xbar

You wouldn't steal a book....

There are low-integrity folks who are willing to risk getting caught for fakery in public spaces in trade for the promise of notoriety.

Chicanery seems to scale anywhere that there are insufficient institutional barriers.

Parenting-level policy response recommendation: once the trees grow back, you can proceed.

Don't blow it, Canada. You think Rogers is bad now....

This is a neat trick. I would like to see a series of House investigations that do this and publish the wiki as a matter of course.

Security folks have understood this math for years: there have always been virtually infinite vulnerabilities in production software. Better researchers find them in any repo rather rapidly. The only thing keeping folks safe has been the limit to the research against any given repo that any highly-capable researcher would devote.

As the cost of research approaches 0 via AI tooling that approaches highly capable (and now tireless) researchers, the rate of findings will increase, as will the rate of subsequent incidents.

What remains an open question is whether in-production code quality can improve sufficiently over time to return to a state of relative security.

It turns out that privatization of public services does not yield the lowest prices for consumer as a result of market forces. Because it does not create services markets, it creates services monopolies.

It has not gotten any worse. The rapacious greed of politicians in service to their own interest has been universal since the beginning of politics.

No. That is reactionary. Conservatism means "government should govern as little as possible to guarantee freedoms, and no less. it should not provide services for a fee (aka tax)."

I would expect rule-of-law to have consequences for a failed root CA before entrusting a nation with another.

Well said. I choose not to believe this was an error.

Sorry Quad9. I love you. I am sad France does not understand you the way I always have.

Stay Swiss, my friend.

After the first 8 hours of playing with Mythos, I was asked what I thought. My response, "this generation of LLMs is going to drive the largest wave of security incidents the world has ever seen."

It is still getting started.

CA approvals are bad. From 2000 to 2015, I ran an org where we allow-listed a modest subset of the the CAs that were approved by Google, Microsoft, and Mozilla. There were too many incidents and bad actors.

Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.

Smart business decision to have made 10 years ago. Thanks for the mess.