I don’t think you’re using straw man correctly.
You’re naively referring to how consensus should work while completely ignoring both the well-defined attacks I referenced and the reality of large actors in a consensus network. You don’t know what you’re talking about or you don’t understand how the theory works or you’re possibly just being obtuse. No matter what, this is pointless. Good luck.
If login tokens are stored on a public ledger replay attacks write themselves. Public or private, keeping every login token ever is a horrible audit mechanism and doesn’t scale well. At scale, speed to generate becomes a concern. Not at scale, something lighter is faster.
A normal database scales better than a license blockchain and doesn’t require extra computation to write. Audit logs and hashes prevent extra edits. License files signed by a central authority don’t require a database and the central authority is functionally equivalent albeit less expensive than a blockchain.
I am still interested in a good use for the tech. I have yet to see one that is genuine.
If any of it is rewritable, none of it is immutable. You can’t have it both ways.
“You just don’t know” doesn’t answer my question. A private blockchain, by design, is already owned by its largest actors.
I don’t know that it is, though. Can you show me form of blockchain in the real world where this doesn’t apply? Saying large actors can’t affect a specific piece of internet technology, so far, is rather like teaching physics without friction. It’s nice and fun and easy to understand but completely ignores the reality of any implementation.
Go ahead and prove me wrong. Show me blockchain implementations that are immutable post append. On my end, we can talk about Bitcoin forks. We can also talk about the current state of consensus mechanisms, each of which has the explicit ability for large actors to rewrite history in their favor. Even Monero is susceptible because this is fundamental to the blockchain in any form. It’s been a huge reason why I make sure I get paid up front for any consulting I do in this space.
What exactly are some of the use cases for an infinitely growing, append-only database built primarily so its largest users can rewrite history at will?
It is. The vuln itself was found with guidance of an AI tool. Doesn’t make the vuln any less bad. Does make Xint look really shitty for constantly shilling with boilerplate AI instead of a good human analysis (or at least something above boilerplate).
The only guaranteed fix is in the kernel. You’ll want to check your distro for the CVE. The disclosers very happily bring up all the distros affected but do not seem to have reached out to any of them to also patch. The CVE itself is still waiting for NVD analysis beyond its base score.
I’m not actively saying they did anything wrong but I am saying they’re blowing smoke about responsible disclosure.
I think you’re displaying a very big gap between understanding risk assessment and understanding task completion. So far I have not seen anyone say they would not complete the task. I have seen people complete risk assessment. Risk assessment does not mean I will not do something, it just reflects the urgency with which I will do it. Most self-hosted users can safely apply basic risk assessment to see, while the impact may be high, the likelihood is low. Obviously the likelihood increases the more hands off you are with, say, unattended container updates for things that can escape containers or access the underlying system. Should most self-hosted users literally drop everything, rush home, and apply the patch? No, basic risk assessment does not merit that. Should everyone apply the patch? Yes.
Your comment said Forgejo has a disclosure process. The article says the author went with a carrot disclosure after reading the disclosure process and making a value judgement. Because your comment only mentioned Forgejo having a disclosure process, not an evaluation of the author’s evaluation of the disclosure process, it made you appear as if you had not read the article.
In your response to me calling that out, you offer an analysis. The author is lazy for using carrot disclosure over the defined disclosure process. That’s a valid take. I’m not going to disagree with that.
I don’t think you read the article.
Forgive me, I’m not super versed on Dewey’s mathematics ideas. Quick skimming of some articles and papers seems to suggest he was very practical and wanted kids to tie into the real world. How does that differ from the pink side? Both, to me, seem the opposite of classical logic training.
Doesn’t Ubuntu still ship with Snap? I don’t think Flatpak trumps that yet. It’s hard to say one of the other formats won when Canonical (or Fedora derivatives in the case of Flatpak) still mainline something else.
Absolutely valid. In the context of identity verification, I trust ID.me more than random companies that do not have government contracts because government contracts come with security and compliance regulations that require regular audit and make the chances of breach less likely. In either case, it’s a private company and, as any security nut would have told you, when it gets sold all bets are off like 23andme. Even more importantly, in the US, any kind of ID verification is a terrible idea, government or private, because we have no data regulation or privacy constraints. I call out the US here because we have no GDPR equivalent (CCPA wouldn’t hold up to federal data). Even if ID verification were conducted by the government, it can still be used for gnarly shit like we saw with ICE and DOGE.
On a sliding scale of evil, ID.me is the evil I know will currently fight to continue remaining the only evil which is the only solace I have in the US.
The theme of this post is “what things online would I be okay giving my government ID to.” The author did not mention government services in the article, so I brought those up and differentiated which government services I think are reasonable for ID verification. In the US, social security is basically a retirement fund and a huge target for scammers. I’m willing to verify there or for my taxes (although those should just be done for me; different argument). A data portal eg census data is not something I am willing to verify my ID for because it should be public. US trademarks, for example, now require ID verification for an account. An account gives expands some access on the website and allows the ability to file. If I file a trademark, I am fine with verifying my identity. If I make an account, I don’t need to verify my identity until I file.
I didn’t mention picture sharing websites because I agree with the author’s stance.
In the US it is becoming common for federal services to require ID.me verification. I’ve never really had a problem with social security requiring ID verification. I do have a problem with data portals requiring it.
You and I are in agreement; the user I responded to seemed to be implying otherwise.
Edit: I think it’s a bit strong to say it’s “a literal white supremacist talking point.” Your average boomer is going to mistakenly associate it with Voltaire. I think folks that are some level below terminally online have seen one of the many pieces pointing out its origin. Away from the author, it could stand on its own merits which is why “kids with cancer” is a funny response to it. In the US, at least, I haven’t seen a lot of discussion from the white supremacists who run the government on this quote which further makes me question if it’s a literal talking point. Perhaps you are aware of groups that are actively pushing it? If not, it’s a bit more reasonable to say what the first response in this thread said. Be careful.
Yeah fuck the bill’s sponsor and her desire to reduce costs for a family of four by $50 every month
State Sen. Mary Elizabeth Coleman, an Arnold Republican, said the bill is an attempt to increase affordability for Missourians as prices rise.
“Missourians are paying more and more for necessities,” Coleman said. “Most of us agree fundamentally that essential services should not be funded on the backs of the poor.”
Coleman said a family of four would save $54 per month with the removal of grocery sales tax.
I dislike scam money as much as the next person. I do not, however, dislike cryptography. There’s a really good common in the thread about elliptic curve cryptography not having a place on Codeberg anymore and I think that’s valid. I don’t even know if OpenSSL could have a place on Codeberg with this decision. Their nonprofit, their rules. Just not very libre-minded and definitely sets a bad precedent. And before someone tells me Microsoft actively censors GitHub, this isn’t a whataboutism thread. It just reduces my trust in a supposedly open collective.