acdha

Remember that the non-defense sector of the government has been having cuts for decades and lots of important work is outsourced to rotating contract teams. This is definitely unacceptable but I'd bet there were more than a few people there who were profoundly unsurprised that the backlog caught up with them.

You might be detected but if, for example, you were smart enough not to MITM the same client twice after an error, I suspect a ton of people would ignore it and just assume the airport/coffee shop WiFi was flaky.

I’d also bet more things use libcurl behind the scenes than we appreciate, and that at least a few of them have things like silent updates which retry after a failure without notifying a user. I’ve seen a lot of agents which just try to periodically check in because they’re designed not to be noisy on lousy networks.

It’s a hard problem: if you query on use, you not only introduce delay but also leak information about what servers people are connecting to. Dealing with that starts looking a lot more complicated (bloom filters per CA of recently-revoked cert IDs?) needing to be implemented into multiple libraries and the failure mode is an outage unless you fail open.

Being able to trust the OS is a huge advantage, though, and they built the rapid response mechanism to handle those updates:

https://support.apple.com/en-us/102657

The big question is why they’re not using it for things like this, where a tiny layered file system update would benefit almost all of their users immediately.

Just like Apple has. The problem here is whoever made the decision not to use that capability:

https://support.apple.com/en-us/102657

It’s not an excuse but an explanation: there are separate stacks owned by different teams and they haven’t been forced to collaborate. If you use an internal CA you’ve already had to deal with the easier additive version of this problem because that fails in an obvious, less harmful manner than quietly accepting something which needed to fail.

I was also surprised to find Java’s key tool returning successfully for the delete request without actually doing anything: list, delete, and list again would still show the CA. Debian had this right during the 90s, all they had to do was follow the system convention.

This feels like all of the C code getting attacked now where everyone spent the last three decades building up cruft because fixing it would be a chore, and now the separate bills are coming due all at the same time.

It’s more expensive to use them all day: that’s the problem facing power plant owners where renewables are so much cheaper that they break the economics for power plants which were designed to run continuously but are more expensive when wind and solar supply is limited.

(That’s the answer for the northeast, too: New England has no shortage of wind all winter long and batteries don’t care where the electricity comes from)

That’s a pretty massive assumption at the end: you really don’t want to cut corners with safety and unless the government can simply ignore residents, very few people are willing to live near a nuclear plant so you have to anticipate delays or higher transmission costs.

While all of that’s happening, you’re guaranteed to be producing more carbon emissions before anything can be displaced.

It’s becoming common but the current administration has been highly committed to preventing that because it cuts into their fossil fuel donors’ business.

Grid-scale sodium batteries are already in production, and there isn’t some kind of magic anti-technology shield which keeps the United States in the 1920s.

When talking about cost, it’s important to remember that solar+batteries are already cheaper and, unlike nuclear, happen on much shorter timescales. I’m not opposed to some nuclear plant starts but those guarantee a couple decades of increased pollution before there’s any chance whatsoever for carbon reduction, whereas solar can come online in a year.

Serious citation needed that there are week-long stretches of continuous wind-free heavy cloud covering thousand mile stretches of the United States.

Also, it’s weird to talk about Florida when, say, Arizona and Utah, etc. are right there. Even Wyoming despite being further north has over half of the month sunny in the winter. One thing to remember is that we could power the entire country using solar with a fraction of the land currently used to produce corn for ethanol so we don’t even need to substantially change land use, just stop subsidizing inefficient fuel generation.

That's why it's important to practice your processes for both shipping quickly and overriding cooldowns. There's a baseline of things which are not easy to exploit where you want to patch on a regular cadence and the risk posed by a supply chain attack is greater than the risk of an attacker having enough of a footprint inside your systems to escalate. The fact that sometimes you have a specific situation like this where that's not true doesn't mean that 9 times out of 10 the cooldown was the better risk-reduction strategy.

I’d worry if they try to grow too quickly and take on large amounts of investment. Pressure to deliver huge hits can be toxic.

I really think it’s going to depend on how big they get. Early BioWare very clearly had everyone committed to building games they were proud of; EA’s management equally clearly are just moving money around for things they don’t care about or believe will negatively impact them personally.

I think that pattern is widespread around the greater tech industry: antitrust enforcement, etc. would be great for having fewer cases where decisions which affect thousands of people are being made by executives who are really detached not just from consequences but simply awareness of what’s going on in each of the different segments of their business.

> You are shifting the goal-post.

No, that was literally the first paragraph of my original comment.

> If you don't pay the premium for redundancy, your S3 is the same sitting duck as the single SSD in your office, albeit an expensive one.

Again, this is misunderstanding what the service provides relative to raw storage. I suggest reading the documentation about reliability and thinking about how that SSD in your office fails to provide either geographic redundancy (which all but the one-zone flavor of S3 has) or bitrot protection. Similarly, while it is true that some security concerns still require you to configure things correctly, you should think about the infrastructure you would need to build to match the core service: none of that is something you can’t match but building and operating that has costs.

> Ask those who lost their data in Bahrain AWS.

Let’s think about this slightly longer: how is the SSD in your Bahrain office doing? Iran has to hit multiple AWS data centers to lose your S3 data so to match that you need to build a system which syncs changes at multiple separate campuses in the region, which is significantly more expensive, and when you realize that you probably want a copy somewhere far away, the work to build that will be more than checking a box — and don’t forget that you have to regularly test all of this to make sure you can trust it to work in a disaster.

Again, as readers of the original comment know, I’m not saying just you can’t do this but that it’s a category error to think the comparison is the raw hardware and not the combination of redundant hardware, software, and staffing you need to match capabilities. You can beat that with enough scale but that’s a very different equation.

