bigfatkitten

It’s absolutely possible, but almost nobody does, at least until they get breached.

Developers have decided that the convenience of just letting their servers pull arbitrary code off the Internet is more important than the security risks.

There’s also been a regression in how infrastructure is operated.

15 years ago you didn’t let your production infrastructure talk out to the Internet, and if you did, it was via an explicit proxy with allowlisted domains. This significantly limited the damage that a malicious dependency could cause.

With the move to cloud and DevOps, that network security model disappeared.

Back then they only really did routing and switching, and those are still the only things that Cisco kind-of does well.

Almost every new product of theirs I’ve touched in the last 20 years has been trash, and even the R&S golden goose is being dragged in that direction with customer-hostile functionality like Smart Licensing and a general decline in quality.

And that you have to do business with Google, who have a religious objection to providing any meaningful customer support.

I get better support from AWS as a $30 per month customer than I did with GCP and Google Workplace spending $300k per month at work.

I stopped worrying about this because everyone I correspond with uses email services that store emails in plaintext, mostly Microsoft and Google.

I am also a happy Fastmail customer, but they are an Australian company with infrastructure in the US.

That’s more or less how I’ve heard Meta employees justify their own career choices.

Or Afghanistan, or Vietnam.

It’s a pretty obvious outcome. Attorney-client privilege applies to the executive branch of the government as much as it applies to anyone else, and not just in national security matters.

You’re government agency, and you ask your lawyers about how the law operates given a particular set of circumstances.

In response, the lawyers provide you with advice about how they think the law applies to this situation, and what findings they think a court would make given the evidence etc available.

Information subject to attorney-client privilege (as this information would be) is exempt from release under FOIA anyway. Dropping a security classification on top adds protections against unauthorised release by insiders.

Sometimes there are good reasons for this, such as to protect particular technical capabilities that are easily circumvented if adversaries know that they exist, or to protect human sources who might end up dead if found out. Other times, there are no good reasons to do this but without knowing all the circumstances it’s impossible to tell either way.

The fact that you suggested that number people of people who install custom bodies etc is miniscule indicates that you are not at all familiar with the AU/NZ market.

That’s not a new thing.

I replaced the heater core on a 1987 Ford XF Falcon. In hindsight, it would’ve been easier to pull the motor out and cut myself an access panel in the firewall than it was to disassemble and reassemble the dash.

> Why would you want that on EV chassis tho?

Because you want to install equipment such as air compressors, pumps, welders, cranes or water tanks, or you want to carry bulky items like ladders, and/or you need accessible and ergonomic lockers, drawers etc to store your tools and equipment without having to dig around the tub.

Same reasons as you’d do this on an ICE truck.

The number of people (and in particular, fleet operators) who do that in Australia and NZ is extremely high.

Ford Ranger Super Duty wasn’t even available with a factory tub at launch, and the Toyota Landcruiser 79 doesn’t have one at all.