mike_d

They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.

See, before the cloud, you used to deploy your code to actual physical servers. If your site became really popular you needed more than one server to run it.

Before commercial and open source load balancers became a thing we literally used HTTP redirects to distribute load. You might visit www.example.com and get redirected to www13.example.com, which was an actual box in a datacenter.

I don't think the internet would exist today if websites just randomly fell over once the number of simultaneous users exceeded the capacity of a single server.

I can tell you from first hand experience that moving high value items isn't as exciting as you'd think.

ULDs are the standardized shipping containers of the sky. You can rent ones that have an inner armored layer and tamper evident seals. They fly as commercial cargo, usually on the flag carrier airline if its a government load. No special rituals or armed guards. Shipments are broken up so the loss of a single aircraft is at most $5 or $10 million.

There are some highly specialized aircraft that transport full loads but they tend to be closer to the supply side, moving bulk gold or diamonds from remote mines for processing.

Cash is the interesting exception (most non-US currency is produced by commercial printers) where a country will send its military to go pick up one big shipment.

In the past my attempts to work on crypto related problems have been met with needing the higher tier of "offensive" access.

"Apple claims that OpenAI and two former Apple employees, including OpenAI’s now chief hardware officer Tang Tan, stole trade secrets including confidential product designs and proprietary information about its manufacturing processes."

Nobody. Going back to 1989 every AOL account had a screen name that was used as your login and your identity. Being an employee was just a flag on your account in the database.

In 1993 AOL launched its internet gateway that accepted something@aol.com and put it in your AOL Mail box. You could tell that someone was an AOL employee because a banner (I think it was) appeared at the top of the message telling you.

Some of the network engineering folks had real aol.net addresses, but I don't know how that was handled internally. I also think the Netscape folks eventually made enough of a stink to keep their previous email address too.

Microsoft is going to be charging you per hour to play GTA 6.

The problem is they can't fit any frontier level open models.

For the heck of it I confirmed "http://www.longbets.org/601" does in fact result in a 301 redirect to "https://longbets.org/601/". I suspected they might have used a 302.

In this case Apple's legal department had identified the serials and IMEIs as PII.

This is why the case is in civil court and not criminal (because Apple didn't violate any "laws" as you claim). It is a contract dispute.

Guardrails are not a safety measure, they are a pay-to-play scheme that allows the people with deep pockets to have access to offensive and defensive capabilities first.

The attempted coup brought out a lot of pro Mossadeq protestors. It wasn't until the 19th when clerics organized anti Mossadeq protestors that it took hold.

Might be worth flagging to Wikipedia editors for a review.

> Did i say anything that was untrue? Or do people not like the truth?

It is widely assumed, but not factually correct, that the US was responsible.

On August 15th 1953 the CIA staged a coup to overthrow the government, but it failed. By the next day the State Department was actively trying to enter into diplomatic talks.

Three days later a group of clerics headed by Ayatollah Borujerdi took advantage of the situation and stirred up unrest that was ultimately responsible for the Shah taking power. They had been concerned about Mossadeq embracing secular liberalism and a referendum that dissolved the Majlis (parliament/congress). MI-6 had offered them support, but they rejected it.

I would highly recommend this book if you can get a copy: https://www.amazon.com/Iran-CIA-Fall-Mosaddeq-Revisited/dp/0...

That is the rule for COM/NET/ORG. ccTLDs can do what they please.

That said, as a registrar I highly recommend people renew important domains for 9 years. It gives you maximum buffer but allows you to transfer to a new registrar even if your old or new one has the same misconception hard coded.

They have a tiny Hong Kong office that handles marketing as well as a US office for technical support, but the entirety of engineering and manufacturing is in Shenzhen and Chengdu.

Because they provide a hosted site-to-site VPN service they are obligated to hold a B13 license. One of the conditions of which is the ability for the Chinese government to request access to devices worldwide.

This lends itself to a spider like design with just a ton of antennas sticking out of a box, or a trash can with the antennas hidden inside around the outside edge.

Do you have other ideas for how to lay it out?

You don't seem to know how backdoors work.

Oppressive regimes mandate that tech companies pre-install apps to protect people from spam calls, or install specific root certificates so they can intercept your traffic and insert a helpful banner into your browsing session to remind you when to pray.

The EU isn't going to ask Apple to add DataCollectionBackdoor(). They are going to demand that in the spirit of freedom and happiness EU companies must have access to Apple users private data.

The best practice was to rotate your passwords, but we discovered that this led users to picking less secure and easier to remember passwords and patterns.

Once technology offered up solutions to problems like password managers and breach notifications, that recommendation changed.

PCI used to mandate password changes for in-scope accounts (meaning they have access to credit card flows). Now that MFA is widely deployed that requirement only remains for accounts that do not have a second factor for authentication.

If you were ahead of the curve and implemented strong password policies that did not conform the the PCI baseline, all you had to do was explain to the auditor why. Assuming what you were doing genuinely increased your security posture it would be approved.

Ironically the gaps you point to are things they have had to do to appease the European Union.

I used to run security for building size computers if you want any feedback. My email is in my profile.

Any competent enterprise risk team is going to give a hard no to a SaaS application being in the critical path for on-prem business critical workloads. So there goes Fortune 100 too.

If you are successful and better schedule workloads you are just deferring upgrades and expansions. The customers Dell/HPE/etc. sales rep is going to freak out, some vice presidents are going to go golfing together, and all the remaining high value customers don't renew.

What you are really left with is the "small and medium business" clusters that are purpose specific. They are running 100% on a handful of tasks that can probably be hand tuned.

This sounds like really cool technology, I just don't see the business. Hopefully you'll consider open sourcing it soon.

It does not matter if the way we work has changed, or AI adoption has increased, or aliens show up. This is a demonstrated lack of loyalty that would result in immediate termination of the situation were reversed.

The important take away for everyone else is do you trust Matthew Prince to always take the high road and do what is right, combined with the fact that they man-in-the-middle all of your websites encrypted traffic? What happens when revenues are down and the shareholders demand blood again?