rixthefox

I think a better analogy to use would be a very slow loading app.

Say your app takes 5 minutes to load the first page and 1 minute to switch between pages after that. Instead of blaming the developers, blame the users for expecting too much of the app. Personal responsibility and all that.

It's the users fault they are using the app during peak times. If they really needed access to X part of the app they should have done it before it got busy.

That’s all well and good but it seems really unnecessary to paywall it behind what is really an overpriced SSL certificate.

IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone.

This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required.

Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image.

I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.

Pray tell what you call it then:

A company takes a game that had a very lively multiplayer community, replaces the game engine that was based on software that could run on any platform as long as it supported Java to .NET where the only possible platform is Windows. Take everyone who has ever purchased the game and force them to migrate their accounts to a Microsoft account in order to continue playing, then intentionally make the two versions of the game incompatible just to force people to play a watered down "definitive edition" that still lacks many of the features that allowed the community to thrive in the first place while issuing all these updates that essentially equate to "spyware".

Yes, I think the word you are looking for is, in fact, Hostile.

If an adversary knowing your IP address scheme it’s so bad to you, you’re not doing it right.

Security through obsecurity is not security.

I'm part of that range (late millennial to gen-z) and I feel that lost hope.

I don't speak for everyone in my cohort, but from my experience, I lost my hope when orange guy took the chair. Him and the people who follow him seem to have a penchant for "fsck you, got mine" and because it was never corrected early on that attitude became the beating drum of the nation for 4 years. For 4 years the worst behaviors of people went unchecked out in the open and now those same people yell and scream censorship when you try and correct it.

Our generation has been the punching bag for everything and finally we've just had enough. Our outlook for the future has never been worse. We were told growing up to always hope for "a better year" but that "better year" was more often than not better for everyone else but us. We're on track to be worse off than our parents in both generational wealth and opportunities [1] and people are just finally done blindly hoping for things to get better. Most people in my generation have stopped planning for the future because this country was too concerned about giving money and tax breaks to the already obscenely rich.

Elon's purchase of Twitter and subsequent actions have only dampened my hopes of anything getting better. When billionaires can piss away 44 billion dollars and cause all sorts of chaos just because they feel like it, meanwhile people in my generation are forced to work two jobs just to barely make a living wage, yeah I don't have much hope left for a better future if this is what the new normal looks like...

[1] https://www.cnn.com/2020/01/11/politics/millennials-income-s...

I think the harshness is on point. We've gotten to a point where people's lives are deeply connected inside their devices and people need to understand that it's not "just a phone" anymore.

Just like it's the buyers responsibility to make sure they aren't purchasing a stolen vehicle, it should be equally the buyers responsibility to ensure they are not purchasing a stolen phone. Proof of a clean IMEI would be a start. The problem stems from most countries outside the US not taking the IMEI database seriously and so in some countries it's possible to activate a phone with a reported stolen IMEI.

I personally think Apple's choice to restrict activating stolen iPhones is a smart move overall. If countries won't use the IMEI database, this is the next best thing. It's not our responsibility to "unlock" phones for people because they didn't perform due diligence.

Violence because some Americans just cannot be trusted with public data.

My biggest complaint about living in the US, being a natural born citizen, is that most people seem to make everything about themselves and this is partially the problem. All of this information being publicly available isn't the problem, it's that most people don't know how to leave well enough alone and think that just because they have this information that they need to act on it and use it to their advantage.

Likewise, you have the people who simply have no self-control and will fly off the handle and do something without knowing all the pieces and just assume they have heard enough to make up their mind. They would use that information to hurt their perceived enemies because in their messed up echo chamber if you're not Male, White, Christian, and Heterosexual then you're the wrong kind of American. The current issues surrounding abortion and women's rights only reinforce that mindset. These people label those differences as an "illness" and all that virtue signalling to make you feel like you're wrong if you believe otherwise.

I think that's the model everyone (eg: your average consumer) likes and is most familiar with.

Advertisements on TV are tolerated because it's not targeted and just a random broadcast to everyone who might be interested.

