Forgot your password?
typodupeerror

Comment Re:It wasn't researchers (Score 0) 105

Ah, yes. The old "there's totally evidence to back up my statements, I just can't be bothered to give you enough details to find the evidence" routine.

The only instance that some googling shows up is the same one linked to in the summary of this story -- namely, that 404 Media worked with a "rare bookseller" (who they won't name) to put an airtag inside one of the books (which they won't name) in a shipment of 1000 books.

Comment Re:The only books they're destroying... (Score 5, Interesting) 105

I mentioned this to the other guy but yeah they were destroying rare books. A rare book seller caught them by sneaking an Apple Air tag into one of his books that he shipped to them.

There's rare and then there's "rare." From what I've seen, the people involved have declined to say what the books involved were. About the only reason I can think of to hide that is because they know that people won't be as outraged when they find out what the "rare" books actually are. However, it was a bulk lot of something like 1,000 books, so it's a pretty safe bet that they weren't exactly valuable.

The 1973 manual for a toaster that I found in my grandfather's attic is certainly rare, but we're not losing anything if Amazon feeds it to their AI machine.

Comment Re:The death of homework (Score 1) 109

AI is too easy to use, when the work is done at home. And I say, good riddance. Homework has for decades been a substitute for learning. AP classes aren't actually "advanced" they just require more homework. If AI kills all those extra hours of busywork, that's a good thing.

The historically-bad results of the final at least suggest that doing out-of-class work themselves actually helps students.

Comment Don't believe this for one second. (Score 4, Informative) 42

Just last week, we received notification that IBM is rolling out a "program" to upper-level employees with decades of experience. The idea is that we would work reduced hours for the next year at full pay, and then leave IBM after a year (next March, I believe.)

Of course, this is for US employees only. I think we can be sure that the replacements for these employees (if there are any) won't be in the US.

Comment Re: Just Tested This (Score 1) 43

reddit.com/robots.txt disallows all agents (wildcard *) so there is not much that search engines can do.

Sure there is; the search engines can ignore robots.txt for reddit.

It's one thing to use robots.txt to say that you don't want the content on your website indexed by search engines, but if reddit is pulling this kind of stunt (giving that access only to Google,) then there's no ethical problem with other web search engines bypassing whatever anti-scraping techniques that reddit uses.

Comment Access control with... polkit? (Score 1) 320

run0 doesn't implement a configuration language of its own btw (i.e. no equivalent of /etc/sudoers). Instead, it just uses polkit for that, i.e. how we these days usually let unpriv local clients be authorized by priv servers.

Polkit .rules files are quite readable, for the most part, but they're also written in ECMA-262 edition 5 JavaScript! I'm not really thrilled with config files that are executable and might have odd exploitable language features I don't really need. But, whatever you do, don't run it with an argc == 0 .

Comment Another Kingmaker Identity Solution (Score 1) 11

This means production workloads can rely on the Rekor public instance, which has a 24/7 oncall rotation supporting it and offers a 99.5% availability SLO for the following API endpoints

(Rekor README)

And that is the key reason to stay far, far away: this system is yet another identity service which happens to be supported by software. Like most identity services, they have carefully constructed it to ensure that the user receives no actual proof of identity. That proof resides on a ledger in some cloud server, somewhere, and verifying anything requires queries against the service. This means that the service can:

  • Start charging for "blue checkmarks" or for the ability to put entries in the ledger
  • Start charging for verification queries
  • Decide they don't like you today, then lock you out of either of the above
  • Decide what Certification Level you or your organization have today
  • Learn how often you commit/push/release, potentially monetizing this data stream
  • Learn all the software (or other blobs) you verify at once, giving them insight into your software stack
  • Stop existing at any time, leaving its users without anything of value

I don't see the words "distributed" or "federated" anywhere on the tin, with the possible exception of OIDC. But they are in control of what third-party OIDC providers they trust, if any. If their ledgers are not fully distributed, they are only as good as the metal in their hard drives. (And are one ransomware attack away from ruin and oblivion.)

Despite its obvious flaws and shortcomings, the whole point of the GPG Web of Trust is to escape the tyranny of these centralized ID providers. The cost is having to keep something secret—i.e., the key. cosign frees you from this requirement, but you are forever chained to their service. For me, this is not worth the price of admission.

One open problem in source or binary validation is trusted infrastructure—or the lack thereof. Projects that wish to use cloud computing for their builds, and to guarantee that the binary builds come from said cloud, usually have no choice but to trust The Cloud with their precious $identity key. This can leave it exposed to bad actors. The solution to this problem is reproducible builds. If your artifacts can be reproduced, they can be signed on non-cloud hardware that your project maintainers can see, touch, and trust. The solution is not "add yet more cloud servers with yet more keys run by yet another organization, making our system even more fragile and complicated."

But there's usually not a lot of money to be made in making things simpler.

Slashdot Top Deals

Remember: Silly is a state of Mind, Stupid is a way of Life. -- Dave Butler

Working...