• 0 Posts
  • 63 Comments
Joined 1 year ago
cake
Cake day: July 5th, 2023

help-circle
  • On the other extreme, 24/7 operations have redundancy.

    A friend of mine explained that being an Emergency Medicine physician is a great job for work life balance, despite the fact that he often has to work ridiculous shifts, because he never has to take any work home with him. An Emergency Room is a 24/7 operation, so whenever he’s at home, some other doctor is responsible for whatever happens. So he gets to relax and never think about work when he’s not at work and not on call.


  • This is wrong, because you’re talking about disability insurance in a comment thread about disability discrimination.

    Disability is very broadly defined for the purpose of disability discrimination laws, which is the context of this comment chain.

    Disability is defined specific to a person’s work skills for the purpose of long term disability insurance (like the US’s federally administered Social Security disability insurance). Depending on the program/insurance type, it might require that you can’t hold down any meaningful job, caused by a medical condition that lasts longer than a year.

    For things like short term disability, the disability is defined specific to that person’s preexisting job. Someone who gets an Achilles surgery that prevents them from operating the pedals of a motor vehicle for a few weeks would be “disabled” for the purpose of short term disability insurance if they’re a truck driver, and might not even be disabled if their day job is something like being a telemarketer who sits at a desk for their job.



  • Oh I actually know this one. Mostly historical accident and path dependence.

    In medieval England, kings wanted to make sure that taxes and fines to the crown were properly paid, so they had their own officials in each county, who reported to the King rather than to any local officials. Sheriffs were responsible for tax collection, law enforcement (both arresting people before they could be tried and carrying out the rulings of the court). But they’d have to wait for the king’s courts to actually come to town and hold trials and what not, so in the meantime the king’s financial interests weren’t necessarily aligned with the sheriff’s.

    So coroners were appointed to watch over county matters and represent the king’s financial interests whenever the courts came to town.

    When someone was convicted of a capital offense, their property escheated to the crown. That was an important source of revenue for the crown, so coroners would determine whether a dead body was the result of a crime or not, in order to make sure the crown wasn’t missing out on some convict money.

    Both the Sheriff and coroner positions survived the transition into American governance, but independence and democratic reforms meant that these previously crown-appointed positions needed to become elected positions. Most states kept Sheriffs and Coroners as county officials, and preserved some of their traditional roles and duties. Many coroners offices were renamed to “medical examiner” but basically still preserved the role of keeping stats on deaths. And without appointment by the crown, most states just chose to make these elected positions.



  • It boils down to this: the ad was a visually detailed and drawn out destruction of things some people like and are not easily replaced. These are physical objects that people genuinely have emotional attachments to. So it’s musicians and photographers who probably had the strongest visceral response: the type of people who kept obsolete devices past their obsolescence because that was the physical artifact of the thing they learned their craft on.

    I know software developers who would’ve had the same visceral reaction to a Commodore 64 or Apple II or NES being slowly destroyed. Or even other gadgets that people loved, from a Walkman to an iPod to a Tamagotchi to original iPhone.

    It’s not like the scene from Office Space where there’s visceral disgust for the thing being destroyed, but precisely the opposite emotions involved.




  • None of what I’m saying is unique to the mechanics of open source. It’s just that the open source ecosystem as it currently exists today has different attack surfaces than a closed source ecosystem.

    Governance models for a project are a very reasonable thing to consider when deciding whether to use a dependency for your application or library.

    At a certain point, though, that’s outsourced to trust whoever someone else trusts. When I trust a specific distro (because I’m certainly not rolling my own distro), I’m trusting how they maintain their repos, as well as which packages they include by default. Then, each of those packages has dependencies, which in turn have dependencies. The nature of this kind of trust is that we select people one or two levels deep, and assume that they have vetted the dependencies another one or two levels, all the way down. XZ did something malicious with systemd, which opened a vulnerability in sshd, as compiled for certain distros.

    You’re assuming that 100% of the source code used in a closed source project was developed by that company and according to the company’s governance model, which you assume is a good one.

    Not at all. I’m very aware that some prior hacks by very sophisticated, probably state sponsored attackers have abused the chain of trust in proprietary software dependencies. Stuxnet relied on stolen private keys trusted by Windows for signing hardware drivers. The Solarwinds hack relied on compromising plugins trusted by Microsoft 365.

    But my broader point is that there are simply more independent actors in the open source ecosystem. If a vulnerability takes the form of the weakest link, where compromising any one of the many independent links is enough to gain access, that broadly distributed ecosystem is more vulnerable. If a vulnerability requires chaining different things together so that multiple parts of the ecosystem are compromised, then distributing decisionmaking makes the ecosystem more robust. That’s the tradeoff I’m describing, and making things spread too thin introduces the type of vulnerability that I’m describing.


  • In the broader context of that thread, I’m inclined to agree with you: The circumstances by which this particular vulnerability was discovered shows that it took a decent amount of luck to catch it, and one can easily imagine a set of circumstances where this vulnerability would’ve slipped by the formal review processes that are applied to updates in these types of packages. And while it would be nice if the billion-dollar-companies that rely on certain packages would provide financial support for the open source projects they use, the question remains on how we should handle it when those corporations don’t. Do we front it ourselves, or just live with the knowledge that our security posture isn’t optimized for safety, because nobody will pay for that improvement?


  • GamingChairModel@lemmy.worldtolinuxmemes@lemmy.worldBackdoors
    link
    fedilink
    arrow-up
    13
    arrow-down
    1
    ·
    edit-2
    3 months ago

    100%.

    In many ways, distributed open source software gives more social attack surfaces, because the system itself is designed to be distributed where a lot of people each handle a different responsibility. Almost every open source license includes an explicit disclaimer of a warranty, with some language that says something like this:

    THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

    Well, bring together enough dependencies, and you’ll see that certain widely distributed software packages depend on the trust of dozens, if not hundreds, of independent maintainers.

    This particular xz vulnerability seems to have affected systemd and sshd, using what was a socially engineered attack on a weak point in the entire dependency chain. And this particular type of social engineering (maintainer burnout, looking for a volunteer to take over) seems to fit more directly into open source culture than closed source/corporate development culture.

    In the closed source world, there might be fewer places to probe for a weak link (socially or technically), which makes certain types of attacks more difficult. In other words, it might truly be the case that closed source software is less vulnerable to certain types of attacks, even if detection/audit/mitigation of those types of attacks is harder for closed source.

    It’s a tradeoff, not a free lunch. I still generally trust open source stuff more, but let’s not pretend it’s literally better in every way.




  • There are quite a few classifications of trucks. In the U.S.:

    Class 1: 0 - 6000 lbs
    Class 2: 6,001 - 10,000 lbs
    Class 3: 10,001 - 14,000 lbs
    Class 4: 14,001 - 16,000 lbs
    Class 5: 16,001 - 19,500 lbs
    Class 6: 19,501 - 26,000 lbs
    Class 7: 26,001 - 33,000 lbs
    Class 8: Over 33,000 lbs

    Classes 1 through 2 are considered “light” truck, 3/ through 6 is “medium,” and 7 and 8 are “heavy.”

    Classes 7 and 8 require a commercial driver’s license.

    Generally, Class 3 starts to have 4 wheels on the back axle, and Class 6 generally starts having multiple axles on the back. At a certain point, you’re up to 18 wheels on a tractor and trailer.

    OP’s picture is probably of a Class 2 truck, while you’re thinking of Class 1 trucks.