hannob

There are reasons browsers do things the way they do.

Experience and user studies have shown that users have a hard time decoding what error messages mean. "This certificate is expired, but only for a little while" isn't meaningful for people who don't have a mental model of what a certificate is.

Furthermore, "downgrading" warnings increases the incentive to ignore issues, potentially causing more problems down the line.

My best guess would be some kind of netapp product, as we saw some self-signed certs on hosts that identified as netapp. But netapp didn't answer, and we got either no or no useful feedback from any of the certificate owners. So we ended up being unable to figure that out.

I'll probably share a list in some way soon and will try to ask the wider cryptographic and TLS community if anyone can figure it out.

My prediction would be that it won't become mainstream.

Even if it will be practically possible to build quantum computers for average users (given they currently rely on complex physical experiments, one can doubt that), there's the question of whether there's a need for "mainstream" quantum computing.

As has often been said, quantum computers aren't some magical thing that makes every computation faster. They are faster at some very specific problems like breaking cryptography (I doubt that there's a mass market for decrypting the old WIFI traffic you stored from your neighbor, and, these days, most internet traffic is already pq safe) and simulating physics (also probably not something average joe wants to do every day).

In all likelihood, quantum computers will be specialized devices used, e.g., by scientists. You may be able to rent your quantum computing time if that gets cheap enough to be practical, but I doubt many people will ever own one.

I would take this with a very huge grain of salt.

The only source seems to be a fringe right-wing news webpage (Apollo News) citing from an internal paper (which, it sounds to me, is just a vague proposal from a media oversight body). I have not seen any reports in major news publications, and would assume there's a lot of context missing in this reporting.

Historic bit: in the late 90s/early 2000s there was a bit of a trend - and quite some tension - of demoscene parties getting taken over by LAN parties. I believe the Gathering used to be a demoscene party, but completely transformed into a gaming LAN party.

There were also those that tried to be both (I believe Assembly is doing both to this day) or those that kept the gaming out (Mekka/Symposium, which no longer exists, but there's been a followup party called Breakpoint, and later another followup called Revision that still exists).

As far as cloud service servers are concerned, I don't think ARM CPUs have any meaningful marketshare, right?

You could start running things on ARM, but, almost certainly, that comes with a lot of extra friction. (Not saying that isn't a bad idea, it'd probably improve the ecosystem as a whole and flush out architecture-specific assumptions in server software. But it's not someting trivial to do.)

I think this one is among the most significant findings: https://factorable.net/

I also believe there were some android ASLR issues based on the same weakness (i.e., low early boot-time entropy).

But this is all quite old, and there've been massive improvements. Basically, "don't use a very old linux kernel" is your mitigation for these issues.

Making hydrogen from seawater is not an actual problem that needs solving.

The problem with hydrogen electrolysis is its energy requirements to split water. The energy requirements for the desalination of water before that is a rounding error. It's not worth the hassle to develop electrolyzers that can deal with seawater.

I know quite a bit about PKI and X.509, and I can tell you that much: the overlap with how DNSSEC works is limited.

Buy a pack of 20x500mg (just checked, common size in Germany), take 2-3 every half hour for a while.

Sure, that's extreme. But if you're unaware of the risks, you feel sick, and you believe it's helping you.

I mean, people aren't killing themselves in masses with it, but it happens every now and then. Easily imaginable that one in a few million people will have enough tendency to take more pills and is unaware of the overdose danger.

You're supposed to concatenate all the input numbers, to create a message that has hundreds or thousands of digits; then RSA-encrypt that number.

That's not how it works...

In modern protocols, you don't encrypt at all with RSA. You use a key exchange, and if you use RSA, you only use it as a signature algorithm to initiate the key exchange.

If you happen to want to encrypt with RSA, which you usually shouldn't, you first use a padding algorithm (the modern variant of that is called RSA-OAEP) with which you prepare and then encrypt a random key. That key you then use for symmetric encryption.

You're training users to click away error messages.

Has everyone lost their minds?

Clearly yes. (Ok, not everyone, but large parts of the IT and software development community.)

Well...

There's a long history of people trying to build software that detects bad software. It's known as Antivirus software. It doesn't work very well, because you're up against fundamental truths of computational theory (the halting problem).

Your understanding is entirely wrong.

Most hydrogen fueling stations receive it from the next steam reformer, which will make it from fossil gas.

If the rest of the world wants to still have an industry once we finally decide to seriously use green technology, they should quickly catch up to China - if that's still possible.

While China is still very reliant on fossil-fuels, and particularly dirty coal, they're at the same time working on dominating the post-fossil age at astonishing speed. After they already dominate solar and batteries, they're working on doing the same for a number of other future green industries. They are already dominating future technologies like Green Methanol that most people in Europe or the US have never heard of.

