> This just means you should never let a model operate “hands off”.
Good luck with that one. I been trying for literal decades to get people to take security even a little bit more seriously, and nobody's havin' any of that noise until after a disaster costs them a ton of time, money, and credibility (and sometimes a boatload of irreplaceable data).
People love convenience. Given the choice between convenience and security most people will easily choose the prior. Security is also just hard. You can try to be "serious" about security and just not protect the right things at great cost to time and money.
> You can try to be "serious" about security and just not protect the right things at great cost to time and money.
Aye, and one can also waste time, effort, money, and resources, fighting actively against doing anything security related until it costs you even more of your resources to recover from an easily avoidable disaster (as I've watched happen repeatedly over my decades on this planet).
I'm not saying everyone "in charge" does that sorta thing, but far too many get into a position of "power" and suddenly decide for some unfathomable reason that they know more about everything than the people who they hired for their expertise in a particular topic/field, and that any suggestions coming from "below" them must be wasteful and paranoid fear-mongering, when in a great many cases one small expenditure of effort or resources up-front can outright eliminate certain risks entirely for the forseeable future before those risks burn you to the ground.
Compared to what? A trillion-dollar US corporation? The US government?
What I'm really alluding to is nationalism, which at this point in the US is mostly synonymous with MAGA.
Although, I've found the US people in general are pretty nationalist by Western standards, even liberals, progressives, and many other (not all) members of the left. It's basically this webcomic: https://miro.medium.com/v2/resize:fit:720/format:webp/0*W8YT...
So sure, if you distrust the CCP more than your own government or largest corporations, you don't have to be MAGA, just an indoctrinated nationalist.
I'm not sure how an unwillingness to trust the Chinese Communist Party is in any way "racist" exactly. I know lots of Chinese people I'm fairly sure I could trust, but the Chinese Communist Party ain't among 'em. Do you trust them?
> ... and both times I got piled on and downvoted heavily. And my opponents never explained how the hell are they going to deal with an actual CO2 in the atmosphere. The only feeble realistic response was "plant trees, duh".
Yeah, that ain't helpful at all. They should take a moment (since they're already taking time to comment in the first place) to explain why technological carbon capture really isn't a valid solution all by itself. It's extremely expensive and not very efficient/effective overall. Definitely should not be just ignored outright though, because many technological inefficiences have been overcome in the past, and this one could possibly be also. It can still be a part of the overall solution even in it's current state. Just ain't likely to be some "magical cure-all" anytime soon. We must do other things that are already known to be efficient and effective while we're still able.
> Guess they aren't aware that trees are not immortal.
Trees don't need to stay alive to maintain the carbon captured during their lifetime. If they fall (or are cut down) and are buried, the carbon they contain can stay captured pretty much indefinitely.
> Once again, I'm led directly to the conclusion, that I'm REALLY glad I wasn't born into the millennial generations...
Yeah, at this point I'm genuinely hoping to be dead before "Mad Max" world (or "Terminator") become our new actual reality.
I find it so very sad that "Idiocracy" is actually a hopeful looking future compared to the much more probable possible outcomes portrayed in our fictional future movies.
Sorry, young-folk... I wish we'd left you a better world instead of a pretty much solid guarantee that your future will suck more than we can possibly imagine.
It's questionable whether a robot that's not carrying a human counts. I can't just plonk down a vending machine on the sidewalk and start collecting money with it, and a vending machine is just a sales robot. The fact this other robot is on wheels is beside the point.
Mobility aids, including motorized ones, are definitely legal on sidewalks. The US doesn’t mess around with accessibility.
When I was younger I was taught that bikes weren’t allowed on the sidewalks, but to my surprise it’s actually been legally allowed in most cities where I’ve lived. There are a lot of wheeled and motorized types of traffic allowed on sidewalks in a lot of cities.
> Mobility aids, including motorized ones, are definitely legal on sidewalks. The US doesn’t mess around with accessibility.
Yeah, there's entirely valid exceptions to the rule for sure, and this is definitely one of 'em.
> When I was younger I was taught that bikes weren’t allowed on the sidewalks, but to my surprise it’s actually been legally allowed in most cities where I’ve lived. There are a lot of wheeled and motorized types of traffic allowed on sidewalks in a lot of cities.
I've had police where I live ride up to me on their bikes, on the sidewalk to warn me that riding my bike on the sidewalk is illegal. Normally I'd just say "sorry" and stop doing the illegal thing, but in this case, they choose to consistently break the law themselves while telling others that activity is illegal, so I respond with "I'm willing to accept that, except why are you riding your bikes on the sidewalk?" - Police response: "Because it's not safe in the road here. Have you seen how drivers here drive?" - Me: "Point made. Thank you officer." - Police: "Okay, well, just be careful. Don't run into anyone on the sidewalk or we'll have to ticket you." - "Thanks officer. Y'all have a nice day." - Police: "You too." (Our police here are mostly pretty human and overall decent folk if you treat 'em as such. We're kinda lucky in that regard. I've been other places where that's absolutely not the case.)
> Another good example why writing secure software matters in the age of connected devices.
I wonder how many more decades of screaming into the void will be required for it to be taken seriously by those who deny any/all security efforts until after the disaster has already happened (and then still will only approve the absolute minimum required efforts)...
The people who should be held liable never will be. Their money is like an impenetrable shield to any sort of accountability. They'll just scapegoat the guy that warned them about the risk repeatedly for not doing more to prevent it.
I have been in meetings were the Data Security Officer refused to sign off on specific projects, without having a proper pentesting report in place, for example.
Because legally it would be their responsibility, if something would happen.
> I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.
For me this has always been true of systems in general all across the decades that I've worked with technology. It's like pulling teeth to convince anyone in charge that backups or security are even a little bit important until after there's been a costly disaster, then it's all about "Why didn't you warn me this could happen?" - Umm... You mean like every single day for many months until you told me to shut up about it because my paranoia doesn't justify the tiny expense of ensuring you don't lose many tens of thousands of dollars or years of irreplaceable work or important records?
Cookies, in and of themselves, are not bad. Like any tool that can be misused, they're just being abused by a ton of really shitty people in an effort to try to enrich themselves at the expense of others. Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Now we have a new (nearly impossible) problem to solve. "How do we prevent bad actors from abusing pretty much any feature of a public system which can possibly be abused, or reliably catch and punish the people who try?"
> Cookies do solve a valid problem on the web, that being "How do we maintain 'state' from one page request to the next in a stateless protocol like HTTP(s)?"
Don't you people remember how it was done back when web browsers didn't have cookies, or could be configured to reject or ask for each cookie? The server software automatically added a PHPSESSID parameter to every link, containing the session identifier.
RFC 2109 predates anything that vaguely resembles PHP, and Netscape (thus, defacto, basically everyone using the internet), had cookies 3 years before the RFC. PHPSESSID wasn't added until PHP 4 in 2000.
If you're going to be a bitchy pedant, you'd damn well better be CORRECT.
Good luck with that one. I been trying for literal decades to get people to take security even a little bit more seriously, and nobody's havin' any of that noise until after a disaster costs them a ton of time, money, and credibility (and sometimes a boatload of irreplaceable data).
reply