Anxiety that certain things may be used against you in the form of advertising is a very real problem people face. A teenager who is researching transgender topics would be potentially frightened if the TV station the family usually watches that never shows any ads about transgender health suddenly started pushing those kinds of ads and the parents disapproved.

The problem lies in the tracking technology. In order to make informed decisions about what people might potentially be looking to buy includes learning that individual's preferences and the rather unfortunate part of everything being online is that includes everything you could possibly imagine. Everything from the type of job you have right down to your porn preferences and other proclivities are potentially up for grabs and I'm sure the vast majority of people would feel greatly unnerved if Google, Facebook or whoever showed them just what kind of person the algorithms have determined them to be just by the data they've already collected.

Long term, systemic damage to both product and company reputation.

Google Stadia case in point. Nobody serious backed Stadia because almost everyone expected Google to kill it off so nobody jumped to it and then it was inevitably killed off because it didn't bring in the cash Google was expecting. Even when the stars had aligned for them with the pandemic and supply shortages that should have given them tons of players Google just couldn't convince enough people to go for it.

I wouldn't be surprised if there are high level talks going on about the sustainability of some of this exact lines of thinking. Chasing growth organically is fine. Artificially generating it by shifting costs or cutting corners elsewhere to maintain the illusion of growth eventually sinks the whole ship.

They really do want to be the center of everything it seems. I wish they would stop trying to be the Cisco of Networking in the sense of trying to convince a lot of people to let them handle critical network functions for a ton of networks.

All it will take is one major outage for everyone to see this is a bad idea.

Why trust a cloud provider who could go down and take half the Internet with it? Why centralize it that much where that is even possible?

Wouldn't this be more evidence that Google shouldn't be running the Play Store?

If they are going to start blocking apps that do adblocking on-device that sounds like an abuse of power and a HUGE conflict of interest with Google running the Play Store AND being owned by an advertising company.

Yes, the quote was originally Linus Torvalds saying "If Microsoft ever builds applications for Linux then I've won". Can't find a direct source from when he said it but that's what the joke was referencing.

Container escapes are a very real security threat that need to be taken seriously. Just like you wouldn't let all your users have a remote shell on your machines even if they are locked down. Just because they can't get anywhere doesn't mean they can't find ways out of that. If you're on the machine and can run whatever code you want, it's not a matter of if, it's when.

The admin may know what applications they are running in the container but I can bet you they don't know every library that container is shipping and I hold very little faith that these admins are going to pin a laundry list of every single container they run along with all the different versions of libraries each container is bringing and constantly checking that list for CVEs. This problem increases for every single container you bring onto that server.

Edit:

I love containers, don't get me wrong. I've seen first-hand how incredible it is to be able to set up an application inside a container and then remove that application and have no residual packages containing the libraries and dependencies that program needed. I get it. I just don't like how dependent we've become on them.

Now I'm a network engineer first, and server admin second. I don't want to spend a majority of my time pinging container maintainers to update their dependencies when an updated version of a library comes out. I expect to be able to update my local copy of that library and get on with my day and not have to worry about when this library is going to get patched in each of those containers.

I think the point he was making was too many people and projects are turning towards containers as a sort of "end all" where we're abandoning local system dependencies by shipping applications with their own bundled versions of libraries.

My biggest problem with this shift is I'm seeing is people are running their distribution updates and containers are still shipping with vulnerable versions of libraries. So a server admin updates his servers thinking he's all good, No, No he's not because $DEV hasn't updated their container dependencies and now that server gets pwned because here's yet another layer of dependencies I have to deal with on top of the ones I'm maintaining with the OS.

So no, please don't make containers on everything just because you can, because more often than not the container you never intended to be used in production WILL be used in production because someone was lazy and didn't want to deal with the dependencies.

Additionally, to your point, specific node versions? specific yarn versions? Is it really that unreasonable to demand libraries be backwards compatible with warnings on software saying a method is being depreciated? Like I can understand for major revision changes but seriously. I should be able to run the latest version of node and that code still work with warnings telling me that the code I've written will eventually stop working in later versions due to changes in the underlying setup.

My point being, don't weigh on containers as a crutch for badly coded software. Operating systems have moved towards rolling releases, it's about time libraries and programming languages followed suit.