xocnad

Indeed they can but they are in some ways like an individual model per judge, albeit with a sub-optimal interface and very slow, but at least they are hard to game in mass.

And you are not even addressing how easily a model could hide all kinds of special treatment - either way - at the whim of its creators, be they the government or some outside "trusted" party

It doesn't look like fly.io publicly disclose who there auditor is so it is hard to judge that specific part of your experience. I'm not disagreeing with your perspective on startups. I'm saying that type 2 gets much harder when you are large. non-homogenous and lack sufficient automation and monitoring.

My experience with pen tests that you put above or on par with SOC2 Type 2 security mirrors the discussion here. It all comes down to the reputation of the firm doing the testing.

From my 8 years of working SOC2 Type 2 audits done by PwC for a large PaaS Cloud with a worldwide presence (not the big 3) saying Type 2 is almost as trivial as type 1 is absolutely false. This might be true for someone running their own low volume SaaS in one region but for someone the size of Apple they are investing a lot of resource to stay on top of the controls, especially patching and permissions. If you've invested heavily in homogenization and automation your less likely to fail and the audits will be simpler. Even with significant investment I expect there are many aging corners in any "cloud" that make audits subject to failure and require a lot of work to avoid qualifying exceptions.

As the comment you are replying to does not, on its face, seem to have a political bia you should be explicit about where/how you identified that bias. Without this you are the one injecting politics not the OP.

This does not jibe with my experience with my long-in-the-tooth Garmin when it cannot connect to my phone and has been recharged after a total power down. It can take minutes but not hours.

Searchable elsewhere - todsacerdoti : https://news.ycombinator.com/user?id=todsacerdoti

US equity assets are generally available to most. Where I earned my savings is also irrelevant.

This also happened to me about a week ago and I had the same reaction/discovery process you did. OT but I wonder if there was a recent ramp up in these attacks. It was done against an email I do not regularly use that was attached to my account as an alternate and haveibeenpwned confirmed was in a data breach back in 2020.

Got burned by exactly this when on a high deductible HSA plan.

I am not knowledgeable at all about the structure or internal politics but on the face of it (based solely on the representations in this "article") wouldn't the staff that were directly dedicated to implementing the communities priorities be a "worthy cause"?

The US does not require women to register for the draft. And our current political leadership over the military is actively attempting to take women out of combat and leadership roles.

But why would what parties take from what happened with Laconia be limited to the attacking craft being submarines? The exact same situation could have happened with attacking surface ships instead of U-boats. The takeaway seems to be that we can't trust our enemies not to attack us while performing rescues so we don't have to perform them.

San Remo which you referenced in another reply doesn't seem to go into what is required of combatants around rescues but it does say that rescuers can't be attacked [1]. That would make the Laconia argument be that I can't be committing a war crime by not rescuing survivors because I presume that I am at risk of having a war crime being committed against me.

[1] https://ihl-databases.icrc.org/en/ihl-treaties/san-remo-manu... : The following classes of enemy vessels are exempt from attack: ... and vessels engaged in relief actions and rescue operations;

> What do you think is supposed to happen when a warship is destroyed with a cruise missile? There are people on this thread arguing in a way that makes me think the answer is "you're not allowed to strike warships with cruise missiles".

This thread has many tendrils. I'm not sure what this has to do with any of my replies as I've not said, nor implied that.

> From what I've read, the practical obligation to survivors is met once the attacker is confident that some SAR team somewhere has been notified, which was the case here.

Can you point to that in San Remo which you've referenced multiple times - or somewhere if appropriate? I cannot find sections that deal with requiring the rescue, or notification of the need for, of shipwrecked survivors in San Remo - perhaps I am not using the right terms.

I'm not sure why that would say they don't apply just to submarines though? The attack could have been by surface vessels with the same outcome?

War is horrible - I wonder if it hadn't been carrying mostly PoWs and it had become more well known what the repercussions would have been.

> And modern submarines have nil ability to search for and safely collect the shipwrecked.

A definitive reference that was more conclusive on this point as well as your extensive further assertions would be helpful. I have no expertise in submarines and I apologize if it seemed otherwise (but I did stay in a Holiday Inn last night!) but you've not laid out your bona fides to be able to make these proclamations either.

> Parity doesn't really factor in, it's not something you'll see in international law. You're not supposed to have to put yourself at risk to effect a rescue.

Sure, I was commenting on the reference you provided being targeted to situations where there was more risk and not directly addressing a similar situation as to what occurred here.

> Conducting a surfaced rescue is inherently risky to the crew of a modern submarine.

You could argue there is risk to any vessel, not just submarines, using the examples you have provided later on yet GCII Article 18 still requires you to do it.

