Trisell

Are they logging public lands or private. Because those are two very different venues.

Here is an opinion article for Montana of one such group. This is typical of most of these groups. They prevent logging by getting injunctions against any logging project on National Forest Land.

https://mtstandard.com/news/opinion/editorial/allow-the-fore...

Until you have walked through a modern fire nuke zone. It’s like walking on the moon. Nothing under a foot across is left. This picture is very typical of what is being left behind by the large self sustaining fires.

https://images.app.goo.gl/jcLatNG6dAdpoALY8

Source: Spent 10 years as a wildland firefighter on major fires my whole career. And still have friends and family that are deployed on fires today.

Dead burnt trees fall down and rot feeding the next fire that comes through that forest. Instead of logging those trees and using them leaving good trees and new growth behind.

Modern logging does no such thing. These contracts limit the size of trees that can be cut. Prevent clear cutting and force replanting all as a part of good forest management. Clear cutting all trees in the forest are a thing of the past. Loggers have come to understand the need to manage and promote growth and long term usage. Not just clear and cut of years gone by.

They don’t seem to address the elephant in the room. Environmental groups have sued to stop every single logging plan the USFS has tried to put in place since sometime in the mid 90s. This even includes logging burnt areas where dead trees are left to rot and feed the next fire. Until these organizations are held to task for the conditions they have helped create in the name of the environment, the fires will continue to burn over grown forests that have had all natural and artificial management removed from them.

I find these days almost any local tv news website to be all but unusable. Between the multiple ad pop ups, multiple auto play videos, and the general clutter. Just trying to read a single news story is an effort that pisses me off to the point where I just close out the tab instead of reading the article.

I bet their executives didn’t view themselves as running a tech company. Funny how that works these days.

I’ve noticed that Cyber Security at a lot of companies are still stuck in the sys admin days of yore. They continue to hold on the antiquated tooling that doesn’t scale or actually detect most issues. And the idea of learning or expanding into security automation beyond their toolset is frowned upon by a not significant number of member of the community doing the day to day work. This creates an atmosphere where they SecOps teams can’t articulate the positives they are bringing to the organization. And thus the market doesn’t pay them their worth.

Compare this to DevOps where the sale has been done well and the business is convinced that these highly paid automation engineers will help the business to improve and speed up software delivery providing more income to the company.

Until security is able to properly articulate how they are helping and improving the business, not just getting in everybody’s way. The field is going to struggle to raise salaries to comparable levels as these other disciplines.

And this is what it looks like the the CCP needs to take down an overzealous businessman. It’s not a traditional make him disappear in the night. It’s a slow devolving of his assets via fines and state directives. It’s been interesting to watch the CCP dismantle what was it’s arguably biggest capitalist/communist success story. Sends a pretty dire message to anybody thinking they can grow bigger then the CCP.

Apparently AD doesn’t scale. Who know. /s

I saw an IV yesterday that was 1000%. I’m not sure I’ll ever see that again in my lifetime.

Seems to be close to the same issues that happened in US-East a couple(?) weeks ago. They've now added cloudwatch and it seems that we can't spawn new ECS containers.

I predict a rash of eventual FireEye, Cisco, and other vendor zero days in the near to mid future. If you are a nation state actor what better way to find zero days then to get the source code and find the bugs to exploit. This is the only thing that makes sense that would be worth the risk of attacking companies such as FireEye and Microsoft.

“Microsoft, Alphabet-owned Google, Cisco, Dell Technologies-owned VMWare, and the Washington-based Internet Association joined forces with Facebook to argue against that, saying that awarding sovereign immunity to NSO would lead to a proliferation of hacking technology and “more foreign governments with powerful and dangerous cyber surveillance tools.”

So I’m to believe nation states having these tools is bad. But Facebook just at handing over data on dissidents to repressive governments is okay?

Pure conjecture. But let’s say solar winds is using a known popular build server, and this build server was only ever going to be accessed by internal resources and employees.

Then let’s say this build server had an unusually high usage of build plugins. And the upgrading of that product was difficult and sometimes troublesome because of these custom plugins and their interdependencies. And so they at some point they missed an upgrade or two on accident, or because upgrading is hard.

Now they are running an build server with several know vulnerabilities. But because that build server isn’t public. It’s really no big deal that it’s a bit out of date. Until it is.

