joecot

If a hacker hacked the CEO's email address, and then used that address to email their secretary asking for information, and the secretary responded.... that is not a security failure on the secretary's part. That's the CEO's security issue, and the company's security issue. Therefore, it's a useless pen test, unless the purpose is to tell employees no emails from anyone can be trusted.

A phishing email can come from the inside. But seeing whether employees will respond to a valid internal email is not a test of employee security. And in this case, it was as heartless as it was useless.

It's a message from a valid internal email address. If a company's own email servers can't tell the difference between valid internal mail and external phishing, that's the company's problem, not the employees. If the company's email is hacked so that a hacker can send valid emails from a legitimate internal email address, that's the company's problem, not the employees. Nothing of value was learned by this test, besides the disdain GoDaddy has for their own employees.

If I put myself on the other side, I'd stop producing gross sexist ads, stop supporting overreaching internet legislation, and stop treating my employees like garbage.

If a company had a pen tester offer bribes to people, and those employees accept bribes, the pen test was indeed failed and those employees should be rightfully reprimanded. That's good security.

If a company had a pen tester send what appears to be a perfectly legitimate message to employees offering them a company bonus for responding (during a worldwide pandemic where everyone is short on money), and then says it was a pen test and they've failed, that company is awful and heartless. There might not be a legal case against them, but the company is still deserving of public scorn and outrage.

That nickff's comment asked whether both a promise of a bonus and a promise of a bribe would be equally considered a "promise of compensation"? That's who I was replying to.

Whether or not a promise of a gift is a legally binding contract, there's a vast difference between a promise of a gift and a promise of a bribe.

While that may be the case, an undelivered gift is still worlds different than an undelivered bribe.

Do you consider:

a) Being gifted a TV by a friend

b) Someone telling you they'll help you steal a TV from your friend's house

To be the same thing? Because one involves a perfectly reasonable and legal promise, and one does not. If you can't tell the difference, remind me not to invite you over.

Let's say you run RHEL on your production servers. You pay for licensing those servers, which gives you Red Hat support, and also because you have proprietary software which is only supported on Red Hat.

You pay a pretty penny for those production servers. But you also need development servers, and staging servers. For those servers, RHEL would be a gigantic waste of money. It's the production servers you need enterprise support for, none of the rest.

CentOS was a downstream release of Red Hat, with the same packages from Red Hat compiled. It was, for the most part, identical to Red Hat without the support. This meant you could develop on CentOS Dev Servers and test deployment on CentOS Staging servers, and expect it to work exactly the same when you sent it to production. Lots of less licensing costs, same results.

Now, CentOS Stream will be upstream of Red Hat. Instead of getting the same packages as Red Hat, now you're getting the testing packages of Red Hat. You can no longer expect to get the same results from CentOS stream as from RHEL. The end of life for updates for existing CentOS releases has also been moved up drastically. By all appearances, Red Hat and IBM are essentially forcing companies to license and use RHEL on their dev and staging servers, by making CentOS Stream unusable for it.

Lucky for many, Canonical went and got Ubuntu certified for many of the same proprietary hardware and software systems that were previously only supported for proprietary linux distros. This means your dev, staging, and production can all be the exact same distro, and the only difference is which servers you're paying for Canonical support for. This is a recentish change though, so many companies locked into Red Hat / CentOS because of the clear path that was established between Development and Production. And certainly not every proprietary software/hardware is supported on Ubuntu, yet. Lots of companies won't switch (the structure of Red Hat to Debian is pretty drastically different), and IBM is counting on that.

Sure. Since you say this is not a big deal and CentOS is not dead but is just changing, I really only have 2 questions:

1) What in your opinion were the main use cases for CentOS before this change announcement?

2) How do you think CentOS Stream is still viable for those use cases?

There's a large gulf between users who will play nothing and users who will pay something. If you start charging you have to account for how much of the user base will leave just for there being any cost at all. If you're using Paypal or similar for transactions you lose 39 cents out of each $1 yearly transaction (and if you run your own merchant account now you have to secure credit card information). Additional customer service overhead having to deal with people's $1 yearly transactions, on top of people expecting better responsive customer service because they're paying customers now, maintaining private customer data ... the variable costs per customer would probably end up more than $1. It'd be cheaper, literally, to make it free.

Maybe $5 a year could work as a price point, and given the gulf between Pay Nothing vs Pay Something, I doubt $5 a year would've lowered the conversion enough to make $1 a year transactions worth it. Don't do credit card transactions for a dollar or less unless you're counting on it converting into a higher amount a month later.

