181–190 of 300 posts
This is a big deal.
Earlier quoted context omitted.
In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about (in comparison to many other more likely failures): 1) determine what physical hardware in aws the target is running code on 2) somehow get the aws virtual machine manager to let the attacker run their malicious code on the same hardware 3) somehow pierce the protections of the virtual machine to read…
> In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about In AWS case, this is an AWS rule about when they will sign a HIPAA BAA, even though there is no HIPAA regulation that specifically prohibits the arrangement at issue. AWS clearly thinks it is worth worrying about. When you run your own public cloud, you can determine what risks are worth accepting p…
Earlier quoted context omitted.
This seems suspiciously like government getting something right... with regards to a quickly-evolving new technology market... has this ever happened before?
Can you think of a concrete example where the government got it wrong?[1] For the sake of argument, the federal government in the last 50 years? Maybe the encryption export ban. Or the CDA, but that was quickly reversed and the part that's left (Section 230) was really instrumental in the rise of the modern web. [1] And I don't mean wrong as in "NSA spying" because you disagree with the policy. I mean like, "regulati…
Clearly more work needs to be done to rigorously investigate and evolve the space, but recent Federal regulations have essentially put small innovators out of business.
In sum: a harm-reducing item is being regulated into the ground.
Earlier quoted context omitted.
The point I was trying to make is that if you have actuators running MISRA C that are going to be driven by something written in Tensorflow, does it still makes sense to have a requirement to use MISRA C in the first place for the low level part ?
I'd be very wary of using complex SOUP like TensorFlow, even if brought under my quality system. I think a good answer here is that once one goes under design control the subset of functionality needed should be implemented in-house under the organization's SDLC.
From the regulations: "Fall back strategies should take into account that—despite laws and regulations to the contrary—human drivers may be inattentive, under the influence of alcohol or other substances, drowsy, or physically impaired in some other manner." NHTSA, which, after all, studies crashes, is being very realistic. Here's the "we're looking at you, Tesla" moment: "Guidance for Lower Levels of Automated Vehic…
For the Tesla comment, what more could you expect from them right now? If you have auto pilot on your hands have to be on the wheel or it vibrates and then it starts slowing down e eventually since it knows it's not safe. People can work around any system for this, but stuff like this makes it have to do it consciously. Seems pretty reasonable on Tesla's part.
Earlier quoted context omitted.
> In practical terms I don't agree that the threat of someone doing all of the following things is worth worrying about In AWS case, this is an AWS rule about when they will sign a HIPAA BAA, even though there is no HIPAA regulation that specifically prohibits the arrangement at issue. AWS clearly thinks it is worth worrying about. When you run your own public cloud, you can determine what risks are worth accepting p…
Yes, I agree that Amazon is behaving perfectly rationally given the legal environment. My point is that the legal environment has been designed in an un-optimal way from a technical perspective. Identifying such a situation was rayiner's request.
I'm not commenting on Amazon's rationality (I haven't actually evaluated the security concerns that would determine that.)
> My point is that the legal environment has been designed in an un-optimal way from a technical perspective.
And you haven't pointed to anything in the legal environment that is suboptimal from a technical perspective. You haven't even pointed to anything in the legal environment at all.
Amazon (as a BAA) has certain administrative responsibilities for putting administrative and technical safeguards in place to prevent breaches, and certain obligations and liabilities in the case of breaches. HIPAA and related laws and regulations do not specify the specific administrative or technical safeguards, though they do specify areas that must be addressed.
Amazon has decided that the particular technical arrangement you prefer is too high of a risk, but you haven't pointed out anything that indicates that this is the result of an outdated regulation that results in poor technical choices rather than technology-neutral regulation and a reasonable evaluation of the security concerns of the particular technical arrangement you would prefer.
It wasn't mentioned in the bloomberg article, but the 15 areas covered are: • Data Recording and Sharing • Privacy • System Safety • Vehicle Cybersecurity • Human Machine Interface • Crashworthiness • Consumer Education and Training • Registration and Certi cation • Post-Crash Behavior • Federal, State and Local Laws • Ethical Considerations • Operational Design Domain (operating in rain, etc) • Object and Event Dete…
The cynic in me immediately interpreted "Post-Crash Behavior" as the exact opposite priority from "Privacy".
The data collection "black box" side of it is in a different section.
Earlier quoted context omitted.
While networked cars are interesting, there is also a massive security issue here. Hackers will easily figure out a way to spoof the communication, and could play with traffic. There are mitigations for most issues, but it's a complex topic. Just imagine some scenarios: -) Spoof an emergency break advisory that causes tailing cars to also do an emergency break. (could be mitigated by first observing that cars in fron…
>Hackers will easily figure out a way to spoof the communication, and could play with traffic. It's far far easier and quicker to throw a brick off a highway bridge but that surprisingly happens very infrequently.
What is it about self-driving cars that has HN readers so incredibly excited? Sorry if it's a little off-topic. The reason I ask is there are plenty of other countries in the world where cars just aren't that important, let's take Netherlands for example. If you have automatic cars, society here is not just going to be that excited AFAIK. Public transport here is great and most people cycle everywhere, because it's f…
Now imagine the scenario for most of the US, a public-transport-hostile country for the most part, where millions upon millions of people burn their precious lives waiting in traffic and sucking in traffic fumes. In my mind, this is one of the most appalling wastes of human potential that has ever existed. Sure, some try to make lemonade out of lemons by educating/informing themselves as they see fit but by and large, it is a huge waste. Not to mention the many thousands of people who die every year in car accidents during the daily commute.
So from my point of view, the self driving car is a thrilling concept: the ability to disengage from a useless, pointless, and hopeless daily grind and engage in something that I want to do, whether it be work, reading, watching a movie, etc. is cool. The closest I have come to this dream in my transit-unfriendly Texas city is the one job where I had an opportunity to take the train/bus into downtown: while this made my daily commute very long, I loved it because it freed me up from the drudge of driving.
Some might ask that perhaps I just hate driving. That is not true. I love taking road trips or autocrossing when I can. But to equate the daily commute with enjoyment is a bridge too far, in my opinion. Banish it, I say, banish it.