HN user
CISO & Security Product Leader.
You are assuming quality applicants are evenly distributed in terms of time of application - they aren’t. If you cut off at 100, you will only get a sample of people spewing fully automated application bots which mostly aren’t what you want.
I built something like this a long time ago. I actually used a FUSE filesystem to present a file interface to the calling application, then a policy engine to determine who could access the file and what the contents were. The FUSE driver could also make callouts to third party APIs (my example was the OpenStack key manager - barbican), but could just as easily be 1Password or something similar.
Man, you have a love of arguments to authority. Just saying that everyone else thinks something isn't an argument and condescending to everyone isn't compelling, especially when you are incorrect.
US definition of critical infrastructure includes Communications (https://www.cisa.gov/topics/critical-infrastructure-security...).
The EU lists digital infrastructure as well - https://home-affairs.ec.europa.eu/policies/internal-security....
Two seconds. That's how long that took. It _is_ strategic infrastructure and is declared so by everyone with expertise and authority. Since there are plenty of examples of wars caused by damaging / interrupting infrastructure - see any sort of blockade, you would lose that bet.
People and countries go to war for lots of reasons - sometimes even pigs (https://en.wikipedia.org/wiki/Pig_War_(1859)).
You have a reasonable argument on the basis of proportional response. I don't buy it, but it is a think that people can have a reasonable discussion about. If you engage in that discussion in good faith and stop condescending to everyone, you might have a better time and actually learn something.
This is...not true. Attacking key infrastructure is an act of war. Just because they try to do it secretly doesn't change that fact. 'Grey zone' tactics doesn't make any difference here. Green men, intel services, etc. are still government entities acting at the behest of the leadership to commit acts of war.
The argument here is about appeasement or not. If you allow continued acts of war to pass without response, you get more of them. This is the lesson of bullies from the playground to WW2. I'm more than willing to have a conversation about what sort of response is the best, but saying that Russia is not a warmonger is incorrect - they are committing acts of war. Just because no one has called them on it yet doesn't make it not warmongering.
This doesn't seem that useful? Svalbard would require significant, continued supply. Unless the Russian navy is able to own the Barrents Sea, any force on Svalbard could just be waited out. Once the diesel is out, the defenses go down and they freeze. Not to mention that it is well in range for medium range ballistic misses from Greenland, Iceland and the Nordics.
~70% of desktop computing today is performed on MS devices (https://gs.statcounter.com/os-market-share/desktop/worldwide). Virtually all of that 70% is done on a paid operating system (mostly OEMs as you noted). While I think that it has been clear that we are moving to a free OS model since the Apple revival (iPhone driven, not desktop) the speed of this change is slow. There is no point in MS trying to rush it as they would just cannibalize what is still a ~$24B business for them.
How easy it is to steal something isn't really a good measure here. First, the vast majority of MS customers can not find a script on GitHub and run it and most don't have a desire too. MS is likely willing to live with some level of piracy as stamping it out would cause larger revenue loses than accepting it. That doesn't tell us anything about their strategy or the market.
As to the OEMs, MS is essentially doing what you suggest and offering a tiered model. If you buy Windows yourself at full price, then you can re-install it, change hardware, etc. If you get it through an OEM (where MS is selling that license at a massive discount) you don't have those rights. I'm not saying I love these choices - especially the BS about limited installs and hidden licenses - just that the choice does exist. (We can have a reasonable argument about the Windows tax - less important now, but still a thing).
If we're right about the future, MS has to replace that $24B somehow. Their current plan is services so they need to tie MS users to MS services and monetize those. In this case, it seems that MS doesn't believe that there are enough folks like you who are willing to pay > $100 for a license so they are pursuing this path.
Good news is - unlike the 1990's, we have multiple, credible alternatives so you can pick non-Windows systems.
Because the writing has been on the wall that people are no longer going to pay for operating systems. That means that MS has to replace all that Windows revenue with services revenue. Apple has already done this in that their services revenue now account for $100B annually (https://www.statista.com/chart/14629/apple-services-revenue/) and MS doesn't have a hardware business to rely on as Apple does.
