Yeah? By "datacenter" are we talking about the kind of gigawatt scale facilities dedicated to AI they're casually tossing around in the USA? I haven't heard of any such projects that actually got off the ground. Stargate UK was paused. If so where do they get their natural gas from.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
I think "good security/engineering practices" still has a chance.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.
Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.
That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.
Completely agree there is lots you can do to shut down exposed surface area.
Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud took over. Looks like it might make a comeback. Maybe with a new fancier job title
There's a really simple solution that people will hate: server goes offline at night.
I've seen this a few times, and it's pretty annoying as a user, but ultimately it's not that bad usually. If you are ordering something at 3am, the physical shipment still occurs during daylight hours. Many banking operations are not actually instantaneous, they settle in a batch job overnight.
And this doesn't have to be binary. Providing a read-only interface provides lots of value while having a reduced attack surface.
You can have guardrails and still ask for approval. There is a difference between a guy who just has to approve a CVE fix and someone that has to take the time to understand what's going on, etc.
Yeah. There's a huge difference between how a 5-10 person start up or a 50-100 person business can handle this, compared to a tech giant or hyperscaler who's already got 1000 engineers in a dozen or more timezones.
It's easy, if you already have teams in the US, UK, India, and Australia - it's always normal office hours in one of those location.
I find there is quite a difference between something like "what do I do next" for a specific problem, and actually trying to learn something hard from an AI. The first it is quite good at, the second it is not. Surface level is easy, going into the weeds is difficult
> if an advanced theorem is proven, and no one alive is competent enough to comprehend it, does it even matter
For any applied mathematics: of course it matters if I can use a better algorithm for $PROBLEM. Yes, even if I do not understand it (I'd like a LEAN certificate tho)! As for pure mathematics, it can be argued that it never mattered in the first place.
I disagree. What might be "a few prompts in claude code" for you, could be a lot of work for someone else. Not everyone is comfortable setting up a domain name and hosting etc... and if you provide value, why not ask for something in return?
It's incredibly sad that somehow knowing how to navigate websites made for complete idiots (domain registrars) is considered worth paying for. How many middle-men do you want to pay?
I can think of many reasons.... "we were using python to quickly explore the space and rewrote to rust once we figured out the interface and started to focus on speed and safety", or "the original authors wrote this software in smalltalk but we'd rather it be golang because this simplifies deployment"
> You prefer a changing codebase over something that has evolved and is being tested over a long period of time?
As long as the test-cases are there, why would I care what language software is written in?
reply