Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)S
帖子
5
评论
685
加入于
2 yr. ago

  • Section 3 of the 14th Amendment does not require any specific test which defines “insurrection”.

    Ya, the real problem is that it doesn't. As specifically stated by the CRS:

    Determining who has engaged in either of the two disqualifying activities—that is, engaging in insurrection or rebellion or giving aid or comfort to an enemy—is likely to be a difficult task given the scarcity of precedents and lack of clear definitions

    And that difficulty is why that whole document exists, there isn't clear legal guidance. And the historic precedents on it are a mess. Yes, either house of Congress has the power to refuse to seat a member of their respective house and have used the 14th Amendment as a reason in the past. Moreover, Congress could pass a law which sets out a legal framework; but, that's not really happened either. The whole reason that this is even a discussion is that lack of clarity.

    Republican strategy has long revolved around the targeted devolution of norms. They hide in the cracks between definitions which assume good faith participation in the labor of mutually consensual governance and shield themselves in perpetual faux-victimhood. If Congress does not pursue the execution of Section 3 it is nothing less than an abdication of their duty to their Oath of Office.

    Arguably, Congress did try to do something, the House Impeached Trump. The Senate dropped the ball. And the American people then buried that ball far enough to interfere with Satan's daily activities by re-electiong Trump. It's a bad situation, but also not one we're going to solve by misrepresenting the law. Especially by handing The House the sole power to determine what Presidential Candidates have engaged in insurrection by a simple majority vote (the requirement to impeach). If you want to bring up "devolution of norms", that sort of power is going to take the cake. Anytime we have a split government, we're going to see impeachment and barring from office on the flimsiest of excuses. What we need isn't half-baked ideas but an actual, well considered framework.

    Your last paragraph is a result of misunderstandings and assumptions on your part.

    I think it's down to you moving the goalposts. You specifically stated:

    The language of the 14th doesn’t require an impeachment or other formal conviction to apply. The fact that Trump was successfully impeached for inciting an insurrection is enough. The Senate’s failure to execute its duty does not erase reality.

    You are arguing that the House Impeaching is enough to trigger Section 3 of the 14th Amendment. Which is what I'm calling ridiculous. Trump being convicted by the Senate would have clearly barred him from holding office again. The reality is that he was acquitted. That's the part which is actually important.

  • What the fuck did Greenland do to deserve this?

    It likely has a lot of mineral wealth. It's best to get control of that wealth, before some dirty locals try to setup their own government with rules about respecting them, their culture or property.

    /s on that last bit, for the terminally stupid.

  • In fact, any civilization capable of long distance space travel would have to overcome such idiocy and maximize the potential of all individuals, regardless of the wealth they were born into.

    I'd be curious what you base this statement on? Historically, the societies which did the most long distance travel and exploration were the opposite of this. Spain and Portugal were absolute monarchies, with well defined feudal systems which exploited anyone outside the noble class. Yet, their efforts to "explore" and dominate the Americas were incredibly successful. The UK's greatest exploration and extent was a direct offshoot of Mercantilism, with the East India Trading Company being both the primary actor and beneficiary. US Westward expansion was predicated on theft, war and genocide. Though, as a counter-point, the modern US system does a better job of providing opportunity to most people (with some notable problems), than it used to. And the US has been a hotbed of advancement in the last century.

    In modern times, space exploration was originally driven by the desire to find new and interesting way to kill other people. And it's only been recently that peaceful sharing of information has been normalized. Even there, the cutting edge of space exploration seems to be back in the hands of mercantilist forces. I mean, I love me some SpaceX, "let's catch a rocket" shenanigans. But, we also shouldn't pretend that SpaceX is anything other than a for-profit corporation under a leadership which would be happy to harvest organs from people for a profit.

    I know it's popular to think that space exploration must be a Star Trek style "space communism". But, this doesn't really align with the examples we have from history. And while that is certainly a human centric way to look at the problem, it's also the only real world example we have to look at. Everything else is just philosophers sitting around, passing a bong and saying, "man, what if..." It can be a useful exercise to think about other possibilities. But, I'd tend to focus more effort on what we have evidence for, than made up ideas.

  • I wondered why Samsung, a company that literally produces military weapons, wasnt on the list.

