They primarily manage company-internal CAs for big businesses, which they seem to do well. AFAICT, they noticed that their security infrastructure was compliant for managing a global CA, and thought they might as well also have that as a product. However, there are some operational differences between an enterprise CA and a public one, including that companies want to issue client certs to employees but nobody really does global client certs. That means that they had an intermediate CA for global client certs that they never used, but it was in the standard trust store, and nobody tested that it was handled right until Wayne just went through the standard trust store making sure a new certificate weakness detector didn't give false positives.

So eMudhra correctly handled all the certs they issued, and all the certs they used to sign them, but they got some extra CA certs trusted that they didn't really need, because it would make their side business more similar to their main business, and this caused a major problem.

Chances are that they actually got a real random number out of a HSM for the bad CA certs, but accidentally made the certs with the index of the random number instead of the actual number. (That is, they got the 4th random number and made a cert for 4 instead of the number.) I wouldn't be surprised if they stored the correct private key, which would have made leaf certs that didn't validate because the intermediate was wrong, but they never used it to find this problem.

One of the most obnoxious things about AI advocates is that they are awfully opinionated on my specific work even if they don't know what my specific work even is. So they see it working well in some areas and when I express a nuanced experience that isn't a slam dunk except in certain situations, they are disdainful that I am not all-in.

One concrete example, some guy who has never written or managed code (not even vibe coding), asked if I used git and I said sure, and he informed me that I should change to something that was more AI native based on what he had read online. People reading random tech articles are once again trying to "help" people that get to read the same articles, but without actual experience one way or another. At least the ones that have successful vibe coding have a leg to stand on, but still oversimplifying a very nuanced domain to a boolean 'ai can do all of it it: yes/no' is obnoxious

I doubt that. They may have wondered if it was *worth* the price of the computers at the time, but they were not debating the capabilities.

That facet certainly exists here about token pricing and how it will evolve and in a larger sense about whether it is worth the footprint, and there's every possibility that those concerns will ease with time like they did for computers doing calculations.

The issue here is that folks are treating software development as a monolithic thing. Even very milquetoast software development demanded skill and tedium, but GenAI can chew through the milquetoast scenarios adequately if you are careful and know what you are doing. People who live in that realm then seem to get the mindset that reality applies to the entire domain of software development equally. We have a much more weird subjective results than computers being able to calculate.

Broadly speaking, I find agentic coding to be even more exhausting (and expensive) than AI augmented completion. It's babysitting a mechanism that can screw up at any time, so it involves a *lot* more exhaustive work to make sure you have a harness to let the model try and retry with objective feedback very quickly. A continuing issue being that it fails to recognize an inability to do something but tries to do something anyway, which means any result that is not objectively measured in strict terms is at risk of weird drift.

Today I took a swing and it did a few weird things in my domain. Issue being here there's documentation of a standard but the very first and reference implementation deviated from the documentation, so every implementation was based on the reality rather than documentation. This particular scenario was very specific and you would have had to know very specifically about this risk to warn the model about that sort of mistake. It had a variety of legitimate inputs to process but dropped them without error because it didn't make sense and so it assumed malformed data.

It really depends on your inclinations and problem domain. If you are making a straightforward web ui interface to a fairly straightforward data set, then you can get pretty far. If you have requirements that aren't very picky and you can tolerate some drift, it can get pretty far. If you work in pretty esoteric spaces, then you have to either use it to accelerate and correct code by code or you have to spend a maddening amount of time describing all sorts of stuff to *not* do.

Completions are useful especially for boilerplate and such.

The email wasn't even too good to be true. The nasty phishing emails are the ones where the recipient is supposed to get a real email on the topic, but it's because of a publicly known event and outsiders could easily make up the content, so they just need to find a bunch of likely recipients.

I think the "you've been assigned the mandatory phishing training" emails should come from an external sender and contain a link to get into the extended training, and you should only get the short refresher by finding it through verified sources. Not only would this be a good placement test, it would test that official communications are actually hard to fake and possible to verify using the process in the training.

"In response to the embarrassing data breach that hit the news recently, we've assigned every employee at the company an online training session about phishing at this link. By sure to take it immediately, because it's a legal requirement for our settlement and delays could affect your employment." --Russian Hackers

Seems like this pretty much, though perhaps the more interesting piece is that 'generate a bunch of tokens consistent with human output associated with the environment without more specific direction' influenced the models to have what seemed to be better tokens generated later when they had to now be consistent with specific scenarios.

Though I'm too lazy to read the paper and the 'generally beat' phrasing gives me some wondering about how definitive this observation is versus how much of it might be finding what they wanted to find in the results.

When I had Comcast in the SF Bay Area, it was rock solid. Did not go down for months (or years) at a time. However, other people in the same city found it to be unreliable.

Why can't Spectrum give me a symmetric connection? I get ~700Mbps down and only ~36Mbps up.

The problems are not technology-related, they are policy decisions.

At my last house, I had fiber with a 700Mbs down/700Mbps up connection, but every evening between 10:00pm and 11:00pm it dropped out for 5 minutes.

It makes sense in some cases to have a cleaning fee at the end rather than building it in to the nightly cost.

A decent hotel will clean your room every day, an airbnb will not - they will just clean the place after you leave ready for the next guest. Thus the cleaning costs are the same wether you stay 1 night or 1 month.
If you're not getting daily cleanings it doesn't make sense to factor the cost into the nightly rate.

As much as it can apply to online communities in general including slashdot, Reddit and reddit-likes *really* take the cake for creating circle-jerk communities. Creating niche communities with moderators that ban at any comment they didn't want to see. Saw a reply to one of my comments that I thought to be a bit dumb (basically, that we should replace TLS certificates with blockchain), but not horribly unforgiveable or anything, and the comment got removed and the user banned from the community. Mod saw 'blockchain' and while I understand a negative gut reaction, nothing that should have rated a moderator going that far.

Sorry, Mr. Russian Bot, but I am pretty sure you have that backwards. These days, Russia is losing 8 soldiers for one of Ukraine's.

https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fwww.csis.org%2Fanalysis%2F...

It's only Trump who is calling for the ceasefire.

How much protection does SELinux provide for this vulnerability?

Alternatively, some people in that subreddit can't stand that anyone could express valid concerns about Tesla and decides that it must be some irrational, inexplicable blind anti-Tesla rather than informed and real concerns.

Sent through a physical cable you either receive the original data or not.
Once you are receiving the original data - either through clean transmission, or because error correction has fixed any transmission errors, it doesn't get any better.

At the relatively low bandwidth needed for audio data, there are many protocols and physical carriers capable of transmitting the data and ensuring a perfect copy is received even over low quality cabling.

Do they have to prove this? Or just obstruction?

Of course, if there was no investigation (as DHS has said sometimes), then what was he obstructing?

Frankly, the idea that the government can search the phone of a citizen at the border is an abomination in what is supposedly a free society.

Judges have engaged is so much doublethink about borders. This was an airport, so how was he not already in the USA when the plan landed?