Jwarder

Mozilla has identified issues with CAs that are part of eIDAS. The severity of these issues can be debated, but the nice part of Mozilla's root program is that these are publicly debated. For example, the community identified repeated issues with the CA Certinomis and after failures to improve they were distrusted. Is it a good thing that the EU says that doesn't matter and Certinomis certs must be trusted as part of eIDAS?

https://drive.google.com/file/d/1DgJe-Ku4u66JF2D6zha28tSKxPB...

https://wiki.mozilla.org/CA/Certinomis_Issues

I think it is a legitimate concern in both directions. Who should users trust more: Mozilla or their local government? Some countries have tried to use local PKI to spy on citizens. Mozilla has taken steps in the past to prevent abuse. On the other hand, can Mozilla accept an Iranian CA even if they can match the root program's requirements?

Amusingly, Mozilla rejected the US government's request to add the federal PKI to the root store.

I see two issues at play.

Not all European CAs meet browsers' root programs requirements. Forcing everyone to accept those certs weakens all root programs (Mozilla's, Microsoft's, etc).

There is also the concern that special indicators displayed with a certificate can mislead users. A scummy company with an EV cert isn't any more trustworthy than if they had a DV cert, but browsers want to be careful not to imply a fancy logo makes the site any safer.

my understanding is that it is super common, but not very concentrated in the earth. As a result it makes mining more difficult. You don't just find a ore vein in a cave, you have to dig up and process tons of stone in a wider area.

Looks like someone setup a network where each hop deeper into the network has a name setup to display a line of ascii art.

I wonder how much trouble with notetaking stems from people trying a one size fits all method. Personally, I have three tiers of notes.

A physical notepad for meetings, random ideas, test results, that sort of thing. My goal is to write down items when I suspect I'll forget them in the next 30 seconds.

At the end of the day I'll take 10 minutes review what I've done, with the physical notes as a starting point, and log my activity and open questions per project. My goal at this point is to keep enough context to answer the inevitable "WTF was I thinking?" in a few days. Usually just taking the time to outline things means I can remember the key points.

Finally there is a team wiki where I record details per project. Feature wishlist, customer requests, work with other departments, Q&A. My goal here is to make sure my replacement isn't totally lost after I get hit by a bus.

I like seeing little notes from prior readers. References to other works, question marks, and angry exclamation points are all fun to see.

Underlining or highlighting can be interesting to see what the other reader thought was important. Highlighters can be distracting when they overdo it, but even then it can be fun to see where the highlighting tapers off were the prior reader just gave up.

But dog ears or times when someone folded a whole page in half is just painful.

Facebook reported that they logged passwords in plaintext by accident a couple of years ago.

https://about.fb.com/news/2019/03/keeping-passwords-secure/

How paranoid should I be of a browser plug-in that promises to track every interaction I make and provide that data for advertiser targeting?

The flip side to that idea is that consumers choose to buy this limited lifespan furniture. IKEA isn't tricking people in an effort to grow forever; they are just producing what people want.

What's wrong with it?

I don't specialize in security, but I've seen peppers/global-salts in most of the "serious" password storage schemes I've seen. Looks like an easy layer of protection to limit brute forcing hashes from data dumps.

Looks like you need to grab the build artifacts from their CI/CD system.

https://ci.appveyor.com/project/ellson/graphviz-pl238/builds...

Not something I would trust out of the blue, but that's the best I see off of https://graphviz.org/download/

If given the choice between modern disease control and a wall I would choose modern disease control.

Your example of the flu is interesting. If humanity had modern resources to fight the ur-flu would it be worth the effort? How many lives would be saved over the generations if the flu hadn't become a common threat?

> SARS, MERS and so on, which ultimately turned out to be nothingburgers

As a reminder, SARS and MERS were contained thanks to massive international effort to identify the spreaders, quarantines (including whole hospitals), and restrictions on air travel.

I read an article (>10 years ago so sadly I don't recall the title) about how computer science people see data differently from law people. Computers know nothing about the intent of data, it is only bits. The law (nominally) tries to figure out intent behind the data. It is possible to encode any data so it looks like a random stream of numbers; the law doesn't care what you did to the data, just if you intend to use that data to do something illegal. The user's intent colors the data.

The word indirectly in "who can be identified, directly or indirectly" seems like it opens everything up. A session ID isn't directly PII, but it can be linked a user account and from there someone's name, address, etc.

I found that I have changed my ideas on "enjoyment" per-activity, but not overall. For example: I've developed the habit of watching a movie while exercising in the evenings and listening to discussions on YouTube while gaming. As a result the idea of sitting down for a couple of hours to just watch TV or a movie is almost painfully boring.

But I don't (seem to) have that need for sensory saturation with other activities. I have no problem just sitting down to read for hours.

I read the "only one correct way" to be a per-tool guideline. When looking a tool to do a specific task then (ideally) the tool should just process input with minimal futzing with configuration options. If you need to do something special then you should have a special tool.

Not the parent poster, but prior objections I've seen are that people don't do a good job at picking random words and four words is too few.

> This means that for strong performers going alone is better, and for weak performers going to a company is better.

I'm not sure about this. Performance and value depend on the environment. Some organizations can provide the infrastructure to uplift workers' performance but some people work better in a self-directed situation.

I can see why you would say that, but isn't classical engineering a counter example? Professional engineers have a culture of accountability and responsibility. No system is perfect, but (to my eyes at least) classical engineering works safely without a culture of blame.

Ha. I've been thinking about these sorts of problems and I'm leaning towards the idea that while governments are legitimate (groups of people pooling resources to achieve communal goals with some degree of compromise) most citizens are not legitimate (for lack of a better word). I was born in the US so I get all these rights, benefits, and obligations with no choice. From that viewpoint are immigrants the only "true" citizens of a nation because they actively choose to be a part of it?

Are you sure your Pixel is vulnerable? Looks like the patch for Pixel 1 & 2 was released October 7th.

https://source.android.com/security/bulletin/pixel/2019-10-0...

The jobs numbers suggests where the trend is going. The github and article counts seem more useful to indicate the current state. When looking at those numbers I'd rather pick the more conservative number.

Looks like 3:1 ish.

https://thegradient.pub/state-of-ml-frameworks-2019-pytorch-...

I don't see the article's idea of ownership as universal control, but more focused on being able to use whatever instance of the data you have without needing to rely on a third party.

For example, if I own a book then I can read it, doodle on it, or lend it out at any time. I can't prevent other people from reading/defacing/whatever their copies of the book.

My reading of the issue is that Sendy's webform allows the external requester to bypass the server-side captcha logic by changing a client-side "hidden" input. If you want to be protected then you have to customize the form.

Mozilla and Microsoft publish their lists. Chrome uses the OS's root store. I've seen other open source software use Mozilla's list, but I've never seen a list of what software does that.

https://wiki.mozilla.org/CA/Included_Certificates https://docs.microsoft.com/en-us/security/trusted-root/parti...

The attacker needs to generate a new cert that the client trusts. This is easy on a corporate network where you can force users to trust a private CA. Unlikely to happen with a US ISP, but possible if someone hacks the CA (eg DigiNotar) or the CA hands out unconstrained certificates to someone who acts badly (eg CNNIC).

I kinda recall there being some options in old browsers (>10 years ago) where websites could send their privacy policy as a blob in the http header and the browser would enable/disable content based on pre-defined user options. However I can't recall the name of this and a quick search isn't showing me anything that rings a bell.