Again, spec out a multi-data center server + storage + staffing deployment and calculate the full cost per gigabyte. As I said earlier, if you buy enough storage you will definitely hit a level where you can beat S3 by a fair margin but many places never reach that point and many of the ones who do are going to have other projects which make more sense because they offer a high rate of return or provide something which isn’t a commodity.

Yes, I’ve also built those services. As I said before, it is totally possible to beat S3 on pricing but the margin narrows considerably when you factor in the full costs — e.g. think about how many places had replicated storage but not bit-rot protection or versioning and built that at the application layer instead — and the savings is often not big enough to make it your top engineering pick for the money & attention required.

Fundamentally you’re playing a commodity game and that means you need a consistent edge to be worth the fixed costs. If your fully-loaded advantage is less than, say, 30% you’re better off negotiating with your AWS rep and investing your engineering resources in something your customers want.

Again, this is completely misunderstanding the problem. Your single SSD with no redundancy, integrity, or security, or running servers competes with S3 in the same way that my backyard garden competes with local restaurants.

I’m saying that once you make the fully-loaded comparison, the gap closes a lot and most places will choose to spend their time and attention elsewhere unless they have a truly massive storage need.

This is exactly it: they have tools which are useful but they need close to AGI to justify the incredible amount of debt they’ve taken on for growth. They’re not normally given to having press conferences admitting to felonies but they need investors to believe they’re close enough to AGI to keep the money flowing in and, of course, they’re confident that the current administration won’t act between the direct payments and how much money they have riding on American AI supremacy.

Try doing the math and ask why your time costs. You need to buy a lot of storage to pay for the engineering work and most places would prefer to spend that time and attention on the product rather than shaving a few percent off of the storage bill (especially since the savings will be negative for quite some time).

> It's not "cheap". 6 months of S3 is at around price of outright buying 4TB SSD at retail price. That before you do any IOPS to it

This is badly misunderstanding the problem: S3 is a highly available service with geographic redundancy and a huge range of integrated features. Your comparison would need to be updated to include multiple running servers in addition to redundant storage, and the software stack implementing things like immutability, not to mention all of the security features.

That’s not to say that you can’t build equivalents for the parts you use but you either need massive scale or giving up features to do that. For example, if you can tolerate bitrot or long access times if hardware fails, you can definitely get a lower cost per terabyte.

The reason why most people don’t do that, even when they have scale, is that it adds cost and risk everywhere else if you need engineering/ops people working on storage. If you’re, say, the internet archive that might make sense—it’s quite literally why your organization exists—but most other places are going to see all of the integrated features that they don’t have to build and operate paying for the difference between S3 and physical media pricing. For example, if I want to process files as soon as they’re uploaded or have immutability, I can just turn that on rather than having to build more services.

Here’s an exact quote:

> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation.

Here’s another, referring to the roughly ⅔ of London residents who aren’t white:

> London is no longer the city I was infatuated with in the late '90s and early 2000s. Chiefly because it's no longer full of native Brits. In 2000, more than sixty percent of the city were native Brits. By 2024, that had dropped to about a third.

I think Wilhoit’s law[1] is also a major factor: these guys appear to have taken things like codes of conduct as a personal affront because in many cases it was the first time penalties started being applied to people they identified with as fellow in-group members. You can see this in lots of cases - e.g. compare SV elite reactions to the alleged shoplifting epidemic to the way the same people feel about cheating on taxes or misleading investors for orders of magnitude more money.

1. “Conservatism consists of exactly one proposition … There must be in-groups whom the law protects but does not bind, alongside out-groups whom the law binds but does not protect”

It’s definitely noticeable and he has ties to politically-aligned tech billionaires - for example, when about a third of Basecamp employees resigned, Marc Andressen kept them solvent:

https://x.com/davidsenra/status/2081956616963006913

https://www.theverge.com/2021/4/30/22412714/basecamp-employe...

White nationalism: I highly recommend reading these posts by people in the Rails community:

https://davidcel.is/articles/rails-needs-new-governance

https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...

These are some examples from the source:

https://world.hey.com/dhh/as-i-remember-london-e7d38e64

https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a

I don’t think you can approach it from a rational economic perspective because that’s not how it started: it’s a dominance power play and what we’ve seen with China and the EU is that standing up to a bully is the only thing which causes them to back down. If you accept the offer, people like that see it as a sign they could’ve asked for more.

The companies who are forced to raise prices are politically well-connected, mostly as part of his party, and I’m sure the Canadian government is banking on their executives and his laid-off voters pushing him to cut a deal.

Note the use of “Republican” in the comment you’re replying to: they are trying to walk a fine line between protecting the guy who gave them the votes needed to do things like Roberts’ career-long goal of rolling back the VRA while protecting the core of the party (e.g. the inconsistent logic used to protect the Federal Reserve, which all of the monied interests wanted, but none of the other independent agencies; or the tariffs, which are deeply unpopular with most businesses) or permanently grant powers they don’t want a Democratic president to use (e.g. deploy the national guard over a governor’s wishes).

Things like birthright citizenship are a good example of that latter concept: the law is extremely clear there so they ruled against him because the only alternative would be declaring outright that the President is not bound by the constitution, but in many other cases they’ve made quite unusual actions to preempt lower courts before either finding a new executive power or, where the law is clear, stalling to allow things like deportations to proceed in the interim before ruling against.

The Roberts court is nakedly partisan and makes rulings as necessary to expand and protect Republican power (e.g. they protected Trump’s reelection with rulings with carveouts allowing them to decide the other way if a Democratic president tried a similar argument in the future). You should not bet on a reinterpretation of existing law here moving in a direction you’d like.