xp84

The fact you think all your political opponents are racists and evildoers is why the left lost in 2016, and in 2024.

The non-strawman argument is that giving someone citizenship of your country should not be automatic and quick. We want it to be difficult to get in, because otherwise, to borrow your word, “opportunists” find a relatively well-off, trusting society easy pickings to rob, cheat and steal from. And because we don’t want our country to turn into a place that looks like where some of these immigrants come from.

Notice how it isn’t Australians or Germans ending up having to be rounded up by ICE. It’s because they come from a country that believes in laws. And before you say “but that’s because you’re racist!!” I’d like to point out that the same thing applies to people from the Philippines or China who don’t look or speak like white Americans, but for the most part they come here legally.

Yup, and 50 million “Democrats” assisting them, people who’ve been convinced that maximizing the number of foreign citizens living here without valid visas is the enlightened and cool policy to aim for, or at least that if the other party won’t let them automatically naturalize everyone as they sprint across the border, that this is the next best thing.

We already have paths to citizenship, people just need to wait their turn. People with skills we need can already get in under programs that exist for that purpose.

We don’t want the full population of every failed or economically-languishing state (including ALL kinds of people, including the worst elements that exist in every society) to show up overnight and move in, which is what has happened in many western countries including the US with asylum claim abuse.

It’s rapidly turned high-trust societies into low-trust societies because that’s how those who come here from low-trust societies operate by default. People who have been here and know what a proper society looks like don’t like this.

> Overstaying a visa is a civil violation, not a criminal offense. If you want to hunt them as fugitives, change the law.

It sounds like you’re saying we should all just accept that our visas mean nothing, and that in practice literally anyone should be able to just show up, claim asylum, never show up to court for their hearing, and what we should do is absolutely nothing. In “blue” states they are strongly encouraged to sign up for driver’s licenses and welfare programs, and state agencies are forbidden from even asking their legal status. State and local police in those states are often banned from spilling the beans even when they commit crimes.

So, overstaying legal status can’t be addressed by states because Dems think it’s too mean to send them home, and it can’t be actively done by federal agencies because to do so, they have to come into states and investigate people to determine if they’re legally here or not and we don’t like the possibility that they might ever get it wrong.

This is why Democrats lost all respect from moderates like me who used to proudly be part of that party a decade ago. They’re not serious anymore. They appear to want a system that pretends to work but which everyone ignores because everyone knows it’s never enforced. Like driving 70 on the freeway in a 65 zone - everyone does it.

This is not how we should run immigration.

No, unless it’s were a cli image viewer. The gui parts of the OS, and what’s written by Apple, use keychain.

Macs have two completely independent root CA stores. The cli and all the opensource parts use /etc/.

Curl project did actually release support to compile it with default keychain support a year ago, but of course Apple never updates their cli tools, so expect to see that in macOS 37.

Note: I’m not defending Apple here.

It was arguably always halfhearted at best. Look at how behind they were on many things for years. They update things, I assume, when necessary to make the build toolchain work, and possibly to hold onto their POSIX compliance status which some us government buying contracts demand. The fact they changed the default shell to zsh instead of that decade(s)-old version of bash they used to have (avoiding a GPL license change, I think?) was a miracle.

I might find that a good tool, too, but it’s worth pointing out that even doing that upon any change to the keychain trust settings won’t fix the full problem here. The bad “4” certs are also signed by another root, Sectigo, so when CRLs are not being used (a case that seems common for the cli tools), then the certs downstream of the “4” certs have an alternate path to a trusted root. Unless you also nuke the Sectigo cert. which I would personally, but I have a different risk tolerance for breaking random sites than I guess Apple expects its whole customer base to have in the aggregate.

I know, it always makes my jaw drop when I realize that it’s still a significant number of people, since I remember it being a thing I used circa 2005. I don’t think git was even a thing back then.

This seems like extremely acceptable collateral damage to me. Sectigo should already be working with their customers to reissue immediately since they are the ones who signed the dumb intermediates. Trust only matters if there’s accountability. If root CAs want to keep their trust, it’s on them to not sign things that are bad. That’s the responsibility that comes with the license to print money that being a root CA gives you.

