scottlamb
Well, it does support DDNS, [1] so presumably some people do assign it a domain name. But I don't expect it to participate in WebPKI necessarily. That's not the only way to secure communication from the config program to the device, e.g.:
* The routers I worked on in 2006 had baked-in keys/certs signed by our own CA with cn based on serial number rather than reachable customer-chosen FQDN. That's not WebPKI but it actually works. Elk's configuration software knows the expected serial number and could use a similar approach. The configuration is not http-based (much less browser-based) anyway.
* It'd be better to just punt and say the communication should be secured by proxy or VPN or something than to offer TLS in a misleading way and suggest it should be directly exposed to the Internet.
As for the Ethernet expander to the central station, that totally could use TLS and WebPKI.
[1] https://elk-manuals.s3.amazonaws.com/M1XEP_v2_Installation_M... page 14
I don't see that update available after `sudo apt update && sudo apt upgrade`, and one of the `curl` commands from this thread still succeeds. How long does these typically take from notice to actually being available on whatever mirror one hits?
In the meantime I ran `sudo dpkg-reconfigure ca-certificates` and unchecked those two particular items. That worked.
edit: doh, it was an own goal. I had a `/etc/apt/preferences` that was causing it to prefer `stable` over `stable-security`. facepalm. not sure how I ended up with that, but clearly I did something dumb. should anyone else be wondering, `apt-cache policy ca-certificates` is helpful.
[1] https://lists.debian.org/debian-security-announce/2026/msg00...
In my experience it's equally likely they just don't do validation to begin with. For example, my Elk M1XEP (physical security system's Ethernet expander) runs a configuration server with and without TLS. They recommend with, but it uses a self-signed certificate, and the crappy VB.NET configuration program doesn't validate the cert in any way, so it can be trivially MITMed. The Elk M1XEP also can connect to a user-chosen alarm monitoring service ("central station") over the Internet. I don't think it uses TLS at all for this. I think there's optional shared secret auth/encryption?
As I understand it, the private key is supposed to be a number in the range [0, 2^256), but they actually generated a number in [0, 256) for these 8 intermediate certificates. Once you know there are so few possibilities, you can try them all ~instantly, so effectively everyone has the private keys. (And when I say "you can", I actually mean you, not some hypothetical more skilled version of you: even if you don't know anything about public key infrastructure, if you have access to an LLM, it can do it for you with a single prompt.)
Yes and no. The traditional separate kernel exposes one set of interfaces that these tools use. A library version might expose a different set of interfaces that accomplish the same thing. Your application could then use those to provide similar observability. But maybe not—that consideration was mostly absent from this article. And with new tools, you need to retrain your developers, SREs, LLM agents, etc. If your new tools are that much better, it might be worth it. But these articles have fallen far short of making that claim.
> Also, I don't need a tool to tell me I'm being punished by the IO or CPU scheduler if I am the only one using the CPU and IO :)
Disagree. Embedded programs still have IO and CPU scheduling problems, including priority inversions. You don't need different programs to have CPU scheduling problems, just different threads, or different tasks with an async scheduler. Any time you have concurrency you need to consider scheduler observability.
> With a unikernel, the [observability] surface is much smaller. If the functionality isn't in the application (the operating system), then the [SRE] is screwed. There's no next hop.
Tools such as `strace`, eBPF, `lsof`, `ss`, etc. have tremendous value. The article mentions some nice things for observability ("structured logging, OTel") but so much gets thrown away.
I'm joking...but not entirely. It sounds impressive on a promo packet when you say you've saved 100 TB of RAM / $$$ through whatever technique. But it sounds a lot less impressive when you say if this system grows to this size in x years, I will have saved 100 TB, especially when no one yet knows how large the system will really be in that time or what the cost of RAM will be. I dunno, maybe if you say that x years ago, I made a decision that now is saving us 100 TB, that's kinda impressive, but you're also getting credit for it x years after you did the work. It also doesn't have the implication that it must be inherently complex/hard because some other smart person chose the other way. And there is a bias to care more about recent accomplishments. So I don't really think it'd be valued the same at all.
Also, in general big tech (at least Google) prefers growing the userbase over improving efficiency. Periodically efficiency is rewarded, e.g. when RAM cost suddenly balloons or some big must-have feature has suddenly used up capacity planned for something else. You get rewarded for doing efficiency work on demand, not eagerly.
