raesene6

well it's a view of the world that adding two words to a sentence is unreasonable, but (and this is just a suggestion) I think you'll find that you get less negative feedback if you make it clear when something is an opinion rather than a statement of fact.

If they like a drink (or several) and a party, indeed it's a good place to go.

I've been to Shetland 7-8 times for holidays, lovely place, but not really in the winter. Apart from anything else the crossings can be really rough, or cancelled altogether if the weather is bad.

I only did the ferry from Aberdeen once in really bad weather, they handed out leaflets to everyone getting on saying it was "at the passengers own risk"!

Lets just say, even several of the crew were seasick on that voyage...

Saying that you're part of the culture doesn't really remove the suggested universal negative, it just implies that you feel that you are part of that demographic.

The point I was going for was that I'd suggest that all humor is so subjective that it's impossible for a universal negative to apply.

In the same way that beauty is in the eye of the beholder, humour is in the ear of the listener.

I would suggest the backlash would likely be due to the wording of your original comment.

you stated that "Programmer humor is really cringey."

Cringey is generally a negative sentiment and saying "is" implies that this negative sentiment is a generally accepted fact.

I'd suggest that humour is almost entirely subjective, and therefore attempting to suggest that any form of humour is objectively bad makes no real sense.

If you had said "I find programmer humor to be really cringey" you may well have received fewer negative reactions.

Up Helly Aa isnt' designed to capitalise on credulous foreigners, it's very much a festival for the local population of Shetland.

Apart from anything else, I can't imagine many people wanting to go to Shetland in January for a holiday :)

Savitech didn't rebel against control, they were just lazy in not revoking/limiting something they, by their own admission, did not need any more.

If you don't want to participate in mainstream computing with it's certificate authorities and authoritarianism, there are always alternatives for you to use.

Use Linux, use hardware which focuses on freedom and privacy, these options are freely available.

that looks like an interesting guide :)

One thing you might want to add is a bit of a warning about the risks of exposing a Docker daemon to the network with tlsverify=false as that would enable anyone who can reach the port on the network to run docker commands and likely take over the host OS.

I guess it depends on what you consider high profit. From https://techcrunch.com/2017/05/18/patreon-pushes-as-youtube-... looks like Patreon has 50k creators and 1M+ patrons.

The challenge could well be that whilst they're growing and making money, they're not making enough money to satisfy their VC backers, having taken $47m in funding so far.

So to elaborate. Many Internet facing systems are application servers (e.g. web servers). They typically have very few local users, administrative/Ops staff are the primary users.

At that point an attack requiring the ability to execute arbitary code on the host as a local user is possibly less relavant as, if an attacker is in that position, they likely have a number of other options to further their goals.

The reason I made the comment about alternate controls, is that the original discussion and point I was making revolved around Internet focused attackers, rather than local attackers, so it's not too surprising that I didn't try to cover that case :) No sinister intent, honest!

Heck however if we want to then lets theorize that I can just use some form of firewall to port forward the high port that's presented externally to 22/TCP internally to get the best of both worlds, both a less visible external service and an internal port that requires root to bind.

malicious local user is a slightly different threat model though with a number of other possible controls.

Do you think there's any benefit in reduced log noise making a serious attacker more obvious to SoC analysts?

I.e. if I run SSH on 24956/TCP and start seeing attacks, it's a fair bet this is targeted (someone has taken the time to do 65K port scans, not common for untargeted attackers), so it's a stronger signal for the blue team to look at that activity more closely than the noise on 22/TCP.

I don't think it gives you nothing. As an example, say a 0/1-day gets dropped and someone starts compromising systems.

You're trying to get round your estate ensuring patches are in place, but that takes time.

The bots are starting with the low hanging fruit, systems on default ports.

Being not on a default port helps, by buying you more time to react.

So to me the answer there might be to address the complacense which is the real problem and not remove obscurity ...

The idea of revealing all to improve paranoia rather sounds like the idea of attaching a sharp spike to your steering wheel to encourage safe driving :P

eh?

runnning a service on an alternate port is generally extremely easy to do and has several benefits

1) It makes it easy to pick out the serious attackers. If you run SSH on 34985/TCP for example and start getting password brute force, you've got an idea it's a targeted attack, whereas on 22/TCP you get hammered by dumb bots all the time.

2) If someone is slamming round as fast as possible popping boxes with an 0-day they'll likely only bother with default ports (e.g. SMB worms, they compromised a lot of systems, but only on default ports)

There are start-ups in the "hearable" marketplace. Things like https://www.nuheara.com/ have products out already and there's various ones like http://www.waverlylabs.com/ coming along focusing on things like instant translation as well as hearing augmentation.

