acdha

Remember that the non-defense sector of the government has been having cuts for decades and lots of important work is outsourced to rotating contract teams. This is definitely unacceptable but I'd bet there were more than a few people there who were profoundly unsurprised that the backlog caught up with them.

You might be detected but if, for example, you were smart enough not to MITM the same client twice after an error, I suspect a ton of people would ignore it and just assume the airport/coffee shop WiFi was flaky.

I’d also bet more things use libcurl behind the scenes than we appreciate, and that at least a few of them have things like silent updates which retry after a failure without notifying a user. I’ve seen a lot of agents which just try to periodically check in because they’re designed not to be noisy on lousy networks.

It’s a hard problem: if you query on use, you not only introduce delay but also leak information about what servers people are connecting to. Dealing with that starts looking a lot more complicated (bloom filters per CA of recently-revoked cert IDs?) needing to be implemented into multiple libraries and the failure mode is an outage unless you fail open.

It’s not an excuse but an explanation: there are separate stacks owned by different teams and they haven’t been forced to collaborate. If you use an internal CA you’ve already had to deal with the easier additive version of this problem because that fails in an obvious, less harmful manner than quietly accepting something which needed to fail.

I was also surprised to find Java’s key tool returning successfully for the delete request without actually doing anything: list, delete, and list again would still show the CA. Debian had this right during the 90s, all they had to do was follow the system convention.

This feels like all of the C code getting attacked now where everyone spent the last three decades building up cruft because fixing it would be a chore, and now the separate bills are coming due all at the same time.

It’s more expensive to use them all day: that’s the problem facing power plant owners where renewables are so much cheaper that they break the economics for power plants which were designed to run continuously but are more expensive when wind and solar supply is limited.

(That’s the answer for the northeast, too: New England has no shortage of wind all winter long and batteries don’t care where the electricity comes from)

That’s a pretty massive assumption at the end: you really don’t want to cut corners with safety and unless the government can simply ignore residents, very few people are willing to live near a nuclear plant so you have to anticipate delays or higher transmission costs.

While all of that’s happening, you’re guaranteed to be producing more carbon emissions before anything can be displaced.

It’s becoming common but the current administration has been highly committed to preventing that because it cuts into their fossil fuel donors’ business.

Grid-scale sodium batteries are already in production, and there isn’t some kind of magic anti-technology shield which keeps the United States in the 1920s.

When talking about cost, it’s important to remember that solar+batteries are already cheaper and, unlike nuclear, happen on much shorter timescales. I’m not opposed to some nuclear plant starts but those guarantee a couple decades of increased pollution before there’s any chance whatsoever for carbon reduction, whereas solar can come online in a year.

Serious citation needed that there are week-long stretches of continuous wind-free heavy cloud covering thousand mile stretches of the United States.

Also, it’s weird to talk about Florida when, say, Arizona and Utah, etc. are right there. Even Wyoming despite being further north has over half of the month sunny in the winter. One thing to remember is that we could power the entire country using solar with a fraction of the land currently used to produce corn for ethanol so we don’t even need to substantially change land use, just stop subsidizing inefficient fuel generation.

That's why it's important to practice your processes for both shipping quickly and overriding cooldowns. There's a baseline of things which are not easy to exploit where you want to patch on a regular cadence and the risk posed by a supply chain attack is greater than the risk of an attacker having enough of a footprint inside your systems to escalate. The fact that sometimes you have a specific situation like this where that's not true doesn't mean that 9 times out of 10 the cooldown was the better risk-reduction strategy.

I’d worry if they try to grow too quickly and take on large amounts of investment. Pressure to deliver huge hits can be toxic.

I really think it’s going to depend on how big they get. Early BioWare very clearly had everyone committed to building games they were proud of; EA’s management equally clearly are just moving money around for things they don’t care about or believe will negatively impact them personally.

I think that pattern is widespread around the greater tech industry: antitrust enforcement, etc. would be great for having fewer cases where decisions which affect thousands of people are being made by executives who are really detached not just from consequences but simply awareness of what’s going on in each of the different segments of their business.