genmud

Yea... I don't know what the right solution is, but it feels like people are getting their brains significantly influenced, or rotted by the endless dopamine hits that social media bring them.

I have a small kid and most of my tech friends who are parents share the opinion that tech/computers can be extremely dangerous if not actively moderated for children.

The 2 people I know who do not let their kids use smartphones/tablets under any circumstances work in adtech and social media.

I always find it ironic when reporters talk about surveillance when they have about 100 ad trackers, shoveling keywords of the articles to advertisers so they can track and show specific ads to you.

You are making the assumption it is for long term habitation, which might not be the case.

For long term habitation, you would solve it like any other engineering problem. How many people do you need to support, against what threats, for how long and what safety margins do you need.

Air is a solved problem, you either pull/push from the outside environment and filter on its way in (open circuit), or you treat the air (closed circuit). Waste goes into a leech field or is incinerated. Electrical is generated / stored onsite or powered externally.

I don't think that the reporters have ever dealt with high security requirements. Things like safe rooms, underground evacuation routes and multiple secure egresses are not that uncommon for high net worth individuals.

Some people have security teams they pay millions of dollars per year for, who ensure they aren't kidnapped, injured or otherwise harassed.

It was a view in response to the above post, not a generalized view I take on things.

I’m actually a fan of embedding security resources into the eng teams and having those resources fix issues rather than toss shit over the wall. Knowing how software works is really hard without living inside the code base.

> Ah, yes, this is the "start from the assumption that everything has failed" trick.

I am actually fairly data driven, and it's why things like SBOMs are exciting. Based on my experience, if something is exposed to the world and that thing has a vulnerability... within a period of reasonable time (say within 12 months), it will be exploited.

> No, sorry, I do not care that (e.g.) CVE-2023-4911 has been categorized as "high"

I wasn't actually referring to my "high" being the cvss scores. It was likelihood of exploitation(in my org), not the score. In your example, that would be a local exploit, so wouldn't be a high in my book unless you are shoveling user input to a CLI, which I would hope isn't happening.

Personally unless you know there to be higher risks for certain things, if it ain't 9+ on cvss, it gets a ticket cut to deal with it like any other but at some convenient time in the future.

> but what we actually get is "raw CVSS score tells you all you need to know and absolutely dictates urgency and triage priority"

Your security org sucks and are doing it wrong. I'm genuinely sorry, and I'll say that not all of us are like that :(

As a cybersecurity person, probability is typically high since so many people release POCs and impact is almost always they steal all our IP and lock our computers, grinding business to a halt. CVSS is kind of helpful for triaging stuff, but if you are even a moderately sized org, it's literally fire drills all the time or you bury your head in the sand.

Business people typically don't wanna hear that and then act all shocked pikachu face when it happens.

They are similar, but different. Like ops is similar to eng, but different.

For one, they can quantify downtime easier. Also, in most orgs, cybersecurity is responsible/accountable for the problems, but only can indirectly influence things.

Anyone in cybersecurity who isn't a fucking moron (of which I freely admit there are many), without a doubt knows the problems they solve are not unique. As someone who has done it for nearly 20 years, me and my colleagues absolutely despise having to repeat the same shit, over and over. I want nothing more than to not be necessary.

I liken my job to being a janitor, and people can't seem to stop from pissing, shitting and trashing everything. It's goddamn 2023 and we still can't get people to always validate input or ensure proper constraints are built in.

Cool, I agree with the author in concept, but there are so many goddamn engineers that ship incorrect/buggy/insecure software that if it wasn't its own function, nobody would even pretend to care. In my experience, most Project/Product/Program Managers sure as shit aren't going to prioritize it.

Not every org is FAANG. Unfortunately in many (most) organizations, in house developers get caught quite frequently eating the metaphorical security crayons.

In some orgs, that is the case. In other orgs, risk management might be a functionally absent, with legal teams being reviewers of contracts and abdicating that role to outside counsel.

Privacy and smartphones are mutually exclusive depending on what your threat profile is.

