• 1 Post
  • 1.22K Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • I have never felt so old.

    Name, address, and phone number of the account holder used to be published in books that got sent to everyone in the city and also just left lying in boxes that had phones in them if you needed to make a call while you weren’t home, because your phone used to be tied to a physical location.
    You also used to have to pay extra to make calls to places far away because it used more phone circuits. And by “far away” I mean roughly 50 miles.

    It’s not the biggest thing in the world, privacy wise, since a surprising amount of information is considered public.
    If you know an address, it’s pretty much trivial to find the owners name, basic layout of the house, home value, previous owners, utility bill information, tax payments, and so on. I looked up my information and was able to pretty easily get the records for my house, showing I pay my bills on time, when I got my air conditioner replaced and who the contractor who did it was.

    As an example, here’s the property record for a parking structure owned by the state of Michigan. I chose a public building accessible by anyone and owned by a government to avoid randomly doxing someone, but it’s really as easy as searching for public records for some county or city and you’ll find something pretty fast.


  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.


  • I can see the rationale, but I disagree.

    I think it’s difficult to make a good assessment because every situation involving multiple legitimate armed factions that’s come about has had a lot of other Context around it that makes it hard to know if what you’re seeing is because of the factions, or because of the context.

    That being said, the vast majority of cases I can think that involve multiple armed factions seem to devolve less into rational actors minimizing conflict to reduce cost, and more into rational actors executing violence to maintain control of resources or impose conformance with their beliefs.
    Violence is often very profitable. It gives you control over resources you didn’t have, and compels people to cooperate with your wishes.

    they also couldn’t legitimize the violence

    In the absence of a monopoly on violence, all of it is just as legitimate. Each group sees their use of force to further or protect their interests as legitimate and others as illegitimate. This can manifest as blood fueds, vendettas, communal violence, or the myriad forms of organized crime.

    I totally agree that the leviathan, which is a much cooler word for the entity with a violence monopoly, has no reason to offer overmuch quality to their violence. The leviathan only wants to use force to perpetuate their monopoly on force.
    I’d argue that the violence required to maintain the status quo is less than what competing factions would exert trying to establish themselves.

    While there are plenty of states doing horrible things, there are plenty that are relatively benign, and even the horrible ones are, on the historical scale, less common and more mild.
    The most docile areas seem to me to be ones with a single legitimate violent actor, and pro-social systems in place to reduce the need for cooercion.

    I don’t think we can ever entirely get rid of the state, since at some point people will form a structure to manage or, at least document, the society they’ve built, and a state by any other name is still a state.
    But we can wither it away if we make sure to replace it with non-coercoercive social replacements instead of leaving a vacuum like the “starve the beast” folks want.

    As the smallest nit, the states monopoly on violence isn’t to be the sole doer of violence, but to be the sole arbiter on the legitimacy of violence.
    In a perfect system, you fighting back against the rogue cop is legitimate because the state legitimizes your use of force.
    Practically, we usually only see that legitimazation happen with stand your ground laws and castle doctrine, and less police issues because the police are “special”, but that’s aside from the lofty theory.


  • Cool. That’s a coherent political philosophy, you just don’t normally run into people arguing for more legitimate use of violence.

    Personally, multiple armed entities sounds like the worst aspects of government without the redeeming aspects.

    I’m the breed of anarchist more concerned with involuntary power hierarchy than specific forms of said dynamic, like class. Reducing the number of groups who can coerce others into doing stuff isn’t aligned with more legitimate armed factions.
    I voted for my sherrif, so I’m more okay with him pointing a gun a me than your trade union, whom I didn’t vote for. It’s not wholly voluntary because I didn’t get to vote for “disarm the sheriff and make the fire fighters the principle law enforcement group”, so it’s far from perfect, but at least I know who’s holding the gun.


  • You say that living in a world where the government at least actively controls what can be sold as a roadworthy vehicle, and unsafe cars can be taken off the street.
    “I don’t want government doing what they’re currently doing because I never see any instances of the problem they’re trying to prevent”.
    “We don’t need vaccines because I never see any of the diseases doctors are always wanting to vaccinate for”.

