What's a duct-ape and how did you learn to control them?
452 karma · joined February 19, 2016
As far as I can see, simply that the same company helps them get the loan is the same one that pays them to drive. And also that they probably buy new cars and are upside down on the loan as soon as they drive off the lot.
If you really came through with the extra pay I think they still sleep in their cars and bank the difference.
There is no legal bar whatsoever. No bond, nothing.
> I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them.
Sure, and I don't even expect them to really know the details of a driver's license either. I only expect them to actually spend two minutes checking ID, photocopying the request, etc.
With a physical appliance all they'd need to do would be lock it in a safe.
> This idea is wholly, entirely preposterous.
No, that's the certificate system in the first place. That a CA in China can sign a cert for a company in another country, etc.
Also, and most critically, it's musical chairs between cloud and security companies. If Symantec came to Google to complain it's likely they'd go straight to VPs who used to work with them and get special treatment.
Hence the call to use notaries. Let's avoid the whole buddy network.
And no banker was jailed for 2008.
> And by that I mean there was no institutional conspiracy to do so.
That simply means that the conspiracy was too big to reasonably punish. Too many friends of the prosecution would have been hurt, so miraculously nobody was charged.
> But given the potential repercussions, banks are being very cautious. They cannot afford more scandals.
Which is what the OP was saying. We've dumped risk on the banks and now they're hurting legitimate customers to avoid that risk. And because it's essentially mandatory to have a bank, customers are being forced to use services that - like Paypal - will hold their money for months or years without feedback simply because they can.
They don't care that they freeze your accounts and you can't pay your mortgage, they're indemnified against claims from customers. "Oh, sorry, it was vaguely related to anti-money laundering. Check back in 90 days."
It's almost like our governments are trying to make us use non-bank solutions.
It's a ridiculous system and fwiw, it shouldn't be the security companies (though that's being very polite to Symantec) that grant certificates. It should be notary publics (a business all about assurance of human identity) using a physical appliance.
Or, admit we don't care and ditch the entire system for something based on bailing wire and chewing gum, because that's roughly what we've got now.
> We invaded, and not only did we not prevent that outcome, we actually caused it.
Well yeah, who thinks you bring peace with war? There are ways we could have taken over Iraq peacefully, such as making it a protectorate and giving everyone health care (which would have been far cheaper than the war).
In fact, what you're saying is the second half of the traditional "We have to do something, and this is something, so we have to do this." fallacy. "Well, if bombing the the ungrateful fuckers didn't make them love us we're out of here."
No, you've got a lot of shit to fix before you get to quit.
Also, "What? subjects and recipients are unencrypted!?" -- Every User Ever
I was hoping to use a very advanced force as an example to show that things that may sound secure aren't if your attacker has a certain level of resources.
Fwiw, most pen-testers would aso be able to bypass any such casually enacted system too, but that's less obvious so I had hoped to avoid that argument by going with an extreme example.
You're confusing being uninteresting with being safe. (Safety is numbers is irrelevant once you've been selected.)
> Sorry, I'm not going to continue arguing with you.
Stop clicking Reply.
Which defeats the whole purpose. Without the ability to pay more we don't encourage drivers to cover demand. Demand-based surge pricing is a feature.
> I realize people want cheaper taxis, but drivers need to be able to make a living.
That's silly. Landscapers need to make a living, which they ensure by not taking jobs at below cost. Ditto, everyone else except those in protected industries.
> There's a reason labour regulation and unions exists. Some of it may slow some business development or keep corrupt people in positions of power, but a lot of it originally started with the idea of stopping things like child labour, unsafe factory conditions and slave wages.
But few or none of these rules apply to taxi drivers because they're usually forced to work as independent contractors despite being like employees in all ways; we know that's not actually the issue cities have with Uber.
So why do we protect taxis? It's emphatically not to protect drivers (or we'd protect landscapers, etc...) but to protect the medallion-owners.
