pletsch

Knowing the source code doesn't mean someone is a skilled communicator and expecting people who are bad at <any area> to pick out problems with LLM output in that space is a losing battle

Central government would typically be a customer

This is a wrong assumption, it's not that they aren't customers as they'll deal with hundreds of vendors/partners and will benefit from these changes regardless but national cyber & supporting IT agencies (including the UK) are often providers themselves to both other government agencies and private organizations in the country.

This can be anything from running their SOC functions to specialized consulting services to intelligence sharing so the bill is definitely relevant and the exclusion of the govt. doesn't seem to serve a purpose other than saving the budget to implement/maintain their own rules.

I think a lot of it boils down to your goals with it, I'm personally very engaged with my user base and take pride in my communication and you may not value that over less work/more dev time. This is also for an internal tool but the audience is diverse (500+ devs, cybersecurity engineers, leadership, writers, etc), I stick with one set of release notes for a few reasons:

- One location, people who may fall into multiple categories (or none) don't need to check multiple places, users also know that all my communication will be via that page/they don't have to wonder if they're missing something

- As much as some detail doesn't matter to certain audiences, I find being able to give all the detail you want a user to know while maintaining readability to less technical audiences is a skill worth developing because the result is regardless of where your notes end up, the person will understand what's changed and why it matters

- Maintaining multiple versions leads to mistakes, at some point you'll leave out a detail to one audience that matters so letting the user mentally filter what they don't care about takes the onus to get it right 100% of the time off of you. I'll often categorize my changes by the section that had the change to help users with this.

- This is a personal preference and you touched on this one but it's just far less work, I've found it common in tech that people don't want to do things more than once or they'll automate it/look for shortcuts and this is no different. This isn't always a bad thing but getting release notes right means your users stay informed/use new features which is why we build them so I think it's worth putting my energy into doing it properly every time

What exactly do you want to do in cybersecurity? There's many focuses and sub fields that change the response.

I agree with the premise that report writers usually lack an ability to tell the story. It's tough though because I know a lot of SOCs and IT dept's will take any detail they can get if an incident happens in their own vertical and there is a lot of desire to help the community in IT/security culture.. but these reports really are for business partners more than anyone else and in that context, people could learn a lot by taking the advice into account.

The post does use cyber industry terminology inconsistently though, noted in another comment, and I fear that's going to make every technologist exit the page before getting the point.

This reads like someone who's coming out of CS, it's really hard to know this from outside the industry but these are two very different fields culturally. I interview for 10-20 cyber positions a year and a lot of your site doesn't pass the sniff test:

1.95% interview success rate and 400+ users? On effectively a new site?

2."Learn from industry leaders and seasoned FAANG professionals with real-world experience", like who? There are only so many cyber FAANG staff (and their time is very expensive) and not only do you not list backgrounds/who they are, you don't even list who you are on the about page

3. The hands on labs don't seem to exist? There are also plenty of sites you could point to that do this but I suspect you want the users for subscription $

I say all this because cyber is an industry based on trust and there's very little to trust about the site as it is.

Last thing I will add, LLMs in this field are struggling, you need a crazy amount of data to tune it properly and I fear you may end up doing more harm than good by having the model suggest made up things as good answers. I think a good path to solve this problem would be curating the questions for your background field (then hiring others for theirs) and having low-high value answers.

The article says Trellix but the same could be written about any EDR from a capability standpoint. To add to the staff's point about giving root access, and while that's more on Microsoft needing to get vendors out of the kernel, it shouldn't be a compromise users have to make.

With that said, I find myself agreeing with the mandate, if you're using university resources, they have a responsibility to protect those resources and EDR is table stakes these days.. but they also need to be providing any devices required for the job, allowing BYOD for restricted data makes an already tough environment to secure harder than it needs to be.

It gets mentioned at the end but service disruption really is the problem here. Reminds me of how quickly my govt (Canada) breaks strikes nowadays to avoid these disruptions.

I don't know if there's a way out of businesses that don't see the value of IT ignoring these risks (outside of legislation) but I hope we don't end up in a situation where bailouts are common/companies rely on govt intervention.

This is a strange disclosure post.

They may not have had a security email but I’m sure there was some contact this could have been sent to before posting something like this.

Part of me wonders if OP even tried or was mostly just looking to dunk on a company.

Wonder if Server Products includes Windows Server OS? Not really bigger than Windows if so

Would also like to see block mounting of ISOs by default.

Also in Ontario with unlimited PTO. They have to pay out the minimum provincially required amount of vacation if you don’t take it, so two weeks.

I like the Civilization series, with a modern era start, for this.

There’s often a couple different ways to victory and there’s already enough built out to put plans into action immediately.

The federal government made it illegal with the emergencies act, this donation almost certainly came before that though. More relevant is that the Ontario government asked a court (which was granted) to freeze all funds related to the convoy.

So maybe not illegal as much as just a terrible look for the party.

Well designed security programs shouldn't slow down your PC. This is a failure on the infosec department. Sysmon/Windows logging can do most of the hardwork with very few resources.

Reverse proxy with a dynamic DNS server (DuckDNS for example)

Could they go after the ownership group? Novalpina Capital is UK-based.

Email providers absolutely block email, its the edge cases that make your spam folder.

People jump to conclusions? On the internet? No, I don't think that likely

Thank God for the Bruce.

The Queen is a significantly better piece. The King needs to be protected and is borderline unusable until end game, where the Queen is the most powerful piece from start to finish. This is so evident that in higher levels of play, people just resign when they lose their Queen.

China will probably deny it regardless of what other countries say. Beyond that, attribution isn't made by IP addresses.

You would thing a company with that much money like MS, they would have drop several millions on a few pen test, and independent security audit companies.

Are you under the impression that MS doesn't spend millions on security? They're currently spending roughly $1b/year. This isn't going to be fixed by "a few pen test"

Apple releases a guide for this, somewhat, exact scenario: https://manuals.info.apple.com/MANUALS/1000/MA1976/en_US/dev...

Google Maps also keeps track of your location, I don't have the exact setting but its under location history. Might be worth checking. You can also turn your phone to only allow location to apps while the app is open.

I'm not in California and I know a lot of people on HN are, so I'll refrain from giving further advice. If you don't find your answer, I'm sure an hour of an accountants time could help tremendously.

This really depends on where you're located. Who are you using as a payment processor?

I use Matomo, it runs on my home server, its open-source. Pretty sure you could run it on a Pi. There's a docker container that you can spin up in a few minutes.

https://matomo.org/

Not going on either side here but for what it's worth, Cuba is viewed differently in Canada vs the US

That's great. The market for C02 is already there and cooling towers exist everywhere. I have a gut feeling this could be licensed to the large players for their new builds, even if the co2 is just used onsite.

How much CO2 are you actually pulling out of the air? I've read a bit about other carbon capture companies and Carbon Eng. is claiming 1M tons/year with the new facility they're building.