I'm sure MS sees a future where Windows is free and if you don't have an account, they can't monetize you at all. At that point, you are no longer a customer so there isn't much point in them continuing to support you.
Pretty sure those services are only for transferring data into S3, not out.
8% of revenue in perpetuity seems like a licensing deal, not payment for services. WP is arguing that they don't need a license deal to deliver their service which seems to be true? Therefore, the 8% just seems like a shakedown to get money - good old blackmail.
Did you read the PDF? WP Engine answers this - quote below. They employed (or used to employ) WordPress core contributors and have spent lots of money in the community. It's not 'Matt's Product' but an open source code base supported by a large community.
=== Quote ===
Contrary to Mr. Mullenweg’s statements that WP Engine does not contribute to his narrow and self-serving definition of the WordPress community, WP Engine has been deeply dedicated to advancing the use and adoption of WordPress through innovation, investment, and active community involvement. WP Engine has contributed tens of millions of dollars in ongoing support for the broader community through events, sponsorships, and the development of educational resources, including sponsorship of WordCamps worldwide and producing DE{CODE}; educating and empowering the WordPress community through content like the WordPress Roundup and the Building WordPress series; hosting, funding and actively maintaining multiple Open Source projects (e.g., ACF, WPGraphQL, faust.js) within the ecosystem used by millions of websites around the world; and producing informative webinars, podcasts, and tutorials. Even considering Mr. Mullenweg’s incorrect statement that contribution is only based on hours worked and contributors to Five for the Future, Mr. Mullenweg falsely stated that WP Engine is failing on this metric. In reality, WP Engine is ranked 30 out of 189 in hours contributed and 16 out of 189 in contributors, significantly outpacing multiple other contributors relative to our revenue.
=== End Quote ===
Blackmail is not okay - even if what he argues is true. He could have just done his presentation as he wanted and, as long as his claims are actually true, he wouldn't have had any trouble. Instead he tried to Blackmail a company into giving his FOR PROFIT COMPANY money. This wasn't about supporting WordPress, this was about rent seeking for his own organization.
Narrative Bias: https://en.wikipedia.org/wiki/Narrative_bias is pretty close.
The Cost and Usage Report (CUR) from AWS is just a fine-grained listing of all the resources in your account and their cost. It can be dumped out on different schedules (hourly, daily, monthly) and in different formats (CSV, Parquet).
It is pretty common to configure the CUR files to be dumped into your S3 account and query them via Athena. Athena is billed as $ per TB scanned ($5 last time I looked), so the cost will be based on how often the data is being queried. Downside is that each query can take quite a while to execute depending on data size.
The other common option is to ingest the CUR data into Redshift which gives you better control / options for performance, manipulation, etc. but requires that you set up and manage Redshift.
Hard to tell exactly what the Athena cost here would be as it depends on the number of assets in the account and the frequency in which you are querying the CUR. However, you can issue quite a bit of Athena queries on CUR data for most AWS use cases without incurring too much cost. Unless you have a rapidly changing environment (e.g. hundreds of k of assets turning over daily) or just tons of standing assets, you should be safe to assume hundreds a day at the most? Probably much less for most use cases. This is assuming they are querying once and storing rather than real time querying all the time and normal usage patters, etc.
Undecided did a couple of videos on this technology. It seems quite useful for heat storage - as other commenters have noted, it isn't that efficient for pure electric <-> electric storage.
* How a Sand Battery Could Change the Energy Game - https://www.youtube.com/watch?v=G6ZrM-IZlTE
* Sand Batteries for Home Usage - https://www.youtube.com/watch?v=KVqHYNE2QwE
Second sentence in the linked GitHub:
While SQLite supports the special filename :memory: that allows the creation of databases in memory, there is no built-in way to populate such a database using raw bytes without hitting disk as an intermediate step. This virtual filesystem overcomes that limitation.
I'm guessing both have ways for non-profits to take donations without the normal 30% cut. Here's Apple's program: https://developer.apple.com/apple-pay/nonprofits/
Not the OP, but I assume they mean the requirement by society on how well individuals conform to the expectations of that society. In high compliance societies, individuals are ostracized / punished for non-conformance - think atheists in a religious society. In low conformance societies, individuals are able to maintain a high level of privacy or society is more tolerant of divergence.