    The PDF you linked: Designation of Chinese Military Companies.Samsung is Korean.

    And while I'm sure the Chinese Government would love to dig out a map from the Han Dynasty, claiming rule over the entire Korean Peninsula, I doubt Samsung is making weapons for them.

  • Yet.

  • Once again, the opposite of “live service” is not “single player”.

    Thank you. As someone who loves multiplayer games, I like that I have had a lot of options lately. But, this whole "live service" crap needs to die. Sell me a game and then go away. If you want to release an expansion and sell me that, great, I'll take a look. But, quit trying to sell me a subscription.

  • Studio execs look at the mountains of money which have come from online games like WoW or Fortnite and get gold fever. They dream of having a permanent siphon attached to their customers' wallets and so will ignore any warning signs that their ideas suck and keep chasing the subscription model. And, in the end, it's not the execs who really suffer when these things don't pan out. They blame "market forces" and "soft demand", fire the development team and then spin up the next stupid idea, either at the same company or at a new one.

  • Kinda "meh" on this one. Sure, attackers will use other formats to spread malware. But, it's not like thy haven't been successful enough with zip files. If anything, it might mean that Windows Defender actually has a better chance to analyze the contents, before they execute. Though, whether or not Defender will actually block the execution is open for debate.

  • The fact that Trump was successfully impeached for inciting an insurrection is enough. The Senate’s failure to execute its duty does not erase reality.

    Do you actually understand how impeachment works? The House passing articles of impeachment means very little. For a legal equivalent, it's like the grand jury agreeing to indict. Should we be punishing criminals just because charges were brought against them, even if they were acquitted? Of course not. While the House has the Power to Impeach:

    The Senate shall have the sole Power to try all Impeachments. -US Constitution, Article I, Section 3, Clause 6

    The reality of the situation is that the Impeachment of Trump isn't a factor in the 14th Amendment barring him. Had the Senate convicted, it would have been a cut and dried situation, but that didn't happen. Were Trump convicted for insurrection for his actions on January 6th, it would again be an easy situation. The reason there is such an interesting conversation, and not much else, around the 14th Amendment and Trump is that the legal situation isn't clear. Lots of folks have said that Trump's actions were an insurrection, but he hasn't actually been convicted of it. Congress could probably bar him from holding office, but that hasn't happened.

    I'd also point out how insane it would be for the House's Power to Impeach to become the de facto bar for executing the 14th Amendment's bar on holding office. This requires a simple majority in the House. Really think that one through. You want the House to be able to bar any person from holding Federal Office, based on a simple majority vote? The level of chaos that would create would be insane.

  • This is not speculation. Donald Trump was successfully impeached for inciting insurrection.

    Did you stop reading your link at the title? Literally the third sentence:

    On February 13, 2021, the Senate voted to acquit Trump on the article of impeachment.

    If you want to dig into the arguments about what is and isn't legally insurrection and if the 14th Amendment is self executing or not, that is an interesting discussion. But, don't lead with a "pants on head" stupid argument that the House passed Articles of Impeachment, for which the Senate acquitted him, as evidence that the 14th Amendment applies. Just fucking no.

  • My all time favorite was Robotech, though it has not aged well.I also went through a lot of Disney in my youth:

    • Gummi Bears
    • Duck tales
    • Darkwing Duck

    And then there was the smattering of others:

    • Dungeons and Dragons
    • Thundercats

  • No RTO

    跳过
  • I work in cybersecurity. One of our common issues is people getting malware while surfing for porn. I'm willing to bet that it's not all looking and no touching.

  • Yes, as soon as we actually invent AI.The Large Language Models we have now aren't really it. When we have programs which can come to a well reasoned decision and actually explain the logic of said decision, then we'll start having something approaching AI. For now, it's just a well directed random number generator.

  • The kids are over the moon with their gifts. Ma's in her bath tub and I'm in my cups. And I'm about to settle in for a long evening of Nethack. So ya, I'm feeling pretty good for Christmas evening.

    I hope everyone here who is feeling down finds something in the new year to make them happy.

  • I'm sure there are several out there. But, when I was starting out, I didn't see one and just rolled my own. The process was general enough that I've been able to mostly just replace the SteamID of the game in the Dockerfile and have it work well for other games. It doesn't do anything fancy like automatic updating; but, it works and doesn't need anything special.

