colonelxc

Splunk on the other hand has dashboard examples on almost every page (on their homepage, a carousel with five different examples of the things they purport to solve).

(another blog post does a great job with showing off capabilities: https://www.gravwell.io/blog/gravwell-and-collectd )

For instance, if housing is already at the zoning maximum for an area, would this tax be effectively the same as a property tax, because the best land value for this property would be the same amount of housing (assuming it is not completely run down) as currently exists?

Interestingly, my area is zoned at X single family homes per acre. Lots are smaller than an acre, and recently a pair of lots was combined/split and 5 (close together) houses are being built there. Does the land value of the neighboring houses go down when the area hits peak zoned requirements? Like, they could have potentially built another house in the 'backyard' of the first one, but now they would run into zoning because of the next yard construction. So now is the land value lower (and thus lower tax?).

People also say that they like LVT because they don't get taxed on improving their home. But wouldn't the LVT already factor in an improved home value (if the standard for the area was larger/improved homes)? Thus you're effectively penalized for not improving your home (ex: "The best value for this property is a 3000sqft home here, not a 1500sqft home"). I know the land value is supposed to 'avoid' improvements, but if we're taxing on what someone would pay for the land (if it was devoid of improvements), we would have to factor in what they would then build on it, which might be a much nicer, larger home than what currently exists. (Someone might value a piece of empty land highly if they expect to get a big payout by putting a large house on the property).

In my opinion, the 'speaking to an audience' via indirect blog posts doesn't really help us move forward as much as direct discussions do. Since we already had thorough discussions about this topic both here and on reddit, I don't see the value in this post.

I will admit that this type of indirect conversation isn't without its uses though. For one, I don't think the original blog author participated in the discussions here or on reddit. So our discussion boards were also indirectly attacking that post, without much room for the author to respond. Similarly, it's impossible to have a discussion with everyone you disagree with. Sometimes the best you can do is state your opinions, and let people consider them as they will.

I guess a better statement I could have said earlier is that we already have a forum (right here) for discussion of articles, and we don't need the disconnected responses-via-blogposts, because we can just discuss things normally here.

It would be prudent for these companies to spend an afternoon creating a list of all the places where data is being stored about a user. That would just help if it ever becomes necessary to actually delete data.

See elsewhere in these comments for information on appointing an EU representative. It is not required in most cases.

"Bespoke permissioning" is also required if you have tiers of users with different feature sets (free, basic, premium). So just treat whatever private-data-requiring-thing as a feature that needs consent.

Incidently, the evolution of smartphone permissions has also gone in this way, allowing fine grained allowing/disallowing. You have to expect that you wont have all the permissions you want. The GDPR just makes it so that you don't get to say "all or nothing" for the things that don't need permission. But, the good apps were already doing this anyways.

""" Under the GDPR, you must appoint a DPO if:

you are a public authority (except for courts acting in their judicial capacity); your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking); or your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. """

So if you're not doing 'large scale behaviour tracking', you would not need one. A simple company that sells a subscription service should not need one, unless they are also selling targeted ads, and maybe if they are doing identifiable tracking of how a given user uses the service. Aggregated metrics with no identifiable data do not count (This feature has been used X times). If you are, then it becomes a question of what is 'large scale' in terms of the GDPR.

As the author of this blog post notes, there are good responses in the /r/programming comments[0].

[0] https://www.reddit.com/r/programming/comments/8lmnl2/from_ja...

You need a space after the star, (* core) which is not like escaping at all...

"Intel SGX is a set of central processing unit (CPU) instruction codes from Intel that allows user-level code to allocate private regions of memory, called enclaves, that are protected from processes running at higher privilege levels."

I still don't fully understand the security model of enclaves (for instance, the same wikipedia page also talks about modifying spectre to work against enclaves[2]).

[1]https://en.wikipedia.org/wiki/Software_Guard_Extensions [2]https://github.com/lsds/spectre-attack-sgx

(disclaimer: I work at Google, but obviously not on this)

A few years ago I ran a no-exit relay from home. Eventually Hulu blocked my IP, even though all traffic from my IP to hulu was from me, and not via tor. Hulu couldn't be bothered to differentiate, and just assumed that a tor node at my IP address meant that traffic coming from that IP must be something routed via Tor.

By not differentiating, you are making the same mistake, and will punish people for no reason.

Edit: Assuming you are pulling the 'exit node list' you link below, I don't see how that is happening, as it does at least claim to verify that you can actually exit through the node.

(regarding "Speculative task") Also called "Hedged Request" here in an article called "The Tail at Scale"[1]

[1] http://www-inst.eecs.berkeley.edu/~cs252/sp17/papers/TheTail...

More seriously, I generally don't re-read books. One exception is The Cuckoo's Egg, which I reread every ~5 years.

This allows clients to self-host the javascript (so it can't be modified to log the plain text password somewhere), and probably can plug into existing form validation with little hassle.

I guess the question is why should I trust your service more than using Troy Hunt's API directly. If you're sending hashed credentials anyways, all the verification of NIST recommendations needs to be done client side anyways.

Though it does make me think that it would be a good trick to offer this 'service', but then keep all the proceeds (everyone gets the same ransomware download). Maybe less profitable on the long term though.

By the time the DDoS was in effect, the corrupted logs had been deleted by the client. They would now always succeed (even with the old server code, or old client code) until they got a new corrupted log.

The site also has the right to prevent you from viewing their content without compensation (in this case, through ads).

Of course it is probably not intentional on their part, they probably have never tested with an adblocker. Even if they were aware of the issue, I can't imagine it being very high priority.

This interface is the historical bgp announcements for this particular ASN. The X access is time. The Y axis is ip address blocks.