• 0 Posts
  • 19 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • You can vote from overseas in whatever location was your last permanent US residence.
    People in DC get to vote for president because a special law was passed giving them electoral votes.

    People in Puerto Rico have a US permeant residence that doesn’t let them vote for president, so they can’t legally vote from a different jurisdiction.
    One of the proposals that’s come up occasionally is to make a similar law for Puerto Rico as we did for DC, but there’s never enough consensus on any plan to go forward, up until relatively recently.


  • if you technically pull people out of poverty by outsourcing to the lowest paying, least labor regulated parts of the world, is the fact that extreme poverty went away in those areas even a good thing?

    Yes. Your prospects of a healthy life increase when going from not being able to provide for yourself to being barely able to provide for yourself by working in fantastically poor conditions.

    If a sweatshop didn’t provide more worker value than extreme poverty, people just wouldn’t work there.

    The bare minimum of improvements is still an improvement, and that we should strive for better than the bare minimum doesn’t make the bare minimum worthless to the people who got it.





  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.





  • So, you’re correct that active emergencies take priority.

    That being said, in essentially every place that has 911, both numbers connect to the same place and the only real difference is pick-up order and default response.
    It’s the emergency number not simply because it’s only for emergencies but because it’s the number that’s the same everywhere that you need to know in the event of an emergency.

    It should be used in any situation where it should be dealt with by someone now, and that someone isn’t you. Finding a serious crime has occurred is an emergency, even if the perpetrator is gone and the situation is stable.
    A dead person, particularly a potential murder, generally needs to be handled quickly.

    It’s also usually better to err on the side of 911, just in case it is an emergency that really needs the fancy features 911 often gives, like location lookups.




  • Attributing loosing or making preposterous strategic mistakes to some sort of 5D chess is a weird choice to make.

    I don’t know why so many of you people have such a hard time accepting that the popular conception of Russia as an Eastern counterpart to the US was inaccurate. Turns out that if you consistently invest less in your military equipment and personnel, you have a less capable military. It’s been 40 years since their expenditures have been comparable, and quite frankly it shows.

    Using your old equipment for an invasion would actually be a pretty novel strategy. Ukraine consistently used the best equipment available to them. That that was leftover NATO hardware doesn’t mean Ukraine was choosing to hold the good stuff in reserve.

    If they’re trying to use a “let the reservists die and then send in the competent soldiers” strategy, it doesn’t seem to be going very well. They’re somehow not holding the territory they took very well, and churning through a lot of what was presumably reserve hardware.

    Failing to execute a gulf war 1, and so deciding to chill in a Vietnam situation for … Some reason … for an indeterminate period of time is just not a strategy that any sane strategist would pick.

    If Russia has the ability to just handwave their way to victory if things got too rough, they’ve done a pretty terrible job of demonstrating it.
    I honestly can’t comprehend what you might have seen of this whole affair that would make you think they had that ability, beyond clinging to the notion that a former superpower must still be a superpower.
    They just don’t have the economy or the equipment to be able to afford to burn through endless waves of soldiers like you seem to think they’re intentionally doing.
    They didn’t even get air superiority, which is just embarrassing.



  • An all out war is unlikely, since if NATO involvement was going to kick that off it would have done so by now.
    The next point of escalation that could start something bigger would be stuff like NATO openly sending troops or actively providing fire support.

    US hesitation to allow our hardware to be used for this type of attack is much more to do with the political issues surrounding the war being framed as a proxy war instead of defensive support.
    The electorates support for “saving the day” and “superior US hardware helping keep a country free” is high. Support for a protracted and complex proxy war without clear right and wrong sides is exhausting and hits too many Iraq/Afghanistan buttons for people to care.

    Asking for and publicly being denied permission to bomb targets adjacent to the capitol does just as well at communicating “we can bomb your capitol” as actually doing it.


  • There seems to have been some policy miscommunication between political and military parties of both nations.
    The US has maintained that the restrictions have been to not allow offensive use, or specific long range missiles for targeting well inside Russian territory.
    Ukraine understood this to mean using them to fend off an attack, and only targets within a specific distance from the border.
    In the past few months it seems that much of this has been clarified, and Ukraine is now using US munitions for a proper US “preemptive defensive action inside enemy territory”, because a Russian base in Russia is full of Russian soldiers who will be ordered to attack, therefore an attack is defensive.

    If it was an actual miscommunication or a pivot is unclear, but the US language seems to have not changed, and a policy that acknowledges that almost anything Ukraine does in this war is inherently defensive is much more reasonable.



  • In this case, it’s really not a Linux/windows thing except by the most tenuous reasoning.

    A corrupted piece of kernel level software is going to cause issues in any OS.
    Cloudstrike itself has actually caused kernel panics on Linux before, albeit less because of a corrupted driver and more because of programming choices interacting with kernel behavior. (Two bugs: you shouldn’t have done that, and it shouldn’t have let you).

    Tenuously, Linux is a better choice because it doesn’t need this type of software as much. It’s easier and more efficient to do packet inspection via dedicated firewall for infrastructure, and the other parts are already handled by automation and reporting tools you already use.
    You still need something in this category if you need to solve the exact problem of “realtime network and filesystem event monitoring on each host”, but Linux makes it easier to get right up to that point without diving into the kernel.
    Also vendors managing auto update is just less of a thing on Linux, so it’s more the cultural norm to manage updates in a way that’s conducive to staggering that would have caught this.

    Contract wise, I’m less confident that crowd strike has favorable terms.
    It’s usually consumers who are straddled with atrocious terms because they neither have power nor the interest in digging into the specifics too far.
    Businesses, particularly ones that need or are interested in this category of software, inevitably have lawyers to go over contract terms in much more detail and much more ability to refuse terms and have it matter to the vendor. United airlines isn’t going to accept the contract terms of caveat emptor.