• 0 Posts
  • 25 Comments
Joined 2 years ago
cake
Cake day: August 12th, 2024

help-circle
  • That’s just not true. Bottles are made from 4 different plastics that all have to be separated for recycling (bottle, label, cap+ribbon, soft part inside the cap to make a waterproof seal). The ribbon part the cap is attached to is also present in bottles where the cap is not attached and it has to be removed anyway. So nothing really changed there except the part that has to be removed is bigger now.

    Despite what right wing nuts that have to be against every progress say, there is literally no downside to this law.

    But the biggest improvement is from nature cleanup crews that previously always found the bottles but never the caps.





  • The problem is that the standard is fucking huge and maybe your browser supports every feature of version 5xx but is missing a feature related to authentication using guinea pigs introduced in v369. So it would only be allowed to advertise compatibility with v368 even though it can do everything except Guinea pigs.

    Realistically you would trim the standard to a core set and advertise compatibility with a version of that and then advertise optional extensions. And that’s optional bits if you ask me.



  • groet@feddit.orgtoPrivacy@lemmy.ml*Permanently Deleted*
    link
    fedilink
    arrow-up
    3
    arrow-down
    2
    ·
    1 month ago

    I heard the wisdom once that you should self host everything except for email. I’m sure there are great tools to make it manageable but the effort/gain is just very high.

    Just find a email provider that let’s you connect your own domain, use wildcards, etc.

    Of course email is pretty central to most digital identities, as most accounts can be reset through email. So if you absolutely want to be sure you control your identity you must self host email (but you also must own the authoritative DNS for that domain so you must register directly with the TLD and not through a registrar …)







  • You don’t get hacking protection from bots

    I disagree. I don’t know the details of cloudflares bot detecion, but there are many automated vulnerability scanners that this could protect against.

    I said that instead of crashing the system they should have something that takes an intentional decision and informs properly about what’s happening.

    I agree. Every crash is a failure by the designers. Instead it should be caught by the program and result in a useful error state. They probably have something like that but it didn’t work because the crash was to severe.

    What’s the point of your complaint if you do agree?

    I am not complaining. I am informing you that you are missing an angle in your consideration. You can never prevent every crash ever. So when designing your product you have to consider what should happen if every safeguard fails and you get an uncontrolled crash. In that case you have to design for “fail open” or “fail closed”. Cloudflare fucked up. The crash should not have happened and if it did it should have been caught. They didn’t. They fucked up. But, i agree with the result of the fuck up causing a fail closed state.


  • it shouldn’t crash the whole thing: if the bot detection module crahses, control it, fire an alert but accept the request until fixed.

    Fail open vs fail closed. Bot detection is a security feature. If the security feature fails, do you disable it and allow unchecked access to the client data? Or do you value Integrity over Availability

    Imagine the opposite: they disable the feature and during that timeframe some customers get hacked. The hacks could have been prevented by the Bot detection (that the customer is paying for).

    Yes, bot detection is not the most critical security feature and probably not the reason someone gets hacked but having “fail closed” as the default for all security features is absolutely a valid policy. Changing this policy should not be the lesson from this disasters.






  • That is factually incorrect. Many websites would literally stop working. Not “mildly confuse”, but “be unusable”.

    You ever logged in to a website? That’s a cookie. Ever used an online shopping cart? That’s a cookie. Ever changed a websites language in a dropdown? That’s a cookie.

    All these cookies are first party. There are also essential third party cookies for thing like SSO (“sign in with google/Facebook/github/etc”)

    Tell your browser to reject 100% of cookies and tell me how much fun that is.

    “Legitimate Interest” is the bullshit term. Why does an ad company have a legitimate interest to my data? That should be removed from the law.