Hacker Timesnew | past | comments | ask | show | jobs | submit | bflesch's commentslogin

Weird, z.ai does not resolve for me. Is there anything special about that domain?

https://z.ai


If you have systemd-resolved, it tries to validate DNSSEC by default and replies with SERVFAIL if it fails. Same happens here, I go through some privacy focused DNS servers and they sometimes remove the signature.

$ resolvectl query z.ai

z.ai: resolve call failed: DNSSEC validation failed: no-signature


That seems to be it, thanks for the explanation :)

Just tried it, works for me.

Resolves fine for me

Correlation != Causation

I invite you to scientifically work on this important topic. Catch up on previous work by others and then use a proper statistical methodology to do proper research and validate your hypothesis.

Other possible factors that could explain it apart from your theory on SSRIs: more exhaustive news reporting, less wealthy parents and thereby more kids brought up in poverty conditions, more parents with lead poisoning, more kids exposed to plastics, more weapons per household, more exposure to violence and/or mobbing, violence in video games, less third places that kids have for socializing, more social media, more mobbing at school, more unrealistic beauty standards and many others. Some of them might've been researched already and some might not.

Even though you're not trying to do a degree you can always do proper science and maybe also prove a novel explanation.


I'm pretty sure religious fundamentalists from all beliefs would love to get rid of Eurovision song contest. Excluding Israeli citizens from it hurts their moderates more than it hurts the hardliners.

Ask Donald Epstein how they chose locations for Miss Universe during cold war times. They'd never exclude the countries they wanted to ideologically reform.


>Excluding Israeli citizens from it hurts their moderates more than it hurts the hardliners.

Nah, it hurts their public image and thus hardliners. Like similar actions against South Africa did.


Whatever their rhetoric they desperately crave respectability, making Israel a pariah state à la 1980s South Africa would hurt them badly.

Why else are they even trying to be in Eurovision and UEFA in the first place


They’re in UEFA because half of the countries in Asia (AFC) and Africa (CAF) wouldn’t play them. Same reason Russia considered leaving UEFA recently.

Black, like Leon Black of Epstein fame

So the guy was Google's planted ~expert~ lobbyist for the European Commission and now he's rich enough to quit, and makes a blogpost about it because people are rightfully skeptical about his motives?

It's just sad that these kind of bugs still slip through. So many people lack the ability to come up with the most straightforward edge cases for their validation code.

To me it feels like people who build LEGO their whole lives but never once stray away from the step-by-step manual and never have built something "outside the box".


Privacy laws are not complex, they only become complex if your goal is to actually skirt them.

Tax laws are also quite easy, tax lawyers are only needed if you want to NOT pay what the country you're operating in is owed.


Respectfully, it sounds like you just haven't dealt with any significant tax or regulatory tasks.

There's entire industries of experts who work on these tasks, and they don't just work for people trying to skirt the rules. I've hired people for both tasks and the reason was specifically to comply.


Not privacy, but as an example:

NIST, MS, and the security community all recommend against forcing people to change their passwords on fixed intervals. They should only be changed when there is an indication they have been compromised.

PCI requirements demand mandatory 30 day rotation intervals on user passwords for users with administrative privileges, IORC. Something like that.

They haven’t kept up. So until they change the rules you can either be PCI compliant or implement the current best practice. Not both.


Your example completely ignores the temporal dimension.

The best practice was to rotate your passwords, but we discovered that this led users to picking less secure and easier to remember passwords and patterns.

Once technology offered up solutions to problems like password managers and breach notifications, that recommendation changed.

PCI used to mandate password changes for in-scope accounts (meaning they have access to credit card flows). Now that MFA is widely deployed that requirement only remains for accounts that do not have a second factor for authentication.

If you were ahead of the curve and implemented strong password policies that did not conform the the PCI baseline, all you had to do was explain to the auditor why. Assuming what you were doing genuinely increased your security posture it would be approved.


They specifically addressed the temporal element:

> They haven’t kept up.

Other standards all used to recommend password rotation. Most have amended it to deprecate or even prohibit password rotation.

> Once technology offered up solutions to problems like password managers and breach notifications, that recommendation changed

It wasn’t just that.

The original recommendation for password expiration failed to take into account the human practices that resulted.

Everyone has worked in an office with passwords on post-it notes, or seen passwords numbered with sequentially incremented integers at the end. Password rotation isn’t merely a baseline level of assurance, it has a negative impact on security because of the effect it has on password hygiene. In practice, passwords that expire can be easily guessed by appending something to the end of the prior password. And they are more likely to be written down in plaintext.

Permanent, non-expiring passwords without MFA are stronger in practice than expiring passwords.


And where the complexity comes in is where you need to comply with PCI and NIST 800-63 at the same time.

would you say civil engineers are only required if you want to skirt building codes?

Someone has to understand the codes and how they might be applied to a specific project, and direct a project such that the outcome will comply.

Codes dont provide a blueprint for a house or a bridge. They stipulate features and properties that it must have. Design resides with the firm.


> Privacy laws are not complex

Privacy isn’t complex, compliance is.

> Tax laws are also quite easy

Yet audits are still a pain.

> tax lawyers are only needed if you want to NOT pay

This is nonsense. Tax lawyers are sometimes used to skirt the law. They’re much more often there to help prove you followed it.


Privacy by design while making a seven-figure salary because you make people buy stuff they don't really need is quite difficult ;)

Wow, Google must be a poster child for privacy then.

Impressive mental gymnastics to go from the topic of sexual abuse to a criticism of democracy - oh no, "western democracy".


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: