• 0 Posts
  • 22 Comments
Joined 2 years ago
cake
Cake day: June 30th, 2023

help-circle



  • The issue is big companies.
    Google/Amazon/Microsoft can now fork sudo-rs and not have to upstream their changes.
    So then Google fixes an exploit for their sudo-rs implementation (or whatever software) and patch it under a different licence. Now the upstream, Amazon and Microsoft forks don’t know if that exploit is also in their implementation, is related to their implementation, or how to potentially fix it.

    The only way it works is if sudo-rs is implementing new features in a way that it benefits Google/Amazon/Microsoft to contribute back to upstream so they don’t have to keep merging/fixing their exploit code.

    For something as stable as sudo, it actually benefits Google/Microsoft/Amazon NOT to share their changes.
    If they are rolling and recommending their own distros (which I’m sure they already are) that include their forked changes, then they can say that their software is more secure than other brands. It benefits them for their competition to suffer security breaches, especially if they trace back to these kinda changes.

    Which makes everything worse for everyone.


  • Your threat assessment is way off.
    So, you import a phone. What sim do you use? Where do you use it? When do you use it? Who do you contact with it?
    All of that is more valuable and easier to get for the police than some sort of modification of firmware or platform as it passes through customs.
    If in doubt, flash your own firmware.

    If this is actually a threat assessment to you, asking on Lemmy is the wrong place. You need people with the same experience that an entire country has at their disposal.

    If it’s a concern as opposed to an actual threat, buy some 2nd hand phones from random places and buy some prepaid sims (ideally via smurfs or black market means). And be aware of how you use them




  • Years ago, I played with AWS then contacted their support to make sure any AWS billing to my account was disabled.
    I thought I’d try it again recently, and couldn’t log in.
    I still don’t think I’m missing anything.

    I’d rather have VPS or server providers where I know exactly what I’m getting per month no matter what, tho I’ve ran near data transfer surcharges.


  • Oh, it’s expected costs.
    Like, figure out the compute requirements of your code, multiply by the cost per compute unit (or whatever): boom, your cost.
    Totally predictable.
    Compared to suddenly having to replace a $20k server that dies in your data center.
    So much easier.

    Except when your code (let’s be honest, the most likely thing to have an error in it… At least compared to some 4+ year old production hardware that everyone runs) has a bug in it that requires 20x compute.
    But maybe that is a popularity spike (the hug-of-death)! That’s why you migrated to the #cloud anyway, right? To handle these spikes! And you’ve always paid your bills so… Yeh, here’s a 20x bill.


  • The amount of software that is limited free self-hosted but the next tier of “self hosted” is enterprise and thousands per year is ridiculous.
    Absolutely ridiculous.

    Like, you have self hosted. I like your software, I use it personally and that’s why I’m using it for (and recommending it to) small businesses. They could afford your 10-100 per month for whatever extra features, but they don’t want to rely on 3rd party hosting. They want to host it themselves.
    But the only way to get those features is to go for some “cloud” bullshit they don’t control, or to pay “enterprise” prices.

    It’s why I make part of what I make/charge a contribution to the products and projects I use and recommend.
    I’ll set all that up and tailor it to your company, but anything and everything I recommend/implement is standing on the shoulders of giants. So pay those giants.
    Although I think I’m lucky with the people I work for, in that that are interested in the tech, but not the detail.


  • Such a framework for a government to properly adopt FOS software would require provisions against a “bad government” controlling said software.
    Just because the US is plummeting into a political nightmare doesn’t mean the EU couldn’t do the same I. 20-40 years.

    Such a framework of governments moving from Microsoft/Google/Amazon/Cloudflare/Whoever to a FOSS equivalent should require the target Foss platform to be run by an independent non-profit that cannot be politically influenced.

    But I have no idea how to actually future proof that from corruption. Because money talks, and billions can buy so much influence in so many unexpected places



  • Autopilot crashes?
    You mean MCAS (Maneuvering Characteristics Augmentation System)?
    It’s not autopilot. It’s worse than that.

    Due to the larger engines needing to be mounted in a different place, the flight characteristics changed between previous gen 737s and the new 737 MAX.

    The characteristic change would mean it needs different certification from air authorities and existing 737 pilots would require recertification to be able to fly the new 737 MAX (which is supposed to be just an updated model).
    All very expensive for what should be merely an upgraded model.

    To avoid this, Boeing used software to change the characteristics in order to bring it inline with previous 737s and the existing certifications.
    And as it was just an augmentation system, it was deemed high risk but not critical risk. As such, it didn’t require full redundancy, didn’t require Quick Reference Handbook entries incase of issues/errors, and didn’t require training.
    In fact, pilots had no idea it existed, what it could do or how it worked.

    Which means when it had an issue and caused extreme pitch down due to faulty sensor readings, the pilots had literally no idea what was happening as they were trying to stop the plane from accumulating pitch down every 5 seconds.

    And then Boeing tried to fuck with the narrative. I think they also didn’t tell pilots about MCAS until after the Ethiopian Airlines crash (the 2nd caused by MCAS), but I’m not 100% sure on the timeline.

    Boeing has had a stream of QA issues, the way MCAS was handled was idiotic, they are a shitty company.

    But I have no issues flying in a Boeing.
    I don’t like or trust the company, but I trust the air authorities. And most of all, I trust the pilots.




  • “The United States has unilaterally and repeatedly provoked new economic and trade frictions, exacerbating uncertainty and instability in bilateral economic and trade relations,” the statement said. “Instead of reflecting on its own actions, the United States has groundlessly accused China of violating the consensus, a claim that grossly distorts the facts.”

    That is such a wonderfully diplomatic way of saying “stop being a fucking idiot, your words have meaning and these are the consequences. Grow up”.
    Even just “grow up”, tbh.

    As much as I dislike the amount of reliance the world has on China (for the labour conditions there, the nature of their government to impose dodgy practices, generally speaking not being a “good egg”), China seems like the only trading bloc (although not a bloc, I guess… Maybe “trading entity”) that can unilaterally stand toe-to-toe with TACO and win. So, good on china.