surge

"Just good enough" is a constantly moving target. Its a bit like tech debt, what's good enough one year isn't the next, being PCI compliant doesn't keep you from getting customer cc #'s stolen.

Just good enough is also a question of risk appetite. If the business decides it wants to "accept the risk" rather than take whatever measures necessary to remediate a risk, that's up to them.

I don't think you know what the point of a red team is, if you did you'd understand how oxymoronic your statement is.

A part time red teamer is just a pen tester. That's not what a red team does, and adequate threat emulation isn't someone who flies in for two weeks does somethings that you can only accomplish in two weeks, then fly out to the next company to do the same things. You actually need to dig deep and research a companies individual weaknesses and that takes time. Threat actors have that kind of time to sit and observe and probe, a part time noisy pen test isn't going to get you more than the basics.

Also a blue team has to be right all the time, the attacker only has to get things right once. That's why you constantly test your assumptions with a red team and give blue someone to "train" with and improve with that isn't an actual threat actor. You don't want the first time you fight to be in the ring, you need to spar.

A lot of pen testing consultancies brand themselves as red teams, but a lot of them are just rebranding pen testing services to the ignorant.

WTF are you talking about, we regularly evade these tools?

Yeah, and my team and larger cyber org was under risk management, until some new exec decided to shift us under the technology org (a decision I do not agree with due to conflict of interest).

I'm a full time red team. Depends on your org, but you're not ready for a red team until you get the basics of blue straight.

Most of our blue is threat and anomaly detection. They spend a lot of time in tools, sure but its usually a SIEM like Splunk or similar tools for event correlation and behavior detection like Crowdstrike. Qualys isn't going to find custom written malware using common utility as a C2 channel.

I agree with this, finding vulnerabilities is really hard, and there's people coming out of college with no experience anywhere else in the field trying to get high paying jobs looking for vulns in technology they don't understand or have never worked with.

One of the best vulns I've ever remediated was one discovered by an application developer in their own authentication that was prescribed by our platform. He knew it was a problem and knew it needed to be fixed, but knew he needed us to report it before a fire got lit under the appropriate people's butts to make it get fixed.

We're paid to find risk and reduce risk.

Software developers and project leads are paid to ship product, even if its held together by glue and duct tape.

The problem is they don't have security and risk reduction in their incentives and automation, and they should, call it DevSecOps or whatever. After all, availability is one of the areas of security, but that usually falls on operations.

Sounds like someone is tired of getting dinged for using outdated security practices in their application designs.

I came from the other side of things. I know what its like, but the fact they care more about features and not fixing vulnerabilities or designing applications to have good security is a failing on their end. Shift left, do it early, so we're not finding it right when the product is getting ready to ship when its finally in a form ready to review.

>3. Build standardized patterns.

Yeah, you can have them, but then the various project teams don't follow them or even look at them during the design. Then wonder why its being reported later. Are they kept accountable when they don't follow the prescribed patterns and it causes project delays when its called out? No. It's our fault for road blocking.

>4. Abandon the perimeter model.

Uh yeah, we talk about zero trust but its the app teams saying "its an internal application, not publicly accessible so its not a big deal if there's no encryption or credentials are stored in the clear" in their arguments to why its not an issue or they shouldn't have to fix it.

>5. Advise, don’t dictate.

I can not speak for every place, but we recommend solutions and call them "Recommendations" but if there's another better solution to reducing the risk we're not the SME's in your product, as long as it adequately remediates the issues through some sort of control, detection, or fix, it's not really for us to say how its done.

>6. Ask platform teams to integrate security.

They're not interested, they're interested in copying and pasting code from past applications with the same old/bad practices. They even bring practices into new platforms that have great solutions for managing a risk (such as credential storage) and do it the old way (keep creds in a config file that ships with the artifact).

Cybersecurity isn't special, but its the developers (not all) IME that treat it like it is and not part of their job responsibilities.

Or paying out bonuses for the prior year since you don't let them finish the year that makes them entitled to the bonus.

The whole point of increasing interest rates is to encourage the same behavior, holding onto money instead of spending it, thus making money "less" available or removing it from the market. I think doing things to cause deflation to say, curb inflation from say 8% to 5% (by causing 3% deflation in value) helps as its context dependent.

I agree deflation of value into the negatives over a long term causes its own set of issues, but after you went on a big money printing spree to deal with an economic crisis, I think something like counter deflation is possible if inflation rate is still positive.

They also charge more for 4k and don't deliver on it. Most people who pay for 4k notice the piss poor quality of the stream. Don't charge for something you can't deliver.

I personally enjoyed Netflix more when it was a back catalog of older quality shows, and not a glut of baking/crafting/reality competition shows. If you're going to give me the same things I can get on network television it's not worth paying for, especially if they now have an ad tier.

I'm not sure if there is. It depends on their financial security and the positions being eliminated. I guess if the severance is good its not so bad.

Yeah, that's what I was thinking, most companies at least wait until after the holidays to serve the bad news.

I know my company is hinting at layoffs in Q1, well hinting, they've literally said they've budgeted money as an expense in Q4 to pay out severance packages in Q1. So they're at least waiting until after to give people their walking papers. That said, I'm not sure if the anxiety of not knowing if you're in a future layoff is maybe worse since now everyone is concerned, but then again, at least you can act accordingly, maybe layoff the credit cards.

Right before the holidays...wow.

Is it Austin that lost its luster, or all that low interest capital funding is gone so startups are drying up in general?

Swap spit/kiss someone who gets this. Cheaper than dental insurance. Time to bring back the kissing booth.

Physical Media has its own DRM BS, hampering conversion to newer media formats for devices that are still sold and supported, but I digress.

