buzer

Double spend. https://news.ycombinator.com/item?id=30478262

> Was really so (specifically “lethal”? Do you have sources?

Pretty famous example: https://en.wikipedia.org/wiki/Venetian_glass#Island_of_Muran...

> Glassmakers were not allowed to leave the island without permission from the government. Leaving without permission, or revealing trade secrets, was punishable by death

Though importantly this was enforced by state.

...what service offers 15Gbps stream?

> Reading the data doesn't mean they can impersonate you, as the device wouldn't give you access to private keys used for authentication (lets even say these are deleted), only encryption.

They would gain access to anything that isn't separately protected. Every application doesn't necessarily store their authentication in that separate storage that gets wiped and if there is such a storage, there isn't really anything prevents applications from using that storage for other purposes, for example storing the encryption key for application's data.

Gaining access to files, photos, email and such could be used for, for example, blackmail or identity theft.

If politicians, police, intelligence agencies and military are not ready to entrust their data behind the same "escrow" mechanism then clearly they don't trust it enough. If it was as perfectly protected from abuse as claimed then they would have no reason to not trust it as well.

> Let's say police had a device which they could plug into your phone, which would send a specially signed message - a digital warrant, containing all the info a real warrant would - which be permanently be burned into the ROM of your phone, after which the phone would surrender its encryption keys, and the police could dump your unencrypted disk.

And when (not if) that device leaks whoever steals your phone will be able to get access all of the things in there.

> but not put you on a block-list, meaning that they will happily ingest your information again if it comes to them

So since you don't know if they information or not, you should start sending them delete request every second? You know, just in case they got new data since the last request and we know it takes a while to actually process those requests.

I'm not sure if this Wikipedia's official policy but at https://medium.com/wikimedia-policy/wikipedias-nonprofit-hos... they do say:

> Definition of content recommender systems: Having any “algorithm” on the site that “affects” what content someone might “encounter”, is seemingly enough to qualify popular websites for Category 1. As written, this could even cover tools that are used to combat harmful content. We, and many other stakeholders, have failed to convince UK rulemakers to clarify that features that help keep services free of bad content — like the New Pages Feed used by Wikipedia article reviewers—should not trigger Category 1 status. Other rarely-used features, like Wikipedia’s Translation Recommendations, are also at risk.

> Content forwarding or sharing functionality: If a popular app or website also has content “forwarding or sharing” features, its chances of ending up in Category 1 are dramatically increased. The Regulations fail to define what they mean by “forwarding or sharing functionality”: features on Wikipedia (like the one allowing users to choose Wikipedia’s daily “Featured Picture”) could be caught.

One example that I can give is that when Firefox has been running for long time, especially in Private window, the memory usage of "main" processes will grow a lot (normal & GPU). Compacting memory via about:memory does free up a bit but Chrome in similar situation will use a lot less memory. This does slow down Firefox (especially in system where you don't necessarily have a lot of memory), restarting it will make it a lot snappier.

For example I currently have Firefox & Chrome sessions which have been open for about a month on my laptop (16GB of memory). I closed every tab and only left the "blank" page open. Firefox's process manager shows 4GB GPU usage, a bit under 1GB usage for Firefox & about 250MB for extensions. After clicking "minimize memory usage" the GPU memory dropped to 3GB and Firefox process memory usage dropped by about 50MB.

For comparison Chrome uses 400MB of GPU, about 200MB for "Browser", ~150MB for for "utility" processes and about 100MB for extensions (extension list is different so we can ignore the memory usage difference for them, listed it just for completeness sake).

Despite this I do use Firefox as my primary browser.

I recently logged into one of my email addresses that I hadn't used in years and discovered quite a few people had used it as their address for multiple things (of course they didn't have access to it so everything was unread). Lots of services do not really bother to validate the email address (there were e.g. Facebook, Instagram & TikTok emails).

One bigger item was that people were sending details regarding an estate & inheritance. This included an attorney office in Finland (to be clear, I'm also originally from Finland). After finding out I sent email to their DPO as this likely qualifies as GDPR security incident as the emails contained things like names, SSNs, addresses & of course details regarding how inheritance was split. I never got an answer so I reported it to Finnish DPA. I got reply from them pretty quickly that they contacted the DPO and that DPO will be in contact with me soon & the case is closed from DPA side. This was 4 months ago, I'm yet to be contacted by them.

