sakisv

Depends on the software.

In this case, the companies that make and provide AI models that are increasingly used to interact with me on critical things (banks, public sector services) then yes.

Abso-fucking-lutely they should be regulated like crazy.

In fact I'm really surprised by the amount of people that are not worried by how many parts of their lives are being handed over to be managed by a probabilistic system that is controlled by a private company with next to zero oversight.

There must be a greater liability than "oops, you're right to push back"

Mac

This is not true. I'm a Firefox user and it works perfectly fine in Firefox.

I wanted to draw the distinction between something that destroys lives over a longer period of time (smoking) VS something like gambling where you could lose your life's savings in seconds.

The alcohol mentioned in a sibling comment also ticks the box.

For the sugar, I'd say yes, no, no, yes and "not too much, but I'm keeping an eye out".

Not the original person you replied to, but as far as I'm concerned there are a few questions that could very easily indicate which side of the line is something.

E.g.

- Is it addictive?

- Does it have the potential to destroy lives?

- Does it have the potential to destroy lives in seconds?

- Does it have a strong lobbying mechanism behind it? (n.b. things that are good and nice rarely need someone to bribe people to accept them)

or simply:

- Would you be worried if your child did it?

I think the number of "yes" that you get draws a very clear line.

This feels like a good idea in principle, but I can't shake the feeling that it just moves the goalposts one step away:

Now your app doesn't have direct access to your stripe/github/aws/whatever keys (which is good!) but you still need to have _some_ authentication against your proxy.

If you have a per-app authentication, then if your app's key leaks, then whoever uses it will be able to reach all the external services your app can, i.e. with one key you lose everything. On the other hand, if you have per-endpoint authentication, then you didn't really solve anything, you still have to manage X secrets.

Even worse, from the perspective of the team who owns and runs the proxy, chances are you are going to use per-app AND per-endpoint authentication, because this will allow you to revoke bad keys without breaking everyone else, etc.

What this really solves is subscription management for (big?) organisations. Now that you have a proxy, you only need a single key to talk to <external-service>, no need to have to manage subscriptions, user onboarding and offboarding, etc. You just need to negotiate ratelimits.

While I agree in principle, I have to remind you (and to myself) that Australia is part of the Five Eyes: https://en.wikipedia.org/wiki/Five_Eyes

For me it's quite simple: It works and it stays out of my way.

I've owned a macbook since 2010, with a short break during the touchbar era when I got myself an XPS with windows which I dual-booted with ubuntu and later a system76 that comes with their own flavour of Ubuntu, called Pop! Os.

The situation in windows (windows 10 at the time) was abysmal. Completely incoherent UI, settings spread across different menus, ads in start menu, slow and broken search, constant nagging to update windows, to update the drivers, to tell me that the drivers have been updated, to install or update my antivirus, etc. These were not things that I installed myself, these were included with Dell's setup of the machine.

On the system76 laptop things were different. Things were calm, I could configure everything as I wanted and things worked. Until at some point I installed a new version of something, which had nothing to do with sound, but it broke sound, just as I was preparing to join a meeting, and just as we were going into the second phase of lockdowns in late 2020 so online meetings were here to stay.

My macbooks are reliable. I've got the M1 as soon as it came out and I never got a single issue with it. I've upgraded twice (I think) across major versions and everything worked. I don't have to worry about it leaving me hanging when I need it.

(And that's not taking into account things like build quality, touchpad quality, battery life, silence, etc)

In the end of the day, I do a lot of debugging as part of my work. When I don't work, I want to choose what I will be debugging, not have it forced on me.

And don't get me wrong: I see where Apple is going, I know that they're a greedy company that want to maintain their iron grip and have the final say on what we can and cannot do on our machines.

However, for me for the time being it's the least bad option.

Ah, that's a fair point. In that case then yes, I have been bothered by the borrow checker very much indeed lol.

As someone who's only did a couple of small toy-projects in rust I was never annoyed by the borrow checker. I find it nothing but a small mental shift and I kinda like it.

What I _do_ find annoying though and I cannot wrap my head around are lifetimes. Every time I think I understand it, I end up getting it wrong.

Given that a lot of places that deal with money use them, I find your comment quite interesting and would like to learn more :)

The way I solve the plain text problem is through a combination of direnv[1] and pass[2].

For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey.

Next to the `./creds` directory, I have an `.envrc` which includes some lines that read the encrypted files and store their values in environment variables, like so: `export CLOUDFLARE_API_TOKEN=$(pass creds/cloudflare/api_token)`.

Every time that I `cd` into that project's directory, direnv reads and executes that file (just once) and all these are stored as environment variables, but only for that terminal/session.

This solves the problem of plain-text files, but of course the values remain in ENV and something malicious could look for some well known variable names to extract from there. Personally I try to install things in a new termux tab every time which is less than ideal.

