• 0 Posts
  • 77 Comments
Joined 1 year ago
cake
Cake day: August 12th, 2024

help-circle


  • I don’t think sov civs actually have a problem with rules or authority. I think they are deeply insecure in the fact that they don’t understand the rules so they make up new ones that they believe to be absolute and above all else.

    They believe like dogma in this shit like the maritime flag with stripes and a court with that flag gets magically invalidated so they don’t have to follow any rulings. They get a feeling of control when they understand the rules even when the rules are imaginary.


  • Terminology: revoked means the issuer of the certificate has decided that the certificate should not be trusted anymore even though it is still valid.

    If a attacker gets access to a certificates key, they can impersonate the server until the validity period of the cert runs out or it is revoked by the CA. However … revocation doesn’t work. The revocation lists arent checked by most clients so a stolen cert will be accepted potentially for a very long time.

    The second argument for shorter certs is adoption of new technology so certs with bad cryptographic algorithms are circled out quicker.

    And third argument is: if the validity is so short you don’t want to change the certs manually and automate the process, you can never forget and let your certs expire.

    We will probably get to a point of single day certs or even one cert per connection eventually and every step will be saver than before (until we get to single use certs which will probably fuck over privacy)



  • You don’t need something ever. Sometimes you just want something because the alternative is realy bad. I don’t need to eat. I want to eat because I don’t want to starve.

    I want to watch a movie with my partner at the agrees time because otherwise they will be mad. I want to access my digitalized documents to send a letter in time because otherwise I will have to pay late fees. I want to access my gameserver because that’s the one time a week I get to have fun with my friends from my college time.

    There are many situations where I’d rather do the thing I want instead of doing maintenance.








  • You don’t get hacking protection from bots

    I disagree. I don’t know the details of cloudflares bot detecion, but there are many automated vulnerability scanners that this could protect against.

    I said that instead of crashing the system they should have something that takes an intentional decision and informs properly about what’s happening.

    I agree. Every crash is a failure by the designers. Instead it should be caught by the program and result in a useful error state. They probably have something like that but it didn’t work because the crash was to severe.

    What’s the point of your complaint if you do agree?

    I am not complaining. I am informing you that you are missing an angle in your consideration. You can never prevent every crash ever. So when designing your product you have to consider what should happen if every safeguard fails and you get an uncontrolled crash. In that case you have to design for “fail open” or “fail closed”. Cloudflare fucked up. The crash should not have happened and if it did it should have been caught. They didn’t. They fucked up. But, i agree with the result of the fuck up causing a fail closed state.


  • it shouldn’t crash the whole thing: if the bot detection module crahses, control it, fire an alert but accept the request until fixed.

    Fail open vs fail closed. Bot detection is a security feature. If the security feature fails, do you disable it and allow unchecked access to the client data? Or do you value Integrity over Availability

    Imagine the opposite: they disable the feature and during that timeframe some customers get hacked. The hacks could have been prevented by the Bot detection (that the customer is paying for).

    Yes, bot detection is not the most critical security feature and probably not the reason someone gets hacked but having “fail closed” as the default for all security features is absolutely a valid policy. Changing this policy should not be the lesson from this disasters.



  • LLMs are an incredible interface to other systems. Why learn a new system language to get information’s when you can use natural language to ask and the AI will translate into the system language and do the lookup for you and then translate the result into natural language again. The important part is, the AI never gives an answer to your question itself, it just translates between human language and system language.

    Use it as a language machine and never as a knowledge machine!



  • That is the smallest scale of self hosting. The server and the client are the same device. It is also the most insecure way as you probably don’t have any backups and very limited storage space.

    Actually self hosting is the next step when you decide you want 5+ TB of data and have it automatically create backups. Digital storage media degrade pretty quickly and if you just have your movies on a hard drive in your computer, after 5-10 years you might start to lose quality or some files completely.