If your OS isn’t collecting telemetry, your ISP probably is. If somehow both of those aren’t, most phones modems have so many vulnerabilities in them a bad actor can exploit the RTOS and your application processor will never be the wiser.

TL;DR modern smartphones are the devil.

Source: been doing this type of work on/off for about 10 years.

If (security) training worked, we wouldn’t have these issues.

Even in highly regulated, controlled environments memory safety is still an issue. I have seen bugs in these environments where I know for a fact that the developer has had 40-80 hours of training on memory safety and they still pop up.

If these people have occasional issues, the rest of the world has no effin chance.

I feel like tech generally doesn't represent the majority of the US. However, I don't believe quotas are the right way to do it. Active community engagement is the only way to get those numbers in line with modern demographics.

If they weren't so expensive I would be purchasing one.

Its status quo for almost all hardware. Your computers firmware/boot stack has probably some of the buggiest and error prone software you have running near you, unless you happen to be sitting in your car.

It feels like a damn miracle anything actually works.

Because everyone called it heartbleed.

I still remember some of the big ones like MS03-026/031, MS08-067, CVE-2005-1042.

> One of my biggest issues with PHP is that it doesn't cleanly separate the app and the system.

Its probably been a couple decades since I looked at PHP stuff (like php4 was probably the last version I used, though PHP5 might have just been released), but isn't that kind of how the main interpreter was implemented, and many of the patterns built into the language? IIRC there were things like default paths based on OS to system configs and stuff like that.

It never struck me as something that was designed to be ran as a user, but installed on a system and utilized by users. I'm just going by gut feels, but its my perception that other interpreters have more relative paths than PHP.

Many universities will do this for a very inexpensive / low cost. I think the rates for my local university is like $100-150/hour for 50 micron scans?

It looks like the automation api was introduced in 2021. (!!!)

I stopped using it in like 2014 or 2015 after years of requesting improvements (like better ways to automate things without stuff breaking all the time).

I have noticed most software maintenance / engineering decisionmaking over the last decade can be boiled down to “because you suck, and we hate you”.

No, what thought process would make you even think that?

That’s like the point of their whole ad platform. Because there aren’t great bids for inventory, it’s why you see so much temu/wish/marijuana ads.

https://business.twitter.com/en/help/troubleshooting/bidding...

I own a defense company, work on security stuff, I can assure you it is.

Security predictions for next year:

- Continued information operations by nation states using social media, trying to influence US elections, next year around this time (regardless of outcome) about 40% of the US population will believe the election was rigged

- People will try to shoehorn AI into security ops, with little success due to not having great data

- CISO positions will increasingly become more hostile to accepting organizational risks, because of FTC civil complaint on solarwinds CISO

- there will still be new CVEs

What is hilarious to me is the Liebert AC units are nearly the same design/footprint. When they went by, I was like holy shit, they are the exact same enclosure, down to the little rail thing in front!

Just have LCDs instead of LEDs or lamps.

If you sell software to the government you do. Which happens to be the biggest purchaser of software and touches others by proxy. E.G. you might provide software to Boeing who sells to the government, therefore Boeing has a legal obligation and requires all its suppliers to provide SBoMs. Or Dell, or HPE, or Cisco or literally every software / service provider.

Nah, they really don’t.

The fact solarwinds or equifax exist after such egregious security errors with a botched response at best or an intentional attempt at covering up the size/scope of the problems at worse should tell you everything you need to know.

I don’t believe that this type of thing hasn’t happened, but the article talks about ISDN and even in the early 90s that wouldn’t be very common for a non branch office. Then they talk about traffic shaping/QOS and that’s when I call BS. I don’t think the Cisco 2500/2600 routers (which basically everyone used) even supported those features until many, many years later.

Maybe they were talking about T1?

I’m getting very r/thathappened vibes.

... after record profits.

> where the company reported a record gross quarterly profit of $1.9 billion.

Not saying that businesses should not try to optimize, but it seems a bit of a dick move to post record profits and cut nearly 10% of your headcount.