I once got a $100 peer bonus for finding 100,000 cores that were essentially stranded by an accounting error in another team's migration script.
If they are indeed saying understaffing doesn't matter because their current customers don't care, their loyalty numbers will only go up because of that sampling bias. Relatively upscale fast casual places (e.g. Chipotle) will fill replace McDonalds for the customers they lose. The circle of service industry life.
The "world" chart shows an increase from 19% renewal to 34%. Did they cherry-pick that? (Also, "European Union" is more than one country.)
> I don't doubt that it's economical for individuals when the govt is subsidizing it.
Does that distinguish renewables from fossil fuels? Haven't governments been essentially subsidizing fossil fuels (not least by allowing environmental externalities to be ignored) for as long as they've been in use?
> It cost her nearly $10k to have a _used_ aluminum ramp installed for her house.
Why so expensive? I did a quick search, and the only way I could get a (new) aluminum ramp up to $10k was by selecting the 30-foot platform model, [1] which I'd guess would be excessive in most cases. I'm not counting installation fees but it looks like something I could do myself in an hour, and I'm not that handy.
[1] https://reliableramps.com/collections/aluminum-wheelchair-ra...
There was a subthread recently complaining about password managers and their UX problems. These aren't aimed specifically at "disabled" users, but I think it's a similar situation. We can't reliably enforce good standards for sign-in (whether that's just setting the autofill attribute correctly and choosing the correct event handlers for Javascript validators or something far more ambitious), so we expect a password manager to just deal with the web as it is. IMHO they work remarkably well given that constraint, but it's not optimal overall.
Why? Not all "janky" things are the same:
* Sloppy changes to the internal 240V wiring: yeah probably a violation of the lease, and legitimately likely to burn the place down, with associated liability.
* Temporarily mounting to the exterior this mechanism that turns the knob shaft, with no changes to the wiring, no holes, no nothing. I can't think what grounds they'd have for considering this a lease violation or a reason to keep any of the security deposit, as long as you pop the original knob back on when you move out. And as inigyou pointed out, how would they even know?
You do have to set the "api: reboot_timeout: 0" if you don't want it to reboot itself every 15 minutes while HA is down. I persisted the alert threshold to flash though so even if it does reboot it comes right back up and works fine.
IMHO it's not that bad? With the disclaimer that I'm also a software engineer who dabbles very very lightly with electronics and has no mechanical engineering expertise. But the overall approach of doing this by stepper motor seems quite defensible given the security deposit constraint. The only part that seems really janky to me is that it's not physically held in place that well as noted in this paragraph:
> Ultimately, the biggest issue is that binder clips and cardboard aren’t quite as robust of a mounting mechanism as I’d hoped they’d be… and over time, the stepper motor tends to “sag” a bit, resulting in a bit too much friction between the motor, the coupler, and the underlying knob, causing the mechanism to stall out until someone manually goes and reseats it…
Involving MQTT and HA can sometimes get frustrating too; having your AC not working properly if there's a problem on a Linux machine can suck. If this becomes a problem in practice, iirc ESPHome also has a thermostat component, and temperature sensors are really cheap and easy to wire in, so you could do it all on the microcontroller pretty easily in a low-code way. But if this part is working, no need to mess with it.
Is this kind of consumer revolt even really possible?
If you feel strongly enough that you refuse to fly altogether, then of course you can avoid flying on a 737 MAX. But I think most people did not feel the risk was that high. They just want to select "guarantee no 737 MAX" when booking a flight, and as far as I can tell that option doesn't exist.
Even if the flight is not a 737 MAX when you book, they can and sometimes do change aircraft, and as far as I know there's no option to get your money back when they do. If you show up and see it's a 737 MAX...you either get on or you lose your money, and have to find some other way to get where you're going, right?
But since you brought it up, SFPD should also have a policy on when they share drone footage, and I'm going to assume they violated that. In this case I think it's reasonable to take them at their word that it was accidental and they are learning from it. And I'd be a lot more concerned anyway if it were ubiquitous surveillance of ordinary citizens, not just incidental captures during scoped, presumed legitimate operations.
