rob-olmos

One of my wild guesses could be Apple wants to mine the data. Blaming it on having to comply with court orders could be a useful limited hangout.

Can you link any docs for that? I believe a lifecycle is attached to an S3 bucket, and there's no bucket for EBS snapshots as they're tied to EC2.

How do you move your EBS snapshots to Glacier?

Sandboxing in the language runtime is an interesting idea. I wonder if that could be offloaded to the OS/kernel instead so that every language doesn't have to reinvent the wheel. Eventually then hardware could handle it to reduce overhead.

Eg, declare parts of the compiled/interpreted code with specific privileges. Kind of like how memory regions can be NX.

Found this issue with other SaaS-like providers too. Eg, a popular email relay/delivery service has a per-email price if you go over your rate plan, with no ability to set a hard limit for the account or per sub-user.

Compromised account or server? It'd be interesting for their spam filters to catch most of it. But an accidental loop or issue in your code? (like another commenter mentioned with a $30k bill). Yikes.

Incredible to lack such a basic feature to better protect an account especially when money is involved.

Could you provide a bit more specifics on what was being cleaned up please? Thanks

I wish I could understand why platforms are still only allowing one hardware key, especially a platform like Twitter with a sizable base of advanced users.

Did Twilio or AT&T ever provide any response on the blocking numbers issue?

I have doubts the algorithm would be a decision tree, or capable of being contained in one. I feel like at some point it would use or be an ML model.

Would a model also be open and transparent? It would at least be open & testable, but I'm not sure about transparent for easily identifying any biases.

The article mentions possibly treating/curing cancer: "He believes there could be a drug that could mimic the effect of p53, or a way to deliver these genes to people at risk of developing cancer, or who already have it to treat or cure the disease."

What was the solution for the SD card imaging?

Out of curiosity, why do you feel (a) is not the case? Are the profits going to salaries instead?

Faxes, like in US health care. With staff to handle it at the endpoints.

Do you have a certain process or library to version control a WP code base/database? TIA

Yea, I'm looking for the SSH CA (certificate authority, the one that generates/signs the ssh certs for end users) to do more granular authorization. Or, something associated with the CA.

Eg, UserA only has been granted access to ServerB, so only show them ServerB as a target and reject all others.

Thanks for your reply and offer. I'll look into the product a bit more when I get some free time.

I think I was a bit vague about RBAC. I'm thinking that the user account creation isn't vital in this use case since the audit log holds who generated/access. It's more about controlling who can generate a cert for what.

Eg, I think Teleport's model has the RBAC config at or near the CA part, so the cert generation either happens if authorized or denied if not.

Is there a project for being the SSH CA that also includes RBAC for users without costing $hundreds/$thousand per month?

I've seen projects that'll do the SSH CA part, but unless I overlooked it I didn't see any RBAC or mapping ability to restrict users to specific servers.

For mod_php, they'd run as the same httpd user account and could mess with other user's stuff if they were set to be httpd writeable.

Other isolation levels were needed, like an MPM that would run vhosts as their own user, or a vhost level chroot.

Alternatively, there was php-cgi via suexec, but it didn't have the persistent qualities of mod_php.

The comment that this post is referring to seems to be more thorough than the blog post seems to imply on my first read through.

I understand the issue, of what sounds like removing the core/theme signing, due to other issues like 32bit performance issues it seems, but it looks like the WP comment has plausible reasons for why.

It would be nice and more informative if the blog post took a point by point approach to the WP comment, IMO.

That's a fascinating scenario. Even more malicious embedding shellcode in a series of tickers and prices kicked off with a few invalid tickers/prices.

I wonder how many other feeds/sources like that in which so many businesses rely on in at least some level of autonomous fashion.

Reminds of the story of Google wiping out all of their CDN servers by Diskerase because of a single detected value, IIRC.

Would be nice if someone could build a site like https://twofactorauth.org/ for bringing more attention to this alarming and growing issue.

The goal to hopefully influence companies into providing such a fundamental ability.

QuickBooks Online does not have a native backup or restore, at all, and it's pretty ridiculous. QBO told me they also can't do on-request restorations with their backups.

There's a third-party or two that can use the API to do a backup/restore, but also, still, not all of the QBO data has an API. Eg, IIRC, recurring transaction tasks.

Just a matter of time for ransomware to replace data via APIs.

For the size and importance of Cloudflare some insights to a couple questions would be nice:

1. Why are WAF rules not progressively deployed since there's already a system to do so?

2. Maybe there should also be a testing environment that receives a mirror of production traffic before deployments reach real users?

(I understand the WAF change was not set to take action, but a separate environment would be less likely to affect production)

For smaller towns (one I know of being a population of ~6k) callers speak with the dispatcher.

2011 iMac display I can't see the logo, but if I drag the Chrome tab over to a connected ViewSonic VA2431wm monitor from years ago, the logo shows up. Interesting.

Is a SameSite=Strict cookie sent if VICTIM.COM does a redirect?

If so, it sounds like the next trick to follow would be a type of "redirect gadget" to get SameSite=Strict to be exploitable again. If so, maybe it's only the end of CSRFs without a gadget.

Eg of "redirect gadget", CSRF via VICTIM.COM/open-redirect?url=/update-password...

Had to deal with this before. Really hampered things with bloated backups and extended restore times during restoration tests.

Also not a good plan for the database to no longer fit within RAM, especially if the storage engine is evicting cached pages for blob content, only to populate a CDN.

Thanks. IIRC the site I saw was from a few years ago, before the spec was drafted. (I updated my post to be more clear). Pretty sure there was a few photographs on the page out in the flat grasslands.

Found this more lively page, apologies if cross-posting a comment is not allowed:

Semi-related, I think Web Packages and Signed Exchanges could have some usefulness outside of Google's caches. One of their spec examples was for verifiable web page archives. Another idea it could be used for a wifi "drop box" (drop station?) when there's no internet connection around. That isn't uncommon at some popular spots up river into the woods in the US.

The idea is that as people enter the area, they can update the drop station automatically for things like news or public posts with whatever they've cached recently.

I'm pretty sure I read about this idea before the spec was drafted but I couldn't find or remember the site, something like vehicle-transported data.

Semi-related, I think Web Packages and Signed Exchanges could have some usefulness outside of Google's caches. One of their spec examples was for verifiable web page archives.

Another idea it could be used for a wifi "drop box" (drop station?) when there's no internet connection around. That isn't uncommon at some popular spots up river into the woods in the US.

The idea is that as people enter the area, they can update the drop station automatically for things like news or public posts with whatever they've cached recently.

I'm pretty sure I read about this idea before the spec was drafted but I couldn't find or remember the site, something like vehicle-transported data.