d4mi3n

Other response address how you could go about this, but I'd just like to note that you touch on the core problem of security as a domain: At the end of the day, it's a problem of figuring out who to trust, how much to trust them, and when those assessments need to change.

To use your example: Any cybersecurity firm or practitioner worth their salt should be *very* explicit about the scope of their assessment.

- That scope should exhaustively detail what was and wasn't tested.

- There should be proof of the work product, and an intelligible summary of why, how, and when an assessment was done.

- They should give you what you need to have confidence in *your understanding of* you security posture as well as evidence that you *have* a security posture you can prove with facts and data.

Anybody who tells you not to worry and take their word for something should be viewed with extreme skepticism. It is a completely unacceptable frame of mind when you're legally and ethically responsible for things you're stewarding for other people.

Make Google multiple millions by improving ad delivery and conversion within Gmail. Probably by also helping Google land big corporate or public contracts, but last I checked most of the money was made via ads in the free tier of GMail.

If you're using the container to manage stuff on the host, it'll likely need to be a process running as root. I think the most common form of this is Docker-in-Docker style setups where a container is orchestrating other containers directly through the Docker socket.

While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy.

The core of the problem here is that process isolation doesn't save you from whole classes of attack vectors or misconfigurations that open you up to nasty surprises. Docker is great, just don't think of it as a sandbox to run untrusted code.

1. https://gvisor.dev/

2. https://firecracker-microvm.github.io/

Here here. I also have ADHD though I couldn’t use stimulant medications due to bad reactions to it, but I’ve had success with non-stimulant medications (Straterra aka atomoxetine [1]).

A big thing I struggled with prior to medical treatment that I don’t often hear discussed about ADHd was rejection sensitivity.

For those unfamiliar: imagine a time someone said something that hurt your feelings or caused a strong emotional reaction.

Now imagine that as a routine emotional response to day to day interactions. Feeling intensely sad, irritated, insulted, etc. to extents completely o it of proportion to whatever was said or even implied.

It’s brutal. It contributes to a lot of depression and social anxiety for folks with ADHD. It doesn’t matter if you’re aware of the response being disproportionate—you get to go on that emotional roller coaster whenever somebody says they don’t care for your favorite food, accidentally cut you off in a conversation, or the day just turns out differently than you were expecting.

Medical treatment makes a huge difference—in my particular case the difference between feeling like I had the emotional regulation of a toddler and not needing to constantly question every emotion I felt prior to responding to things I was reacting to.

Stimulant medications didn’t work for me, but they do this for most people with ADHD (more effectively, too!) and like alterom it saddens me whenever FUD like this crops up.

If I were to put on my security hat, things like this give me shivers. It's one thing if you control the script and specified the dependencies. For any other use-case, you're trusting the script author to not install python dependencies that could be hiding all manner of defects or malicious intent.

This isn't a knock against UV, but more a criticism of dynamic dependency resolution. I'd feel much better about this if UV had a way to whitelist specific dependencies/dependency versions.

I’d counter that with the Equifax breach that raised thei stock prices when it became clear they weren’t being fined into oblivion. Suing is also generally only a realistic option if you have money for a lawyer.

It’s not an unreasonable take given historic behavior. Rather than decrying the cynicism, what steps can we take to ensure companies like Tesla/Waymo/etc are held accountable and incentivized to prioritize safety?

Do we need hasher fines? Give auto regulators as much teeth as the FAA used to have during accident investigations?

Genuinely curious to see how addressing reasonable concerns in these areas can be done.

I’m just worried they we’ll go from very obvious advertising to advertising that’s a lot harder to spot.

I can block adds on a search engine. I cannot prevent an LMM from having hidden biases about what the best brand of vodka or car is.

Let's keep this conversation productive. I don't read OP's comment anything like your response seems to imply.

While I don't think OP's point about morals is relevant here (they vary widely from culture to culture), equating the stock market to gambling misses out on a lot of nuance. Your average 401k retirement fund is going to outperform your average gambler 100% of the time over one's lifetime. Long term investments also tend to not prey on addictive patterns of behavior.

I personally think for a society to function well, it behooves ourselves to recognize when there are certain patterns or behaviors that are self destructive if left unchecked. I feel addictive drugs and gambling fall into this category. That's not to say banning this behavior is the right call, but there's a lot of space to explore productive policies between full on bans and anything-goes.