I wouldn’t be surprised if they exfiltrated enough from FireEye to make it worth it. It’s another premier security solution used by a larger number of highly likely targets. It will be interesting to se what FireEye vulnerabilities we see come out in the near to long term future. What kind of vulnerabilities can you find if you have the device source code?

I think your premise that they will experience French Revolution like consequences is overlooking the fact that unlike the 1700s. Up and taking your money to another country that still likes you is the click of a mouse and a private jet flight out. So no they won’t capitulate to higher taxes of earlier times. They will just leave. Like they already are at the threat of it.

The issue is that most Saudis don’t work. Most of the work done in that country is done by “lower classes” of non Saudis. So when the tap dries up and they all have to work. What do they do?

The idea is interesting. But it looks like you end up with a yaml file that enumerates each of your tables/endpoints and the queries that back them. So are we exchanging the “complexities” of code, where we have control and testing, for the “lack of complexity” of yaml that becomes unwieldy and untestable in the name of “simplicity?”

I think this is why AWS has went to recommending the multi-account model with a service per account. That model greatly limits the blast radius of misconfigured IAM in an account so that if you lose a service. You lose that services data. But almost completely block any cross application compromise. That being said multi-account can be just as difficult as IAM if you don’t properly architect for it.

At my company I am working to get all of our IAM policies ironed out in AWS-CDK. Through this any developer can pull down the git repo containing the IAM roles. They can makes changes and submit MRs but the only approvers of those MRs are part of our Access Management team. This all of the IAM roles can be crafted by the devs but must be explained and understood by the AM team through a code review process. After that automation takes over and then the policy can be referenced by other CDK/CF templates.

IAM is a mental model close to a language. And until you understand that mental model it might as well be Japanese to an English speaker. But once you are able to understand that model crafting extremely fine grained policies becomes a breeze.

I don’t find it a scourge. I actually find that I can look quickly at a project and get an idea of the tools that they are using. This seems to be a bonus and really a few more files isn’t a big deal.

Under the terms of the deal, Boeing will build a new version of its F-15, an older fighter jet developed in the 1960s, with new automated flight controls and electronic warfare capabilities. The newer model, known as the F-15EX, will be designed to carry heavier weaponry than smaller, stealthier jets like the F-35.

The Air Force is looking for a bomb/missile truck. They already have extensive experience with the F-15, and retraining(pilots/maintainers) and retooling to use the smaller f-18 would most likely cost as much or more as this deal. Also given military structure you would have to spin up a whole new command and maintenance Wing for the new type. Where the f-15 will just get added to an existing f-15e wings.

+1 for flyway. Used it at two companies. Ability to fully reimplement schema from any version to the most recent version is amazing. Also the ability to review a schemas structure at a given git commit is super useful.

The company I work at works with and contains a significant amount of PII regularly phishes on our staff. It’s usually between 1 in 5 and 1 in 4 that will click on the link. Despite all of the education and quarterly repeated phishes those number really aren’t improving much. I think at some point you have to accept that end users will click on things, and add additional protections in place to help mitigate the risk.

I’ve enjoyed the CDK. I looked at Pulumi, but settled on CDK because it’s AWS developed. As where I work is an AWS shop, I didn’t see many advantages to Pulumi, and I felt more confident in AWS continuing development and support, vs another 3rd party company that could go out of business.

Also I really have enjoyed the built in unit test tooling of the CDK. Unit testing my infrastructure code has been a game changer.

There is a lot of FUD currently going on. This podcast by Joe Rogan is great. Listen to an expert and then make your decisions.

Here is the bio of the guy he interviews. Since Joe Rogan isn’t a “reliable” source.

Michael Osterholm is an internationally recognized expert in infectious disease epidemiology. He is Regents Professor, McKnight Presidential Endowed Chair in Public Health, the director of the Center for Infectious Disease Research and Policy (CIDRAP), Distinguished Teaching Professor in the Division of Environmental Health Sciences, School of Public Health, a professor in the Technological Leadership Institute, College of Science and Engineering, and an adjunct professor in the Medical School, all at the University of Minnesota.

http://podcasts.joerogan.net/podcasts/michael-osterholm

Used it a year at my last job and now almost a year at my current job. Never had an issue. It just runs no matter how much I throw at it. Only have had to change the instance sizes to deal with data ingest.