Forgot your password?
typodupeerror

Comment Re:Are there people in the government (Score 1) 77

Sounds like the precise argument why governments shouldn't be the ones regulating these things. Maybe private industry consortiums

"These things"? You mean the government shouldn't be drafting regulations for government, which is what we're talking about here? Instead, private industry should be telling the government what to do?

Comment Reminder of how this works (Score 1) 289

No one can possibly think that a one-time tax like this is a good idea. Even if you want higher taxes on the wealthy surely (a) you want recurring revenue not a one-off (b) you want to actually collect the taxes not just scare the tax base out of state.

But this is the key part:

Although it has gained enough signatures for the ballot, the groups backing the measure have until June 25 to decide whether to move forward or potentially strike a deal with the state.

The way the ballot process in California works is you can propose terrible legislation, pay for signatures, then get what you want in return for withdrawing it (which you can do even after submitting signatures, which is ridiculous).

It's become a very broken system.

Comment Re: Seems defensible. (Score 1) 38

If their published standards indicate that giving the connector that level of admin permissions is excessive, and the access needed to exploit this is as clearly a set of poor security management as the last paragraph of the summary implies, then, "Yes, it should be corrected, and no, it's not bounty worthy" seems a reasonable stance to take. It sits right in the zone of that definition.

You could have the argument, but it's not clear to me that Google has it wrong.

Well I am sure they are not wrong in that they have legal cover to refuse the bounty.

I think they probably are wrong in excluding all config related bugs from their bounty program. Chained exploits are becoming increasing attack vectors so "you need elevated privileges" is not the moat it used to be. And GCP takeover is a big cost to bear. "We can prove it was your fault for not reading our docs carefully enough" will probably not be the salve their customers want in case of exploit. Security is hard and protecting customers from footguns is often worth doing.

But if Google doesn't want to know about these kinds of issues that's up to them. Keep it in mind before purchasing their services, however.

Comment Re:Open source it then (Score 5, Informative) 52

The main aim of Stop Killing Games is to ensure the practice of rug-pulling eventually comes to an end. They are not trying to save MMOs, for example.

Moreover they don't demand that every game currently on the market comply with open-sourcing requirements: at a minimum, companies always have the option of simply providing customers with adequate notice before shutdown. Open-sourcing the server would be nice, but it's hardly the only way to protect consumers' interests. Scott has, for example, suggested game boxes being marked with an estimated expiry date for online service functionality.

But most importantly: because this is about future games, not the present, the market has time to change. If studios and publishers are designing their games with a fair EOL in mind, then they can make decisions from the get-go to avoid licensing dependencies that they won't be able to release in a possible 'afterlife' version of the game. As suggested by your example of GameSpy in C&C: Generals, when a commercial dependency is crucial to a game's success, it tends to be a client-side library, but typically the problematic dependencies aren't crucial; they're e.g. add-ons for Unity or Unreal that the studio bought to save time. In a world with SKG laws, the providers of these dependencies aren't going to be a stagnant target either—demand for compliant libraries will motivate development of open-source versions.

Interestingly, the will for doing this does exist among game developers; they just need the institutional support from legislation to twist the arms of the studios and publishers. Ross Scott has talked to a lot of devs who are burnt out from having their projects cancelled, leaving them with huge gaping holes in their resumes and portfolios where they've spent years on unreleased projects that are stuck under NDA. In general they tend to see SKG as a path to ensuring the games that do see the light of day aren't also scrapped, which would erode their work histories even further. (Apparently it also just plain feels bad to have your work erased from history. Shocking, I know.)

Comment Re: shit world (Score 1) 180

How can this be seen as a victory?

The "victory" is literally "pwning the libs." The thought process is, "Anything that denies them something that they want makes them weaker and us stronger." The base rallies and cheers, and meanwhile Trump and his cronies go back to extracting ungodly amounts of wealth from the entire world's resources.

Comment Re: D.o.g.e. (Score 1) 180

If they leave them there, the next administration might be able to switch them back on and start gathering woke climate science data again.

Kinda unlikely. If you leave anything sitting under the ocean, it's going to experience significant wear and tear. If there's no budget even to monitor the status of the monitors, let alone conduct routine maintenance, they're likely to be as good as junk by the time they're switched back on.

Comment Re:D.o.g.e. (Score 1) 180

Literally hundreds of scientific papers have been published using data from the OOI

Not to mention that the data is also used in industry, particularly in farming and fishing, where it is used to predict climate-related events. And this aren't just long-term events we're talking about. "Where are the fish likely to be this year" is a question this data can help answer.

Slashdot Top Deals

Never buy what you do not want because it is cheap; it will be dear to you. -- Thomas Jefferson

Working...