Former Shopifolk here. As of 2022 - 2023 they had some private packages in their SCM and an internal Artifactory deployment that was a caching proxy of Rubygems and other upstream dependencies. This may be changed since, but as far as I’m aware many Shopify devs occasionally volunteer time and fixes to Rubygems and related projects from time to time.

They certainly have the capacity to run their own full on mirror service, but I doubt they have serious incentive to do so given exciting controls and culture re: Ruby and OSS contributions.

Absolutely. A lot of data security risk is gauged by who has access to what, and the sad fact is that many teams don’t use row or column level security for ergonomic reasons. Features like this would do a lot to make these features easier to reason about, understand, and verify.

"Don't get greedy" and similar variations assumes intent rather than what I see as the reality of how companies operate within the US--not a failing of individual virtues. If you're a public company, your shareholders will want stock prices to go up and are more than happy to use their shares to vote for whoever is willing to make that happen.

This is, of course, an exaggeration. Not all shareholders value profits above all else, but many big ones do. Ignoring what incentives (and disincentives) are put on a business drive it's behavior. If you want something contrary to those incentives, you need to change those pressures or you're doomed to be disappointed.

I came to similar conclusions. I was very off-put by equivocating what’s effectively free speech to political violence.

We’re entitled as citizens of the US to say things. We are not entitled to not be made fun of if our ideas aren’t acceptable to someone else. This cuts both ways.

Odd article. I agree on points made about political violence being counterproductive, but the author goes on to imply ridicule of others is as problematic in the same sentence.

Killing someone is a very, very different thing from ridicule and it’s important to recognize this.

While I wouldn’t say ridicule is productive, criticism of problematic ideas absolutely is. I don’t think Charlie deserved to be shot.

At the same time, it is absolutely healthy and important to reject certain ideologies that are counter to the foundational ideas of a society if you want to maintain said society. For the US, I believe that’s anything that erodes the rule of law and disenfranchises citizenry from participating in the democratic procsss.

I’m not deeply familiar with Kirk or his assailant’s ideologies, but I sure as hell hope the US as a country can move away from a lot of the political extremism motivating this violence. I suspect I’ll be disappointed—a lot of people are hurting and that’s hard to come back from—but I hope.

Not an expert, but I've been told RAG in combination with a database of facts is one way to get more consistency here. Using one of the previous examples, you might have a knowledge store (usually a vector database of some kind) that contains a mapping of countries to capitols and the LLM would query it whenever it had to come up with an answer rather than relying on whatever was baked into the base model.

Oh, absolutely. There are some ways to avoid this--customer managed encyrption keys, for example--but there will always be some kind of trade-off. The less an EDR (endpoint detection & response) tool can see, the less useful it is. Going with a customer managed encryption approach means the customer is then on the hook for watching and alerting on suspicious activity. Some orgs have the capacity and expertise to do this. Many do not. It often comes down to deciding if you have a budget to do this yourself to a level you and an auditor/customer is comfortable with (and proving it) or outsourcing to a known and trusted expert.

EDIT: For additional context, I'd add that security/risk tradeoffs happen all the time. In practice trusting Huntress isn't too different than trusting NPM with an engineer that has root access to their machine or any kind of centralized IT provisioning/patching setup.

It's definitely not a product for an individual user. Controls like this are useful in certain arenas where you need total visibility of corporate devices. As with any highly privileged tool or service, compromise of it can be a big problem. That said, the goal with tools like this is to usually lock down and keep a close eye on company issued laptops and the like so you know when one gets stolen, hit by some malware, or somebody does things with it they aren't allowed to be doing (e.g. exfiltrating corp data, watching porn at work, running unauthorized executable, connecting to problematic networks, etc.).

As an example, if you're at a FedRAMP High certified service provider, the DoD wants to know that the devices your engineers are using to maintain the service they pay for aren't running a rootkit and that you can prove that said employee using that device isn't mishandling sensitive information.

Neat! I'm not surprised at the findings here. BlueSky (for the average user) is pretty much a drop in replacement for Twitter.

Despite the smaller total numbers in Mastadon, it's great to see that the ecosystem seems to be successfully avoiding centralization like we've seen in the AT-Proto ecosystem.

I suspect that the cost of running AT proto servers/relays is prohibitive for smaller players compared to a Mastadon server selectively syndicating with a few peers, but I say this with only a vague understanding of the internals of both of these ecosystems.

I thought this was an interesting statement:

> the difficulty of male competition increases with population density at a greater rate than the same of female competition

I queried GPT and checked a few of the sources, it was an interesting diversion: https://chatgpt.com/share/68b3508b-cd98-8000-8021-811acd5908...