    We used to sell cars where the steering wheel was solid steel and a low speed collision caved your face in. Industry only started to sell safer cars when they were forced to do so.

    There’s being pissy about government abuse, and then there’s being upset about safety standards.



  • It depends on where you are, the cop, and a lot of other context. It’s one of those cases where America is more like 50 different little countries than one big country.

    My state police force has a policy to only chase if there’s an active danger to public safety.
    That doesn’t apply to the sheriff’s of the 83 counties in the state, or the approximately 500 other police agencies, although many counties mirror the policies of the state police.

    Weirdly, I generally trust the state police more than any of the others. They tend to be significantly better trained and more focused on public safety than making money for the county.
    I’ve only been pulled over by one once and he just wanted to make sure I was okay, which was fair considering my car was failing and it sounded like a shitty old lawnmower that was also broken.

    In general our police are powerfully undertrained, underpaid, over funded, improperly screened and with a radically unhealthy attitude on their relationship with non-police. We also lack enough uniformity for that assessment to be universal.



  • No chase policies aren’t uncommon. They’re not universal but they’re not uncommon.

    Given the rarity of chases, the danger they pose, and the lack of benefit in most cases, the guidance is usually to not bother unless there’s reason to believe there’s something like a kidnapping or murder.

    Or the cop will fire blindly through the back windshield of the car. Luck of the draw really.



  • Minimum wage means minimum livable wage, and “livable” isn’t the same as “survivable”.

    Anyone working should be able to afford the amenities we call living, not just scraping by. Children, transportation, food, healthcare, reasonable recreation, savings, retirement, self development and actualization. All of it.
    People not working should be able to survive, and we should do everything we can to get them to that “living” point as well. Disability or a bad labor market shouldn’t close someone off from eating, having children or going to the doctor.



  • So, kinda. The ruling did have more nuance than a lot of people take from it, but it’s still not a good ruling by any means.

    The president has absolute personal immunity for core constitutional acts, and the presumption of immunity for official acts.

    That means that you can’t sue Biden for vetoing a bill, or other things defined in the constitution. That doesn’t mean you can’t sue the office of the president, but that you can’t sue the individual.
    The next part is that the courts need to assume that there’s immunity for anything done “as the president” unless the prosecution can argue that not having immunity couldn’t possibly infringe on a power of the president, and you can’t use the presidents motivation to make that case.

    So the president talks to the justice department about what they can do to sway the election for him: you can only talk about the impact of holding the president liable for talking to the justice department about elections.

    You can’t talk about the president assassinating a political rival because that introduces their motive. “Would the office of the president be hindered by holding them personally liable for using the constitutional power to command the military to target a threat to the country”.

    Trumps family could sue, but Biden wouldn’t be liable, only the executive branch.




  • Most voters don’t have a business and never will.

    The value of a net new business is that it creates more jobs and economic activity.
    Most people benefit from more jobs to either work at or drive up labor demand.
    Per that school of economic thought, incentivizing a new business adds more activity to the market and more opportunity for people to find ways to innovate, provide value and become profitable.
    Giving money to an existing struggling business is subsidizing a businesses that’s already demonstrated that it’s not working.

    However, we’re both putting too much into it. The goal is to say $50k for small business, because people like a business friendly atmosphere.
    Trump gets credit for giving tax cuts to businesses for stock buyback, which only helps investors. The goal is to court people who want pro business policies without literal handouts to corporations.


  • If you watch the video, he wasn’t using it for anything political. He’s doing low stakes crowd work. He’s chatting with people, gives a guy in a trump hat a signed hat while making some self deprecating jokes and good natured insults to the guy in the trump hat. Definitely makes like he’s going to steal the guys hat, and puts it on for a second for a bigger laugh.

    Optics good, bad, or neutral, it wasn’t a planned “solidarity” thing like the headline makes it sound.

    A better headline would have been “Biden borrows trump hat for laugh at lunch following 9/11 memorial event”