micaksica
One of the downsides of programming being easily accessible and easy to get a job in is that there is no required standards body to write code. There's no way to fix this. The best you can do is refuse to hire people that worked on these or similar systems, and I'm sure they will find jobs somewhere within the government-contractor software engineering space.
I believe that if this site enumerated all the ways that you can maliciously use computerized vs. paper voting systems, we would show a hell of a lot more benefits to a manipulator than a voter.
This is what's really strange about the American healthcare system. For everything else in America you can either get a price up front or an estimate of total costs up front. Why should going to the doctor be any different than going to a mechanic? Pay advertised flat rates for issue diagnosis, and get estimates for the problem.
Yes, in cases of emergency you can't really shop around too much, but the majority of the time you're going to a doctor, you could at least call and get estimates of how much things will cost. It's not even possible to do this with most healthcare organizations. If you call your doctor's reception and ask "how much will it cost for this visit?" they'll tell you they don't do billing and they won't know until it's processed by insurance.
Price transparency in the healthcare market - or at least some decent estimate of it - would be a great thing to see. American healthcare is ridiculously inefficient because it appears wholly designed to be byzantine.
A lot of engineering teams unfortunately see strong security as a hurdle to fast development, and/or security is put as a lower priority to feature development or other deadlines. A lot of business units see security as a cost sink and have the "there's only so much we can do to protect ourselves, if they want it they can get it" or "it won't happen to us" mentality.
On the other hand, some companies have security built deeply into their lifecycle, and really care.
It's the same on iOS.
I can't say I'm happy with Robinhood. It's dumbing down something that can get you into a world of financial pain if you don't know what you're doing.
If they want to target people that don't understand what they are playing with, they shouldn't be giving away options/crypto access/margin buying to people that don't understand those concepts. Expect a lot of people to lose a lot of money. /r/stupidfinance has some pretty great posts in which people were left in the cold after playing with fire in RH.
I used to really care about trying to harden the Node ecosystem, and last year it was one of my main goals. I tried to send multiple vulnerability reports, do mass static analysis of npm packages, and wanted to contribute more to the ecosystem, but the consistent ambivalent reactions of much of the community that I talked to turned me off of the project entirely. If npm wants to continue to be a security dumpster fire, let it burn. Node is a waste of security researchers' time and an honest goldmine for black hats looking to compromise relatively powerful novice webdev hardware.
I don't see it changing anytime soon. npm is a business that isn't focused on security. These things keep coming up, and yet npm install metrics I'm sure aren't decreasing. Until they face meaningful competition and/or the rest of the Node community begins to give even half a care to security outside of this forum, there will be no incentive for anyone to do anything about it. It's easier to play PR, give a little lip service to it and dodge the problem than it is to add any friction to their potential growth.
While this may seem pedantic, it is important that people do not rely on BTC transactions for anonymity. Perpetuating this myth may become dangerous for some Bitcoin users.
And nearly every kid can afford a shitty chinese USB->MIDI controller and a cracked version of Live/Logic/FL Studio. The DAW and a controller is the weapon of choice for today's pop music industry. The fact that guitar is dying as "mainstream" shouldn't come as much of a surprise.
Microsoft developed quite a few of these ideas internally with the TwC (Trustworthy Computing) initiative in the early 2000s, and built a protocol - and development workflow - around threat modeling and security awareness. Most of their internal security-oriented protocol is listed for free:
https://www.microsoft.com/en-us/sdl/
As are some of their tools. For individual developers wanting to have a better sense of what threats their applications may face during the design stage, there’s a good Wiley book on threat modeling:
https://www.amazon.com/Threat-Modeling-Designing-Adam-Shosta...
If you’re really in a hurry, a lot of the typical OWASP vulnerabilities are mitigated by choosing higher—level, long-standing frameworks and abstractions (e.g. Rails, Symfony, ASP.NET MVC) that handle a lot of the things that can hurt you. From there, most of the low hanging fruit skids will find can be mitigated simply by following the security best practices documentation for your framework before you start writing code in it.
