As some other comments on this post have mentioned, there is a a treaty known as the "Lugano Convention", whose parties are the EU (as a whole), Denmark [0], Iceland, Norway and Switzerland; post-Brexit, the UK wanted to join in its own right, but the EU refused. Under the Lugano Convention, if you get a judgement in a French court, you can then apply under the convention to have a Swiss court enforce it; however, there are exceptions which the Swiss court could rely on to refuse to do so – but I have no idea what are the odds that a Swiss court would decide any of those exceptions apply.
[0] Denmark has an opt-out from this area of EU law, which is why it is the only EU member state which needs to be directly party to the treaty; it applies to the others indirectly through the EU as a whole being a party to it
Well, one option Quad9 could consider, is moving to Liechtenstein - it is part of the EEA (unlike Switzerland which isn’t, although its bilateral agreements with the EU/EFTA partially approximate EEA membership), but unlike Switzerland, it isn’t party to the Lugano Convention
However, I don’t know whether the other aspects of Liechtenstein’s legal and political system would make that viable or not.
> That doesn't work if you are writing a library where users of the library are able to implement their own event types.
-or- in places where you simply want to maintain a compilation firewall, for compile times, or encapsulation... i.e. you don't want to update the "visitor" in a pile of unrelated files each time you come up with a new Event.
> using a passkey in a flexible password manager (Bitwarden, keepass, 1Password, etc) really does continue to give the user control.
Sure, but if you read the article you would know that deal can (and will undoubtedly) be altered. The passkey issuer can demand that the passkey be hardware-backed, and I've already run into passkeys that cannot be stored in bitwarden out in the wild (i.e. they REQUIRE that I use a TPM-backed store in my computer). Eventually it will be a particular TPM-backed store running on an attested platform. Now that's not generally the case today, but make no mistake, that IS the ultimate goal... You will only access valuable services from devices that you fundamentally have no control over (e.g. locked down OS's with attestation before you can access X,Y,Z), so that you can't steal from netflix, skip the sponsor segments on youtube, block ads in your web browser, etc. etc. etc. If you want a preview of how this might all work from the technical side, just look into how TEE works for large-scale GPU deployments right now.
Unfortunately I can see Apple eventually getting onboard too. As in "Sorry your device is no longer secure for using passkeys. Please update to a newer device!" Nice little incentive to boost flagging iphone sells.
Except that banks can (and do) already require proprietary apps to generate one-time passwords, often requiring official iOS and Android phones. It's not some nebulous future, it's happening now.
And you can't really blame them. A TOTP 2FA from your password manager is not secure. It WILL be hacked sooner rather than later. And SMS is horrible, expensive, and unreliable.
So far, only FIDO keys provide hardware-backed security ("resident keys", not passkeys) that is nicely segregated into self-contained hardware module. And it does not require you to run a full end-to-end DRM-ed stack.
If you _want_ true privacy and security, that's pretty much the best case you can hope for.
Except that those "self-contained hardware modules" are actually rarely "self-contained" but usually an integral part of a smartphone running a huge bunch of mostly-untrusted code and that the containment keeps getting breached, of course.
The only difference is that banks will now blame you for any losses caused by hacked devices because it is on paper "unhackable" with a well-updated device, so it is now your fault that their crappy bank app's security was broken.
And you still don't get to use Passkeys with banks, of course.
I'm using a Yubikey that is permanently plugged into a USB-C port on my laptop and another one in my dock at home.
> Except that those "self-contained hardware modules" are actually rarely "self-contained" but usually an integral part of a smartphone running a huge bunch of mostly-untrusted code and that the containment keeps getting breached, of course.
And it actually doesn't matter if the secure device is designed correctly. Providing a secure channel over untrusted networks is something that we can do easily.
> And you still don't get to use Passkeys with banks, of course.
I can. I'm using US Bank and it supports my Yubikey-bound WebAuthn credential just fine.
It's not about the $7. I can even pay $20. It's about the principle of being against nagware. If the author had asked for a donation in a non-obstructive way, that would've worked.
That's the absolute best possible outcome... The more severe risk is where a neighborhood child gets severely injured and then the liability policy/coverage you were relying on as a homeowner is invalidated because you failed to disclose the trampoline (which is one of the things they typically ask for). Now you are stuck with legal + medical bills which will likely bankrupt you and/or cost you that house.
Same with pitbulls. Like "neat you hid it from your insurance company, boy you sure showed them!" They are going to be so super sad to cash all of your premium checks for years and THEN pay out $0 on the liability claim when fido rips a kids face off.
> But during covid archive.org decided to just remove the limit and lend unlimited copies concurrently
IIRC, this was 100% it. Lending one digital version of one physical asset was likely already a violation copyright. Lending UNLIMITED digital versions of one physical copy was DEFINITELY a blatant violation of copyright.
"IA maintains that it delivers each Work “only to one already entitled to view [it]”―i.e., the one person who would be entitled to check out the physical copy of each Work. But this characterization confuses IA’s practices with traditional library lending of print books. IA does not perform the traditional functions of a library; it prepares derivatives of Publishers’ Works and delivers those derivatives to its users in full. That Section 108 allows libraries to make a small number of copies for preservation and replacement purposes does not mean that IA can prepare and distribute derivative works en masse and assert that it is simply performing the traditional functions of a library. 17 U.S.C. § 108; see also, e.g., ReDigi, 910 F.3d at 658 (“We are not free to disregard the terms of the statute merely because the entity performing an unauthorized reproduction makes efforts to nullify its consequences by the counterbalancing destruction of the preexisting phonorecords.”)."
So weird that the same exact people telling you that programming careers are now obsolete are the same group who haven't been able to fix screen flickering bugs for like a year...
My guess is that they ran selective search on the domains which get registered with any registrar, thats the trigger to start the search. .gov domains are not managed by your typical registrar which is selling the domain registration information to all these downstream partners/scavengers (for lack of better word)
The OP says it's using CT logs, not new domain registrations. The approach you have in mind would not include subdomains and would be less likely to coincide with a new server being configured.
Yes CT is explicitly stated source which is why I qualified it with "Guess" for domain registration. There were couple reasons for that -
1. Quite a few websites in the search results where just on HTTP
2. The .gov sites do use public certificate authorities like digicert, verisign, amazon & letencrypt so they would have been captured unless they are removed explicitly
And yes the domain registration would not include subdomains
reply