corty

This isn't fixable. The only solution is to make cars more expensive, because it is impossible to improve alternative transport without massively raising prices. Alternative transport will always be massively inferior in cost or quality (usually both). Some may advocate subsidizing alternatives by taxing car traffic more. But as soon as the desired effect of vanishing car traffic appears, subsidies will vanish, alternative transport will be expensive and bad again. And everybody will be poorer, less happy and nobody will have gained anything (except alternative transport profiteurs).

The agricultural revolution is responsible for both low child mortality and the lack of famines. Pesticides, herbicides, artificial fertilizers and motorized farm implements are the reasons why humanity has been able to grow exponentially over the last 1.5 centuries, why famines have lessened and why better nourishment lead to fewer child deaths (with a small helping of better hygiene). All that is dependent on coal and oil.

Yes, if it would have particle mass at the time of the big bang it would have evaporated long ago. But all small black holes do evaporate (the smaller, the faster), so if PBHs were e.g. car-mass at the big bang, they could just be the right size for particle-masses right now (and gone in a few years).

Depending on the size of it, harvest energy from its Hawking radiation.

The Sun also wobbles because of the planets. Primordial black holes are (depending on theory of creation and path in later life) smaller than stellar black holes, maybe far smaller, in the order of lunar mass or even particle magnitude mass. So the wobble from a PBH will be overshadowed by that of Jupiter and the other planets. The sun doing a wobble of more than 30AU (what you would expect for a 1 solar mass PBH somewhere past neptune) with respect to the galaxy would have been detected ages ago, even the parallax measurements of yore are precise enough for that. From that fact, the magnitude of disturbance in other planets' and TNOs' orbits and the absence of gravitational lensing observations, our PBH should be in the order of planetary masses.

The electrical grid also cannot handle all-electric heating for all households, at least in Germany. France is different because of their big nuclear fleet.

Very often, green energy discussions forget that doing everything (heating, traffic, industrial processes) electrically needs an increase in electric capacity by a factor of 2 or 3 at least.

Many trade deals contain a catalogue of legal and illegal substances under the deal, often with the requirement to make not-yet-legal ones legal under the deal.

Low-flow anything is especially stupid anywhere north of the alps. Wastewater systems need a minimum flow, determined back in the first half of the last century. If modern appliances, toilets and faucets do not provide that minimum flow, wastewater systems need regular flushings, usually from a fire hydrant. Overall water consumption stays the same, cost rises (because someone needs to do the unclogging and flushing) and greens applaud the useless spread of freshwater conservation in regions where there is an excess of water all year round.

There are many variants. "Don't be vulgar", but also "don't criticize" or "invent something positive to say, only then can you criticize". "Be lavish in your (insencere) praise".

All this leads to a (despicable to me) culture of always-smiling emotional liars. If something I did is shit, say "it is shit". Make an unhappy face. Don't smile, praise my performance when cooking coffee and on the side mention that my last project "made some people somewhat happy".

But I'm not sure if that answered your question, I didn't fully understand it.

But that works in all directions. There are many kinds of people who cannot work together. I for one, despise the "lets all be friends and never say a bad word" crowd. They drive me mad and drive me to leave. I'd rather have a frank exchange of views with someone.

Maybe, but there are more examples along those lines that don't introduce single points of failure.

E.g. very all-encompassing logging is generally good for security, and if the logs are stored in a secure fashion, there is also no security problem created. However, privacy suffers because one might log things one shouldn't log.

In the other direction, file and traffic encryption is good for privacy, and the less "permeable" you make it, i.e. the less readable for admins, system task, scanners, the better for privacy. However, for security, encrypting just for the user's eyes is a huge problem, because you cannot do malware scanning, you cannot do exfiltration prevention. Having users bring their own device into a work network is good for privacy, because those devices don't have central admin access, but bad for security, because same reason.

No. First, there are security measures that wreck privacy, e.g. sending all your data to some company's servers for virus scanning. Routing all your traffic through some filtering VPN provider. That kind of stuff. There are privacy measures that wreck security, e.g. not using personalized user accounts for certain things.

Security is also mostly up to definition, a secure computer system is a system that only does what it is defined to do. What this definition entails is up to the vendor, which isn't necessarily the same definition a user might want for security or privacy.

But generally, there is a large overlap between privacy and security.

I don't know about Fitbit stuff, but LineageOS can do everything else you named. Have been using it for years.

I guess other alternative Android distributions shouldn't be too different there.

The common values of the European Union are there, visible for all: graft through subsidies and comfy posts for you and your political allies. Tried and proven, works beautifully, all the politicians love it!

Office365 supports Kerberos with IMAP, which would be the proper thing to do anyways. Giving passwords to a browser or email application is wrong.

Denial of Service by panicing is also harmful for some processes.

