471–479 of 479 posts
Earlier quoted context omitted.
I'd like that too, but can you give me a working example that is not based around using a VPN, or editing documents on the browser? (which are both viable, but there is a different number of drawbacks to each)
A remote filesystem over a VPN ought to be reasonable. I can't think of another reasonable way to do it.
Earlier quoted context omitted.
sadly, the job of a CISO typically isn't "make the most pragmatic decisions possible to keep our infrastructure secure and running smoothly". In many industries, it's more lke "join as many compliance programs as possible to expand the ability to capture revenue from regulated markets". The CISO didn't make the decision to enforce password rotation- the compliance programs your sales team asked for did
To your point, password rotation is considered an insecure practice because it causes people to append 1, 2, 3, etc to the same password. But I've seen so many companies that still insist on it.
A good solution to discourage this would be to have heuristics that'd make sure that the new password isn't too similar to the old one, but doing that without having plaintext in there somewhere is pretty difficult.
Another solution would be mandating that all of the passwords should be randomly generated, but enforcing that would be difficult, because everyone who isn't used to having 99% of their new account information being in KeePass databases with randomly generated passwords, probably would find that too cumbersome to remain productive.
This seems like a people problem that makes being secure essentially impossible, due to how people use passwords (e.g. "I just use one password across X sites because remembering multiple ones is too difficult" or "I just add a number at the end of my current password").
And others also mentioned the productivity loss, for when people are slowed down by the need to change their passwords. You might easily rotate Let's Encrypt certificates thanks to automation but when it comes to people, things aren't so easy.
At that point, you might just stick with whatever passwords you have, do some dictionary checks in the future, maybe have infrequent password rotation and otherwise stack on more mechanisms, like TOTP through whatever application the user has available, or another means of 2FA, because relying just on passwords isn't feasible.
With cloud gaming you can stream 4K games at 60FPS, with clarity and quality for fast moving objects. Why does remote desktop still shit itself when I move around MS Word with a few pictures? I know a tier 1 financial company that offer 100k / year developers a slow VM and from there you have to log into another VM. The VMs are dual core, 8GB. I watch in horror as each keypress takes more than a second. The amount of…
What’s the input latency like in those cloud games?
Earlier quoted context omitted.
It just makes sshing between the machines by name very easy. You can do the same thing by assigning permanent IPs to all machines in the mesh and then updating all your host files across all the machines in the mesh. Life is too short for that.
Bizarre. Most VPNs used in a workplace would take care of name-based host resolution (ie DNS) for you. This is not a new thing unique to Tailscale.
It takes a few seconds to connect each new machine. It took me way more just to find out how I should configure Cisco's VPN client, and I do not ever want to even think about OpenVPN again.
I've also maintained a WireGuard mesh where I distributed keys and set up /etc/hosts via ansible: add a host to the inventory file, run the playbook - simple.
Yet Tailscale is even simpler than that. And (for my purposes at least) it's free.
Earlier quoted context omitted.
Yes, but if learning X beforehand required learning Y, then we might be expecting the value of learning X to be the combined value of learning X + Y. It should be noted when adopting this approach, that you're lowering the expected value from the people who make it through the funnel. This may be counteracted by more people making it through the funnel, or it may not. The delta in total value is completely unknown.
Those who make it through the funnel with only X are likely more than the X+Y scenario simply because it's less learning and new concepts so drop out will be reduced. This cohort are probably more likely to go on to learn Y if we further assume it was so valuable as to have been "required". In reality requiring X+Y backfires as step 1 because X is all they want and X may be worth 10Y to the student at step 1. The val…
My comment was in the context of students, which generally is backed by public funding. I'm worried about getting less value for the same number of public dollars. That being said, maybe it does still work out as an increase in total value, we should probably do a study on that.
That being said, I'm self-taught too, so I actually benefit if these classes provide less value, as it's easier to convince business folks to hire me instead, but it's the principal of the matter in this case (also I'm not really competing against recent college grads anymore).
Earlier quoted context omitted.
This is just flat out wrong. Any seasoned gamer can feel the difference between a few tens of milliseconds. 300ms would render most video games unplayable. I see this claim a lot and it's making me want to build a website that gives you some common interactions (moving a mouse cursor, pressing a button) with adjustable latency so people can see just how big of an impact seemingly small amounts of lag have on how resp…
Just running my display at 60Hz vs 30Hz is enough. The pointer feels extremely laggy at 30Hz, despite that being a higher refresh rate than a movie.
Earlier quoted context omitted.
I use seafile (similar to syncthing) and it allows to browse your data libraries without requiring a local copy for these cases
The issue is not so much "can I browse a virtual file system" but more "why should I depend on one local file system sitting on a remote server, probably owned by a third party, as being the single source of truth for my own files."
For the latency: 100ms is where the threshold is. Above 100ms, you start to really notice the latency and it becomes annoying to the point that you even start making mistakes while typing. Let's take an example: the average latency from my home laptop to a server in the AWS cloud is 20ms. If I add a GUI remote solution (such is Xpra, which is pretty good wrt latency), the latency increases to 60-80ms (and this is just for remoting a single GUI app like VSCode, but not the whole desktop). Now you add a latency of the app itself, which for VSCode is about 50ms. The total latency becomes 110-130ms. So latency-wise the experience of working with a cloud desktop is noticibly worse than my local developer laptop.
For the cost: my developer laptop costs about $1500. 16 cores, 32 GB of RAM, 1TB SSD. The equivalent cloud desktop setup would probably be around $400 a month. So in just 4 months the cost of the cloud desktop will exceed the cost of the laptop.
In my opinion, cloud desktops only make sense when you're not sure how much capacity you need. Is 4 or 8 cores enough for your work? 16 or 64GB of RAM? The cloud desktop setup is flexible. You need more you allocate more. But once the capacity is known, you should switch to your own hardware to significantly reduce the cost and actually improve the experience.
Earlier quoted context omitted.
This is just flat out wrong. Any seasoned gamer can feel the difference between a few tens of milliseconds. 300ms would render most video games unplayable. I see this claim a lot and it's making me want to build a website that gives you some common interactions (moving a mouse cursor, pressing a button) with adjustable latency so people can see just how big of an impact seemingly small amounts of lag have on how resp…
Just running my display at 60Hz vs 30Hz is enough. The pointer feels extremely laggy at 30Hz, despite that being a higher refresh rate than a movie.
a) movies are not interactive so latency is not a concern, only fluidity is
b) movies come with pre-applied motion blurring to hide the low framerate (which is different from fake motion blur applied in some games)
c) 30 FPS is atrocious even for movies and I wish higher framerate movies had gotten more common