Maybe not, but are at least 5% able to do that?

This should do wonders for the Epic/Apple case

I'm still going to wipe down my plastic and cardboard groceries when it's not a complete pain, but I'm probably not going to worry about spraying my produce with hydrogen peroxide.

Well then it's a good thing you found an actual trail marker rock totem, and not something some teens decided to build that lead you into the middle of nowhere. Which is why this trend is pretty dangerous.

I'm well aware we're in a pandemic, and my family and friends are quarantining and going to great lengths in cleaning and wearing masks. I'm well aware that the US and particularly Trump is absolutely mucking up the response. I'm well aware that we're approaching the breaking point of the "Union" part of the United States, as the Federal government and Blue States fight over resources and jurisdiction.

I'm well aware there's a police brutality problem in the US, including brutality against protesters and the US sending Federal troops into cities.

I'm well aware that Biden is the Democrat nominee and there's nothing to be done about it, and that after however much hemming and hawing he's going to make Kamala Harris his VP, and there's not much to be done about that either. That there likely won't be Medicare For All, or a safety net for millions of unemployed people, or any other really popular and obvious change that needs to be needed.

I'm well aware that China, a world away, is trying to stamp out Uyghurs through apartheid and likely soon genocide.

Scrolling Facebook, Twitter, etc just reminds us of these terrible things that are constantly happening, that we have little control over day to day. And yes, we should volunteer, donate, protest, prepare to respond. But day to day, there's not much we can do to fix it. We're instead stressing ourselves to death over things we can't control, at least right now. Don't forget they're problems, help where you can, but don't spend your life hyperfixated on them.

From Wikipedia:

> The first-sale doctrine is a legal concept that plays an important role in United States patent, copyright and trademark law by limiting the rights of an intellectual property owner to control resale of products embodying its intellectual property.

That means I should be able to sell my glasses to someone without the original creator causing problems with it. It's more complicated than that, but that's the gist.

If I bought these glasses and they shut down the service and refund me, fine, whatever. But what if I bought the glasses, decided 4 months later I didn't like them, sold them on Craigslist for $600, and moved on with my life? After the shut down I get $800 back, and the poor sap who bought them from me gets a pair of worthless glasses and a dead craigslist email. Luckily this company will most likely get away with it because of the "it's more complicated than that" part.

There are plenty of companies thoroughly locked in to AWS infrastructure. They don't need to lure in new companies with these services (though the wide variety helps). The point is to get companies already locked in to start using these services and lock themselves in more, so they have even more difficulty ever leaving.

> I guess Twitch can stay in business for now.

I assume you're being sarcastic/coy, but for those that might not know, Amazon owns Twitch. I'm guessing this service is them white labeling Twitch's tech infrastructure, and priced such that someone could not make a Twitch competitor with reasonable profit margins.

If you're looking to do this without OS X, or you want to do something like this in an existing Video conference app like Zoom or Jitsi (I have no idea if Mmhmm does or not, they give few details and I can't download it), this is pretty easy to do in OBS Studio. You can do video capture of your presentation, yourself, have background images, and arrange things however you'd like. Here's a Youtube tutorial [1] with some examples. You'd then need a virtual webcam plugin to use your OBS Studio stream in other software. On Windows you can use OBS Virtual Cam[2], on Linux you can use obs-v4l2sink[3]. On OS X I think there's still an open bounty for a OBS Studio webcam solution, so since Mmmhmm is only available on OS X anyway that might be a better solution for you.

It certainly seems like Mmmhmm makes this easier, and allows you to smoothly transition from one format to another, but OBS Studio is very workable as well, and works on more platforms.

1. https://www.youtube.com/watch?v=hk7W9ECtpZE 2. https://obsproject.com/forum/resources/obs-virtualcam.949/ 3. https://github.com/CatxFish/obs-v4l2sink

Going back to the restrictions in place before COVID, while COVID is still very much a thing, and we haven't even finished the first wave while a second wave rises, is bad. While Conservative administrations are good at finding ways to punish people through neglecting to act as opposed to having to actively take action, this isn't behavior that should be lauded.

The options here are either that the administration is risking lethal consequences for these students out of: 1) incompetence (they forgot to extend the exemptions), or 2) active negligence. Either is exceptionally bad. Whether it was an active decision or not to let these exceptions end, ICE seems almost gleeful to take the opportunity to kick these students out of the country, and ICE is entirely under the control of the executive branch.