Yeah the cognitive dissonance between writing "Little Brother" and "government can be trusted with more power" while its simultaneously advocating for encryption back doors is mind boggling.

People used to say the same about IE. Most people don't think about it. I just Brave personally.

I'd use matrix before xmpp.

I at least use Signal now, that's not bad.

Yes, the appeal the Fediverse is that its lack of mass appeal keeps it away from the inevitable Eternal September or Enshitification or at least delays it.

In a small way, we can have the Internet of old back, the one where in order to participate in communities online, you weren't driven by algorithmic feeds setup to push ads in front of you constantly, or just generally shit posting about whatever pop culture moment.

Well, currently cooking for 5 and if I shop in the produce department, getting fresh vegetables, etc, I'm paying a lot more than if I don't, or get some premade stuff with a higher shelf life.

"Child" is used loosely by commenters on this article, its fairly obvious they mean teenager when they say "underage". It was stated the hours were flexible and they're going to college so its assumed this is after school.

Given its perfectly fine for teenagers (not children) to take part time work here and many of us here had to earn extra money before becoming adults or to help save up for education. I don't see the problem. My part time job bought me my own computer, that I used to start the career I'm in now. If you want me to believe they're more exploited than I was at my part time job at McDonald's of which was also of great benefit to me, you're nuts.

This article tries to make this is somehow exploitative. This would be a great part time job here, it just pays the rate there, and its normal to pay kids less than adults anyway since its assumed their living costs are mostly covered by parents (a living wage is unnecessary) and their inexperience and unreliability makes its so if you're going to pay full rate you're better off with an adult.

If the kids were doing to to make money for the latest Playstation, this would be fine here. I'm not seeing an issue going off what's in the article, if anything it seems like a huge boon considering what other jobs are likely available to teenage workers.

>“It’s digital slavery,” says Hassan.

It's only slavery if you're not allowed to leave, if its a bad deal, the wages aren't worth your time and effort, then don't do it. Go work in a blacksmith shop or something else they do in Pakistan that's somehow accepted but far more hazardous.

The whole article is framed in a completely champagne social justice lense and not what's practical or what works or is to a mutual benefit for both parties. If demand for those jobs has gone up and this depresses wages, that's how it works here.

If you try to eat healthy, non processed foods, vegetables, etc, your food budget doubles if not triples.

Hotels do a terrible job of catering to families. If you need more than one room, there's no way of telling if the rooms are joined, on the same floor, or if you an get two rooms with an adjoining door.

You're assuming kids have the extra time for that. Homeschooling also is much more time efficient. There's a lot of time eliminated even you're not trying to get a whole classroom on the same page (literally and figuratively), and leaves more time for play, extra curriculars or special interests and positive socialization, things that existed more prominently in education when there were smaller class sizes. You can also cater more to where the kid is at in a subject, moving faster in subjects they excel at and slower in subjects they struggle with, as well as accommodate any learning disabilities or idiosyncrasies as well as age specific level of brain development (huge differences in comprehension levels with just a six month age difference in certain subjects. It's also what the ultra rich and children celebrities effectively do, purchasing a bespoke individualized education plan just in a class of 4-5 in private school.

I always laugh at the people insist it's best to let their kids be guinea pigs while public school systems which aren't even utilized but it's most vocal advocates for their own children are on a multi decade track of "figuring it out".

The most likely place someone is to experience violence in their lifetime is in a school, sexual abuse and assault rates are higher than in the Catholic Church or BSA by population. You can't be mad at people for opting out while the rest of the advocates figure it out for the 5th decade of objective decline and empty promises when problems they've experienced when they were in school haven't even been addressed or have gotten worse. They may be voting for the right people and are active advocates for better education but their kids are in immediate need of a better education.

It also doesn't help adding close to 3 million people in a year to the domestic population (not through births or official visa process), during a time of rising construction costs, and not expecting that to cause an affordability and availability crisis on the lower ends of the market. It's not a problem for wine/microbrew drinking political commentators who aren't competing for finite low skill employment opportunities and lower cost housing, but their feigned altruism has an obvious second order effect for working class.

Yeah, you learn quickly in film school that documentaries edit footage however they like to tell a narrative. A lot of the incidents they describe happening in the wild are just multiple different situations clipped together, if you pay attention you'll notice some clips aren't even in the same place. There's even rumors recent footage of panicked animals were actually being caused by film crew drones, not anything happening naturally in the wild.

Housing doesn't fix the problem of homelessness. You can give someone a free house and if they're not capable of the basics of self care, due to mental health, drug usage, etc. Then the houses get destroyed/misused, becomes a problem for neighbors, etc. There's been a plethora of housing projects, charities, programs, etc. I supported my local one then realized it was making the problem worse. These programs don't talk about the failures, just the few success stories, because they need funding, and they think its worth it if you can save a few, but its not like there aren't other effects of giving someone a house whose not going to use it to make their lives objectively better.

People have this naive notion that the solution is there and just no one has tried it. For every success story there's 9 other failures or worse unintended consequences and the waste of resources that come with it.

The only thing that seems to "work" is temporary housing for those in a drug treatment program, but even that has its high degree of failures or relapses, but at least then its not giving housing to those who aren't frankly interested in getting out of their current situation. Think about it, they've chosen the addiction, even if the consequences were job loss, addiction, etc. In other cases, its a mental illness, often exacerbated by addiction.

There are people who are "homeless" because of reasons outside their control and these programs work for them, but the majority of the homeless problem is not the people who are victim of circumstances and abuse. I support these programs because they save the 1 in 10 or whatever, until it becomes a draw for those that aren't looking for help to get out of the situation they're in and they conglomerate or stick around when bussed in.

The bussing is annoying cause my city often ends up with them, and it overwhelms the resources we have to deal with it for a city our size, but we do the same in turn.