fc417fc802

Without taking a position I will point out that your stated reasoning doesn't hold due to how much momentum these systems have and how slowly they respond. It seems entirely plausible that this outcome would still have happened if temperatures had plateaued several years ago.

When it comes to PE there are myriad examples of shareholders taking a short term view. So are you suggesting then that shareholders of publicly traded companies are somehow different? I think that would be on you to justify but you've instead chosen to attempt to mock me for wrongfully assumed ignorance.

> Shareholders are looking for sustainable projections of growth.

Then why are there so many examples of PE destroying things to make a (relatively) quick buck?

As a native speaker from the US who knows it as two syllables, what region of the US are you referring to? Is this a deep south thing?

If france wants to institute their own great firewall then they should just do that rather than engaging in twisted extra-national half measures that make liability confusing for everyone.

Sure, but "must never leave the HSM" is much easier to audit for and much more difficult to screw up. This entire thing (allegedly) happened because of faulty logic; categorically disallowing as much logic as possible seems like the straightforward fix to me.

If transfer were to be allowed I'd think it should be entirely facilitated by the hardware itself and that capability audited as part of the approval process. (I assume the HSM used in this context is already subject to approval?)

You seem to be agreeing with me. I said it's an open question so expecting me to rigorously answer it in an HN comment is quite absurd, no?

There's nothing unfalsifiable about pointing out that we don't know something.

Closely related, "is this machine conscious" is an important question when it comes to ethics yet runs into the exact same problem. Yet you can hopefully see the issue with blindly deciding in either direction on that one.

> This is a Swiss company offering services to French users.

If I operate a bookstore physically in switzerland and a few of the books I sell are illegal in france I'm not required to check passports or whatever, am I? I can just sell books to whoever (subject to swiss law) and if a french national illegally imports one to france that's a problem for customs or the local police or whoever (analogously the french ISPs) to deal with. Not me, the swiss bookstore operator.

Now consider if I were handing out pamphlets for free rather than selling anything. At that point I'm arguably not even doing business because no money has changed hands.

I realize that the current legal reality might be that quad9 needs to block french users in practice but the entire thing is a farce if you stop and think about it.

Not at all. It's an open question and it's also probably semantically ambiguous. It's cliche to the extent that recently it comes up repeatedly. Regardless of all that it's nonetheless a valid question.

> you must acknowledge consciousness can arise in an agglomeration of human brain cells

That doesn't follow. You could, for example, be a substance dualist. Alternatively you could suspect that there exists some special as yet undocumented property of the human CNS that is required as a prerequisite. Or etc.

In the case of nuclear arsenals that's perfectly fine - MAD simply needs to be plausible, not robustly demonstrated. In the case of CAs I'd argue that the description doesn't really fit since they're getting stress tested by malicious parties on a daily basis. By that logic you could describe linux kernel security as a potemkin village due to the steady stream of zero days. In reality a potemkin village is something intended from the start to deceive everyone else. It's not impossible that's what happened here but that's a very serious allegation to make (ie theorizing that the weak keys were intentional with a conspiracy afoot).

The entire system (CAs and ICANN DNS) was never good to begin with; it's just become that much worse due to the shifting situation over the years. It's an inherently centralized design with no way to verify that example.com is operated by the same entity from one day to the next. The namespace is global and effectively an exercise in rent seeking.

At absolute minimum any sensible system would have a TOFU element whereby the site operator of example.com changing from one day to the next would result in all the tooling across the entire stack screaming loudly (in other words what ssh does). And that's just the absolute bare minimum change that's needed.

I was about to reply with "they didn't have a choice" but on second thought perhaps CAs are important enough that they should never be allowed to export keys from an HSM and should instead be required to physically deliver and install the HSM wherever it needs to be in the world. Inconvenient and expensive but likely for the best.

Doesn't that also fetch the content directly? So depending on the logic of the filter it likely won't make any difference.

Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.