AI right now feels like the go to for anything and everything that was tedious for humans to do or that took quite a bit of expense. What people seem to struggle to realize is that those exact things that they offload to AI are exactly what made their stuff reliable and well known like Cisco. If I am buying a router I really don't want vibe coded software, I want reliable software that had thought behind it especially if it supports a very critical part of a system.
Yes, agreed these are very different things. Also I'm not really sure the argument holds, there are plenty of AWS Command and Control hosted servers and AWS victims, is AWS to blame or blackmailing? The answer is a large no.
Many projects kind of take a different approach where for pull requests CI is not run until approvals from maintainers are given even for very simple jobs to avoid untrusted code running in ci.
At least my naive brain wonders if blocking force pushes to main would have stopped this as it is a setting in Github these days, unless I am misunderstanding the final attack vector since it seems it was force pushed.
I'm not quite sure of what this really accomplishes, like is it just M.A.D.? Like at that point the creds have been stolen and the whole machine is toast.
It's always East 1... Jokes aside I don't understand how often east-1 is taken down compared to other regions. Like it should be pretty similar to other regions architecture wise.
I mean yeah, but the Pi Zero can also do TLS and much more complex tasks so I really don't understand why this is such a big "feat." It's a linux pc just running a webserver. Am I missing something here?
The "Scheduled Maintenance" is just total B.S. and just honestly makes them look worse. Apparently according to their status pages this is what 99.996% uptime looks like. Pay attention lol.
Yeah like their page says "Scheduled Maintenance" which is total B.S. Talking to people at my university's IT side of things Canvas has said nothing to any clients.
Canvas is handling this terrible. No communication, no status updates, etc. Also looks pretty bad their whole platform was compromised and not a single real report for the breach that already had happened. Wonder how long it will take for SLA violations and lawsuits to manifest, especially with most U.S. schooling having finals right now.
Yes, but also one less anything in a highly competitive industry is a bad thing overall. Not saying I think it's a good idea but I seem a grain of reasoning behind it however misleading it might be.
My best guess is lack of resources and that they want to focus on the well known PR workflow instead of trying new things out of the gate. It's exactly that, it's a proven github workflow for better or for worse that most people are familiar with.
This was an amazing read for me, so much so I bought the book and am enjoying reading it. It's quite an interesting read and I'm learning quite a bit more than I knew about the mission EFF stands for.
This seems to be pretty targeted, and with the services affected like livepatch and such this could indeed be an actor DDoSing to avoid patches rolling out for copy.fail