xbar

This was helpful. I found the invisible fiber hard to see.

Normally what happens is that the vendors get a chance to evaluate the verification, but that in the public's interest the working exploits don't get distributed.

You suggest that Canonical has concluded that this issue is not so bad and so it is Ok that they have not released a fix.

Customers and users expect alacrity for CVSS 9.8 CVEs in un-hardenable services like the TCP stack.

Whatever Canonical's security record or process has been for other CVEs does not excuse silence and delay in this case. Canonical, unfortunately, does not get to silently decide such a categorized CVE "is not trivially exploited" without criticism, and likely consequences.

Most people talk faster than they can type. 80 wpm voice chat is easy for everyone. 80 wpm typing filters out most typists.

Precisely. They gave up integrity so early after acquiring the ThinkPad brand as to be immediately unusable.

You wouldn't steal a book....

There are low-integrity folks who are willing to risk getting caught for fakery in public spaces in trade for the promise of notoriety.

Chicanery seems to scale anywhere that there are insufficient institutional barriers.

Parenting-level policy response recommendation: once the trees grow back, you can proceed.

Don't blow it, Canada. You think Rogers is bad now....

This is a neat trick. I would like to see a series of House investigations that do this and publish the wiki as a matter of course.

Security folks have understood this math for years: there have always been virtually infinite vulnerabilities in production software. Better researchers find them in any repo rather rapidly. The only thing keeping folks safe has been the limit to the research against any given repo that any highly-capable researcher would devote.

As the cost of research approaches 0 via AI tooling that approaches highly capable (and now tireless) researchers, the rate of findings will increase, as will the rate of subsequent incidents.

What remains an open question is whether in-production code quality can improve sufficiently over time to return to a state of relative security.

It turns out that privatization of public services does not yield the lowest prices for consumer as a result of market forces. Because it does not create services markets, it creates services monopolies.

It has not gotten any worse. The rapacious greed of politicians in service to their own interest has been universal since the beginning of politics.

No. That is reactionary. Conservatism means "government should govern as little as possible to guarantee freedoms, and no less. it should not provide services for a fee (aka tax)."

I would expect rule-of-law to have consequences for a failed root CA before entrusting a nation with another.

Well said. I choose not to believe this was an error.

Sorry Quad9. I love you. I am sad France does not understand you the way I always have.

Stay Swiss, my friend.

After the first 8 hours of playing with Mythos, I was asked what I thought. My response, "this generation of LLMs is going to drive the largest wave of security incidents the world has ever seen."

It is still getting started.

CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.

Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.

Smart business decision to have made 10 years ago. Thanks for the mess.

Is it a voxel engine?

Evac drones will have a lower destruction rate than kamikaze drones per month, for obvious reasons. If I imagine a kamikaze drone carrying a wounded solder, it better be in Rambo VII because that's ridiculous.

It is a story with strong PR value.

What is the outlook for the hyperscalers?

Cyberspace is defined with the word "hallucination", and Gibson spent 1977-1983 writing his short fiction and first novel on the subject. The degree to which he was influenced by psychedelic culture is open to debate, but I agree that it was non-zero. I think Grateful Dead tapes is your own projection, however. Bob Marley is more likely as muse-ic.

Sickening. No more Ebay for me.

Did it have that tiny rollerball on the side?

We bought a bunch of TabWorks-based Compaqs back then for a medical office where I was doing IT work. I thought it was slick at the time.

Love it. Maximize skeuomorphic design.

Yes. But. Just like long-enduring CEOs of increasing disrupt-able enterprises, long-lived politicians accumulate obligations to their donors in a manner that limits their policy latitude.

Sadly, such long-tenured politicians also happen to be old. The old-ness is mostly not actually the problem. It is the constraints.

I am missing any clues about your definition of out-of-touch.

I played Panzer Dragoon on an NV1-based Diamond Multimedia card at CES in January 1996. nVIDIA gave me an nV1 t-shirt at the time, which I wore periodically for the next 10 years.