If I’m an OS vendor I would have been putting them on notice days ago that their root was being dropped and they have X days to reissue certs and deliver a new root cert or otherwise they can just accept that they’re not qualified to be a root anymore.

I think they meant that Apple’s updates seem to be the opposite of incremental, and they’re not wrong. If anything, Apple has moved in the exact opposite direction in the past decade, moving towards using enormous cryptographically-signed volumes (“sealed” is the term). This makes Apple really happy because they can make sure the users aren’t allowed to modify any of the “system“ files themselves for any reason, but also means that they can’t incrementally update things as easily as they did before. They ship multi-gigabyte “patches” every time.

Why would they need to? Can’t they ship an update that runs an executable that uses the already-existing tooling to update the pem? They’ve posted the cli instructions, so, ship that as a shell script and run it. It should be idempotent, whether the user has already “untrusted” it or not.

> Removing the root CA will mean that these valid certificates no longer work.

Great, that’s fine. They can reissue.

I read GP as a descriptive comment not a justification. They are showing with this issue that they don’t truly support the cli tools in a way we ought to rely on. Whether they occasionally provide some support doesn’t mean they’re supported. Only full and competent support counts, everything else counts as “it’s best-effort at best”

It doesn’t look like that, it looks like it’s a cert.pem file.

You have to admit that “just a quick patch” isn’t automatically low-risk. You could cause a large blast radius if you rush any patch out without proper testing.

Honestly that last paragraph I totally agree. I did edit to “never trust” these clowns’ root CAs in Keychain Access on my Mac, and this is the first I’m hearing that there was any possibility of that being flipped back. Will have to look into that.

If I can speculate though on why these bundles come from the browser or OS and aren’t fully in the user’s responsibility. You’d have to start from scratch for it to not have a bunch of stuff the user had ‘no need for’ to be present, and the user would need to see a cert window semi-frequently that gives the possibility to start trusting a CA, and the bottom 99.99% of users in sophistication has no idea whether they should say yes or no. I mean, without being signed by a root CA you already trust, even the name on the new CA could be completely made up. “Do you want to trust the ‘Apple Root Certificate Authority’?”

Wait, did I miss this? Can you share details on what browsers started doing this?

What kind of psychopath ships 100 distinct container images? I mean, maybe if you’re talking about all of Netflix or something, but… I suspect even they have base images that they use as a starting point.

There’s very little actually running in a docker container. ca-certs may actually be an exceptional case though, since it’s not code that’s running but a kind of data.

It’s not like if you use an Ubuntu image for a node.js app that you get PHP too and have the PHP vulnerability present in your web app.

There are a couple of people with sober takes on this article and you’re one of them. The rest seem to have decided long ago that the entire military is full of mustachio-twirling evildoers, and building their whole mental model of what’s going on with that as the foundation of it.

The facts of the matter are probably much closer to what you’re saying, but some people have become so radicalized (including those who got that way due to Trump-era buffoonery) that they can’t accept even the possibility that most of the actors are operating to protect our collective legitimate best interests.

Most of the people in government and the military are not political appointees, are not political hacks, and are doing tough and sometimes high-risk jobs, from a motivation other than evil. On the other hand, many politicians are motivated mainly by political partisanship and will do anything to try to score political points, including trying to cause outrage about what’s being kept secret, even if it’s been explained to them why it must remain secret.

I’ll assume that there’s some fake district we can create in the system to attribute such things to, since normally the courts are in districts which may be too specific on their own.

But the resulting material would be like, (XXXX meaning redactions)

XXXX was accused of XXXX

Tried before judge XXXX in XXXX District court

The evidence was XXXX XXXX XXXX

The witnesses were XXXX XXXX XXXX

They were found (not) guilty

If anything could be unredacted it could potentially (?) be the bare fact that it was about nuclear secrets but you can’t really reveal anything else without giving majorly risky facts to bad actors.

The redactions of every document could require many full-time very security-cleared clerks (or take years to do if understaffed) and is of the highest importance since a single failure to redact, or operational error, may reveal the whole secret thing. Mostly, all the things need redacting, so either whole documents, or everything but the prepositions and articles is redacted.

