buzer

No. If the value of the cache key is simply true/false then someone would first login to their own account using the long password. This would result in storing:

bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true

If they then try login as you@bar.com using same password there would be a cache lookup:

bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true

> Have they did a bcrypt(password + userId + username), it won't be so bad. Order of entropy is important.

That depends on how exactly it was used. If it was simply used to check if previous authentication was successful (without the value containing information who it was successful for) then single long password could be used to authenticate as anyone.

No wonder everyone always tries to figure out how to spend money if they still have some left before end of the fiscal year. Some individual "I saved us $1 million by shutting down servers we don't use!" Manager "Fuck, now need to quickly figure out some way to spend $1 million..."

If they get judgement from US court can they enforce it in another country where US government has some assets?

That sounds weird. I can understand that you cannot take money that was promised for thing X and spend in thing Y but if you can reduce the X spending I don't think there is any issue.

Now I do not know if Congress has explicitly required X to provide certain thing. If they did then there might be some issue if X fails to provide it. It's probably easy to say someone is accountable for it if it's something objective (let's say building for Congress) but if it's subjective it could get tricky.

> This ban also ruined other games for me. If I ever did well in a game, someone would look at my profile to see how many hours I have and instantly see the red marker that shows “I am a cheater”.

I wonder if that label can be considered to be libel. Probably harder in the US, but from what I understand in UK (or just England?) the defendant must prove that it's true.

Isn't selective enforcement in general within any law in the United States? There are plenty of laws that get broken all the time and it's up to police & prosecutors/AGs to decide which cases they actually want to enforce.

In Windows the issue is that alt+space will by default open the window's control menu (for minimize/maximize/move/etc.). Pressing space down and then alt will work though.

I assume they mean: Given turning/waiting car A, passing car B that is going straight and car C coming from right going straight. Car B likely has right of the way as they are going straight and they are on the left from viewpoint of car C, but car C may not see behind car A (like due to it being truck for example). Both B & C might think they have right of the way. B due to fact they should normally only need to avoid people coming from left and he can see there is no one there, C due to fact he entered intersection when he only saw A who is waiting to turn. I don't know Japan law so I don't know actually has right of the way here (in Finland A would actually have right of the way in mirrored situation as you always need to yield those coming from right in equal intersection, even if they are turning left).

How far does that go to? If you rent a car and get stopped by police does that allow police to seize and sell the car? What if you are driving company car? Company plane?

One question here would be that how derivative works are handled? Like let's use some character as an example. They appear in movie with other characters. Would you need to pay for each character and movie separately? If movie gets bought out would that allow making other works based on characters in the movie?

Also, would licenses terminate when copyright gets bought out?

Certificates can be issued to IP addresses (at least on SAN level, not sure if they are allowed in CN in CA/B baseline requirements), like https://crt.sh/?id=15492507462

> Turns out its warranty (which only expires in 2036) has terms requiring it to stay connected to the internet.

Does it define any requirements for the internet connection? What if the connection latency was, let's say, 1 week?

> location names are used for codenames because they cannot be trademarked

I don't think that's the case. Amazon, Nokia as some counterexamples.

If US suspects they are breaking the law they can convince judge to sign warrant to get that information or start lawsuit and go through discovery. If they refuse the judge can hold them in contempt of court. I assume next they could just get judgement against them (assuming they are breaking the law) and that could be e.g. require seizing assets and dissolution of the US company.

> More directly - is there some set of common web client I've been missing for many years that just doesn't follow DNS TTLs or try alternate records?

I don't know if there is such a list but older versions of Java are pretty famous for caching the DNS responses indefinitely. I don't hear much about it these days so I assume it was probably fixed around Java 8.

Depends on country as well. There was recently a case in Finland where a couple of people found issue in certain locks made by Abloy. They were offering to sell the details to Abloy and suggested that they could alternatively publish them in Youtube. They were found guilty for extreme blackmail (I'm not sure if extreme is the proper term in English, essentially just more extreme form due to e.g. demanding a lot of money). They are planning to appeal it so there is chance it will get overturned.

Unfortunately some APIs assume that they will get all the fields as part of the update. If field doesn't exist in the input it gets it will drop the original value during the update.

As far as I understand CJEU does not, at least not on this type of case where their opinion regarding EU law is asked by national court. Damages & fines are left to national courts, in this case Austria's Supreme Court (who might send it back to lower courts, I do not have any specific knowledge of Austria's court system).

From what I understand what generally happens is that if you start fighting it (especially with help from some non-profit that would like to get some case law settled) they will quickly drop the suit and return the cash. At that point they say you no longer have standing. https://youtu.be/WmVFud7v2r4?t=1020

As far as I understand at least some businesses in California are required to honor GPC.

https://oag.ca.gov/privacy/ccpa#collapse8b

> Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.

> If i'm not mistaken, because of this (via[0])

>> The CLOUD Act primarily...

As far as I understand (IANAL) the CLOUD Act has not been used as basis of decision at least for Schrems II. The primary issues court found were regarding surveillance programs authorized under Section 702 of the FISA & executive order 12333.

Full Schrems II judgement is available at https://curia.europa.eu/juris/document/document.jsf?text=&do...

In Finland banks are the ones who usually handle the strong authentication (not necessarily just the initial one). They are required by law to know the customer. In-person authentication in the branch is required to be done via either ID card or passport, those can be requested from police and expire after 5 years. Driver's license is not official ID card. Logging into you bank account requires 2FA (I'm not sure if any bank sends codes via text messages, at least it's not very common).

It can also be done with ID card (which is a smartcard) or mobile certificate (https://mobiilivarmenne.fi/en/) if the service supports it.

From what I have seen the common way to protect against this is that the DNS service assigns you a random set of DNS servers for your zone (like ns-1887.awsdns-43.co.uk, ns-378.awsdns-47.com, ns-1029.awsdns-00.org, ns-557.awsdns-05.net for reddit.com). All of these must be added to your domain registrar.

From what I understand the issue is more that people point domain to a DNS service, use it for a while and then remove their account (/domain from the account). Now someone else can add it to their account.

This is unlikely to be an issue on their primary domain but could be for e.g. subdomains or some marketing domains that aren't really in use anymore. Or cases where domain is just be squatted.

Let's go with former, I definitely didn't mean to link https://www.uber.com/en-FI/blog/logging/ :)

There is at least https://news.ycombinator.com/item?id=40936947 though it's a bit of mixed in terms how they handle schema.

> In Finland we don't have credit scores, instead we allow looking up defaults.

There is also the newly established The Positive credit register which contains list of all of your debts. Lenders must pull (started in April 2024) the information from there when they are making the decision to grant or deny the request. The report also contains your income for past 12 months (I assume those reported to Income Register). I'm not sure if there is regulation on if they actually need to use the data or not.

Initially all companies that were defined as gatekeepers under DMA were foreign, but on 13.5.2024 Booking.com was designated as one as well. They are a Dutch company.