stuck with your vendors forever' sort of way that results in lengthy outages every 6 months due to mounting, intractable technical debt. But things don't have to be this way, you just need people who are willing to ask "why" or "is that necessary" or "can it be better".

....And then feel OK resorting to ChatGPT for the explanation.

Seriously that threw me, and maybe it makes sense in this context but it seems strange for someone with such an apparent depth of technical knowledge leaning on an LLM for anything.

Wild idea: what if we evaluated research on its merits, looking at things like methodology, controls, and reproducibility?

There's a reason that students are taught on day 1 of Statistics 101 that observational studies can only establish correlation, NOT causation. Otherwise we might as well just admit that cancer causes smoking.

It's one of the most pervasive and blatant errors seen in the news and social media.

Aspartame's potential risks, as compared with sucroses?

Because I don't recall hearing about any aspartame-linked deaths ever, while I know that diabetes is a killer.

Aspartame has been a boogeyman for literally decades, and yet no solid experimental study has shown evidence of carcinogenic activity nor of any negative health effects at realistic quantities.

Any risk posed by aspartame is completely overshadowed by the risks posed by the sugary alterative.

Sugar in general is one of those topics where otherwise intelligent people will suddenly lose the capacity for critical thought-- espousing the use of fructose-based sweeteners (agave) in lieu of HFCS over some concern over fructose, or opting for "natural sucrose" over a non-caloric, zero GI option like erithrytol.

Asking questions about who is funding the research is valid but anytime someone starts coming for the non-sugar option it should raise red flags about the motive for doing so; I would argue that the sugar lobby is far more concerning than the sweetener lobby. Diabetes, not aspartame overdose, is the real killer today.

Funnily enough 'sweeteners' as a class are so diverse that any claim that 'recent studies' universally show a common effect can be thrown straight into the rubbish bin.

Erithritol, Stevia, and Aspartame are all so wildly different that it is implausible they share a common mode of action.

>the US has been murdering children in almost a dozen countries around the globe for the past two decades.

Do you want to spell out what countries, specifically, you have in mind here?

The idea that the CIA is naive to what Russia does is pretty amusing.

Yes, if only they frequented social media, they might have some clue what Chinese, Russian, and Iranian security services were up to. Alas for their naivete...

And it's your belief that the State Department-- let alone the CIA-- are totally ignorant of what Iran does to its staff?

For many years the keyboards were only skins, and for many years after that they would periodically lose their default status and revert to the built in keyboard.

Now it seems that the keyboards randomly hang / crash and don't come up when requested on the first try.

Apple goes out of their way to screw with third party competitors.

So we're effectively saying, "infrastructure is expensive" to justify burning the piles of money instead of using it to improve the situation?

For the same reason people got suckered by FTX and the same reason so many got burned in the many BTC crashes: They got taken in by the wild promises of cryptogains.

The article (and Bhutan) are strangely cagey about whether this process has actually generated a return.

Spoiler: it hasn't.

Bitcoin mining generates literally no value for 99.99% of the population, so anything that improves the infrastructure is going to be more valuable than that.

You need to do those things for a datacenter too.

The tech field is the sad story of execs, marketing types, and end users continually relearning the lessons that they refused to accept from the developers.

Imagine suggesting a literal plotpoint from an Orwell novel with a straight face on hackernews.

Dont forget to update the Wolfram database with who we're at war with!

It really doesn't. It's a language model. Literally every webpage on this topic mentions that.

This is why it will happily tell you that a director directed a movie before they were born, and agree with you when you point that out, and continue to insist that he did it. There is no ability to synthesize and apply new information to a line of reasoning, because the chain of thought is an illusion wrought by a statistical language model.

Its purpose is to be semantically correct, not to reason.

If that were true then why buy the LotR franchise rights?

That only works for so long. It's burning money for warmth instead of spending a bit of time to buy firewood.

If someone is rolling into a Tolkien IP believing they're better at high fantasy than Tolkien, it goes from "arrogance" to "megalomania".

Sometimes it really is best to minimize the artistic license and let the masters work shine through.

Keep in mind that that is pre-inflation. Episode 4 made 1.3 billion adjusted for inflation, with a far smaller moviegoing audience.

The new films are just milking every ounce of life out of the franchise. The money they're making is indeed peanuts to what a talented crew could have made.

Because many of the studios think that big budgets and flashy effects can cover for nonsensical plots, mediocre acting, and characters whose choices do not fit with who they are.

And frequently these mediocre writers roll into established franchises and actively make editorial decisions as if they're the reason were watching e.g. LotR. Newsflash, Tolkien is a far better writer than whoever is on Amazon's payroll, probably best to just stick to his ideas whenever possible. If you want to innovate you'd piss less people off doing a mediocre job in a brand new universe.

Sfp isn't copper vs fiber. It's just the standard for a modular plug on network hardware.

They have 25gbe twinax SFP28s that, as far as I'm aware, have essentially identical performance specs to using optical SFP28s with fiber. The fiber is thinner and can go further, but it also is more fragile and limited on bends. Latency is almost entirely driven by the switch and the NIC.

Photons in fiber do not move meaningfully faster than signals in copper, and speed of light in short datacenters runs is not the limiting factor In latency. Any meaningful processing will happen in electronics and converting from copper to fiber introduces more latency.

There's a good paper on it here: https://www.commscope.com/globalassets/digizuite/2799-latenc...

Tldr coax actually is faster (0.77c) than optical fiber (0.67c).

It's a misconception that electrons are slower than photons. In a vacuum? Maybe. But you need a medium to use photons and in fiber photons go at 0.5-0.75c.

Electronic signals in copper propagate at somewhere from 0.66-0.8c.

The big benefit of photons is that they don't experience electrical interference, so you can often get a lot more bandwidth out of a arbitrarily sized photonic medium than an electronic one.

The actual latency of photons vs electrons is generally not relevant.

You can already do this.

As always the only defense is to compare what is being asked for with the FQDN.

Scenario 1: Attacker compromises ECOMMERCE_SITE where you have a login. The ECOMMERCE_SITE uses md5 for logins, so the attacker just brute-forces the hash and then uses that password to compromise your logins on other sites.

Scenario 2: The ecommerce site has upgraded to SHA512, so cracking isnt an option. But the site is relying on basic auth, so the attacker simply sniffs your password when you auth.

Scenario 3: the ecommerce site is using a secure zero-knowledge auth against a hashed/salted/peppered/whatever credential. They cannot brute force it, and the server never sees your password. They can mess around with the ECOMMERCE_SITE but cannot pivot to any of your other logins.

>If I was a hacker, I can add JavaScript to send plaintext somewhere.

We've just shifted from "quiet, persistent threat" to "hacker announces to the world that he's in". Changing javascript on a prod website is going to trigger alarms.

If you have competent tech staff you can inhouse it on any of a dozen hypervisors for roughly the capital cost you would spend in 6 months on cloud.

Every year on the cloud can roughly cover the expense for double that capacity deployed on prem.

Complaints of "operational costs" generally assume a woefully incompetent staff.

I rather suspect that anyone reading about this-- whether computer literate or not-- will suspect in the back of their minds that this thing is not legal.

Turns out those hunches are pretty reliable, who woulda thunk it.