Yep, but the certs.pem file only contains the root and does not know anything about intermediates. So the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is…
The issue might be Root CA vs intermediates. The root CA that eMudhra rolls upto may be used for other intermediates which were not compromised or revoked. Removing the root CA will mean that these valid certificates no…
Being pedantic, the risk/benefit of remote perspectives are theoretical and dependent on the destination network also having multiple independent links. Otherwise any “uplink” ISPs are all SPoF regardless of anything…
I don’t think looseness is always more comfortable. You need looseness in the right areas which is what tailoring provides. Maybe it’s cold and the extra airiness is working against you. Maybe the clothes rustle and rub…
I didn’t like the article because all of the missing defense-in-depth necessary to prevent the intrusion is firmly in the category of traditional cyber security. I could sympathise with an argument about organisational…
I think (for now), it is still relevant. A language is an abstraction, and a good abstraction, like a good LLM harness, can be quite valuable. Let’s say I’m writing some concurrent code with an LLM. I’d probably feel…
Oops should have RTFA before commenting, I thought the CNAME was only to your servers.
Out of curiosity, how is MPIC relevant? Not that familiar with it, but CNAME would resolve to your server regardless no?
Yeah, I don’t think it assumes zero knowledge, which is what I’d expect from a “first programming language” book. But it does say it’s targeted more for an “algorithms” course in the introduction. As a side note, I…
I think it’s more of a time vs code tradeoff, if done properly. For example in the Vec case, you could theoretically build an alternative which encodes the “three sections” property internally, and ensures correctness…
The existing, human standards are based on human capabilities. Humans may not have read all the papers that could be cited. However, all these papers are almost certainly in the AI’s training set and it potentially has…
Do you have source for IWF funding being by big tech? Haven’t found anything that breaks their funding down by source and the majority on the UK govt site is from “charitable activities”…
Anycast DNS doesn’t mean what you think it means. Your DNS traffic to Cloudflare is routed via anycast. If Cloudflare is sending this DNS query (eg to an authoritative DNS server), the IP address it uses for this is not…
Putting aside the WASM sandboxing (I’m not familiar enough with it to understand how sandboxing works) there’s a DoS vector at least. Even regexes have had many DoS issues, and I can’t imagine WASM being easier to…
There’s a big difference in the expected use of a file. If the file is attacker provided, and the fallback path is being used, the attacker can embed whatever WASM payload they want into the file since the file will be…
Providing access to the data is easy. It is just an MCP or equivalent, and coding such CRUD is cheap now. Applying the actions is unsolved. Unless you YOLO the LLMs, taking stateful actions automatically requires a lot…
If your goals were fame, then yes. But you can still pursue excellence even if there is an alternative “easy” path. The equivalent is something like hand tool woodworking - it’s still a thing despite the advent of…
UK has never had net neutrality, there are many limited data phone plans that include unlimited music/video etc
I think I read somewhere (but could be wrong) that it was because they didn’t want to own any “authentication” services. Their infrastructure was zero trust (as in they don’t hold any passwords or private keys), just a…
Making it explicit wouldn’t be particularly problematic no? Option<&Spouse> in Rust terms. Or for this specific case, a GADT (Single | Married<&Spouse>)? It could even use a special “NULL” address. Just don’t pollute…
Pure CS is not necessarily equivalent to pure maths. For the “science” bit of CS, you do need to do the equivalent of experiments (for more applied topics). For example, a physics degree is expected to have experiments.…
Changing the links and doing nothing else would be a pretty dumb MITM. You could do a more complex variant which is not so easy to spot (targeting specific networks, injecting malware whilst modifying the checksum) The…
I find it interesting that they bought Astro (https://blog.cloudflare.com/astro-joins-cloudflare/), which from my definitely-not-a-frontend-person perspective seems to tackle a similar problem to Next. A month ago. If…
You can make it so employees don’t have ambient access to data, and require multi-party approval for all actions that require user data. Giving away a user password should be treated as a routine risk. I’m not saying…
It doesn’t have to be a compile time constant. An alternative is to prove that when you are calling the function the index is always less than the size of the vector (a dynamic constraint). You may be able to assert…
Yep, but the certs.pem file only contains the root and does not know anything about intermediates. So the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is…
The issue might be Root CA vs intermediates. The root CA that eMudhra rolls upto may be used for other intermediates which were not compromised or revoked. Removing the root CA will mean that these valid certificates no…
Being pedantic, the risk/benefit of remote perspectives are theoretical and dependent on the destination network also having multiple independent links. Otherwise any “uplink” ISPs are all SPoF regardless of anything…
I don’t think looseness is always more comfortable. You need looseness in the right areas which is what tailoring provides. Maybe it’s cold and the extra airiness is working against you. Maybe the clothes rustle and rub…
I didn’t like the article because all of the missing defense-in-depth necessary to prevent the intrusion is firmly in the category of traditional cyber security. I could sympathise with an argument about organisational…
I think (for now), it is still relevant. A language is an abstraction, and a good abstraction, like a good LLM harness, can be quite valuable. Let’s say I’m writing some concurrent code with an LLM. I’d probably feel…
Oops should have RTFA before commenting, I thought the CNAME was only to your servers.