Anecdotally, auditing web applications for security issues is my day job. The majority of the time, ignorance is the real issue, not speed of development. They simply don’t have any idea what threats they are facing, or any real education in secure coding principles. Very rarely have I dropped vulnerabilities and had teams say “yeah, we know about that”. It’s way more “whoa, I didn’t even know you could do that”. Basic security education really matters.
While I can’t really use you as an example, since you kind of need a Mac for a lot of the work you do specifically, I’ve heard the same complaints about Apple hardware from other long-time Mac users that don’t actually need to have a Mac.
I am curious how many of those of us that don’t need macOS day to day have voted with their wallet away from Apple’s pro line, and what they switched to. I still use a mid-2014 MacBook Pro at work, but at home when it was time to upgrade I took the same path you did and went for the 12” MacBook. It sucked in every way.
Now I’m the owner of a Dell XPS, the supposed most Mac-like PC, and I’m simply stuck with another set of problems: it’s developed a great amount of coil whine, thermal management is spotty to say the least, and the sound card drivers have to be reinstalled every few reboots else it will not detect when I have plugged or unplugged headphones, which has me carrying around a USB DAC. When I need macOS, I’m still running High Sierra on a quad-core Mac Mini server from 2011.
The sad thing is that I don’t think there is a good option at this point. All of the “alternatives” to the MacBook contain their own faults.
I actually love seeing things like this, but it’d be nice if there was some more documentation on the project. Crypto libraries generally aren’t the kind of thing you want to pick up when they’re new unless they are both heavily audited and developed by those with backgrounds in crypto work.
Room to grow housing and office space requires a whole lot of development to happen. My greater point is that there is very little incentive for most people to move to Detroit compared to other locales that are further along on actually having a lot of the type of housing that is popular on the west coast, some semblance of working public transport and infrastructure, etc. The M-1 Rail is a good start, but I think we are still years from Detroit being a truly viable choice.
There are better options than Detroit for this largely just because Detroit is very far behind other cities that can offer some of these needs now and grow into the future ones. Detroit is still at the stage of needing to grow a bit more to support the influx.
There is little to no way Amazon is going to be able to import their workforce to live in the city of Detroit. A whole lot of the housing options there are extremely outdated or require extreme renovation, the city’s infrastructure is in crumbles, and blight is still a problem.
Source: I have some friends that live in Detroit. Like, the actual city, not the Detroit Metro area.
It's of no surprise to anyone that follows Node.js security at this stage that the third party dependency chain is really its biggest weak link. Jordan Wright did some good research a couple of months ago on Node dependency trees and malicious packages that's worth a read:
[1] https://www.nytimes.com/2017/09/17/technology/facebook-gover...
[2] https://www.nytimes.com/2017/09/06/technology/facebook-china...
[3] https://www.nytimes.com/2017/08/11/technology/facebook-china...
I disagree with the "middle class" being the ones sending their children internationally. The Gini coefficient in China is higher than that of the United States. Even if it was the same income distribution, America's middle class cannot afford to send their children to private schooling in other countries.
These people are not the middle class -- they are quite far away in income away from the median of the income distribution, even in urban areas. They are the upper class. Maybe the lower upper class, but it's a stretch to say they are middle class.
This can be assumed with any technology stack that is popular, domestically-grown, and well-established in China.
I have WeChat installed. Would I use it to converse with people outside of China? No. But casually, it's what's accepted there, what people ask you for, and what everyone's using.
So in other words, the ruling class continues to rule, as they will be the only ones with the sanctioned political freedoms to study abroad, etc.
> China's fate as being relegated to being the world's giant copy machine is sealed unless things revert
China being the world's giant copy machine has worked very well for those in power in China. Why not sustain that as long as possible? What other country has the stability and resources to replicate that? Most countries with extremely cheap labor don't have the supply chain.
All that was accomplished was that he placed an automated fraud alert, even though his original question was whether or not he was affected by the Equifax breach.
Most of us have made our careers standing upon the shoulders of relative giants until we have grown enough to become taller ourselves. I don't believe that you should have to be able to build a reliable authentication framework to be able to write a decently secure web application.