It doesn't cost a politician a penny to grant a monopoly. For them, it's just paper. And they claim the cash benefits ($x million raised on medallions) as an accomplishment despite that everyone suffers from then on. We didn't get here because some concerned and learned person did a study and decided it was best, we got it because some politically connected trolls got kickbacks (cash or favors) for making sure only the right people got the medallions. If medallions go away, so does that power.
Also, I often see drivers who don't resemble the photo ID in the cab at all. Likely they're unlicensed friends of the medallion renter, who help cover the insane shifts they rent the medallion for. But it negates much or all of the supposed value of taxis.
By giving those drivers an identical (somewhat crappy, as you point out) choice which doesn't lock them in, it's shaking up the taxi industry. And by reducing the value of the medallion it's hurting the monopolists who lobby to keep the number of medallions low, etc, which helps us in the long run with healthier markets.
As for Uber specifically, their value is surge pricing. And I say this as a customer, not a shareholder. I routinely wait for taxis that never come when I'm in cities that have banned Uber. But I never wait for an Uber where it exists - I can choose to pay if I want it. If I'm late for a meeting, I'll pay. It's a service that was unavailable before at any price.
That's a brilliant idea.
What better way to find systematic holes in the system than by making the same people fight against them half the time, and making their reviews based on an equal amount of prosecution and defense? Even if we still just went by the numbers (which we would, it's easy) at least it wouldn't be so one-sided.
Right. I think you're absolutely correct, now. And I fully expect (hope!) that the NSA will one-day come to you with some more-secure hardware and that you will gladly cooperate because as you say - we are all on the same team.
My point is that you can't say what you're saying now. You aren't secure, and you don't have the type of procedures that would ever let you get to more than a 4/10 or so. You don't even see having four independent points of failure as an issue, rather than a benefit.
By promising people that the NSA does not have your organization's keys you're providing the less technical with a false picture.
And maybe, one day, that might matter. You might trick the next leaker into trusting your org as a way to whistle-blow and cause them to be caught by the NSA before they reach the news.
> Yes, and at that point the name for it is "policy". [security procedures]
Yeah, and software is just automated policy. If this is a zero, and that's a zero, etc...
If the guard in the vault runs a non-exploitable policy (ie no "I'm the boss" backdoors) then you can greatly reduce evil-sysadmin attacks.
Is the federal government sustainable? How many employees is enough? Have we already passed that?
Would it be better if we privatized the road crews?
> [Programs] ... They can help, but ultimately you need the private sector to create jobs by selling goods and services.
Well, you do need to create value as opposed to just shuffling it around. But creating roads is enabling much of that private sector earning.
Couldn't we imagine this with a minimalist government and a network of private toll-roads that collected the same or greater "tax" on the local businesses? How does the private aspect help?
> At the end of that 6 years, construction moves on. Money goes to another state, or another part of the state outside of a commute. What do you do then?
I imagine they'd total up the road length across the state, divide by maximum lifespan, and hire enough people to fix every mile by the time it would fall apart.
Yes, in a big state you're unlikely to circulate the same people from corner to corner, but thankfully roads tend to be found in close proximity to people, so I imagine the road crews could all be kept busy (for the most part) around where they each live.
We already do this - my city employs full-time construction people forever. The only decision would be to hire more, and how many is too many.
But if we aren't fixing each bit of road by the time it falls apart (and we are not) then we know we don't have enough.
It sounds good, and because compliance is about by making good-sounding things mandatory (weekly password rotation, yay! /s) it got mandated in a lot of places.
And it did catch mistakes, like accountants sending the wrong files or to external addresses. Which I guess is justification for it right there.
But it's billed as a stronger (ie hacker) protection, for which it's useless, so I never liked it.
I think the world would be safer with an email plugin that helped you by suggesting that you should not send a document to a given address, based on rules and observations. It'd only be a suggestion so nobody would expect miracles, but it'd stop all the unintentional mistakes our system stopped, for a fraction of the price.