That can't be true, right? I mean, Google broke Adblockers in Chrome to prevent this very issue. And it had absolutely nothing to do with Google's Ad business.

So it's completely impossible that such malicious extensions still exist.

(may contain sarcasm)

So their leatherboard of good examples lists nsa.gov with 100 points.

Is this a parody?

I used to create a number of simple web pages in XHTML back in the days when we believed XHTML was the future. Recently, while going through and restructuring some of my old "online stuff", I learned that XHTML really isn't in a state that I'd want to use it any more:

* XHTML 1.0 and 1.1 are officially deprecated by the W3C.

* XHTML5 exists as a variant of HTML5. However, it's very clear that it's absolutely not a priority for the HTML5 working groups, and there's a statement that future features will not necessarily be supported by the XHTML5 variant.

* XHTML5 does not have a DTD, so one of the main advantages of XHTML - that you can validate its correctness with pure XML functionality - isn't there.

* If you do a 'view source' in Firefox on a completely valid XHTML 1.0/1.1 page, it'll redline the XML declaration like it's something wrong. Not sure if this is intended or possibly even a bug, but it certainly gives me a 'browser tells me this is not supposed to be there' feeling.

It pretty much seems to me XHTML has been abandoned by the web community. My personal conclusion has been that whenever I touch any of my old online things still written in XHTML, I'll convert them to HTML5.

Okay, story time: back in 2018, the German government's foreign ministry was hacked.

At the time, a colleague of mine (we were both working for the German IT news magazine Golem) found a web page by a government-associated university that was offline with a message that it's been taken down due to a security issue.

Putting a few hints together, we figured out that Ilias was hosted therer, and that this was how the attack on the government initially started.

We weren't able to figure out which vulnerability was used, but had some ideas what it might've been. (Older versions had a default password for the admin account.)

One wonders: there's an Open Source software that's widely used by universities, even by government-associated universities. It's been the cause of a high-profile attack on a government before. One wonders why that doesn't trigger sufficient funding for regular, high-quality security audits of that software.

Article from 2018: https://www.golem.de/news/government-hack-hack-on-german-gov...

I'm certainly a lay person here, so take this with a grain of salt. But my understanding is that this is part of the problem, or more the issue that people criticize.

I think it's largely uncontroversial that the math in string theory could be useful in other areas. But if that's your argument for the legitimacy of string theory then the question arises what string theory is and if it is still part of physics. Because physics has, of course, the goal of describing the real world, and, my understanding is, string theory failed to do that, despite what many people have hoped.

If string theory is "just a way of developing math that can be useful in totally unrelated areas", it's, well, part of mathematics. But I don't think that's how the field sees itself.

You need an extra tool to download your own photos? That's... not a basic feature?

I'm always surprised what kind of antifeatures people in Apple land are willing to accept and still use those things...

True, but the same is true for therapy. Finding a good therapist isn't easy, and having depression certainly doesn't make it easier.

Where would that come from? It's not that we have some large untapped Oxygen or Nitrogen source laying around that is not part of the atmosphere.

They don't, and they can't cheat physical realities either.

Plants only filter out very small amounts of CO2 from the air over relatively long timeframes. That's why crop-based biofuels require such enormous amounts of space.

Yeah, but there's a plausible explanation for this: Likely, people who get vaccinated also are more likely to do other things to improve their health.

It looks like the shingles vaccine has positive effects that prevent dementia. (Well, that's in the title.)

This study was possible due to a "natural experiment" where one country gave people from a very specific birth date the vaccine (so people born right before and right after that date were very similar, except for the vaccine).

It's not clear why this is the case. It might be that the virus the vaccine supresses plays a role in dementia development, or it might be that the vaccine causes an immune response that has other indirect positive impacts.

I found the intro very confusing, tbh.

Particularly the "no increased risk of all-cause mortality". I mean, if we assume the vaccines worked, we'd certainly expect a decreased risk of all-case mortality (because "all-case mortality" certainly includes "covid mortality"). Reading "no increase" seems to imply "it doesn't change anything". Yeah, technically, the sentence does not say that ("no increase" can mean "no decrease" or "no change").

You have to read further below to get what should be the real message on all-cause-mortality: "Vaccinated individuals had [...] a 25% lower risk of all-cause mortality". I think that should've been in the first 1-2 sentences.

Counterpoint: XML is a horrible format.

Why? Answer this question: how can you use XML in a way that does not create horrible security vulnerabilities?

I know the answer, but it is extremely nontrivial, and highly dependent on which programming language, library, and sometimes even which library function you use. The fact that there's no easy way to use XML without creating a security footgun is reason enough to avoid it.

Oh, great, they found another way to power energy-hungry chatbots with inefficient fossil fuels.