In principle I think this is good. These are useful tools as shown in the first video, helping them safely arrest a suspected thief. And having a policy like this is a good step to ensure they aren't used for ubiquitous surveillance that enables the sort of post-hoc warrantless (and unjustifiable) invasions of privacy we've seen with Flock cameras.
That said, I hope the official policy is more air-tight than this one-sentence version. "with or in lieu of vehicle pursuits" is tautological, only constraining the target to be a vehicle [edit: or does it require they follow a vehicle pursuit policy specified elsewhere? unclear to me]. And can anything be a "training exercise"? What would the consequences be anyway if an officer violates the policy? [edit: I'm also wondering now how tight their policy on an "active criminal investigation" is. When there's significant officer time involved, there's some inherent limit on how silly/vindictive/... they can get, but with enough drones, that could go away.]
I likely wouldn't use a rewrite of such a huge project if it doesn't have the backing of the original team (or a significant fraction thereof) and a believable story for having matched/exceeded the original code quality and maintenance. I also think in general using an LLM for license-laundering is legally and morally hard to defend, although this case is different in that they chose a more restrictive license. Not a lawyer, but my understanding is that you can just download PostgreSQL, do s/MIT/AGPL/ and release it, legally. (The original MIT-licensed version still exists, so no reason anyone would prefer yours until you make another release with some compelling new feature.)
Classy disclaimer! matthieum's (long) reddit comment is also an informative read: https://www.reddit.com/r/rust/comments/1up0uhg/girls_just_wa...
What I mean is: I expect you originally heard a version of this that was more nuanced and supported by data than what you presented. Your paraphrased form is weaker, which I call a strawman. (The "duh, QED" was kind of a give-away.)
Wikipedia lists (among other things) "Oversimplifying an opponent's argument, then attacking this oversimplified version." and "Exaggerating (sometimes grossly) an opponent's argument, then attacking this exaggerated version." as characteristics of a strawman.
btw the opposite is sometimes called a "steelman": arguing against the most solid version of the opponent's argument that you can imagine.
> I mean, sure. I've long argued that the US strategy of printing money and giving it to asset owners is bad. I doubt a wealth tax would help, IMO the real issue is the welfare for wealthy people. Seems kinda dumb and the people claiming that the economy would collapse without it appear to be making up their principles as they go along.
As in Quantitative Easing? I confess I don't understand it as well as I probably should, but I think it's cyclical? and inequality is increasing even when it is not happening? Would a pinky-promise that we will stop and never do it again achieve start reducing inequality, as opposed to just lessening the increase? If not, I don't think that's radical enough on its own. What serious alternative is there to a wealth tax or going back to 70+% highest marginal tax rate?
> But we should all want to encourage wealth. It makes people wealthy.
To the extent anyone and everyone can become wealthy, I agree. What policies would you suggest to achieve that meaningfully (obviously inflation doesn't count)? What I see in these charts is instead a zero-sum game in which the most wealthy become even more so at the expense of the least wealthy.
Okay, fair enough. I took "without adding any new buyers" literally but yes, I can imagine this creating some downward pressure on stock prices.
> Or their spending it on food and rent results in an increase in rents, even for the people who didn't get any, which rents go in part to foreign investors who remove it from the jurisdiction, and then domestic people have even less to invest than before. ... Compare this to the thing where you e.g. relax zoning rules to reduce housing scarcity so that rents come down and then domestic people have that money to invest.
Are these mutually exclusive? I concede that people being unable to afford rent limits rent to some extent, but it's not my preferred price control. Giving them more money that they could use on rent might make it more clear we need to make other changes, and I can live with that.
> you've now created a preference for spending rather than saving/investing while increasing your reliance on the taxation of saving/investing.
Yes. Is that worse than the status quo? There's a lot of spending now that should be happening and is not—people literally dying from inability to afford medical treatment. You'll probably say—just as with the rent example—that people being more able to pay will cause medical costs to increase further, and I agree that should be addressed, but again I think people being flat-out unable to afford it is not the best way to control medical spending.
> [...pointless wars are a massive overall net loss...]
I think you understand this, but just to be clear in case anyone was wondering: I also hate pointless wars, just was making the point that even in the stupidest use of the tax money I can imagine there's still someone getting money to buy Apple stock, even though as a whole we're worse off.
