corty

So in short, the audit is an advertising stunt and will say nothing at all about the security of the actual product.

Well, they were always an option, but becoming less so. Increasingly financial aid from the west and trade agreements are bound to "IP protection", meaning the protection of the scientific publishing racket at the expense of scientists and SciHub (among other things).

Pretending that things are fine now is dishonest imho. Business practices of the IP industry aren't suddenly a-ok just because you can pirate your way around it and pretend that therefore they aren't harming anyone.

That is a new round of FUD from the predatory publishing industry.

On balance, open access helps the developing world far more and costs less: Because access to journal and conference articles is now possible. Before open access, article fees around $50 for reading a single article meant, that to write an article you had to spend the $500 on the roughly 10 (usually more) related articles you needed to research and reference. To even get to the stage of writing an article, you need to read quite a few, impossible with the sky-high subscription fees that even rich western institutions balk at. And as everywhere, university libraries reimburse publishing fees out of the subscription cost they saved.

Open Access is cheaper, fairer and especially beneficial to education in the developing world.

Of course reading articles costs nothing on SciHub, but I guess the people you are working for don't want that to be known, eh?

WSL1 mostly had problems due to the layering violations and poor design decisions in the windows kernel and low level system libraries. E.g. filesystem functionality like "what constitutes an acceptable filename?" or "is that file locked?" is not only implemented by the NTFS driver and filesystem layer but also partly or fully by a number of higher-level system libraries. A lot of that lives on top of the windows syscall layer.

The Linux syscall layer (which is most of WSL1) lives next to, not above the windows syscall layer. But e.g. for all that filesystem access functionality, WSL1 doesn't just have to talk to the NTFS driver and generic FS layer but also to a lot of Win32 system libraries. If it doesn't, things will break. If it does, you have dependencies across layers, syscall conventions and system services. WSL1 didn't work because windows internals are a mess.

GPS has always been a generic term, the american GPS system was always actually known as NAVSTAR GPS (but usually called "the GPS").

Maybe a stupid redundant slightly offtopic question, but I'll ask anyways:

What is the best way to couple Ansible with some git repository to automatically apply changes while still being able to trace and debug?

Not quite. Weapon use would be possible as "Rechtfertigender Notstand", https://dejure.org/gesetze/StGB/34.html . This doesn't just include protection of ones own life, but also of property. However, the force used has to be suitable and proportionate, so shooting someone dead would not be justified. Injuring someone would usually be justified, but will always land in front of a judge to apply 20/20 hindsight. And no one wants to accept that risk.

As it says: unarmed.

Your job as an unarmed guard is to complement the alarm system with your eyes and ears, and if something is amiss, press the alarm button and get out of there. Which is what they did.

The article makes it sound like security was tight, but the museum was, according to news articles at the time, too stingy. If they had wanted to spend the money, they could have had armed guards, physical barriers other than simple glass cases and reinforced outer walls. But they were even too stingy for an insurance, and the insurer might have told them to up their security before taking the contract.

https://www.google.com/amp/s/amp2.handelsblatt.com/politik/d...

Same problem as for document signatures, one needs a trustworthy timestamping service certifying the time of signature, so the client may check if the whole certificate chain might have been valid at the time. This means that you need far more extensive CA and revocation databases than for TLS, because you need to keep all that historical data.

Theoretically. Practically, that legal theory is just a smokescreen for the willingness of the government to overlook any misdeeds by the secret services. Prosecutors and courts got the hint and didn't investigate any further. However, if you are a non-state-sponsored criminal, of course you will be prosecuted. "Qvod licet iovi, non licet bovi" is a very important legal principle ;)

Also, later on, the government just legalized what the BND was doing, thereby invalidating any future attempt at prosecution for that past crime against the BND. Yet still maintaining the illegality for everyone else.

Of course they'll share it. First, non-citizens are usually even less protected than citizens. Second, secret services are also extralegal services as long as they can get away with it. Third, if they get caught, they won't be punished.

German example: The BND has been caught spying on all Germans' communication (most probably still does so), as well as connections to foreign countries. They are only supposed to watch foreign countries. So they came up with a legal theory, called "Weltraumtheorie", where satellites are in space, so outside the jurisdiction of any state. https://de.wikipedia.org/wiki/Weltraumtheorie Later on, when this got out, it was just legalized and extended to fibre connections, because, well, that just replaces space, doesn't it?...

