502 karma · joined June 6, 2018
Or maybe another way to look at it this: the invisible hand of force is yet another invisible hand operating in the markets.
But he isn't running it. He has legal control over it, but in terms of sweat equity he only gets 24 hours in the day like everyone else and you can't tell me he somehow converts that to 1000x the labor of an average, capable, willing, working employee.
If you have specific security concerns, you should be showing actual attacks against wasm runtimes or somehow show that the security model of wasm as a whole will always reduce to an insecure configuration. What you have shown is something that is "exploitable" on pretty much every architecture I know of.
All I can remember from my youth was people pounding on me that being fat was basically evil. You see the same sentiment here from time to time so it still exists.
I agree with this idea. We need a toolkit standard for the web and to stop shoving application code into a document model. What's strange to me is that so many people have been trying so hard to either resist or deny this.
The proposed solution is a non-starter, though. Anything involving XML is probably DOA for the web. I know I don't want to touch it. But something needs to fill this space because UI on the web is so god-awfully atrocious.
This is the important part.
Sure. It's really just a matter of mass appeal. We could fork the existing browser base and eliminate the new attestation API. Some projects are already doing this from what I understand.
What will keep attestation from being used is websites will lose business if their customers can't access the site. We went through this with user-agent string checking in the 90's/00's when IE and Netscape/Mozilla were at war and every site had a very strong opinion on which browser they would support. Even today you occasionally see sites that will hit you with "unsupported browser" errors if you aren't running a specific version of something.
The solution to this was everyone realized they were throwing money away by excluding a large portion of their customer base. At the time no single browser really dominated the market share so it was easy to see that an IE-only site was losing 33% of internet traffic. These days everything is basically chrome-based so this hasn't been as much of an issue.
So in the future we'll see this same thing. Non-attestable browsers will be locked out of attested sites and it will be a numbers game to see if sites want to risk losing these customers/viewers.
At the end of the day, you have to remember that everything on the web is just a TCP socket and some HTTP which is a flexible text protocol. We can build pretty much anything we want but it takes inertia to keep it going.
Anything requiring extremely optimized algorithms will generally start in academia and work its way outward as the techniques are adopted in commercial software. Sorting and compression algorithms are two examples that come to mind. Even games development which has a history of non-academic roots now borrows heavily from academic research to refine things like culling algorithms or optimized computational methods for specialized physics calculations.
I think this is false if only because the premise of Democracy is so poorly defined. What are we voting on? Why? Who is "we"?
Am I allowed to call a vote to strip you of your property? Am I allowed to call a vote to tell you what to eat? Am I allowed to call a vote to tell what to do or where to go?
Why or why not? We have laws today that do all of these things. What does "failure" mean?
I work on a pipeline that processes millions of events per day in a pipeline that contains two pretty busy Go programs. One has an embedded Javascript engine and does all kinds of pattern matching and string manipulation. The other does a ton of database read/write and some crypto-calculations to do data integrity for us.
Millions of events. Per day. Never a panic in production.
It is easily possible to write deterministic, highly performant, and durable applications in Go.
If you have trouble with tools like dig, you have wasted a lot of fucking time.
New-school FOSS nerds don't seem to understand that all poor user experience concerns are because we are trying to be productive. The new style of of reduced information density and easy-to-remember names isn't useful when you are paid to have production systems up and running. What I need are tools that give me the exact information I need quickly and get the fuck out of my way for everything else.
> It’s such an outdated user-hostile boys club attitude fuelled by insecurity and misplaced and not even well-thought-out elitism, and I’ll never pull any punches when talking about it.
Most people that complain about this put the minimal viable effort into actually learning what they are doing. Somehow I'm the idiot after spending hours of my life to learn this professionally and for wanting expert interfaces. You can call me elite all you like but when the whirlpool of disaster is pulling us both under, I'll be in my elite raft surfing the waves while you struggle.
The priests are mathematical algorithms and their judgements are based purely on the ability of candidate algorithms to perform at the current standard or higher. There are no "code mages" in crypto. Anyone is free to contribute.
What you need to understand as an amateur coming into the field is that there are already rigidly tested standards that people depend on and have spent many, many hours thinking very critically about to ensure they are mathematically sound. At this point there are extremely high expectations for minimum levels of entropic distribution.
This is not an art project. New ideas must absolutely perform at a higher standard before anyone will even consider it. You are competing with what exists today and it will be 100% on you to prove that you are setting a higher standard. Everyone will follow you if you can prove this, I assure you.
I'm not saying they pulled it off because I would need to evaluate it, but having your own dependency stack can result in a much more streamlined solution for extra performance since you don't have to compromise to someone else's data model. As this is a high speed message bus, it's entirely appropriate.
These are also basically application-level network routers which really don't need huge levels of dependencies so to be honest I'd be running away from anything that claims it's written using 1000s of the newest, latest and greatest whatevers. Churning out a faster string grinder is what I'm looking for.
If you need light-weight reporting like a status code you can use RPC/reply mechanisms if the broker supports it (e.g. rabbitmq), build your own (custom headers), or use an API/gRPC call.
Everything else starts needing some sort of more sophisticated coordination mechanism and gRPC will look attractive for that although there are usually other options as well.
All of these major Linux firewall features have been around for over two decades and the use of multi-stage rule routing with filters is day-to-day for anyone in network ops. Cisco switches I messed with in the 90s had DHCP helpers for relaying packets across VLANs among other similar features. FTP helpers were extremely common before SSL/TLS/sftp became standard due to NAT and how the port directions work in that protocol.
I've been consistently reminded my entire life that if we don't do this society will immediately collapse into a steaming pile of anarchism. It leaves me wondering why so many complain about the yoke if they asked for it.
Also, I use the royal "we" here because I certainly feel no affinity to any of the political behemoths in charge. I would much prefer to live in a world where these assholes acted more like consultants than tyrants.
No, containers are not a problem and they don't add any additional problems.
I don't obey their orders. If I cooperate with another entity I do so on my own terms. I am only morally accountable to myself and must reckon with any consequences of my actions that might reflect harm upon me. I have agency.
So yes, I must operate in an ordered system but at no point am I morally obligated to another actor.
The attestation API will allow websites to verify certain things about the user agent which they then may use to either deny access or alter the access for the requested resource. This is similar to existing methods of checking the "User-Agent" header string but is much more robust to tampering because it can rely on a full-chain of trust from the owning website.
So will existing tools work with this?
Websites that do not require attestation should work fine. This will probably be the vast majority of websites.
Websites that require attestation may or may not work depending on the results of the attestation. Since programs like curl do not currently provide a mechanism to perform attestation, they will indicate a failure. If the website is configured to disallow failed attestation attempts, then tools like curl will no longer be able to access the same resources that user agents that pass attestation can.
My opinion is that it is likely that attestation will be used for any website where there is a large media presence (copyright/drm), large data presence (resource utilization/streams), high security, or any large company that is willing to completely segment its web resources into attested and non-attested versions. Tools like curl will no longer work with these sites until either a suitable attestation system is added to them, or the company changes its attestation policy.