That is a first step, but what you really want to do (and what most commercial VPN solutions are doing) is tunneling the VPN via https. Preferably with a real-looking web server at one end, so that "firewall solutions" have something to look at and scan for evil keywords. Oh, and you might have to disguise the traffic pattern as something that looks like http, so frequent reconnects. And the payload has to be web-like so that a MitM-proxy sees something like http, so an one direction is a POST, the other is the respective response, and if you cannot do persistent connections because the proxy kills them you'll have to poll at least in one direction.

Yes, this is supremely ugly, but unfortunately entrenched and expected by now. I've been to customers with intrusive filtering/scanning setups like that who then recommended their favourite commercial VPN vendor to get around that filtering...

No, I think not. I guess that is an area where one would miss out without updates, but on the other hand, performance is already "good enough" for most endpoints. Of course, for operating a VPN concentrator you always want more performance, but then again, you won't do that on windows I guess.

There is no "outdated", wireguard has no extensibility on purpose. You might just have to wait for wireguard2. And security patches will be delivered in the usual Microsoft fashion, 8 tuesdays after the exploit started circulating.

Seems you missed the "big web revolution" between 2000 and now. Corporate/school/uni firewall madness filters everything but http(s), so each and every protocol has to be somehow http(s). That is why there are almost exclusively webmail providers anymore. Why stuff like videoconferencing must be http-based. Why we do everything by emulating better protocols via polling a webserver for xml or json responses.

Yes, it is insane.

Nobody really needs enterprise VPN crap, that stuff does far too much weird stuff that is totally unrelated to what a VPN should do, like patch management, malware scanning, firewalling, and other useless box-ticking.

What we do need is a proper replacement for roughly the things OpenVPN plus PAM can do. A VPN plus some user and key management.

You only need to sign the packets in the key exchange on the card. The normal payload packets are protected by symmetric algorithms based on the ephemeral symmetric key generated in the key exchange, no need (and no use) to involve the smartcard there.

No, you just need a signature. But an Ed25519 signature, which current commercially available smartcards just cannot do.

You could be hacking something together with a Nitrokey or maybe Yubikey, those can do Ed25519 signatures. But generally, you would need to fiddle a lot with the implementation, because currently signatures are done in the kernel module, and you'd need to get that into the USB-device for signing and back again. Not impossible, but not implemented yet.

Another way would (theoretically) be to implement different signature algorithms for the wireguard key exchange, ideally some that common smartcards do support. But wireguards author left out cryptographic agility on purpose, so any work in that direction will be incompatible with the original implementation, or at least a very ugly kludge.

Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. All the readers will screw up in different ways, after which the myopic cryptographer will explain that his protocol was of course perfect and there is nothing wrong with it, you are just holding it wrong...

Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decrypting _on the card_ only. If you can really read a key off of a smartcard, sue the manufacturer and never use the key or card again.

There is still gold and ceramics. But both are of course more expensive.

I think both conclusions are wrong.

Since this is a meta-study, drawing conclusions from the absence of null-results and the absence of clustering is prone to a lot of confounders. The article mentions publication-bias, where non-null-results are published with a higher probability. Other such confounders will exist, e.g. data-availability-bias in certain places and populations, location-bias because researchers study their usually first-world, urban, university-town surroundings more often. Community-bias, because researchers tend to cluster and get inspiration for new studies from their community and peer group on the conferences they visit. Data-similarity-bias, because they can only compare studies where data can be normalized to a common base. Quality-bias, because they necessarily include well-done and badly-done studies, in different amounts, usually without weighing them properly, because that is very hard to do.

Most of those confounders cannot be corrected for. So one could draw a conclusion like "we do see null-results in the expected amount and clustering in the expected amount, therefore the result of this meta-study is a confirmation of the lead-crime-hypothesis". But the only correct opposite conclusion is "we do not see null-results and clustering in the expected amount, so our result is 'we do not know'".

So the imho correct interpretation of the meta-study is "don't know, further research or better meta-analysis needed".

And there are other neurotoxic compounds still in common use, such as mercury-aluminium-amalgam for cheap dental work. That would also confound all the simple studies. I'm afraid there can't be a firm conclusion without an in-depth study of heavy metal prevalence in bloodstream and bones vs. criminal behavior. Just plotting sales figures of leaded gas vs. murder rates doesn't say anything. Any more elaborate study is of course smaller and more expensive, so won't be done as easily.

Almost everyone nowadays who dabbles in the social justice business. Most people are already equal before the law, do have equal chances, do get equal treatment. But that wasn't enough, so now the demand is equal outcomes, not matter if it leads to inequality in chances, law and treatment.

It actually isn't.

The fine is based on last annual turnover, not profit and certainly not future profit. Even if Amazon were taking a loss, they still would be fined this amount.