TLDR; seems to be that:

- There isn't any direct empirical research that supports the idea of male competition for a partner gets harder with population density. On the contrary, it seems competition for a guy finding a partner gets worse the lower the population density becomes. This would explain stories I've heard about dating in parts of Alaska.

- The sex ratio balance of a population seems to be the highest predictor of the level of competition for a partner. This makes intuitive sense to me: The less common gender will always have more options than the more common gender in an area.

What I don't know and would be interested to hear about: Is there a strong link between population density and gender ratio? In addition to this, I'm sure there's also all sorts of interesting facets you could examine like cohorts by age, sexuality, or partner preferences like height, build, appearance, etc. and how that factors into the perception vs reality of competition for a desirable cohort of partners vs total available partners.

Doubt it, but I wouldn’t be surprised if the erosion of woman’s rights is contributing. There are places in the US today where you will die by a pregnancy gone wrong because doctors are terrified of losing their licenses and livelihoods if a court rules (after the fact) that the procedure wasn’t necessary.

Where women are forced to carry to term after rape.

Where seeking medical care in another state for either scenario will result in prosecution.

These are real, serious concerns for many woman that will have a cooling effect on their willingness to have intimate relationships.

Plenty of people isolated and medicated with TV alone. Couch potatoes were a thing.

Plenty of people also find community through technology, so I personally don’t believe technology is the only contributing factor here.

I do agree with in you general about many Americans not having enough social or communal interaction, though. I suspect this is more a symptom of a lot of other social issues than a purely technological problem though.

You make some good points about attitude around sex in parts of the US today, and the erosion of community is a topic I was was more often discussed.

Sex ed is also something I was more universally supported. Regardless of your views on when someone should have sex, I doubt it serves anyone’s goals to have young adults getting hurt, sick, or traumatized by a natural part of growing up.

Is this really all that surprising? We have a ton of things ongoing now that we either know or suspect are big contributors to this:

- the whole male loneliness epidemic

- a longstanding loss of community and social organizations around the country

- a pretty terrible job market for many Americans

- plenty of things to be stressed or worried about. Geopolitical instability. Erosion of individual rights. The complete failure of political leadership across the US. Rising cancer rates. Take your pick.

Good callout! Sadly, I’m unable to update my comment to correct. This whole area of law seems to be busy lately.

IANAL, but there’s a question of reasonable burden. Not sure if that applies here, but it’s not unreasonable to say you simply don’t want to do business in a state where the regulations are cost prohibitive. Given they make a reasonable effort to not provide a service to MI, it’s not really on them to police people trying to circumvent a state’s local laws.

Pornhub and BlueSky have done similar in response to this legislation in Texas. Wikipedia and a few other sites blocked the UK to avoid being burdened by their Safety act. Pretty much every streaming platform implements regional geo blocking for licensing reasons.

I’ll be curious to see how things shake out in the long run given the current political climate.

This is disingenuous but soft-fraud is not a term I’d use for it. Fraud is a legal term. You either commit fraud or you do not. There is no “maybe” fraud—you comply with a policy or law or you don’t.

As you mentioned, setting policy that isn’t abused is hard. But abuse isn’t fraud—it’s abuse—and abuse is its own rabbit hole that covers a lot of these maladaptive behaviors you are describing.

This can sometimes be the case, but barring something tangibly dangerous or concerning, talking is cheap and communication is hard. If someone really is a problem, I'd rather know and consciously decide to not associate with them than I would risk losing a potential great relationship because I was nervous about something I couldn't quantify.

YMMV. It'd be a learning experience either way.

Can recommend this. I have terrible memory so I make it a point to reach out and text (or even sometimes call, if it's a special occasion!) whenever people come to mind.

It can mean the world to people sometime. If you've ever had anybody making your day or week by just reaching out, remember that you can be that person too!

It's so easy for people to drift apart. Many people in my parent's generation didn't do a great job keeping in touch with folks and end up lonely or isolated. Avoiding that is as simple as taking a moment to let someone know you were thinking of them.

I think this is putting the cart before the horse. Programs are generally harder to read than they are to write, so optimizing for concise output to benefit the tool at the potential expense of the human isn't a trade I'd personally make.

Granted, this may just be an argument for being more comfortable reading/writing code in a particular style, but even without the advantages of LLMs adoption of functional paradigms and tools has been a struggle.