  • I see containers as having a couple of advantages:

    1. Separation of dependencies - while not as big of issue as it used to be, just knowing that you won't end up with the requirements for one application conflicting with another is one less issue to worry about. Additionally, you can do anything you want to one container, without having an effect on another container. You don't get stuck wanting to reboot or revert the system, but not wanting to break a different running service.
    2. Portability - Eventually, you are going to replace the OS of that VM (at least, you should). Moving a container to a new OS is dead simple. Re-installing an application on a new OS, moving data and configs can be anywhere from easy to a pain in the arse, depending on the software.
    3. Easier fall back - Have you ever upgraded an application and had everything go to shit? In my years working as a sysadmin, I lost way too many evenings to this sort of bullshit. And while VM snapshots should make reverting easy, sometimes it just didn't work out that way. Containers force enough separation of applications that you can do just about anything to one container and not effect others.
    4. Less dependency on a single install - Have you ever had a system just get FUBAR, and after a few hours of digging the answer seems to be, just format the drive and start over? Maybe you tried some weird application out and the uninstall wasn't really clean. By having all that crap happen in containers, you can isolate the damage. Nuke the container, nuke the image, and the base OS is still clean.
    5. Easier version testing - Want to try out upgrading to version 2 of an application, but worried that it may not be fully baked yet or the new configs may take a while to get right? Do it off in a separate container on a copy of the data. You can do this with VMs and snapshots; but, I find containers to be less overhead.

    That all said, if an application does not have an official container image, the added complexity of creating and maintaining your own image can be a significant downside. One of my use cases for containers is running game servers (e.g. Valheim). There isn't an official image; so, I had to roll my own. The effort to set this up isn't zero and, when trying to sort out an image for a new game, it does take me a while before I can start playing. And those images need to be updated when a new version of the game releases. Technically, you can update a running container in a lot of cases; but, I usually end up rebuilding it at some point anyway.

    I'd also note that, careful use of VMs and snapshots can replicate or mitigate most of the advantages I listed. I've done both (decade and a half as a sysadmin). But, part of that "careful use" usually meant spinning up a new VM for each application. Putting multiple applications on the same OS install was usually asking for trouble. Eventually, one of the applications would get borked and having the flexibility to just nuke the whole install saved a lot of time and effort. Going with containers removed the need to nuke the OS along with the application to get a similar effect.

    At the end of the day, though. It's your box, you do what you are most comfortable with and want to support. If that's a monolithic install, then go for it. While I, or other might find containers a better answer for us, maybe it isn't for you.

  • I'm not going to defend everything the TSA does. And they do have a lot of problems. But, the lines at the checkpoint are the result of trade-offs in security. For all things security related, it's about managing risk. You will never eliminate risk, so you need to pick and choose where to apply controls to reduce the worst risks and accept some risk in other areas.

    Think about the possible outcomes from terrorist attacks on airports. There are several possible scenarios:

    1. The attacker kills a few people in the airport using a direct weapon (gun, knife, etc.)
    2. The attacker kills a lot of people in a small area with a area weapon (bomb, gas, chemical, etc.)
    3. The attacker destroys an airplane in flight, killing everyone onboard.
    4. The attacker hijacks the airplane and takes everyone onboard for ransom.
    5. The attacker hijacks the airplane and uses it as a weapon, killing everyone on board and more people on the ground.

    We could probably come up with other cases, but I think this covers the bulk of it. So, let's dive into managing these risks. What are the effects of such attacks, if successful?Looking at case 1, how many people are likely to be killed? Well, that depends on the police response time and the effectiveness of the attacker's weapon. But, based on other mass casualty events, this probably falls into the range of 10-30 people. It could move outside this range, but this is pretty typical of such situations. To pick a number in the middle, will say they the expected loss for such an attack is around 20.With Case 2, again there is variability. But, it's also something we have analogs for and may be able to put a range of casualties on. The Boston Marathon bombing in 2013 killed 6. The attack on Kabul Airport in 2021 during the US evacuation killed 182, though that also included multiple gunmen attacking after the explosion. Let's put the loss rate around 50 for as single bomb, assuming a very packed area and a very effective bomb.For Case 3, the numbers are a bit easier to get a handle on. Typical airliners carry anywhere from 100-200 passengers. The 737 MAX 8-200 is designed for 200, while the Airbus A200-100 carries around 100 passengers. We'll pin the loss rate here at 150, as attackers are likely to target larger aircraft for this sort of attack.Case 4 is basically Case 3, but with an optional loss of only money. For that reason, I'm going to remove this case, but wanted to mention it to avoid the "well akshuly" crowd, since this is a historic problem.That leaves Case 5. And it's Case 4's situation, plus some number of people on the ground. Certainly, not every such use of an airplane as a weapon will be as successful as the attack on 9/11. And that also involved multiple successful attacks. But, let's assume that such attacks will hit populated buildings and cause significant damage. We'll pin the expected loss at 200, This is 150 for the airplane and 50 on the ground, somewhat equivalent to Case 2 with a bomb in a crowded area.

