scott00

It was supposed to have been loaded with dummies, not blanks.

He said there wasn't much value in the wallets. Doesn't strike me as crazy to keep a small amount in something convenient. You see a similar convenience/security trade off made by big players, with immediate transactional needs satisfied by online/hot wallets and reserves held in offline/cold wallets.

Portugal decriminalized possession, but production and sale remains illegal. Without legalized production and sale users are still using drugs with poor dose consistency, which is what kills people.

Supply and demand is not driving the price of Harvard. As you point out, there are many more people willing to pay the current price than are admitted. This indicates that the market price is much higher than the current price. In other words, supply and demand factors would allow Harvard to raise prices substantially if they chose to, and something other than supply and demand is determining where within the range of zero and the equilibrium price the price is set. I don't have a strong opinion as to whether administrative costs are the driving factor, but it's certainly much more plausible than supply and demand.

In most implementations there's only a key or two on the device that you have to sync. The webauthn protocol requires a site that accepts it to store a small amount of arbitrary data for each registered device, which is then handed to any device that attempts auth. Most devices use that to store a copy of the site-specific private key encrypted with one of the device keys. (IIRC there's usually a symmetric key and an asymmetric keypair that are protected by the device, and the symmetric one is the more convenient to use for encrypting the site data.)

It's possible to store every key the device has registered, but most devices don't do it that way to keep the cost of the secure enclave low.

If a public company's auditors find irregularities they work with the company's management to resolve them. If, eventually, the auditors decide there are irreconcilable differences, they will resign, and provide reasons for their resignation in the resignation letter to the company. At that point, it is up to the company to decide whether or not those findings are significant enough that they need to be released to the public. The SEC will consider any auditor resignation for cause to be significant enough that it has to be disclosed, but that doesn't mean that companies will actually do it, as you can see by a bunch of enforcement actions relating to exactly that:

https://www.investor.gov/introduction-investing/general-reso...

(search for "resign")

The SEC quote is about requiring auditors to meet their professional standards. Those standards require them to follow certain processes, things like needing to see evidence for certain things, and not both preparing the books and auditing them, and require that they not issue letters they don't actually agree with. Those standards do not require informing the public or regulators about problems they find.

There's certainly something to be said for having some codified professional standards for infosec professionals, but if public or regulator notice is something you think is important to be in those standards you shouldn't model them off of the standards for auditors, because auditors have no such professional responsibility.

That's not really how auditors work. Auditors either give the client a letter saying what the client wants it to say[0] or decline to provide the client with that letter. They do not go public with their reasons.

[0] Companies want the letter to say whatever their regulators and/or contractual obligations demand that it say.

Not a professor, but my undergrad classes were generally graded as 10-15% homework and 85-90% exams.

With grading like that cheating on the homework is basically pointless, so few did it.

Big customers don't pay list prices, they get negotiated rates. To the extent Azure and GCE are interested in competing on price, it's the big customers they're after. All cutting list prices would get them is a bunch of price sensitive small fish, and that's not where the money is.

The U2F spec

https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...

has a clear description in the "Allowing for Inexpensive U2F Devices" section.

For webauthn, they don't use key handle terminology anymore, but the same fuctionality is provided by the "Credential ID":

https://www.w3.org/TR/webauthn-2/#credential-id

You sign up directly with the relying party and are authenticating to a hardware device which then OKs you to the relying party. Each relying party gets a different public key. The corresponding private keys can be stored inside the secure enclave (this setup is called resident keys), or they can be stored in a "key handle" that the relying party stores and provides every time you attempt a login. The key handle would contain the service-specific private key encrypted with a key held inside the secure enclave.

I think that for the cases where you're authenticating on one device in order to allow access on another device, this is done by bluetooth communication between the devices, and as a result you have to be within bluetooth range of the auth device to initiate the auth flow.

The missing important details: for reasons I do not completely understand, FIDO uses very non-obvious definitions of the words password and PIN. To them a password is a text string provided to an online service for authentication purposes and a PIN is a text string provided to a physically near hardware device to authenticate to that hardware device, after which that hardware device can sign challenges that can be used to authenticate to an online service. When they talk about passwordless they are not precluding the use of a PIN. The PIN gets you your second factor without being stored on a bunch of different services, and with hardware assisted protection from exfiltration and brute force cracking.

Relying parties (aka online services using FIDO protocols) have a lot of freedom to define exactly how restrictive they want to be by making choices about which devices they accept. Through choosing which devices they accept they can choose to require any combination of token, PIN, biometric, and password.

Buyers are often only interested in buying 100% of a company. If an all or none bid comes in, either the people who want to accept or the people who want to reject are going to be unhappy. When setting up a company you have to plan how to deal with this possibility in advance, without knowing the specifics of any offer. Most large public companies come to the conclusion that letting the majority decide is the fairest thing to do, and most shareholders know that's how it works when they are buying the shares.

Any managed postgresql will do: https://www.postgresql.org/docs/current/sql-notify.html

I don't get how this works with ECH. Can anybody add some detail to what's in the article?

