I believe you’d have a very different opinion if the size did change and she had the opportunity to treat it at a very early stage.

I’ve thought about this.

According to this source, “Approximately 72% of all brain tumors are benign”. https://braintumor.org/brain-tumors/about-brain-tumors/brain...

So my wife has gone through all this extra stress to MAYBE catch a cancerous tumor (28%). That’s assuming it grows large enough to impact her before she dies naturally. And I see that the survival rate of some brain tumors, even if found very early, is very poor (5-10% for some tumors, like glioblastoma).

Lots of “what if’s” here. And for what? All i’m arguing is, knowledge is not always actionable, and what’s not actionable can keep you up at night.

The point i’m making is, we should not be trying to pursue a life of 0 risk and perfect decisions. Life is filled with risk (and good and bad luck). That’s just life.

It depends on your personality or worldview. Some people would be much more comfortable lowering their chances of “what ifs” than leaving it all to fate.

i agree with you. If a patient expresses that sentiment to their doctor, they should act accordingly and order the extra screening. At the end of the day it should be a conversation with your provider.

There should definitely be an honest discussion about pros and cons. And not just the physical, but the mental aspect as well.

Just like the opinion would be different if the size didn't change but she embarked in a risky treatment that left her permenantly disabled or dead.

Hindsight is twenty-twenty. If you take the wrong course of action of course you are going to be upset. But that goes for both possible choices. Its not like the choice is ignore vs take some safe but possibly unnessary action. Both choices could kill you.

It was too complex. Just making system calls require white listing libraries goes a long way of preventing a whole class of exploits.

There’s no reason a color parser, or a date library should require network or file system access.

The simplest approach to whitelisting libraries won't work, since the malicious color parser can just call the whitelisted library.

A different idea: Special stack frames such that while that frame is on the stack, certain syscalls are prohibited. These "sandbox frames" could be enabled by default for most library calls, or even used by developers to handle untrusted user input.

You know life expectancy in Portugal is higher than in California, right?

Definitely don’t dismiss it. While there are limitations, it’s already very capable for a number of tasks. Tweaking it to be more effective is skill itself.

> Tweaking it to be more effective is skill itself.

^^^ This is actually one of the currently "in-demand" skills in "The Industry" right now... ;)

100% agree. This is a low quality post both setting unrealistic expectations for a dynamic language and at times straight up making false claims.

Suggesting OOP as a solution is probably the most laughable “solution” though. What does this have to do with error handling and union type inference?

You’d be surprised by the amount of companies handling critical infrastructure that are OK with using PyPI directly

He said companies that care, not companies that should care but do not.

really depends on the company. my company cares a lot about security because it's a huge fortune 50 company with sensitive data and a lot of reputation could be lost with a security scandal

That is somewhat terrifying

There are no sources, this is completely made up.

It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…

So you're saying it's only a matter of time until they issue a cert for x.com as well? :)

Unlike web browsers, digital signature use cases should perform revocation checks, so revoking the google.com certificate should solve that.

The problem here isn't really that one mis-issued certificate, but rather the general problematic behavior of that CA reported in TFA.

If a CA can be convinced to issue a server certificate for google.com, would you feel very comfortable trusting their contract/deed/... signing certificates?

If the government says you need to use their CA, you may feel the feelings, but you will still use them

What would stop me from purging all this CA's certificates from my computet?

I think the current "meta" is CAA records? https://blog.cloudflare.com/why-certificate-pinning-is-outda...

CAA records rely on the CAs to respect them, and this is an article about how a CA has issued a cert in violation of a CAA record.

Oh right, for some reason I was under the impression that browsers utilize the record too.

Correct, which Google is using:

https://www.nslookup.io/domains/google.com/dns-records/caa/

Just need to DoS the revocation server right before your digital signature is checked.

Except it is literal “pcap” as they capture all packets at layer 3. I don’t know the exact specifications of Pico appliances, but it would not surprise me they’re running Linux + libpcap + some sort of timeseries DB

Well, probably, but I meant more like it's not typically someone running tcpdump everywhere and someone analyzing with Wireshark, rather than a systems configured to do this at scale across the desktop.

I don't think that's what anyone was assuming. A "pcap" is a file format for serialized network packets, not a particular application that generates them.

You’d be swapping an open-source vendor independent API for a cloud-specific vendor locked one. And paying more for the “privilege”

I mean that's the sales pitch but it's really not vendor independent in practice. We have a mountain of EKS specific code. It would be easier for me to migrate our apps that use ASGs than to migrate our charts. AWS's API isn't actually all that special, they're just modeling the datacenter in code. Anywhere you migrate to will have all the same primitives because the underlying infrastructure is basically the same.

EKS isn't any cheaper either from experience and in hindsight of course it isn't, it's backed by the same things you would deploy without EKS just with another layer. The dream of gains from "OS overhead" and efficient tight-packed pod scheduling doesn't match the reality that our VMs are right-sized for our workloads already and aren't sitting idle. You can't squeeze that much water from the stone even in theory and in practice k8s comes with its own overhead.