The best argument for there being no possibility for a war crime is one that focuses on the inability of the submarine to assist at all in a rescue. An ironclad example would be with a peace-time situation involving a ship of one's own navy that was in significant distress.

This is for discussion's sake - I don't really believe that there would actually be a war crime trial around this one incident even if it were a surface vessel that did the sinking.

> I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting.

It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/ifra.... You seem to be flippantly dismissing this as insignificant given the people who are probably running this app.

> HN isn't supposed to be an especially political website.

Yes but when technology and politics cross paths...

Per the GP:

> Legally, there's much here that's hard to pin down, massive grey areas and a lot of jelly to nail to the wall.

Similar to an earlier comment you made to me, what references do you have that say that GCII Article 18 is 100% not applicable to submarines? Or more broadly that support your assertion that "you've departed any recognizable modern law of naval warfare."

> Otherwise the U.S. committed several more war crimes for each of the other Iranian navy ships that were sunk by bombs or cruise missiles rather than by submarine-launched torpedoes.

I am having difficulty parsing your reasoning here. What matters is were "all possible measures taken to search for and collect the shipwrecked", not the manner of the attack. You may be implying that bombs/cruise missiles left no possibilities but that isn't a certainty if there were US ships in the vicinity.

Regarding your provided reference to it being "difficult" for submarines to collect shipwrecked survivors - the treatment seems cursory and more germane to conflicts where there is more parity. In this situation what was the risk to the submarine? Exposing it's positions to the Iranians who had not other ships in the area (and per US assertions no other Navy at all)? Coming under attack from a missile launched from Iran while surfaced?

Technically not my position - was pointing out the redirect other's had made. I however did that with the background of media reports identifying the the "double tap" missile strike by the US on a supposed drug boat in the Caribbean as a war crime [1].

Not being familiar with the San Remo manual, a quick review says it does not contradict the 2nd Geneva Convention but it does not seem to directly address shipwrecked survivors. My read of GCII Article 18 [2] seems to clearly make this a requirement however.

My focus was on the the inhumanity of torpedoing the ship given the situation. Are you implying you disagree with this?

[1] https://www.washingtonpost.com/national-security/2025/11/28/...

[2] https://ihl-databases.icrc.org/en/ihl-treaties/gcii-1949/art...

Others have pointed out that the war crime is not picking up survivors. What shocks the conscience here regardless that sinking the ship itself may not be a war crime is the seemingly obvious reason this was done was target practice involving mostly innocent lives. The US would have had many opportunities to simply board and seize the ship. If there had been any resistance at that point that put US forces at risk then force may have some minimal justification for taking lives.

All good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.

And when the app links off to an EU site? Nothing prevents an EU user from using this app. There are a variety of Trump enthusiasts, though I suspect less than there are here in the US.

I am apprehensive of the surveillance state and it's potential for misuse. However this disclosure content is less than ideal:

- It mixes two separate issues 1) embedded default API key and 2) unauthenticated token minting

- The bulk of the disclosure focuses on enumeration of sensitive data that is implied could have been exposed via the default API key, but what is actually exposed is unclear: "The 50 "portal:app:access:item" privileges reference private item IDs that cannot be inventoried without actively querying each one which I did not do"

- The default API key was for "development" and there is no assertion that live data existed in that environment (though it wouldn't surprise me)

- The default API key was fixed in June 2025, it is only the token minting that has not been.

- The token minting issue is only asserted to "grant access to the geographic mapping of Flock's camera network locations" which would certainly be useful as a source for unethical updates to https://deflock.me/ but obviously not nearly as sensitive.

(And I've always used bullets/lists in my communications, long before AI did this)

I share your view - how does this article imply US companies and/or government involvement? If there were such involvement what aspect of BGP gives the US entities more ability to carry this out vs other nefarious actors? I ask this sincerely knowing almost nothing about BGP and wanting to learn...

There are many undemocratic and repressive regimes around the world. Trump has professed his admiration for various of these leaders. You can't seriously attribute noble goals of supporting democracy to him. Also, shouldn't he then be doing this in many other places in the world?

Nice assertion. Perhaps you meant that AI could be directed towards less memory intensive implementations. That would still have to be directed by those same lazy/poor coders because the code the AI is learning from is their bad code (for the most part).

From experience, and to slightly refute the sibling replied, good for the confluent peeps that get flagged as being essential to the acquisition, they'll get a retention bonus of 100-300% of base pay spread over three years. The cutting of staff will begin likely in the 3-5 year time frame.

I would argue they may have and are not keeping it to themselves. Announced partnership with Anthropic: https://newsroom.ibm.com/2025-10-07-2025-ibm-and-anthropic-p...