    Ok, so we have expected losses, now lets talk about how often we expect such attacks to happen? And yes, this is a rough guess. But, since terrorists are unlikely to publish their plans, it's the best we can do. We also face a difficulty in that these are still (thankfully) pretty rare events. And trying to extrapolate from a small set of data points is always a fraught exercise. So, fell free to quibble over these numbers, but I don't think any numbers which fall into a reasonable range will change things much.Case 1 - This attack as a pretty low barrier to entry. If a person can be found to perform the attack, arming them isn't terribly hard. So, we let's assume we get 2 of these attacks a year. I don't think we're actually getting that, but out goal is just to get into the right ballpark.Case 2 - This attack takes a touch more work, bomb making isn't that hard, but making a really effective one isn't easy either. This type of attack does have the advantage that it doesn't always require the attacker to die in the process. So, it might be easier to find someone willing to engage in such an attack. Let's call this 1 per year.Case 3 - This also requires a bomb, but it may not need to be quite as big to be effective. Granted, modern aircraft can be amazingly resilient (see Aloha Flight 243). This attack also results in the attacker dying, so that can be a bit harder to source. So, lets say this happens once every other year, or 1/2 per year.Case 5 - So, no bomb this time, but you have to have an attacker not only willing to die in the process, but also go through enough flight training to fly the aircraft to it's target. And you need the training itself. Plus, the attacker needs to get a weapon onto the aircraft. And since they need to overpower 100-200 people who might just take exception to the hijacking, you probably need multiple attackers willing to die in the attack. This is a pretty high bar to clear; so, let's say that these attacks happen at a rate of 1 every 5 years.

    Ok, so let's consider our Annualized Loss Expectancy (ALE) with what we have:

    Alright, so lets start talking about controls we can use to mitigate these attacks. By raw numbers, the thing we should care about most is Case 3, as that has the highest ALE. So, what can we do about bombs on airplanes? Making them more resilient seems like a good start, but if we could do that, the military would have done it long ago. So, really the goal is to keep bombs out of airplanes. And that's going to mean some sort of screening. We could just say "no carry on, period" and move the problem to the cargo hold. This would reduce the frequency of Case 3 and Case 5, as it would be much harder to get a bomb or weapon onto an airplane, without a bag to hide them in. But, travelers are not likely to give up all carried on bags. So, that really leaves us with searching bags and controlled checkpoints to do it. Of course, as has been noted, this would likely mean that Cases 1 and 2 become deadlier. Let's put some numbers to it. Let's say that checkpoints reduce the frequency of Cases 3 and 5 by a factor of 4 and increase the Loss Expectancy of Cases 1 and 2 by 1.5.

    And we could push the numbers around for the effect of the checkpoints. And we could look at other controls or controls in combination. But, this is the sort of risk analysis which would need to be done to make such decisions. And, ideally, the numbers chosen would be done with a bit more care than my rectal extraction method. Can I say that anyone at the TSA/DHS/etc did this sort of analysis? No, but I suspect there has been some work on it. And it probably does lead to the conclusion that the expected loss is lower for airports with checkpoints than airports without. Though, that doesn't excuse the TSA's abysmal track record for tests done by the FBI.

  • It's right there in the article:

    Reviver's $29.99 monthly subscription fee.

    What, you thought this was supposed to help the customer?

  • Reviver's $29.99 monthly subscription fee.