I'd like to see if and how other people solve this problem

[1] https://direnv.net/ [2]: https://www.passwordstore.org/

I would be tempted to put it on my CV :D

Well, you can never be sure that he didn't:

https://www.fastly.com/blog/summary-of-june-8-outage

I think I agree with what I think you're trying to say.

However I don't agree with the repercussions of this, which are the same ones that make all reasonable people, security experts included, oppose EU's ChatControl or the UK's backdoor requests: There is no way to ensure and protect the people that need protection, as there is no way to ensure that only "the good guys" have it.

We tend to bullshit ourselves into believing that because spyware software like Predator are weapons, meaning that only countries would be allowed to buy them and use them (same way that Jeff Bezos cannot buy and use an F-35 for example). We see though, that certain individuals _can_ get their hands on these things and use them however they want.

For example, 3 years ago someone adjacent to the greek government bought and used Predator against MEPs, journalists, army generals, mafia bosses, MPs of opposing parties and even MPs of their own, ruling, party. The greek government of course denied that they did it, and they said that this individual did not act under the instructions of the government (though they then changed the law to prevent anyone for learning details about it, but that's a different story).

So, apart from adopting the same approach as with ChatControl and encryption backdoors, i.e. banning them, I don't know how we could protect ourselves against them.

So, this is Google Now but instead of one company having access to the data on their systems, now you're giving access to your data from different companies/sources to OpenAI.

(I do miss Google Now, it really did feel like the future)

The "major rule" in question is whether you should rest the meat after cooking or not.

Essentials: my own domain for emails, Fastmail, Bitwarden, Google for 100GB of storage.

Less essential: Obsidian, Kagi (this one may be bumped to the "essentials" at some point), a few VPS on Hetzner to run some projects, domain names for said projects.

Just because I like them and want to support them: Signal

I want to SaaS-ify my scraping process. It's gotten to a point that it works nice and reliably for me, now I need to wrap it in a good DX package and call it version 0.1.

(The main drive behind this was not to sell it, but to have a UI for when a website changes its layout and I'm on holidays and don't have access to my terminal and/or my yubikeys)

Starting a bit of a tangent here I admit, but this makes me much more worried about the future of mobile browsing.

Sure, soon enough a decent non-chromium based desktop browser will come along, be it Zen or something else, but what about the mobile world?

Right now firefox is perfect for me: It makes the web browsable by allowing ublock origin, it syncs my tabs, history and bookmarks, it's great.

Moving to a scenario that we have a different browser on the desktop and a different one on the phone or, worse, the same on the phone but without adblocking sounds like a huge regression.

P.S. Regarding Zen: If you want to be taken seriously, or at least as something more than a toy project, teaching your maintainers how to talk to your (potential) users will go a long way. Telling them off will not gain you any friends. (I'm referring to the github discussion mentioned in a sibling comment: https://github.com/zen-browser/desktop/discussions/5907)

That sucks. I'm kind in the same boat, but with one additional requirement: It should have an android app that I can install uBlock origin. The few times that I had to browse from a phone without an adblock I had to stand in awe as to what a lot/most people have to suffer through daily.

(The other more minor requirement for me is bookmark tags, but I may be able to hijack my way around that)

I have no reason to doubt your explanation and intention, however I think it would have been more efficient if this misunderstanding could be avoided.

Maybe something like "This looks good. Would be nice to see it extended to support companies that do not follow the calendar year.".

Switzerland.

I'm from Greece and I've always dreamt of living there, but through the various turns of life I ended living for almost a decade in the UK first, so now I'm looking to make the move.

(So if anyone from Switzerland is reading this and is looking for an SRE from an EU country, feel free to reach out at cv@ my username.net)

Lately though I've been thinking about Norway as well, though I feel that transition would be much harder.

oh nice! Thanks!!!

A record to an non-elastic IP, and the box gets rebooted

Oh mate, I've seen that happen with a company that was selling security-adjacent services, which were running on servers with just random IPs ffs

I wonder how things would have played out back in the crisis of 2008 if Iceland was a member of the Eurozone:

What they would have been allowed or forced to do and whether their response could have been the same.

Honest question: How was it discovered?

Was it reported by a pentester? (ex-)employee? Facebook itself? How do we know that it goes back to 2012?

I know in the public sector you have to disclose such things to ICO, but does that also apply to private companies? Who is going to hold them accountable?

Well I'm just thinking of concourse the same way it describes itself, "a continuous thing doer".

I want something that will run some code when something happens. In my case that "something" is a specific time of day. The code will spin up a server, connect it to tailscale, run the 3 scraping jobs and then tear down the server and parse the data. Then another pipeline runs that loads the data and refreshes the caches.

Of course I'm also using it for continuously deploying my app across 2 environments, or its monitoring stack, or running terraform etc.

Basically it runs everything for me so that I don't have to.

...or worse, if there _is_ an API call but the response is HTML instead of a json

Ha, you can't imagine how many times I've thought of doing just that - it's just that it's somewhat blocked by other things that need to happen before I even attempt to do it