Once a company starts selling ads, privacy is no longer in their interest. Even paid customers will get lumped in to monitoring and reporting to satisfy / push up ad revenues.
Victim blaming here isn't really very helpful. Cars should be designed with an eye towards how they perform in an emergency. There is a reasonable case that Tesla didn't do that. As an owner of a Model 3 now, it is concerning to me how I would get out of the car if the electrics fail as exiting requires a button press controlled by a computer.
Most people don't have a hammer / seat belt cutter. It is not a required piece of equipment. People aren't trained in its use. There is no expectation that a standard driver (at least in the US) should be able to use this tool. This is Tesla's issue, not the drivers.
In many situations (daycare, elder care) the caregivers are by no means strangers. My 2 year old spends as much or more time with her daycare teachers and classmates than she does with my wife and I.
They love her and she loves them. Just because they aren't blood doesn't mean they don't play a huge part in her day to day experience and growth. In fact, they play a much larger part in her world than her grandparents or other family that she only sees several times a year.
It feels to easy to dismiss these folks as 'not as good as family' when, at least in my experience, they are much more than just paid baby sitters.
I can't read the article (paywall), but in general - you can't. E&Y (and the other audit firms) have very real conflict rules that prevent audit customers from using advisory services and vice versa.
In fact, we went down the road in building out an offer that would have worked with one of the firms and we abandoned it because it was so painful to just determine if they had a conflict and then we would lose the customer if they did.
I got the 500 version based on this article from Wirecutter. Works well, but does require that we leave the door open for a while to let the plastic dry. Silent though. Most of the time, I can only tell it is running by the light on the ground.
https://www.nytimes.com/wirecutter/reviews/the-best-dishwash...
Yes. Many of the privacy and data protections are not based on where the data is stored, but rather where the people who provided that data reside. For example, GDPR (an EU regulation) applies to US companies with data in the US, but only if the data they are storing belongs to EU customers.
I get the resistance to whitewashing, but the terminology of 'processing' seems more accurate. Killing the animal is only the beginning of the process and is generally the least time intensive. Properly butchering an animal while maintaining food safety, producing the proper cuts, etc. is a process that requires tooling and expertise.
I would hope that everyone understands that creating a final meat product involves killing, but we shouldn't trivialize the process requirements just to drive an emotional point home.
It's a customer protection method. Most cryptominers are not using accounts they pay for. They compromise customer accounts and spin up resources. If you aren't proactive about communicating this to customers or blocking it, it can be quite some time before the customer notices and almost all customers will request a refund - even when the attack is a compromised password / successful phish on the customer's side.
Additionally, all cloud providers operate on various models of over-subscription. It is not in anyone's (customer / provider) interest to allow the full consumption of resources when the activity is fraudulent.
As you can see in the post-mortem, they are fine with the usage. They have a process and flag to allow legitimate customers to use their resources. However, based on previous experience at another cloud provider, I would bet that over 90% of those automated hits are correct.
This was bad support. They know that and they seem to be making the right moves to fix it. Fraud is bad for everyone and has to be combated. Not doing so can raise prices and kill a business like DO. I'm sure they feel awful that a customer was so poorly impacted, but the error wasn't in the first ban, it was everything after that.
That's generally true in the states, but it is even worse. You as the patient don't see the actual price before the procedure (unless you ask). After the work is done, you then get a statement saying how much the procedure cost, what your insurance paid and what you owe. All those numbers are opaque and negotiable. Even better, it is common for insurance and the provider to continue sending you bills for months after even common procedures like child birth. It's a total mess.
Their hardened images are fine but there are two issues. First, you'll need to test / dev with them as full implementations of CIS can break things (though not as bad as the STIGs) and, IIRC, they charge extra for you to use their images on public clouds.
It really doesn't. All it does is allow you to cut the line. I love Clear, and I use it all the time, but it doesn't make security faster, it just makes it faster for you. If everyone was enrolled in Clear, security would take exactly the same amount of time.
Or it could be the reason they've said they did it - this was a primary vector for malware authors to compromise user's information and devices. Not everything is a conspiracy.
Sounds similar to Repose (http://www.openrepose.org/).