Viewing profile — akerl_

Or pay the news organizations making content you want to consume.

The difference is that Mullvad doesn't enable any east/west connectivity at all. If somebody guesses a user's Mullvad 16 digit number, they can use Mullvad's services as that user.…

Some questions: > Your 16-digit account number is your login - anyone who has it can use your account, and it cannot be recovered if you lose it. Can you explain the intent here? 1…

I think you've accidentally lumped together "people who work in tech in / around the field of information security" and "criminals". There have been a variety of cultural elements …

The danger of using quotation marks around things that aren't quotes is that you can wildly misstate what somebody said and readers are left to ponder if you just don't understand …

What is the good faith interpretation you’d suggest?

Nobody is suggesting uncritical praise.

This comment could make the same point and be even more effective if wasn't written as a snarky retort in violation of several of the guidelines of the site ( https://news.ycombina…

Interesting. I’ve only used Maven-format repos once or twice and always via somebody’s preexisting CI tooling. Is there essentially a “draft” release that you can edit repeatedly b…

Generally each artifact in the release is atomic, as is (and was) the case here. You’ll never get served a partially uploaded wheel for amd64 Linux, but somebody could come back a …

That’s exactly how individual artifacts are (and were) on PyPI. This change isn’t to artifact immutability, it’s to releases (collections of artifacts)

No? Again, can you think of any packages managers that have a finalize step like you’re describing? All the package managers I’m aware of do one of two things: 1. You push once wit…

Worth noting, because I think it’s confusing some folks on this comments page, that “file” here is “a wheel for a platform” or “a complete sdist”, not “each individual .py file in …

Are there any package managers that have that kind of publish/finalize flow? Every one I’m aware of works either as a one-shot (you have to submit everything in one push) or lets y…

I wonder when Kalshi will start offering bets where one side doesn’t pay out until the end of the universe.

This is a gnarly vuln but a top tier write-up.

I'm scared of companies where SOC2 auditors are driving their security improvements. It's a bit like letting my toddler drive how I stock my pantry: surely by the end the pantry wi…

What about the other Lavabit users whose data he had handed over previously, before deciding to say no?

Even setting aside that there are, in fact, many human and robot eyes staring hard at the firehose of published packages on popular registries, the whole argument feels like a fals…

Agreed. Whenever we end up getting non-IKEA furniture I preemptively cringe as I open the instructions. The only time I’ve had a mistake building IKEA furniture was after opening b…

Are you saying that you don’t think that the GDPR text is written to apply outside of the EU, or that it does say that but it’s not relevant because it’s not viable for anybody to …

Design changes are not part of the self certification process, they’re part of the type certification process, which has always been handled by the FAA.

As has been noted in several of the comments, the crashes were a result of a faulty design, not aircraft failing to meet the design. The self-certification here wasn’t part of the …

Not really in the way the media would have you believe. Like “I was scared for a couple minutes on a Friday morning until I saw the vendor status page” is orders of magnitude away …

What would your damages be? They’re not actually going to charge your credit card for 34 billion.