I've done this before for some businesses that *don't want to know*.

A customer with a server we didn't manage and were not responsible for got crypto locked.

I looked into it, no viable backups, no way to recover the keys, etc. Only solution was to pay the ransomware or take the loss.

The customer was a law firm and I didn't realize this until after the fact but apparently paying ransoms can get you in legal issues. The customer basically said make it go away I don't care what it costs and I don't want to know how you do it.

So I quoted the ransom + my time and bought the BTC and negotiated with the scammer. ironically there customer support wasn't terrible because the first tool they used didn't work so the hopped on a screen share and troubleshooted it with me. (I hated this so much btw).

All in I negotiated the ransom down and put it on a invoice as a single line item.

Would I do it today? Probably not without checking with my lawyer.

Two years to roll out a fab for ddr5?

That is unbelievable optimistic.

Explain to me how they would implement reliable geo-filtering in an architecture where they likely want to process a request in under 5 ms.

CloudFlare should just make it an example of Italy by redirecting any Italian requests to the Wikipedia article on fascism.

It's going to be interesting if he walks due to overcharging.

Of if it were me I'd find the cheapest piece of shit AM radio on aliexpress and have someone tape it to the dash.

Instant compliance.

You need to know about about kernel development.

When you work in the kernel at ring 0 there are no safety nets the only sane thing to do to avoid data corruption is to panic. This is true across all operating systems.

The problem here is Crowdstrike flagged the driver as required for boot.

You can't have it both ways if a driver is required you can't expect to OS to start deciding which drivers not to load. I'm not even sure it would be inherently apparent to the kernel which driver is causing the problem. It wouldn't be an immediate crash on load.

The only thing I might give a bit of blame to Microsoft is that they certified a driver that essentially downloads and executes updates that bypass the usual certification an testing process. The problem is that if Microsoft didn't allow this all the 3rd party AV/SEC vendors would be screaming antitrust.

Microsoft had build APIs to provide the required functionality without requiring a kernel driver but the EU required it to be removed due to Antitrust reasons. If anyone deserves the blame besides crowdstrike it's the EU.

The thing that made it really bad is that a lot of the same companies that have Crowdsrike also use bitlocker. Again, the only improvement I can see here is having a Safemode that prompts for the bitlocker keys rather than requiring an external USB but that would likely decrease the effectiveness of FDE but I'm not all that familiar with bitlocker.

*sigh* Can't believe I'm defending Microsoft.

Do you understand what happened?

I'm not a Microsoft proponent by any means and openly mock people for using Windows servers but I cannot see how this is a Microsoft problem.

Crowdstrike operates as a kernel mode device driver which on ANY of the current major OS will result in the same thing if the code crashes. Crowdstrike is incompetent and when the driver read a malformed definition file it resulted in a null pointer dereference. The kernel has to panic game over. Crowdstrike lists the driver as boot critical so on reboot you get a BSOD.

Microsoft even built APIs to put safety rails around the required functionality but the EU cried Antitrust.

I think the problem is that most people think let the speed of light is fast. Sure it's incredibly fast in terms of what humans typically think of as speed but if you want to get practically anywhere interesting the speed of light is incredibly slow.

That said being able to move at say even 0.5c and not having to deal with acceleration would still be fairly interesting for exploring the solar system.

Yet not intelligent or specialized enough to clean their computers and/or conduct all operations from a tails (or similar) box.

It's not the cost of the radio that's the problem.

EV's make a lot of RF noise due to their power supplies and motors. It's the RF shielding (weight) and antenna as AM requires a larger antenna (more drag, and weight).

It wasn't marketing that made me switch from Firefox to Chrome it was their abysmal performance and pointless UI fuckery.

This was forever ago but Firefox was eating up so much memory that it was unusable. Chrome handled the same workload with 1/4 of the memory and no performance issues.

I didn't want to switch. I wanted to support an OSS product. They forced me out.

Crowing about better performance on a 10-year-old Javascript test that's irrelevant confirms they still are in desperate need of better leadership.

I've run ISPs.

This goes fundamentally against how the internet works. Customers pay for internet access and that includes access to anything on the internet no matter who provides it. That is the fucking point.

It's not Netflix's problem that they failed upgrade their networks. Netflix already goes out of their way with their cashing boxes to mitigate the stress on the ISPs networks.

Allowing them to get away with this would ruin the internet. Telcos are far more despicable than Netflix or Amazon in their practices and behavior don't let your bias against these companies cloud your judgment.

What's your suggesting with ultimately turn the internet into a broken form of cable tv.

Tucows is a Canadian domain registrar.

They have WHOIS privacy enabled which means none of that information is related to the registrant.

While it doesn't come straight out and say it I'd argue the wording implies that nodes that need access to the Internet should have a second globally scoped address.

Just to name a few FTP,SIP,STUN,ICE. With a bit of java script your browser can be tricked into accessing internal hosts on your LAN.

I use PAT to be specific.

And now we are reduced to name-calling and appeals to authority.

No, this is an abuse of ULA. The whole point of ULA is to ensure they never are reachable externally.

If you must have limited Internet connectivity best practice would be to use global space behind stateful inspection that only permits establishing traffic to a restricted subset of services.

Which is practically useless. Nearly all protocols leak the local addresses anyway. If you are worried about the mac address inclusion using stateless auto-configuration you can use RFC4941.

If you are worried about statically assigned servers you can at assignment time obfusticate the IP address. I'd argue, by your measure, that NAT provides significantly less "security" as PAT only has an address space of 2^16 whereas a single /64 has an address space of 2^32. If you really wanted to be paranoid you could assign a /64 per server and randomize the address.

NAT66 provides no value and would bring along all the breakage and stupidity that comes from NAT44.