profmonocle

5 ms·

1.
by profmonocle 2mo ago
A federal court, sure. But this was a state court ruling on a state law.
2.
by profmonocle 2mo ago
> It operates in Texas if it is serving Texas users. What do you mean "serves"? Does that just mean not actively blocking users from Texas? Allowing your web site to be accessible regardless of user location is, and always has
3.
by profmonocle 3mo ago
Replace "climb the social ladder and have power and influence" with "be able to afford a home, have kids, and go on vacation occasionally." It's become very difficult to have even a middle class lifestyle without a
4.
by profmonocle 4mo ago
Even if example.com is unsigned, the delegation from .com to example.com will still be signed (including an attestation that example.com is unsigned). So lack of DNSSEC adoption by users of the TLD wouldn't save them here.
5.
by profmonocle 4mo ago
It's not like the long-haul fiber not owned by FAANG is a public utility, at least not in most places. Traffic that goes over "the Internet" traverses some mix of your ISP's fiber, fiber belonging to some other ISP they
6.
by profmonocle 1y ago
Possibly naive question, why should Wikimedia do anything at all? Do they have a legal presence in the UK? If not, why not just say "we aren't a UK based organization so we have no obligations under this law" Let the UK block
7.
by profmonocle 1y ago
Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address
8.
by profmonocle 1y ago
I don't think OP was specifically stating we need to save these specific jobs, rather they were pointing out the interconnected nature of the economy. Less importing hurts the workers in those industries. Taking that further, it will
9.
by profmonocle 1y ago
I'm fine with this as long as they include the tariff in the listed price. I'm worried businesses are going to use tariffs as an excuse to have a fake list price, then hit you with massive hidden fees at the point of sale. Some se
10.
by profmonocle 1y ago
> 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts That's too generous. "Not your personal army" started because 4chan had a
11.
by profmonocle 1y ago
When the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was
12.
by profmonocle 1y ago
I would also say don't run ghostscript with the same permissions as the web server, especially not if you can just hand it your PDF through stdin and take a PNG through stdout. Sandbox it as much as possible. PDF is a really complex fo
13.
by profmonocle 1y ago
There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.
14.
by profmonocle 1y ago
In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to si
15.
by profmonocle 1y ago
Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary. Any system where the government
16.
by profmonocle 2y ago
Treating a proprietary API as a standard is risky - this is a good example of why. From Amazon's point of view there's no reason to keep the S3 SDK backwards compatible with old versions of the S3 service, because they control the
17.
by profmonocle 2y ago
Who is this actually for? It seems like most people who need private security need it on an ongoing basis, not just for a one-off thing. Even if the need arises suddenly (i.e. a stalker starts threatening a celebrity), it still seems like s
18.
by profmonocle 2y ago
Chrome launched their own root program a couple years ago: https://blog.chromium.org/2022/09/announcing-launch-of-chrom...
19.
by profmonocle 2y ago
And it's worth noting that you can't just ignore this problem if you're using websockets - websockets disconnect sometimes for a variety of reasons. It may be less frequent than a long-polling timeout, but if you don't h
20.
by profmonocle 2y ago
The next long-polling request can include a list of the ID(s) returned in the previous request. You keep the messages in the queue until you get the next request ack'ing them.
21.
by profmonocle 2y ago
The problem is people don't really see wage increases and inflation as things that balance each other out. They think of raises as something earned that will improve their lifestyle - when inflation cancels that out, it can feel like y
22.
by profmonocle 2y ago
> if LLM training involves merely reading a dataset, but it is not strictly necessary to copy, or even store it verbatim to be useful, then does it even fall under copyright protection at all? Copyright includes the creation of derivativ
23.
by profmonocle 2y ago
Would that matter if the company wants to do business in countries with more restrictive laws? I.E. if I wrote my own spin-off of a popular book series, which was somehow considered fair use in country A, but considered infringing in countr
24.
by profmonocle 2y ago
I'm honestly surprised that the US doesn't have a legal framework to force ISPs to block IPs / DNS hostnames. I've been expecting that for 10+ years now, but it hasn't happened.
25.
by profmonocle 2y ago
`sudo tcpdump port 53` says yes, they do use unencrypted DNS. AFAIK Chrome has a hardcoded list of DNS servers which offer encrypted DNS. I.E. if your DHCP server tells your PC to use 8.8.8.8, 1.1.1.1, 9.9.9.9, (or the IPv6 equivalents) it
26.
by profmonocle 2y ago
> As much hassle as things like DoH can be for securing and enforcing policy on a network, it’s about time it became ubiquitous enough that governments can’t leverage DNS for their own purposes anymore. A caveat of encrypted DNS is that
27.
by profmonocle 3y ago
I used Jira at my old job and didn't care for it. At my new job I have to use Procore half the time. I can't tell you how much I miss Jira.
28.
by profmonocle 3y ago
A particular .gov domain using Cloudflare (although from my DNS lookups, that one is not) is unrelated to Cloudflare managing the authoritative DNS servers for the .gov TLD. The fact that only a specific .gov domain - not all of them - has
29.
by profmonocle 3y ago
> registrar business They're the registry, not the registrar. CISA is the registrar for .gov domains, Cloudflare just handles the backend. (DNS and whois infrastructure) Government employees likely never see anything about Cloudflar
30.
by profmonocle 3y ago
They've just taken over authorative DNS. The captchas come from their CDN product.

More ›