breakwaterlabs

> Shouldn't this problem show up in a much larger portion of the population?

Casual awareness of studies on this suggest that it DOES show up but the symptoms (lowered immune function, seasonal depression, bone issues) are generic and subtle enough to fly under the radar.

It is not helped that, in my experience, many US health plans do not cover the cost of vitamin D testing without a diagnosis of deficiency (which generally requires a test). While that cost is usually low it does mean that it tends not to be offered because practices tend to avoid non-covered procedures for administrative and billing reasons-- you have to actually ask your physician to do the test.

My understanding is that it is somewhat difficult to end up at serum levels of vitamin D that create actual problems, so in general my not-medical-advice suggestion would be to ask your physician about taking a supplement: they're cheap and if everyone took them it is likely population-level health would improve, and it may dramatically improve your QoL particularly in winter months.

Do you have a cell phone? Do you use Wifi? Do you use an ISP who, in the last few decades, has performed any form of interception or traffic-tampering?

I hazard that the answer to all three of those is "yes".

The near-universal use of TLS and the absurd ceremony we go through to ship root CAs everywhere is all premised on the idea that MITMs are not terribly difficult.

The entire reason one can rest easy as they connect to their coffee shop's WPA2-PSK network, is the security provided by TLS.

And if you don't think an ISP or agency would abuse this if it could be done undetectably then you haven't been paying attention these last 20 years (hence why DoH is now a thing).

If your argument is that we should stick rather closer to the RFCs and wire-level truths when explaining TLS and the eMuhdra situation to laypeople, I wish you all the best in your endeavor.

I find that communicating just enough to allow the formation of an roughly accurate threat model better retains attention; and in this particular situation I was being somewhat glib to emphasize the point of how insane our PKI system is.

> IF they first spook DNS

Or arp poison, or BGP hijack, or get in-path via tenancy shenanigans... TLS exists, premised on the literal assumption that such things are possible. If your argument is that we don't need to worry about a TLS weakness because such things are hard, I'd ask why we even bother then. CA compromise is the literal worst-case in PKI-world.

The private key is a red herring, it is not used for "encryption" as such.

The certs are used to validate website identity, whereupon key agreement is performed to establish a symmetric key that has nothing whatsoever to do with your certificate.

All that matters here-- all that we use the keypair for-- is to prove that each party "is who they say they are", and that is something your CA can lie about.

If a layperson understands,

    able to issue arbitrary certificates that an arbitrary browser will trust 

as

    has the secret codes to everyone’s encryption

...then they're close enough, without digging into the RFCs, codicils, addendums, etc. They can perform a MITM, which is the literal thing that our PKI/TLS system is supposed to guarantee cannot happen.

> they are trying to maximize screen space.

Ironic to say on hackernews which shows massive whitespace in the margins-- and if I try to widen my tab sidebar it actually indents the margin rather than eating into it.

One can look across the computing space as a whole and see that, it is surely not the case that we're "maximizing screen space".

It's hard to explain partly because when you explain this thing we've done with TLS and PKI, it sounds a little insane.

> "We set up a system where every government and a bunch of random banks and IT companies in the world holds the secret codes to everyone's encryption. Then we make them pinky swear not to abuse it, with stern talkings to if they do. And now it's all on fire, because one of them was irresponsible!"

You can know the intractability of the problem that PKI is solving, and the (worse) alternatives that have been tried, but that doesn't make this system not-insane to a normal person, and its at least a little bit the fault of the collective "us".

And it's not like it is an impossible problem; we rely on TOFU for SSH, we have remotely-attestable TPMs everywhere, ZKPPs / PAKEs exist, session keys and federation protocols are widespread. Somewhere in the set of "possible solutions" are options that don't sound unhinged when you explain how we got to this eMuhdra situation.

EC, not RSA. RSA would *never* allow something like that.

It would need to be a 3, 5, or 7, since a prime is required.

> It is a presentational symbol through which forms of felt life become publicly perceptible.

It is utterly baffling to me that this is a thing someone felt needed expressing. Surely, intuitively knowing this is part of being human?

How else do we explain the blues, love songs... anything?

Of course it's AI generated, its a benign, beige opinion being drummed up as some incredible insight. You can use Awk on plaintext? Incredible! No one has ever in the last 15 years of journald debates mentioned this.

And every such burst of inspiration is accompanied by bullet-points to flog the dead horse further.

Lest you think it wasn't mind-numbing enough, now we're turning it into a narrative arc worthy of a screenplay: text, coming of age, has become markdown (which the author certainly loves). Completing the arc, we're going to acknowledge its limitations ("be unbiased / balanced"), and then come to a denouement where we tie it up with a bland bow.

If it were easy to see what's a number and whats a string, type confusions a la YAML's fun wouldn't exist: Is "no" a string, a country, a boolean? Is 0 a boolean, a number, or char[48]?

This is specifically an area that "text" is quite bad and is the source of much woe. Your provided example would be parsed by most parsers today as a string, since it mixes spaces (non-numeric) and surrounds it with quotes.

In fact, given well-defined binary, it is rather simpler to turn it into "text" than the reverse. It seems like you've forgotten that "0x32 0x20 0x37 0x20 0x2A..." is literally what is in that file you would view. Plain text is, after all, just one example of a binary format.

In almost all of these cases, it is both: the labs are operating the agents, while developing them, and committing their CFAA felonies in the process.

"The law" already exists, civil suits are a thing, and we no more need targetted AI regulation than we need targetted truck-rebar-incident regulation.

These incumbent labs are angling for regulatory capture by stirring up hysteria and suggesting that existing laws are insufficient. Don't do their job for them, first test whether there's actually a legal gap here.

By what yardstick should we then measure the DoEd's performance-per-dollar, or determine whether it represents "waste"?

Because it seems to me that a chief indicator that waste likely exists is an inability to show ROI.

> There isn't really much waste in federal spending

I do not believe anyone who has consulted in federal IT or worked on contracts is capable of making such a statement. All of the motivations for all parties are heavily bent towards waste, and in fact any attempt to make things more efficient (reduce headcount, for instance) would be recieved poorly by department heads and contractors.

As one example, a department head who reduces staff by 20% has just reduced their own next year's budget AND kneecapped their resume.