I've only been paying attention since 1990 but every single time a feature they don't offer "is stupid" until they offer it.

Even when I liked the company this Cluster B behavior always bothered me.

If there's an example of "that's a really nice feature our competitor has but we don't offer it yet" I haven't seen it.

The closest I can think of was offering WebObjects for Solaris. Not sure if that ever shipped or we just had a beta. I bailed from that Healthcare IT team when the CIO pulled funding for two-phase commit among disparate patient medication systems with the rationale "even if medication errors kill someone it'll be cheaper to settle the lawsuits than pay for the license." Enough people left that they outsourced and everybody still hates that replacement system.

I learned too late that MBA's don't care about quality.

> everything you do has fucked the consumers

Say more ... how has suing to end the Play App Store monopoly 'fucked consumers'?

Let them do their thing.

I remember in High School the Camaro guys couldn't stop talking about how their Camaros were better than Mustangs but the Mustang guys never felt the need to denigrate the Camaros.

It's a matter of nature.

unrelated: Tailscale is so fooked today:

https://www.bleepingcomputer.c...

Some people here may need to panic right about now.

More correctly, it is default on for nearly 100% of computers sold. Large orgs want it that way (it's a feature), makes installs easier. And yes, that includes all servers, workstations and laptops in the world, except perhaps special purpose stuff (military, space, etc).

It's correct. I've never seen any machine with a default BIOS configuration where PXE booting is disabled. This is considered a feature (makes installations faster). You need to switch it off in the BIOS to stop that.

It is not off by default. I have seen a lot of different hardware in my life (I basically do booting for a living), and I have never encountered a BIOS that had PXE disabled by default.

BIOS has a boot order, and as far as I can recall PXE is always the last option. The order of what comes before varies, e.g. whether or not USB boot is tried first.

In fact, on most systems if they cannot boot, they keep rebooting and ending up in a loop trying PXE boot over and over, and then giving up and rebooting again. But it should be noted that of course, if you get access via PXE you already have full control over the system anyway. The new thing here is that you can use a single "malformed" packet with a payload instead of having to set up a DHCP and tftpboot server to deliver a malicious payload. The fact also that this happens before TPM is enabled makes is extra serious, as there is no way to stop any malicious code executing.

BIOS upgrades can be helpful if they contain a fix, but they tend to be unavailable on consumer hardware fairly quickly after the vendor stops selling and supporting it. Also BIOS upgrades are know to be finicky, and it's very easy to brick your system, which means opening up the box and connecting to the chip with a CH341A EEPROM programmer, something which not everyone is going to be capable of. Some machines have way to recover from a bricked BIOS, but in my experience those don't work most of the time and you end up reprogramming anyway. On many laptops the BIOS is on the back of the mainboard which typically means disassembling the system to get the CPU cooler off.

On nearly all machines it's enabled by default, but it's usually the last boot option.

AFAIK it was only put in the PRO versions of Intel NUCs, the other NUCs I have don't have it. It's really handy to have, because you don't need physical access to the box anymore. So I use the PRO boxes a lot for testing.

Of course on server hardware it's a different thing. It's hard to find any server that doesn't have it. On some boxes it's even a licensed feature that you need to buy^H^H^H rent to get it to work (the bastards).

The right way to do this is to hire a group of developers and have test volunteers report workflow problems - then FIX them - then iterate. That's the point of choosing an open source solution.

Eventually there would be no problems remaining.

But so many possible scenarios exist that it's impossible to guess what happened here.

PS _NSA_KEY

There are apparently other unpatched vulnerabilities that are known but 'too busy':

It sounds like this fix got done because it was 'accidentally' posted as a public PR.

https://github.com/tianocore/e...

Yeah, the threat actor would need a foothold on the PXE network, which is a private VLAN (or better) in the competent case.

That's why we worry about APT's and such.

Granted, you'll find people on certain cloud providers who do far too much on a public IP.

What if someone has fifty windows open with fifty tabs each?

Asking for a friend.

Solid effort - good job.

It's a bummer if any of the employees got rug-pulled but many of the best employees will strike out on their own, form new companies with working conditions they value, and likely hasten Skydance's demise.

Firefox was never there for the "Good Ole Days"

Firefox was a reaction to Mozilla becoming too ambitious and too unfocused.

The Netscape/Moz split was already after things had gotten bad. Moz completely jumping the shark was already bad.

The Good Ole Days were NCSA Mosaic and Navigator 1.1. Before the AOL invasion. Before people on the internet expected you to care about their feelings, and before politicians and mega corps knew how to screw it up.

Once upon a time, having friends on irc or usenet was like the nerd equivalent of _living on a pirate ship_

(except the avg pirate was at least +1SD on the IQ scale.)

It was the last vestige of freedom.

There is no "good internet" with Tay Zonday on it. Or girls.