If US army truly needs to hire some foreigners I don't think they would have issues either modifying H1B rules so they are exempt or getting their own visa category for their own needs. I don't think either party would truly be against that even if Congress needed to pass the law since DOD is asking it.

Of course they could also just hire them with higher wage and tell Congress that they have option to make a small dent in the defense budget by passing that law.

Proving bugs can be pretty hard if you don't have access to software & source code. That is similar to the US, courts usually won't give you access to source code to verify if software is operating correctly, you generally only get cross examine the company representative & person who performed the test. DNA tests are one good example.

One case where defense did get access to the code (FST developed by NYC) led to discoveries (https://www.propublica.org/article/federal-judge-unseals-new...) that led to it being retired from use.

From what I could gather from quick look this seems to targeted towards B2C applications, i.e. 1 customer has 1 user. In B2B cases there is often cases with "customer has entitlement to feature X, but only users A & B can use it, C cannot" (and in some cases users have access to multiple customers). Are you planning on adding this kind of support and are you planning on handling the role/user mapping yourself or just providing some integration points?

(just to be clear, not relevant in my case at this point, just something that was a bit messy to handle in something I worked with previously)

Wouldn't "in connection" make this actually extremely broad? For example I doubt C-level executives have 0 connection to software development during the year. They likely make official or unofficial feature requests or give feedback. And if we really push that definition, if the software collected telemetry automatically from the user interactions and this data was then used to improve the software, wouldn't just using the software be connected with the development of the said software?

On top of the already suggested local BGP routers you can also use https://dn42.us/ to test a bit more real-world like scenarios.

Okay, thanks. I was primarily wondering due to "Significant Disruption to the Employer" seems to be one of the possible categories and it's description sounded similar to reasons why one would get L1B visa.

Do L1B visa holders have reasonable chance of getting compelling circumstances EAD if their visa date isn't current for EB-3? I'm wondering if I should suggest that option for HR when they file the I-140 (or after if it's approved, whatever the process is).

> That said, I don't understand how TC String can be considered PII.

IANAL (or even Belgian).

There wasn't a direct ruling on if TC strings itself were PII. They were personal data that can be linked to individual since CMP will get both the IP address and the TC string.

As for IAB being (joint) data controller, the reason (sections 68 to 80) given for that is that they determine purpose and means of processing. They might not hold any data, but they set the rules for the framework.

In Finland the universities (and I believe in many other European universities have/had this as well) there was "academic quarter" which meant that if something was scheduled for 10am it would actually start at 10:15am. IIRC if they used precise time (10:00) then it would actually start at that time.

I've heard it dates back to when people didn't have easy access to precise time. It would allow students to hear the hourly bells and walk to the class.

Thanks. I tried to look into this a bit more and it sounds quite a few places are interpreting "be made available on the market without known exploitable vulnerabilities" as that there cannot be any known vulnerability at the release date. Germany's Federal Office for Information Security (BSI, https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicat...) seems to be even looser with the definition, on 5.3.2.3 they actually say it's just "SHOULD", not "MUST". No clue what they are basing that on.

The "including the possibility to reset the product to its original state" is interesting one, would that prevent manufacturers from not allowing user to downgrade to original version (via eFuses)? 5.3.3.1 on those guidelines does say "initial or newest version", but that doesn't really sound like original state.

> Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations.

What are the specifics on that? Like does the vulnerability need to be public or is it enough if just the vendor knows about it? Does everyone need to stop selling it right away if new vulnerability is discovered or do they some time patch it? I'm pretty sure software like Windows almost definitely has some unfixed vulnerabilities that Microsoft knows about and is in process of fixing every single day of the year. Currently even if they do have a fix, they would end up postponing it until next patch Tuesday.

And what even is "vulnerability" in this context? Remote RCE? DRM bypass?

Salmonella and it causes are very regional in EU. Places like Finland have basically 0 cases of salmonella caused by domestic poultry products per year. If there salmonella is found from any chicken in the flock, the whole flock will be quarantined and generally fully slaughtered (meat & eggs must be pasteurized after the slaughter if they are sold). In 2023 0.1% of the tested flocks had salmonella.

According to https://pmc.ncbi.nlm.nih.gov/articles/PMC11945640/ most of the outbreaks in humans (where exact cause was found) were caused by foreign vegetables.