> Wouldn't that make it not a straw man argument?
I think the "even" and "..." are doing a lot of work in my sentence. You presented a less strong version of the argument than that given by people who support it, thus it is a straw man, period.
> an assumption that voting or committee can be better at allocating resources than a free market
Would you say we had a free market in the 1970s, when the chart I linked showed the top .01% by wealth's share of taxes exceeded their share of wealth? That's essentially what I'd like to go back to, perhaps by a wealth tax. I would say we had a free market then, showing progressive taxation and free markets are absolutely compatible. This isn't Soviet-style central planning.
I'm not at all sure everyone in these discussions agrees on this point!
I agree with you not only that this is bad but also that wealth taxes are not the only way to address it. They are a way that is getting momentum right now, AFAICT more than the other things you mentioned, and we may have to choose between voting for a wealth tax (or candidates who support one) or doing nothing.
fwiw, I'm really not sure which approach(es) I'd choose if I could single-handedly decide how to reduce wealth inequality.
> The high marginal rates in the mid-20th century were fake.
I think "federal receipts as a percent of GDP" isn't the right chart to answer this question. Overall tax rate != how progressive the tax is or how high the "effective" marginal tax rate is. On https://inequality.org/facts/wealth-inequality/ the "The Top .01% Don't Pay Their Fair Share as They Hoard More Wealth" shows a clear cross-over point where before about 1980 the top .01%'s share of tax was greater than their share of wealth, and after it reversed. That's consistent with the 1981 change I mentioned.
Yet I assert it's useful to ask if the status quo—one person has >$1T and many others don't have enough for basic needs like shelter, medicine, and food—is optimal or if it'd be better to redistribute some of this.
* We don't need the ability to quantify or rank all wealth distributions, just compare some of immediate relevance. That's much easier, in the same way that even though the halting problem is undecidable, we can prove some realistic program A will halt and some realistic program B may not.
* We don't need objectivity. Democracies decide many subjective things by majority vote (sometimes 2/3rds or whatever), directly or through representatives. I don't always agree with the outcome, but it's the system we have here in the US/California, and I assert it's better than a dictatorship or requiring 100% consensus to take any action.
Even your straw man version of this argument is pretty convincing to me alongside graphs showing the extent to which our inequality is growing. https://inequality.org/facts/wealth-inequality/ see the "The Top .01% Don't Pay Their Fair Share as They Hoard More Wealth" graph in particular.
This is more a disagreement of values than facts, I think. Some people see the richest man's net worth go from $100B to >$1T and think he deserves that for starting these companies, and taking any of it from him is class warfare. Others think that rich people's pissing contests and lifestyles would be essentially the same if their wealth capped out at say $100B instead, we're morally obligated to use that money to try to meet Americans' basic needs, and using other's taxpayer dollars to allow him to reach those heights (see <https://en.wikipedia.org/wiki/You_didn%27t_build_that>) is class warfare.
High marginal income taxes (it was 91% in 1963, 70% until 1981, there's your compelling case where they turned out to be right, inequality was not growing then like it is now) or a wealth tax are not the same as Soviet style socialism. They still give an incentive for entrepreneurs, innovators, and hard workers.
Is that assuming the tax money is going into the void? I agree it might force roughly 0.8% of shares to be sold in a given year. But as to not adding any new buyers: no one's being forced to buy stock in the same way, but shouldn't someone be getting the money and potentially using it to buy Apple stock?
Let's imagine for a second the wealth tax money is simply given to people who are below the threshold. Most of them may waste it on silly things like food and rent, but some might end up with a surplus and become investors. Same effect if say the income tax is lowered to make the wealth tax revenue-neutral. Or if say it's used to expand Medicare. It's hard to for me to imagine a way to spend taxes that doesn't help someone. Even if the money is used on war—a net destruction of value and lives—there are some people selling missiles better off a result.
I think the current situation is not great, but I'd want to fix it by investigating why we're seemingly unable/unwilling to impose the punishment currently on the books. I think it would be plenty if we did—to me, more than six months jail time for stealing <$950 would be excessive. We could increase the fines and decrease / take away the jail option, but does it matter? It's not happening anyway.