Out of curiosity, how is MPIC relevant? Not that familiar with it, but CNAME would resolve to your server regardless no?
Yeah, I don’t think it assumes zero knowledge, which is what I’d expect from a “first programming language” book. But it does say it’s targeted more for an “algorithms” course in the introduction. As a side note, I…
I think it’s more of a time vs code tradeoff, if done properly. For example in the Vec case, you could theoretically build an alternative which encodes the “three sections” property internally, and ensures correctness…
The existing, human standards are based on human capabilities. Humans may not have read all the papers that could be cited. However, all these papers are almost certainly in the AI’s training set and it potentially has…
Do you have source for IWF funding being by big tech? Haven’t found anything that breaks their funding down by source and the majority on the UK govt site is from “charitable activities”…
Anycast DNS doesn’t mean what you think it means. Your DNS traffic to Cloudflare is routed via anycast. If Cloudflare is sending this DNS query (eg to an authoritative DNS server), the IP address it uses for this is not…
Putting aside the WASM sandboxing (I’m not familiar enough with it to understand how sandboxing works) there’s a DoS vector at least. Even regexes have had many DoS issues, and I can’t imagine WASM being easier to…
There’s a big difference in the expected use of a file. If the file is attacker provided, and the fallback path is being used, the attacker can embed whatever WASM payload they want into the file since the file will be…
Providing access to the data is easy. It is just an MCP or equivalent, and coding such CRUD is cheap now. Applying the actions is unsolved. Unless you YOLO the LLMs, taking stateful actions automatically requires a lot…
If your goals were fame, then yes. But you can still pursue excellence even if there is an alternative “easy” path. The equivalent is something like hand tool woodworking - it’s still a thing despite the advent of…
UK has never had net neutrality, there are many limited data phone plans that include unlimited music/video etc
I think I read somewhere (but could be wrong) that it was because they didn’t want to own any “authentication” services. Their infrastructure was zero trust (as in they don’t hold any passwords or private keys), just a…
Making it explicit wouldn’t be particularly problematic no? Option<&Spouse> in Rust terms. Or for this specific case, a GADT (Single | Married<&Spouse>)? It could even use a special “NULL” address. Just don’t pollute…
Pure CS is not necessarily equivalent to pure maths. For the “science” bit of CS, you do need to do the equivalent of experiments (for more applied topics). For example, a physics degree is expected to have experiments.…
Changing the links and doing nothing else would be a pretty dumb MITM. You could do a more complex variant which is not so easy to spot (targeting specific networks, injecting malware whilst modifying the checksum) The…
I find it interesting that they bought Astro (https://blog.cloudflare.com/astro-joins-cloudflare/), which from my definitely-not-a-frontend-person perspective seems to tackle a similar problem to Next. A month ago. If…
You can make it so employees don’t have ambient access to data, and require multi-party approval for all actions that require user data. Giving away a user password should be treated as a routine risk. I’m not saying…
It doesn’t have to be a compile time constant. An alternative is to prove that when you are calling the function the index is always less than the size of the vector (a dynamic constraint). You may be able to assert…