maldeh

> I wish the order of presentation were different, because it starts with incorrect and misleading claims and then only later fixes its trajectory.

I wouldn't hold my breath, every inch of this article is evidently AI-generated - you can tell not only from the meandering narrative but also from the "Not because X, but Y", the short punchy sentences to reiterate the same point, the really strange cherry-picked examples for head-to-head comparisons, and the sincere concern over simplified generalisms.

> Yeah, ok. This is what they should lead with. It's an important message.

Is it? Your optimism in hoping to find some point to all this restores some of my faith in humanity, but I think it's misplaced here. The entire premise of the article is bizarre - why should it be surprising or bad that historical figures from 1000s of years ago, regardless of their historical importance, don't have proportionate representation in contemporary discourse?

The source is 4chan, and most certainly an exercise in creative s#!$posting.

It looks like it could be a binary intended to be snuck in with third party package dependencies and such that you might unintentionally execute within your lambda runtime. It's one thing doing mining at a slow trickle within the free tier of a single account, and another thing altogether when potentially millions of lambda functions in the wild are mining for you.

But agreed, it's not necessarily functionally different from any other crypto-mining malware hidden in public repos, save for the focus on runtime. Presumably Lambda provides a standardized enough runtime for reliable execution.

A more poignant elegy to the modern landscape of compliance theater I have never seen:

> Security Standards. Okta's ISMP includes adherance to and regular testing of the key controls, systems and procedures of its ISMP to validate that they are properly implemented and effective in addressing the threats and risks identified. Such testing includes:

> a) Internal risk assessments;

> b) ISO 27001, 27002, 27017 and 27018 certifications;

> c) NIST guidance; and

> d) SOC2 Type II (or successor standard) audits annually performed by accredited third-party auditors ("Audit Report").

I don't think storing AWS keys within Slack would comply to any of these standards?

Likely some stressed out buyers paid for overpriced homes given the sharply rising prices across the market (although completely by their choice), and the sellers probably loved it - but that's already par for the course with the housing market at the moment. Zillow probably didn't help but isn't the sole contributor by any means.

> A more innocent, but also unproven, theory is that those who got sick suffered from a mass condition brought on by some stressful underlying situation.

A Stand Alone Complex?

One could argue that we are doing the followup even to this day (with the China CLEP programme, India’s Chandrayaan, USA’s ongoing Artemis campaign and others). The deed was done, the minimum bar was set and humanity has been as determined as ever to breach the peak it had achieved back in the sixties even as government funding waxes and wanes. Public interest has not changed in the least.

India's first forays into semiconductor fabrication in the 80s and 90s were likewise enthusiastically supported by the government (land, incentives, tax breaks and so on), but were ultimately hamstrung by more fundamental infrastructure issues that couldn't just be magicked away - water shortages and unstable power grids - each of which could grind manufacturing to a halt for months on end and delayed production cycles. (I think there was also a major fire in a leading SC plant that caused delays by years.) If anything these shortcomings could be exacerbated in 2021-22. The government would need a much more comprehensive infrastructural solution this time around.

"Art is what you can get away with."

- Andy Warhol

Not to mention:

> Already have an account? No you don't.

> Try to log in below if you think you do anyway.

This is a good principle in terms of reducing the overall blast radius of exploits. But to do this the implementations should genuinely be independent.

In practice we may find a monoculture within a hidden layer of the stack than we're optimizing for, such as an OS kernel method, TLS library or chipset which coincidentally has captured the entire market. When a clever enough exploit on a common resource is found, then the problem transforms to one of coordinating patching for the same, wherein a broad ecosystem of higher level components (like Android or PCs) becomes nearly impossible to thoroughly cover. As such malware authors may potentially still get away with writing a single version of their software so long as they target low-level enough. With sufficient fragmentation they don't even need to invent their own exploits, just use publicly known CVEs that they can brute-force against older devices.

(Not saying you're wrong, your recommendation may still be better in the long-run. We're after all weighing the risk level of black swan events, such as a zero-day on a low level of the stack, or a high level of the stack on a high-volume vendor)