381–390 of 390 posts
I'm -constantly- seeing 'certificate expired' in my browser. This certificate stuff is so hard that they can't pay some Chief Certificate Officer $15/hr. to -do nothing else- but assure that stuff is renewed in a timely fashion? We furry 'self-reproducing' (YMMV) mammals are simply not ready for all of this.
Note for company communication guys. Please, please don't say: "Our teams apologize for any inconvenience this may be causing you" instead opt for "Our teams apologize for any inconvenience this caused you"
Earlier quoted context omitted.
Firefox and Chrome give me that warning page, but I just click on "Advanced" and it will let me continue to the website. At least for me, it's just a huge warning to be careful but I still have ultimate control.
Watch Google decide that the advanced option is a security problem, and remove it, and Mozilla gladly playing along because "security" and "users are dumb". The "owner" is no longer in control, and has not been ever since the web became "app-ified".
Browsers could have bright red flashing lights telling users that they're currently being phished and users would still enter their credentials because doing nothing isn't seen as a meaningful alternative action.
Earlier quoted context omitted.
It's not like a cert is necessary for it to function. A VR headset is basically a monitor you wear on your face. This is their own poor design choice that just ensures they're going to lose business of anyone who needs reliability in their headset.
The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…
Earlier quoted context omitted.
The "monitor you wear on your face" trope is simply inaccurate, and essentially a misunderstanding of the state of VR today. I say this not to either criticize you or excuse the mistake by Oculus (they really needed to countersign their cert with a timestamp server), but to educate. These are non-obvious issues to people that don't follow the VR sector. Monitors work without low-level drivers because their maturity (…
A surgeon doesn't care about any of this.
> "Each year, the FDA receives several hundred thousand medical device reports of suspected device-associated deaths, serious injuries and malfunctions."
It is also specious to argue that a consumer product is being used for live surgeries without FDA approval.
This does not excuse the mistake, nor does it change the fact that the error will make people question the reliability of the product - as they should.
However, mistakes do happen, even big ones. Rockets blow up. Airbags have defects that make them not work. McAfee pushed out an antivirus update that deleted a Windows system file, crashing hundreds of thousands of PCs.
The important questions are: how does the vendor respond, what procedures do they put into place to prevent it from happening again, and are those procedures enough to give future buyers confidence that the issues are addressed?
Saying "that shouldn't have happened," while perhaps true, is simply not constructive.
Earlier quoted context omitted.
Checking at install time is effectively useless. The whole point of running signed code is that you can't just load some rootkit. Secure Boot only loads a signed bootloader which only loads a signed kernel which only loads signed kernel modules. You can't do what you're suggesting without fundamentally breaking this chain of trust. What's to stop a rootkit from just spoofing that it was installed months ago?
> What's to stop a rootkit from just spoofing that it was installed months ago? The fact that if a rootkit is in a position to performing that spoofing, it doesn't need to , because it already has the power to make arbitrary modifications to the system image.
Earlier quoted context omitted.
Checking at install time is effectively useless. The whole point of running signed code is that you can't just load some rootkit. Secure Boot only loads a signed bootloader which only loads a signed kernel which only loads signed kernel modules. You can't do what you're suggesting without fundamentally breaking this chain of trust. What's to stop a rootkit from just spoofing that it was installed months ago?
The signed kernel keeps track of when it first has seen a certificate. That is signed by a kernel, so a rootkit can’t spoof unless the system is already compromised.
Earlier quoted context omitted.
Those things aren't cheap for simulators, either - not to mention knock-on costs. "What do you mean - I got the doctors in, which alone took a month of herding cats, and now it won't work, just because?" How low has the SW development bar gone, if "it's okay" now means "at least it's not directly killing people"?
The GP was suggesting that this could kill people. I simply implied that it wouldn't, and compared to killing people, I would say a lost day is "okay".
In other words, comparing to the worst possible outcome is, by definition, not a very high bar.
Earlier quoted context omitted.
FYI, the Oculus does work without internet.
So does Steam, but the metrics filter back to the mothership eventually.
Maybe I should have just given up the day Oculus dropped Linux support.
Earlier quoted context omitted.
Watch Google decide that the advanced option is a security problem, and remove it, and Mozilla gladly playing along because "security" and "users are dumb". The "owner" is no longer in control, and has not been ever since the web became "app-ified".
It's not that 'users are dumb' it's that the only way to keep users and lazy IT staff from telling people to just click through the warnings is to make it difficult to do so. How else can you fight the 'click through until it works because I have work to do' mentality? Browsers could have bright red flashing lights telling users that they're currently being phished and users would still enter their credentials becaus…