From a backwards compatibility perspective, HTTP2->HTTP3 is really very similar to IPv4->IPv6. HTTP3 isn't really backwards compatible with HTTP2. The client just establishes a lower version connection and then the server (which must implement both versions) adds a header to the response telling the client they can establish a HTTP3 connection if they want to. In IP land you get to skip the lower version initial connection because you've already figured it out from DNS, but other than that pretty much the same deal. In both cases both clients and servers that use a new version are dual-stacked because there are plenty of both clients and servers that only support the lower version.

I know it seems moronic, but I think it might actually make sense from the advertisers point of view. Some percentage of people who buy a thing are going to return it and buy something similar in the next week. That percentage is almost certainly large compared to the percentage of the overall population who's going to buy that thing in the next week, and it seems plausible to me it's even large compared to the number of people who have been browsing for the thing but haven't bought yet. (Think of it as the ratio of people just browsing vs ready to buy.)

Cops can't always prove a suspect has committed the crime they actually care about, and in such cases will look for other crimes the suspect has committed that might be easier to prove. The most famous example is that Al Capone was convicted of tax evasion.

Marijuana possession is both very common and easy to prove, so it works well for that purpose. If a cop happens to come across it on a "good" person, they can always look the other way.

(not endorsing this approach, just speculating as to how police may view the situation)

The standard route to a junior software job paying >$100k is to attend an elite US college, major in computer science, and get very good grades. If you pull that off, you will have no problem getting interviews from companies that do on-campus recruiting, and your classes will probably prepare you well for the interviews.

If you live in the US already and have very good high school grades and standardized test scores, you should definitely consider it. Being poor is not necessarily a deal-breaker, the elite schools tend to have very generous need-based financial aid.

Please note that I'm not trying to tell you that this system is good for society or even good for the companies themselves, just telling you how it is.

If you are one of the many many people for whom that path is unrealistic, there are a few other options that can get you there. The first is to find any software job you can and work it for 2-5 years, and at the same time study data structures and algorithms. Then follow the process some other people have mentioned to try to get a job at a big tech company. I would think after 2-5 years experience you can probably land a job at a not-big-tech company in the 70-80k range without much trouble. Just 6 months is not going to help much in getting your second job (if a job ends that fast, there's often something seriously wrong with either the person or that person's boss, and if I'm sifting through 200 resumes, why take a chance?), but $20/hour is hilariously low (at least in the US), almost any other programming job is going to pay much much more (again, in the US).

Also, in general with job hunting, you just have to be really persistent. Well paying jobs attract hundreds of applicants, and there's a lot of luck required just to get the first interview.

Finally, I'm hiring, email in profile if you want to send a resume my way.

Consideration is a hard requirement for a binding contract. Note however that consideration in contract law doesn't mean the same thing as in general usage: in contract law it means "something of value". So a contract promising to give someone a guitar is not enforceable, but a contract promising to sell a guitar for $100 is.

In general the likelihood that the parties have read the contract doesn't have any bearing on the enforceability of it. But most such contracts are also contracts of adhesion (roughly speaking a take-it-or-leave-it offer), and there are special rules for the enforceability of contracts of adhesion. The principle is that they can't be too surprising or too unfair. There's a fair amount of case law about where that line is (which I mostly don't know).

The reason it's more complicated is to support reflection. C# allows you to create objects and call methods at runtime based on data not available at compile time, including classes and methods that don't get used by the normal (non-reflection) code.

That means that by default you can't do tree shaking, which means you would end up with enormous exes, which will probably annoy the type of people who want a single exe.

The bit more advanced is to tell the compiler which types you might want to reference by reflection so that it can shake the rest out of the tree.

I think this process is now underway on honeycrisps. Lately they seem to have thicker skins and less crispness than in the early days.

The method in the article required an hour of photoshop work. Anybody know how much expertise is required for that step?

Any names you can name using federated xmpp? In my little corner of the trading world everybody seems to use either ICE Chat and/or Bloomberg. My guess would be ICE Chat is xmpp under the hood, but I don't think it's federated.

I have the exact same power issues with my Dell XPS laptop running Windows 10, and a few more. I think my favorite is when I have to restart the computer before it will shut down.

Point is, Windows is no guarantee of a functioning system.

If your grades were good at the small name school a master's degree at a big name school might be both within reach and give you a shot at compiler and OS work.

I'd love to hear more about this, sounds fascinating.

One point I think a lot of people are missing here: it's not likely that Zuckerberg would have paid anything out of his own pocket even if he had been sued individually. Generally most large companies agree to indemnify and defend their executives against any civil liability stemming from their position with the company.

How in the world does this satisfy the advertisers? They send the personal identifying details of each customer to Google/FB, and then Google/FB tells them "oh yeah, that guy totally saw an ad"? The ad giants would never lie about such a thing... they will just fix all of the bugs that under report and just not have the time to get to all of those pesky over-reporting bugs.