• 1 Post
  • 117 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle
  • Safari support means there’s benefit to web server support. Server support means there’s benefit to browser support in other browsers. Apple can kick start the network effects necessary to get this standard adopted.

    Webp and heic are fine for web, but JPEG XL is special in that it actually has use for print-based and other ultra high resolution workflows, while also having the best path forward for migration from JPEG.










  • Well they can pay compensation to people who do work for them: employee salaries, contractor work, etc. So the nonprofit structure might prevent them from paying dividends or stock buybacks or other ways of transferring directly to shareholders in their capacity as shareholders, but nonprofit structure alone isn’t a guarantee that the organization won’t steer excess cash into someone’s pocket.

    No reason to believe this is true of this non-profit, but that’s the reason why it’s important to look at the books of nonprofits that you donate to.





  • I don’t think this question really makes sense.

    DNS is centralized in that there is a root zone that determines who is the canonical authority for each top level domain like .com or .world (and the registrar for each top level domain controls who controls each domain under them). But it’s also decentralized in the sense that everyone who controls a domain can assign any subdomains below that, and that anyone can choose to override the name resolving with their own local DNS server (or even a hosts file saved on the device).

    The court case here is trying to override the official domain ownership records at specific DNS providers. The problem is that the intermediaries are being ordered by the courts not to follow the central authority.

    Federation wouldn’t fit this model: we still want DNS to be canonical where everyone in the world agrees which domain resolves to which IP addresses.






  • I’m not going to pretend to be an expert on this (I worked in cybersecurity in 2000’s but was only entry level, and changed careers before cloud/mobile made things way more complicated), but the general point still seems true: security requires conscious design that discourages poor configuration by client IT, and makes bad practices unviable by not only end users, but also the sysadmins who manage the actual IT resources. Then, things should be limited in impact.

    In other words, the manufacturer doesn’t get to wash their whole hands of this thing if their design makes it easy for clients to screw up. In this case, it does sound like these systems were deployed by clients that didn’t have a solid understanding of the relationships between on-prem AD and ADFS and didn’t know how to configure them securely, that’s also a significant documentation/education issue that Microsoft owns some responsibility for.

    (Plus in the case of the Solarwinds hack, there were a few other Microsoft vulnerabilities exploited to get to the point where the hackers could traverse the system looking for keys/certificates.)

    So I don’t think this particular dude was warning about a non-vulnerability, and it sounds like the “security boundary” response he met with internally is similar to how you’re responding to this report.