Depending on transmission losses, yes. Theoretically, power plants could also have better exhaust scrubbing and carbon capture, but most currently don't.

Polish coast, near Gdansk.

It really depends on where you end up and what the local culture is around food, cooking and restaurants. I've been to places where restaurants are stellar, but I've also been where you would only get dogfood. Where, when asking locals about eating out, you get an answer like "only tourists are that stupid".

The solution is to make pedestrians afraid of stepping into the bike lane. Pass them quickly, closely and surprisingly, if they run into something in the process all the better.

As a basement-dweller myself, I also got a few ticks from my cat. He collects them in his fur, comes inside to feed, sleep and cuddle, and sometimes a tick decides that I'm yummier than the cat.

Dog-owners do report the same problem, at least if the animal is allowed close contact with humans for more than a few seconds apiece.

There is a tried and proven modern way to do what you claim moskitos are important for: vaccinations.

Yeah, right. Instead of just getting rid of the moskitos, let's introduce a spider that likes human blood, but is currently unable to get it directly. No chance for that one to go wrong...

We are already wiping out in the order of a species a day, usually in an unplanned, "oops" fashion: https://naturalhistory.si.edu/education/teaching-resources/p.... Killing a few more in a planned, methodical fashion after having evaluated their use and harm won't make a lot of difference. Any big "disturbance of the ecosystems" is either already occuring or will fix itself over time. I think the risks are minimal, because we are still alive after all the damage we did already.

Then almost no humans should be alive anywhere. Almost all river valleys are former swamps, laid dry somewhere between antiquity and now to be habitable and arable. Rome was a swamp dried out by the cloaca maxima, among other reasons to get rid of the mosquito plague and associated diseases.

We have made land habitable for millenia, you are arguing for a return to stoneage levels of settlement.

That business model is already taken, most larger contracts are won that way. Somebody founds a special-purpose company for that exact contract, gets bids of their own on the subcontracts and then submits an offer. After the project is paid, money is split up, company founder gets an appropriate share.

However, this is also the usual way that the government and subcontractors taken advantage of in bidding processes: Submitting company wins, collects payments, pays founders, but doesn't pay subcontractors, doesn't perform all of the contract, hires unreliable subcontractors and when shit hits the fan just goes bankrupt. That is why there usually is a "good standing" requirement in the call for bids that excludes new, small or government-contract-inexperienced companies. Or puts liabilities on the subcontractors, who of course don't like that.

It isn't only snowflakes in the government mistreating their power.

Government procurement is also complex and long-winded to ensure fairness and abuse of power, at the request of taxpayers and companies alike: Everything (with very rare exceptions) must be procured via a bidding process, so you first need a formal "call for bids". Leaving out the bidding process instantly leads to accusations of nepotism, legal consequences, or dismissal. The decision after the bids must not include interactions or refinements of the bids, because that would be favouritism and invalidate the process. So all the requirements must be known and laid down in the call for bids. So if you need someone to gather requirements for you first (because most government people actually know they would be the worst PM ever)? Have another bidding process first with "requirements gathering and CFB writing" in the CFB, taking another year, just to write the actual CFB for what you need. The eligible bidders and the bidding time is clearly defined by law, so e.g. around here you need to allow all EU companies and have to wait for 6 months before opening the bidding envelopes to decide. The decision itself must be objective, so you need to rely on a scoring system that might later on be attacked in court, therefore usually the only score that is used is the price. Using anything else will lead to a lengthy court battle about the scoring criteria, preventing you from making any progress during the proceedings. Make any mistake and bidding will have to be restarted, leading to another 6 to 12 months of delay, more if courts get involved (which they will).

Oh, and to use public money responsibly, you may only pay after execution and delivery of the contract. And only after formal verification and acceptance of the criteria laid out in the bid. So there is another few weeks to months after you are done before payment can even be ordered. If you left that out, the public would metaphorically hang you for paying for the occasional shitty job. Being informal about it would invite lengthy court battles from loosing bidders. Additional pain comes from bids where there is more than one contractor, e.g. in buildings where the electrician has to wait for the plaster and paint. Any delays in painting will lead to delays in the electrician being paid for work and material he already delivered ages ago. Lots of small companies go bancrupt in those situations.

So I actually thing a bit more flexibility, less fairness and a little more power to some government snowflakes could make everything go far smoother.