Since it sounds like the concern here is about the public’s interest in monitoring to make sure no abuses are taking place (which is a value I do share), what part of this aim would be served by a redacted report like this?

Idk. Honestly native is a good descriptor if you mean “we designed it explicitly for ___” as opposed to “we realized last quarter that ___ was the new cool thing, so we bolted it awkwardly onto our product”

This is a valid point, but doesn’t it seem like it is tremendously easier to get a ride somewhere in some random suburban area or even a semi-rural area? New York or San Francisco had plenty of people who would’ve been willing to drive cabs who couldn’t afford a medallion[1] but it seems like in less urban areas what was lacking was just the exact product Uber provides: a dispatching system that connects people who need rides with people who are willing to drive, without requiring those drivers to paint their cars yellow and incorporate their own formal business. It lowered barriers on both sides of their marketplace, especially on the driver side, since it was no risk to become a driver - if you never got any rides, you hadn’t really invested anything.

Anyway, isn’t that a good thing for those areas? I think a lot of people just didn’t have any convenient way to get around besides walking or waiting an hour for a very infrequent bus.

[1] (I was going to say “couldn’t get a medallion,” but since they were rentable and thus served as investment vehicles, it’s really just a matter of not being willing to pay the price those things commanded on the market)

In my untrained opinion, I don't think that will be as much of a cheat as it might seem. Or more accurately, creating a simulation accurate enough to where it would work for this purpose would be where all the breakthroughs would have to be made. Building a perfect simulation requires an understanding of the system being simulated, that I don't think we fully have of molecular biology -- if we did, I suspect we'd already have many of the answers we are seeking when we do this kind of research.

But I'm no biologist so if someone else is, feel free to correct me.

Well, it matters more for AI because there are some limitations of human research that don't apply to AI. Not all of course, just mainly the fact that there's a finite number of great researchers. Other things are limitations that could theoretically be overcome -- for instance, it's "only" money stopping you from having more lab space as long as you have a suitable robot to run a lab.

I find it absurd that you were downvoted to death for pointing out this fact that I had not considered. Thank you.

Having been briefly on an ACA plan, it's not ideal because those plans tend to be worse by any metric. Acceptance rate (size of network), copays, covered services, deductibles, etc.

ACA is sometimes cheaper though! Depending on your age, and your income, and whatever politicians in your state are doing to throw sticks in the spokes (not that the ACA really needs any help to collapse, given what an intentionally-compromised, politicized mess it's been from the beginning).

I just wish that we could do a full redo of health-insurance portability with these simple changes: COBRA with zero time limits, and you can choose to apply whatever number of dollars the government(s) would use to subsidize an ACA plan for you, towards COBRA premiums instead. Next, allow employers to offer you pretax premium subsidies to use to pay for COBRA insurance from your former job so that if you take a new job you don't have to change insurance unless you want to.

I'm assuming health insurers would deeply hate all of that, since the upshot from all that is they'd have to compete with each other in the consumer market! They do compete today of course -- to get contracts from employers, but employers have far different interests than humans do.

*Luck out. That's what I get for using dictation.

Honestly, I would argue Uber advocates had a valid point. Taxi medallion laws were created to artificially screw with the market by limiting supply of taxi cabs to far below a reasonable number that would’ve been on the road otherwise. This was 100% to the benefit of the taxicab industry and came at the expense of people who wanted to ride in cabs.

I do have some sympathy for the cab drivers who used to be able to earn a better living, but the only reason that was possible is that city government gave them a sweetheart deal, which isn’t fair. It makes exactly as much sense as having barber medallions or pharmacist medallions. If they had those, it might cost $85 for a basic haircut, and pharmacist and barber medallion owners might make a ton of money (remember, you can rent out medallions, so they became investment vehicles), but those are prices we’d all be paying for.

Regulations that just pick winners and losers, making most of us the losers, are stupid - and should be loopholed-around if it’s possible.

Maybe so, but in a controlled and deliberate fashion.

Not just random output of who knows what model, from who knows what prompt.

Many people still do woodworking for the love of the craft, even though factories exist with machines that can do everything hand tools can but 10x better and faster. If AI gets way out in front of anything humans understand, I expect that mathematicians will probably pick up where their understanding actually is, and carry on.