Or anyone who'd ever gotten access to the computer, or installed a camera near it, etc.
The critical part of that answer though, is "one of the". The system fails if any of the individuals is be malicious. A more-robust system would require multiple malicious agents in various organizational silos (security, compliance, management) to fail.
> every time the private key rotates
Well, if I got in once it probably phones that home for me.
> you really can't scale up this particular mechanism and keep it secret
Well, it isn't secret. We know the NSA intercepts hardware to muck with it, when needed. Much easier even than planting something in your server room explicitly. Also, they wield NSLs compelling silence and cooperation. It's not like being discovered here or there would stop scare or stop them.
It would probably scale pretty well given that this is the extreme; most people just generate keys on the old debian box in the corner.
It's pretty hard to setup a system that would survive an powerful adversary who simply didn't know your passwords, have access to your safes, etc. But to then make that system hardened against a malicious insider with get-of-of-jail card?!
Assume your first samples show the effect and the later ones don't. The first test will show a strong correlation and the second not. The larger test will simply show a weaker correlation.
To get those higher mandates we'd have to try to pass less-controversial things. Again, not that it's meant keep us here as if this is a special reference frame that I cherish, but that it would force us to reach out to both sides and find change everyone can support.
Both parties in the US election were looking to force their politician on everyone else. A healthier answer would be if we picked everyone's compromise president. But first-past-the-post is designed to produce all-or-nothing outcomes.
When a politician elected with maybe 40% of the popular vote, from the 65% of people who vote, gets a 51% advisory mandate from those few who show up to vote in the referendum, it's a pretty weak reason to drag everyone else along. Democracy is built on the idea of false consensus. That once enough people decide on something that it doesn't matter if others do. The closer we go to simple-majority, the worse that is.
fwiw, I find it funny that you think that's conservative. I get more feedback that it's hyper-liberal. I don't think either are correct.
Ehh, somewhat. Why did you pick beg instead of some other similar word? Probably because you heard the original expression and decided to borrow it. It's unlikely you were just thinking one day of how to describe this thing where an answer really raises more questions and said, "Hey I know, I'll call it begging the question!"
> I have no problem standing my ground on "begs the question" because I refuse to be limited by other people's inability to crack open a dictionary.
Which if they opened, would show them a contradictory meaning. But not drastically contradictory where it'd be obvious - just subtly not what you meant.
> For example, some people have made it their personal crusade to claim that backers on Kickstarter are not investing anything because they don't receive any ownership in return for their money. These people are wrong. It's true that by the word's finance definition no investment is taking place, but by the word's English definition they are absolutely correct to say it is an investment (just like one might invest in their college education).
It's more that they don't receive anything back, except maybe a product, which we call "buying". If you personally said to me - I'm investing in VR for the future by buying an Occulus I wouldn't blink, but when a company does it, it does suggest that they're trying to blur the line. Especially given how many people seem to misunderstand the deal... I'd call shenanigans on Kickstarter's usage, but not yours.
> Because the word "begs" is easier to say than the word "suggests," partly because it's one syllable instead of three. It's easier, it's better, and it's the phrase I want to use. (It's also more correct than suggests for what I'm trying to say.)
Yeah, for me it's exactly not right. Begging is something weak things do to get something. It brings to mind prisoners and cute puppies. It suggests many things that I don't mean and doesn't get at what I'd be trying to say. Maybe it just happens to fit 100% to what you want, but in almost every case I've seen of someone borrowing a term for something else, it's more that people just don't understand the subtleties (or they don't apply in their domain) of the phrases.
And frankly, you seem like you've got an "I can do what I want" chip on your shoulder which may explain your choice more than strict understandability criteria.
I'd definitely use a trusted DB for storing bank accounts. The consistency is pretty much the first requirement and the data maps perfectly to tables. And 7B checking accounts isn't that big, compared to some problems so it'd probably scale pretty well even worst-case.