    Someone, somewhere is making money on these and probably providing kickbacks campaign contributions to get laws passed to allow this sort of stupid.

  • My list of items I look for:

    • A docker image is available. Not some sort of make or build script which make gods know what changes to my system, even if the end result is a docker image. Just have a docker image out on Dockerhub or a Dockerfile as part of the project. A docker-compose.yaml file is a nice bonus.
    • Two factor auth. I understand this is hard, but if you are actually building something you want people to seriously use, it needs to be seriously secured. Bonus points for working with my YubiKey.
    • Good authentication logging. I may be an outlier on this one, but I actually look at the audit logs for my services. Having a log of authentication activity (successes and failures) is important to me. I use both fail2ban to block off IPs which get up to any fuckery and I manually blackhole entire ASNs when it seems they are sourcing a lot of attacks. Give me timestamps (in ISO8601 format, all other formats are wrong), IP address, username, success or failure (as a independent field, not buried in a message or other string) and any client information you can (e.g. User-Agent strings).
    • Good error logging. Look, I kinda suck, I'm gonna break stuff. When I do, it's nice to have solid logging giving me an idea of what I broke and to provide a standardized error code to search on. It also means that, when I give up and post it as an issue to your github page, I can provide you with some useful context.

    As for that hackernews response, I'd categorically disagree with most of it.

    An app, self-contained, (essentially) a single file with minimal dependencies.

    Ya...no. Complex stuff is complex. And a lot of good stuff is complex. My main, self-hosted app is NextCloud. Trying to run that as some monolithic app would be brain-dead stupid. Just for the sake of maintainability, it is going to need to be a fairly sprawling list of files and folders. And it's going to be dependent on some sort of web server software. And that is a very good place to NOT roll your own. Good web server software is hard, secure web server software is damn near impossible. Let the large projects (Apache/Nginx) handle that bit for you.

    Not something so complex that it requires docker.

    "Requires docker" may be a bit much. But, there is a reason people like to containerize stuff, it avoids a lot of problems. And supporting whatever random setup people have just sucks. I can understand just putting a project out as a container and telling people to fuck off with their magical snowflake setup. There is a reason flatpak is gaining popularity.Honestly, I see docker as a way to reduce complexity in my setup. I don't have to worry about dependencies or having the right version of some library on my OS. I don't worry about different apps needing different versions of the same library. I don't need to maintain different virtual python environments for different apps. The containers "just work". Hell, I regularly dockerize dedicated game servers just for my wife and I to play on.

    Not something that requires you to install a separate database.

    Oh goodie, let's all create our own database formats and re-learn the lessons of the '90s about how hard databases actually are! No really, fuck off with that noise. If your app needs a small database backend, maybe try SQLite. But, some things just need a real database. And as with web servers, rolling your own is usually a bad plan.

    Not something that depends on redis and other external services.

    Again, sometimes you just need to have certain functionality and there is no point re-inventing the wheel every time. Breaking those discrete things out into other microservices can make sense. Sure, this means you are now beholden to everything that other service does; but, your app will never be an island. You are always going to be using libraries that other people wrote. Just try to avoid too much sprawl. Every dependency you spin up means your users are now maintaining an extra application. And you should probably build a bit of checking into your app to ensure that those dependencies are in sync. It really sucks to upgrade a service and have it fail, only to discover that one of it's dependencies needed to be upgraded manually first, and now the whole thing is corrupt and needs to be restored from backup. Yes, users should read the release notes, they never do.The corollary here is to be careful about setting your users up for a supply chain attack. Every dependency or external library you add is one more place for your application to be attacked. And just because the actual vulnerability is in SomeCoolLib.js, it's still your app getting hacked. You chose that library, you're now beholden to everything it gets wrong.

    At the end of it all, I'd say the best app to write is the one you are interested in writing. The internet is littered with lots of good intentions and interesting starts. There is a lot less software which is actually feature complete and useful. If you lose interest, because you are so busy trying to please a whole bunch of idiots on the other side of the internet, you will never actually release anything. You do you, and fuck all the haters. If what you put out is interesting and useful, us users will show up and figure out how to use it. We'll also bitch and moan, no matter how great your app is. It's what users do. Do listen, feedback is useful. But, also remember that opinions are like assholes: everyone has one, and most of them stink.