I'd even argue that you always always want to use some common webserver or proxy (nginx, apache, haproxy, ...) on 80/443 proxying to the application running on 127.0.0.1:8080. Why? Multiple reasons:

- Unified TLS config and certificate deployment to your chosen common webserver. Never again having to fiddle with yet another crappy vendor configuration not knowing about anything beyond DES, Java crapping itself with larger certificates, vendors not patching TLS library problems for ages.

- Unified log format: Vendors never stick to a proper format, but everyone can read and parse apache logs. Also, easier handling through unified output to syslog/logstash/whatever.

- Unified authentication: No need to wait for all your vendors to support your orgs chosen SSO scheme. Just let your common webserver handle things and pass on some 'X-Authenticated-User: joe'. Most vendors do handle those.

- Additional authentication: Afraid of pre-auth exploits in a vendor's crappy application or whatever SQL injection in the login form some internal department concocted? Just have the proxy do an additional authentication step (e.g. negotiate/kerberos/AD auth), then unauthenticated users cannot harm you and authenticated evil users will be plainly visible in the logs.

- Fixing crap: Vendor changed the URL scheme of some webapp again? All the links from the internal wiki are broken now? Have the proxy do some regex-rewriting.

As for the various grandparents talking about whatever they did at FAANG: I don't believe it, because the above concept is (almost) the same as what e.g. Google is doing with https://cloud.google.com/beyondcorp

Use npcap and check the settings for the admin-not-required button (forgot the exact name). But generally, accessing raw anything needs elevated rights and should need elevated rights. For a normal user to be able to sniff network and usb traffic is usually a huge security hole and therefore correctly locked away. Not at all comparable to the other cases someone discussed above about some crappy app needing admin to write c:\windows\crappyapp.ico...

Set-screw Marr? How the hell are those even legal anywhere, they are unusable without getting electrocuted when connecting them. Screw-on insulator cap? You are giving me the shivers...

If you need something with a screw, use https://de.wikipedia.org/wiki/L%C3%BCsterklemme#/media/Datei...

But almost always, really really, use Wago 221 (preferred) or Wago 2273. You won't want anything else anymore.

I think the problem isn't limited to Microsoft Outlook but to anything bound to ActiveDirectory: Randomly, sometimes multiple times per day, sometimes not for a week, Teams, WebEx and Office365 will re-reqest credentials. In some cases they continue to work even if you ignore the prompts, sometimes they don't...

Resistance in push-in clamp contacts is a little higher than soldered contacts, and about the same as screwed ones. Consistency for push-in contacts is far far better: Cold and sloppy soldering just doesn't happen, loose screws don't happen. Corrosion resistance is worse both for screwed and push-in contacts, but the push-in ones are self-healing: just wiggle it a little and it is fine again. Solder does also age and corrode, but very slowly. Both solder and screwed contacts are prone to loosen and break under vibration and movement (which shouldn't happen when wiring a house, but relevant e.g. for cars). You can do aerospace-grade soldering, which together with proper wiring design to reduce transferred force and vibration, will be sturdier than anything else, but also far far more difficult and expensive. Soldered contacts are also prone to degrade quickly when heated, e.g. when overtaxing a circuit or the (sloppily done) solder joint, which can happen at less than the circuit rating. Push-in clamps keep the contact pressure even with heat expansion, movement and deforming ageing wires.

So there are specifics one has to be aware of, but in most cases, you want push-in clamps. Soldering is the only alternative, but isn't really viable without the proper skills of the worker and inspection of all solder joints.

If you think so, please elaborate why and provide alternative explanations. Just dismissing my statement without any discussion is not only overly dismissive. It also is not a productive way of discussion, it doesn't add anything of value.

Have rich parents shielding you from any negative consequence and providing a financial fallback.

Control is one argument, but I'd go with the money argument:

All the big cloud providers like Google and AWS as well as the small ones like Hetzner do have an incentive to keep IPv4 going as long as possible. They can charge a premium for things IPv4 "because addresses are scarce". Charging a premium means more profit margin.

At the same time, they do not need to invest in more than lip service for IPv6 support in their offerings: No cloud provider has any comprehensive IPv6 offering, most services don't do IPv6. The edge ones maybe do, but there are always sharp edges, missing docs and general pain, pushing everyone back to IPv4 where the profits are.