Of course whether they'll all just getting steam-rollered by Apple/Google is another matter...

I've used screen to GIF for this http://www.screentogif.com/ it worked pretty well for me.

if a keyboard requires compressed air cleaning to function, that sounds like a design defect to me.

I've used PC keyboards for ~25 years now and I've never had one that would break if not treated ...

I've not look too much at Mesos and DC/OS, so could be wrong, but my understanding is that where Openshift is focused on managing containerized workloads using Kubernetes and Docker or CRI-O , Mesos and DC/OS are more widely focused on managing a variety of workloads which could include containers but also VMs etc.

For me, the benefit of Openshift over vanilla Kubernetes is the additional management tooling and the strong default settings for production use.

Openshift has a lot of focus on things like manageability and security which make it well suited to production workloads in enterprises and anecodotally it seems to be taking off quite well in enterprise customers.

As InTheArena says, both Docker EE and Openshift have Open source cores and then supply commercial support and additions to suppplement them.

It's a pretty common model amongst these companies, and hey they've got to make money somehow :)

Not really sure I see the vendor lock-in here. If you use Docker EE sure you're going to be locked in to their solutions to an extent but then that's true of adopting any commercial supported solution that provides layers on top of the base k8s clustering tech (e.g. Openshift).

The API is still k8s and the YAML files are identical, so migration at a technical level off that platform should be easy enough.

I think this move is about Docker maintaining the trajectory in enterprise where people want the management GUIs and extra features but where Kubernetes and particularly Openshift is making progress at the expense of Docker EE.

I like minikube for some things, but I'm hoping this will be better by allowing for multiple K8s nodes to be spun up which is handy for some learning/training scenarios

This looks really cool from the videos that they've got up on their Youtube channel.

I'll be very interested to see what choices they made for Kubernetes configuration as there's a lot of options there and they're pitching "it just runs"...

Also looking forward to Docker for Mac/Windows having this support too!

it's 3 of 9 barcode (https://en.wikipedia.org/wiki/Code_39) that says "BearSSL"

To be honest I'm a external security assessor/pentester and I've not had much pushback from clients on this. That said I don't always get visibility of whether they implement our recommendations or not :)

To me, it's not really a debatable point that loading JS from a source you don't control implies trust in that source and therefore a risk that if they are compromised it affects your site.

Whether that risk is ok for a business depends on a number of factors like :-

- How trustworthy are the sources they're loading from? - What reviews have they completed on the security of those sources? - Do they have contracts in place with those sources that cover the requirement for security?

Loading third party JS is increasingly common for a lot of sites, and I tend to raise it when doing security reviews, for this reason, you're trusting the security of those 3rd parties.

There are some defenses that can be put in place. The first one is kind of awkward in many cases which is to host the JS on your own domain. There's still the risk of course that it will go off and get additional code from the 3rd party source to execute, but that can be reviewed for.

The other option is to use sub-resource integrity (https://developer.mozilla.org/en-US/docs/Web/Security/Subres...) to ensure that only scripts you've reviewed are used.

Of course you need then to make sure you're notified before the 3rd party makes changes that would break the signature.

Yeah my main time with them was early 90's when I spent two summers working in arcades at the Santa Cruz beach boardwalk.

We often got to play after hours for free, and Street fighter and mortal combat were favourites.

http://www.investopedia.com/ask/answers/100115/why-luxembour... suggests that the basic rate is 21%? and http://www.grantthornton.lu/online/www/navMain/publications/... suggests the rate is currently falling

Also has some other pointers about why Luxembourg is considered a tax haven...

interesting read. One thing I'm surprised about is that they didn't assess the Slack chat that's mentioned throughout the document, to assess what information might have been uploaded/shared there.

From what I've seen of slack it retains a lot of history (even if you're on the free plan where you can only see a limited amount, the archives are still there), so you'd think would be an interesting source of data for this kind of investigation.

Indeed.

Another useful technique, which has been recently introduced, is Multi-Stage Builds https://docs.docker.com/engine/userguide/eng-image/multistag... . This lets you avoid putting tools needed for compilation into the final image.

Well they sold services which made use of a vulnerable version of struts.... You can argue services != products, but It could be argued a similar approach could apply.

The fact that they didn't sell those services to consumers but that consumers are the ones impacted is actually a big part of the problem.

There's an externality here in that the people who suffer the loss have no part in the transaction (they are neither buyer no seller) so have no way to, in an economic sense, impact Equifax's behaviour, which does lead to the idea that regulation could be an appropriate approach.