Taxes on guns are completely constitutional. The 24th amendment explicitly outlaws poll taxes.

"The right of citizens of the United States to vote in any primary or other election for President or Vice President, for electors for President or Vice President, or for Senator or Representative in Congress, shall not be denied or abridged by the United States or any State by reason of failure to lay pill tax or other tax" - 24th amendment to the United States Constitution

It’s not a tax on the gun though. It’s a tax to exercise the right, identical to the poll tax.

The word "Computer" used to refer to a person whose job it was to Compute things.

Yes, everyone should explore the details of the technology they build on top of, and also should explore questions about what it means to be a person or how the world works.

If you're doing formal verification, why are you JIT generating Code? Is the formal verification also being JITd? How do you know the agent wrote a good spec?

I don’t know why, but it’s certainly possible to imagine JIT-generating code and then verifying it. Which is why I asked why we were assuming the verification wasn’t happening.

Who writes the formal verification spec and when?

I suspect there are already plenty of test suites out there for something as universal as a networking stack.

Secrets should go in a vault and retrieved with the help of a workload identity.

How does the running app instance get the workload identity?

The ways I can think of are (1) it's baked into the source code (worst possible security), (2) it's provided on the command line (also bad since command lines are visible to ps unless you do various OS-specific hijinks), (3) it's provided in an environment variable (no better than before), or (4) it's read from some well-known path (it seems to me that anything that could read a process's env vars could also read the contents of this file, so how is this more secure?)

> (3) it's provided in an environment variable (no better than before)

Even if you take no measures beyond simply using a token that can be exchanged for secrets (and you can – invalidate it, authenticate it, etc.), you’re already doing better than before, because the token isn’t useful to an attacker without access to the secret store, whereas something like a JWT secret key is very useful.

Thanks, I can see how invalidating the token after first use, or after a short time period, reduces the exploit possibilities. (If all upstream service providers that you depend on were perfect, this could be arranged separately for each JWT that you need, but they aren't perfect.)

> authenticate it

> the token isn’t useful to an attacker without access to the secret store

If it's not a bearer token (that is, if you need to provide some additional credentials to authenticate it to the secret store) then any such additional authentication would need to be passed in somehow. Are you maybe assuming that in the environment where the app runs, some subsystem will have already installed a credential for some suitable IAM security principal? Because in that case, I certainly agree that it's better to anchor everything off that. That covers many cases (including every cloud) but not, e.g., rented plain VPSes or a couple of servers in your own basement.

Pulling in lots of dependencies creates this kind of risk regardless of the ecosystem. That being said in the JS/NPM world you tend to have a LOT more dependencies (especially indirect ones) than other languages. I saw someone do a cursory analysis and JS/Node projects tend to have 5x the number rust or ruby projects.

This is really a cultural problem not a technical one.

Quality vs variety trade off. Costco only has a couple options but they are well better and you don't have to do extra work to make sure you're not buying a piece of crap.

Also, you don't have to shop at Costco exclusively, you still have all the other options available. Costco is just a good default if you're not looking for something specific.

How are you gonna use the electric gas pump in that scenario? The electric car guy just needs a few solar panels.

Do you have any citations, or just your assertions that this happens?

I mean asking ChatGPT got me this answer that around 49% of 30-34 year olds grew up in social housing in the UK. Sources and reasoning included in response. So I'd say that's a pretty strong signal.

https://chatgpt.com/share/6a7750bd-1538-83ea-840c-57266e366f...

If you don't think the NHS has any problems then I don't know what to tell you on that you either don't follow any information about it or don't interact with it.