yardstick

Yeah I completely understand the motivation. I just wish they were more pragmatic to the security risk vs building their reputation.

Maybe, but if I was maintaining PHP or another critical software, I’d think twice about letting Chainguard have inside information.

I would let Chainguard deal with the patches post official release like all other unreliable parties.

Both are to blame.

Calif more than Chainguard, but still Chainguard too.

Calif was obviously twitching to claim credit for their findings, and what I find troubling is this eagerness was more important to them than giving users a chance to update their systems.

Even if they ended up waiting only a day post release I would still say it seems a bit too soon. Maybe a week after. Not everyone’s system have aggressive patching schedules and PHP is soo heavily used.

True. But less likely to be able to deploy at scale. Waymo cleaners I’m guessing will be far less likely than drivers to care about keeping their cab super clean and noticing these things.

Plus as per this article, the rider is way less likely to talk important business in front of the driver - hence Waymo being ideal.

Just wait until someone installs a listening device somewhere in the cab. Doesn’t need to be Waymo doing the listening. Target Waymos that operate around financially important areas like tech and finance companies and profit.

We should just tell the French they can send their fishing boats outside the plant. Two birds one stone :)

London-Manchester being an hour trip instead of 2+ would be a game changer on day commutes. Yes prestige played its part too.

> Are 8500 environment consents a lot for a 140 mile incredibly fast rail system?

That’s about one consent every 26.5 metres. A modern intercity train carriage is about 25 metres long.

It seems like a crazy number of consents for the distance.

Sounds familiar. I’m being billed £0.01/month for something in GCP, I don’t know what even after digging, but I’m too fearful to complain about it or disable the account lest it somehow gets my main Gmail account blacklisted somehow.

How about

Allow git clone for free/unrestricted still.

Require the user to sign in to view html views. Sign in require a valid email or phone where a validation link is sent.

Or: Users signed in won’t see the Anubis. Users not signed in can still see the html views but have to use a very high work level?

Or: Limit unauthenticated requests from an IP to 5/minute. Authenticated requests can do a lot more before hitting the limit.

Busy servers generate more heat. Inefficient code makes servers busier. There’s a real physical outcome for bad performance code at scale.

But you don’t really want lots of idle or underused servers, aside from burst capacity management. So if they universally and consistently wrote more efficient code I’d expect a smaller datacenter. Full of still busy servers but just less of them.

Open source works just fine for this - take a look at geoacumen-country

https://github.com/geoacumen/geoacumen-country

Semi-related, there are some very cool converted datacentres in the UK.

The Bunker operates an underground datacentre out of a former military installation. Radar base if memory serves me. That’s definitely hardened from airplane attacks and I believe is used by some hyperscalers.

https://thebunker.net/wp-content/uploads/2026/02/The-Bunker-...

No idea, just answering the “Why not pick a location not within a "major airport flight path"? It seems much cheaper.” question.

London has lots of datacentres in Slough (near Heathrow) and Docklands (London City Airport, but also many LHR planes transit over).

AWS/Azure/GCP/etc Colo in Equinix/Telehouse datacentres there, and those Docklands locations in particular were picked based on location to LINX (major London peering/interchange), and LINX was put in Docklands out of desire for relatively proximity to telcos, and London’s banking/finance industry.

Thanks for the clarification. It’s a bit of a shame as going via ISE would have let the group move onto other endeavours. Maybe people will just refer to the draft name and that’s that.

DJB has orchestrated a vote rigging campaign against this WGLC, encouraging users to join the list and vote/express their opinion and providing the exact subject header to use. Have any other sides been saying, essentially, just join the group and say you’re for/against?

He’s been moderated during the last call because of his email disclaimer/footnote, and apparently refuses to respond on list during this time. Seems like he’s playing a few steps ahead where he can (yet again) cry foul on the system and cry foul on vote rigging. Despite him being a key instigator. I’ve already seen at least one poster reference a RFC explaining how IETF consensus works and how its not a pure numbers game (5 for and 100 against can still be consensus, depending on the circumstances; the inverse also applies).

What’s his next step if the authors publish as an information RFC? He can’t stop that, right?

I’m a passive observer on the same list and have been for at least several years. I don’t plan to comment on the WGLC currently going on… but I will be so extremely happy once the subject is done with.

It’s like watching a cybersecurity version of Dawsons Creek or The Young and the Restless or… Jerry Springer?! Insane

There used to be - probably still are - cameras that would digitally sign all their images. Used in crime scenes? Maybe we will end up seeing wider adoption of this, despite the privacy implications. Hackers attention then will focus (once again) on the certificate supply chain and crypto hardware.

There are some - albeit few - cars that tick most of this checklist.

MZS5 EV[1] checks most except the physical buttons, which is a half tick. There’s some physical buttons for some important things, but could do better. The previous model of had more buttons but essentially the same checklist-wise.

1. https://mgmotor.com.au/pages/mg-s5-ev

> Among software developers, and especially among those who work on security-sensitive systems, there is a well-known maxim: Don't roll your own crypto. This does not mean that nobody is allowed to write cryptographic code. Someone has to. It means that, for ordinary production software that protects sensitive data of users, we should not rely on a private, unreviewed implementation that has not been vetted by the wider software development community. We should use established, vetted software packages or tools wherever possible.

The great things about all these crypto libraries are:

- Minimal to no dependencies

- Coded by security conscious people

- Often externally audited

I wish more libs/deps are crafted like them. Until then the risk of rolling your own vs using a dep isn’t as different as it could be.

An eternal summer of CVEs is upon us

As a workaround, can Tailscale internally add multiple menu items and keep adding until one reports as visible?

Agreed. I suppose they could lookup based on your IP to pre-select a country (which you can still override if you need to aka VPNs and ordering from a different country), and based on that then ask for a postcode.

I agree.

20-something years ago, when I paid for my internet connection, I also got an email address (or 5…) and some personal web space (5MB maybe?) and access to their NTP servers as part of that. No ads.

Of course if I left the ISP I would lose access to it, as I stopped paying for it. I’ve long since left the ISP, and they’ve dropped all these value adds.

Presumably because people wanted cheaper plans and jumped to other providers which did internet access and nothing else.

There are people willing to pay a reasonable amount for fair services. I pay for various Google and Apple services, including for email. Those that don’t, have ads based plans.

Sounds like a bug in their css layout related to the smaller screen size

I see a white X in a blue box to the lower right of the modal. Is it that?

I don’t think it’s a silly question.

Before mobile phones, there were public phone booths. Along motorways there were often call boxes. There’s little to none of that anymore.

Also before mobile phones, if you had an accident in a remote area you were at the mercy of someone passing by and noticing you. Today, modern cars can call 911 on your behalf along with your location without you even being conscious. Or if you don’t have a car that does this, then your cell can be used. Let’s not also forget iPhones calling for help when they detect you had a fall at home.

Yes emergencies existed before mobile phones. I contend that the use of mobile phones has led to better outcomes when an emergency happens. I also admit mobile phones will have caused some of those emergencies (distracted driver etc).

No good when the upstream is some wifi connection provided by the building management, rather than a telco themselves.

May as well pick a single solution that works across all Internet connections and weird setups, be an expert in that, vs having to manage varying network approaches based on telco presence, local network equipment, operating country, etc.

On the later parts, VRF in my scenarios won’t scale.

Need to provide support access to 10k-50k locations all with the same subnet (industry standard equipment where the vendor mandates specific IP addressing, for better or worse). They are always feeding in data into the core too.

Much easier to just VPN+NAT.