On other hand countries like Italy find positive samples from 27% of their flocks ( https://efsa.onlinelibrary.wiley.com/doi/epdf/10.2903/j.efsa... ). USA doesn't do testing at that level as far I understand, I only found that 8% of the tested chicken parts have salmonella (https://www.propublica.org/article/salmonella-chicken-usda-f...).

Let's say currently it costs $15 to make thing 1m units of X in China and $50 to make 10k of them in the USA. USA could be scaled to make 50k of them for $40 and 100k for $30. 1m could cost like $25. There are people for who are ready to pay more for local products so the current production volume makes sense, but majority of people will go for cheaper option when given the chance so it doesn't make sense to scale up the production currently. If the import cost of the item goes above local production cost and there is still enough demand for the item, it can make sense to scale up that production even if you cannot compete with the China made things internationally.

Of course that assumes your own costs (like raw materials) do not increase at least on the same scale and that you can rely on the situation being long-term thing (i.e. will last years rather than weeks) as costs include your CapEx on things like new machines.

In Finland any shop that sells small batteries must also offer to recycle them for free.

There is similar rule for bottles/cans with deposits (similar to CRV though values are quite a bit higher, 0.10-0.40€ depending on size/material). If you sell something for which customer needs to pay the deposit for you also need to accept them & pay back the deposit.

> In Germany at least, code written by AI is not copyrightable

> There are nuances, so if you create a macro and then that macro writes something but it is completely determined by you then it should be ok.

How far does that extend? Like would IntelliSense cause your code to not be copyrightable? It's not that different from AI autocomplete on principal level. It shows you some options, but you make the final decision what to use.

And what about binaries? These days there are not many people who could tell the exact binary that is produced by certain source code.

> The whole Mozilla foundation budget oscillated around $100-120M/y for last few years.

Firefox is under corporation, not foundation. Mozilla Corporation expenses are $400M+, not $100M.

https://en.wikipedia.org/wiki/Mozilla_Corporation#Finances

(I don't enough knowledge about freemium economics to figure out if the stated numbers would work out or not)

> It is not legal, anywhere, to (for example) borrow a DVD from someone, copy it, and give the original back. In some jurisdictions you have a right to backups, and a right to resale, but you emphatically do not have a right to privately copy.

If the DVD doesn't have strong DRM (which is pretty rare, CSS counts as strong DRM) you are allowed to make a private copy in Finland. There is a levy on various storage mediums to compensate private copying. I believe there are similar laws in other countries based on https://en.wikipedia.org/wiki/Private_copying_levy

I'm not 100% sure if strictly downloading from illegal source makes downloader liable for damages, as far as I know in all court cases there was seeding involved (in Finland).

Of course the levy is somewhat questionable these days since pretty much everything has strong DRM (as bar is very low) and thus you are not allowed to make copies. The authors who protect their work with strong DRM still get part of the levies though.

I mean yeah, it doesn't even touch what is happening inside your body in order to actually press those buttons. Or what forces are being converted and how they affect the surroundings.

> > IPs are apparently PII

> It always pains me when people spout stuff about GDPR that they think they know but dont.

Are you trying to suggest end user IPs are not PII? There is judgement from CJEU (Patrick Breyer v Bundesrepublik Deutschland, ECLI:EU:C:2016:779) regarding the older Data Protection Directive that IP address is personal data if the service provider can give the IP address to competent authority and that authority has a way to connect it to user. As most (all?) EU countries mandate that ISPs keep logs that match IP address to subscriber and competent authority can get this information, the IP address is almost always PII.

Or is your auditor suggesting that GDPR is less strict than the older directive regarding this case? From my reading the only real difference was that GDPR added a bit more precision on what reasonable actions are ("such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments"). At least to me the example given in the court case would be reasonable when taking those in account.

You can, of course, have legitimate interest to collect it (like many other forms of PII as well), even for cases where the data subject cannot object to it. It doesn't change the fact that it's almost certainly PII.

> I don't remember even seeing a cop.

You probably didn't realize what to look for. There are quite a lot of kobans (https://en.wikipedia.org/wiki/K%C5%8Dban), especially in busy locations. Seeing police patrolling around the area is rare sight from my experience though (disclaimer: Experience strictly as tourist).