Right. The point of the oil exploration expedition is not whether you find oil or not. It's that at google, running an expedition gets you a promotion, whether you found anything useful or not.

> Cops are not terminators.

Then we should stop training them like they are [1]. When Dave Grossman tells cops that they're warriors, and they need to get over their instinct to not want to kill in order to better protect "sheep" from "wolves", we're telling cops to be Terminators.

> If you really think society could function without entire police departments, I welcome you to lobby your local municipality to dismantle their police force.

Minneapolis is planning to do just that, and replacing it with Public Safety services. And as someone who lives a few miles from Camden, it's been clear that disbanding the police force entirely and reforming it has greatly improved the situation[2].

The point of the satire is that politely asking a group to stop murdering people without further meaningful change is unlikely to be helpful. And given that police are now hunting down protesters using facial recognition and social media, and that police unions have resisted even the most modest of reforms over the years, it doesn't seem like these Not Terminators will stop terminating willingly.

1. https://www.inlander.com/spokane/why-thousands-are-calling-o...

2. https://www.newsweek.com/minneapolis-not-first-disband-polic...

> I don't see how this is true unless you're just talking about Facebook's non-chronological order.

It's more than just non-chronological. FB buries many link posts. Specific friends can disappear from your feed for months. FB still has the echo chamber issues it had pre 2016 election, just with fact checking notations sometimes. For many people, FB is where they get their world news at this point, and that's a very skewed way to get your news.

I've always found the change.org donation solicitation a bit shady (you're essentially paying for an ad on the site for the petition), but I have no idea how the donators reached for comment could not know what the donation is. It says very clearly you're "Chipping in" to get the petition noticed more. If they're confused on that I don't know how.

If I were to hazard a guess, it's people reading through HN, seeing "AWS Partitions", assuming it's a new AWS service announcement, and either voting for it without reading it or favorit-ing it for later. I only opened this assuming it was a new service being announced, since that headline is generally the format those are posted in.

As an AWS employee I doubt there's a ton you can do to influence Amazon's physical product side. What you could do is try to influence AWS to stop being the backbone for ICE and DHS's extremely cruel deportation policies. Since I went to an AWS Summit in NYC and walked through protesters shouting "Cut ties with ICE"[1] I've done my best to divest myself from AWS solutions, though it's slow going. Get AWS more employees to stand up to AWS over ICE and DHS.

https://www.washingtonpost.com/business/2019/07/12/no-tech-i...

I updated the top comment, but you got me looking closer at the device list. It seems that v4l2loopback and my webcam were interfering with each other. rmmod-ing v4l2loopback, running the mopprobe myself, unplugging my webcam and plugging it back in seemed to resolve it.

I think you led me to the problem. I updated the original comment, but I think the issue was that v4l2loopback was being loaded without any options and screwing me up, so rmmod ing it and reloading it seems to help

I did attempt purge DKMS, and confirmed the kernel module is the one I've just compiled.

I have it in the tool menu in OBS Studio. If I start the stream with RGB the camera doesn't work. If I start it with YUV32 as suggested in most guides, OBS just segfaults. switching it to YU2 was a helpful hint -- it just doesn't work as opposed to segfaulting.

It's not the screenshare that's the problem, it's the v4l loopback to emulate a webcam

I'm on ubuntu 18.04 and haven't been able to get v4l2loopback related setup to work with OBS using the obs-v4l2sink

* With the packages OBS Studio or the newest compiled

* With the DMKS v4l2loopback kernel module or the newest compiled

EDIT: Thank you for helpful comments. I managed to get this to work by:

1. Purging my existing v4l2loopback-dkms

2. Compiling latest v4l2loopback kernel module

3. Compiling latest OBS Studio

4. Compiling latest obs-v4l2sink plugin

5. sudo rmmod v4l2loopback

6. sudo modprobe v4l2loopback devices=1 video_nr=10 card_label="OBS Cam" exclusive_caps=1

7. unplugging my webcam and plugging it back in

If you're currently having problems, before trying 1-4, try 5-7. It seems like v4l2loopback is getting loaded on boot, and some combo of that and my existing webcam was messing this up. Once I rmmod the kernel module and put it back, capture works but my webcam is gone. When I unplug my webcam and put it back, it all works. It may very well work fine with the standard v4l2loopback-dkms and obs packages without having to compile latest.