But I probably wouldn't for an MMO. Or at least, it wouldn't be where I stored every little thing going on around them - just the events (xp and gold earned) that they'd freak out about if we lost. But even just a log-structured DB would work well for that.
If there's no contention for a resource (in the bank case - the value in the account) there's much less reason for a transaction. I want the system to make its best effort but I don't want to wait around for the message if there isn't anything I can do on a failure anyways.
> Furthermore I am not sure how this relates to FP.
I'm saying that FP is great for ensuring correctness.
> But that is a strong point of RDBMs implementing SQL.
Right. And if I didn't have other functional languages available that might be a bigger issue.
1) Not the best language, but not the worst either. There's no excuse except microcontrollers for C these days (even though I still like it) and the fairly decent JVM can't excuse Java. I think people can come up to speed in a new language pretty easily. It's paradigms that are hard to learn, not syntax.
2) Sounds like you don't have devops. That's a solve-it-once sort of problem. And you have to solve it soon enough for some pieces so it shouldn't be put off. You need to be good at it.
3) It certainly can. It is increasing the size of your system considerably - not just the original system, but also the debugging rules for that system plus (as noted) the debugging rules for the debugging rules ad-infinitum. But what do you propose as a solution? Perfectly trained humans on-call? A procedures manual as detailed as the hypothetical code?
4) Well, lack of CI seems insane regardless of what sort of architecture you have. It's a symptom of not understanding the tools.
5) Capitalized anything is always bunk. But if I hear agile as meaning "short-term goals inside long-term goals, and continuous re-evaluation" then it makes perfect sense and has helped as a consultant and in industry.
> Things such as joins, transactions, and means of enforcing data integrity are useful
If the domain needs transactions I'm already speccing them regardless of general usefulness. Yes all that stuff is useful, but all abstractions have a cost which isn't free just because it's hidden in the DB.
For a problem that didn't need transactions, but for which they were useful, why would you automatically want to couple the solution with your storage layer? If you're looking for the ability to express business logic clearly without cluttering it with error handling, for instance, software transaction memory would probably be a better level to work at.
Based on the part names the person wants to refer to. If you place an order and get exactly what you asked for but not what you want or need, you're wrong.
> What standard for language correctness exists besides consensus?
How many of us need to agree your name is Susan before you'll agree and get your ID corrected?
> Neither is wrong. Terms mean the same thing all the time and context disambiguates perfectly fine.
Well, not perfectly fine but we live with it. Why go out of your way to justify and propagate these errors?
> Not a good analogy for several reasons: (1) both of those are from the same field so context can't disambiguate,
Sure it can. You want your data so I know which piece you must mean.
> (2) there's no widespread consensus that "hard drive" means "computer". In practice most people would misunderstand.
There seems to be here. Maybe your area is more technically sophisticated or maybe they just make other mistakes.
> I'm not fighting for my right to be wrong, because I'm not wrong.
You can call "not right" whatever you wish. I'm not talking about taking back your culture's words or anything; I'm talking about technical cases where there's a clear right answer, and a vast assortment of answers that will not accomplish what you wish or will do it sub-optimally.
> I don't mean to be rude but this sounds extremely smug to me.
Is it also smug to be sure that 2+2 is 4?
I'm not saying you need to attack people for being wrong, I'm just asking why you feel the need to join them as opposed to finding an actually correct thing and saying that. For people who don't know the names of fallacies, "begs the question" holds no special meaning and could be replaced by a multitude of phrases that would communicate clearly to experts and lay-people.
When I do small consulting gigs I always try to be liberal in what I accept - I'll back up your data off of whatever you call it. But I always try to use correct terminology myself and I correct clients with "That's an X, if you ask for a Y you'll end up getting this other thing that's not quite what you want." (But I wait for the verification part of the meeting and I don't make a big deal of it.)