• 0 Posts
  • 96 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle




  • What exactly are you trusting a cert provider with and what are the security implications?

    End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.

    What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

    You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.

    Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.

    In what way could it benefit security and/or privacy to utilize a paid service?

    For most use cases, as far as I know, it doesn’t.

    LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?

    LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.

    Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.



  • I haven’t switched to Windows 11, but I also haven’t been using Windows 10, either. I’ve seen plenty of people say that Windows 11 is fine, but you should probably check with other students at your school who use the same software you do. Make sure your machine can be upgraded to 11, at least, since support for 10 is ending soon and that could result in software or services that you need being unavailable as well.






  • It sounds like they want a representative sample, which isn’t something I’d be confident in my ability to help them with directly, so I’d advise them to first scan for a person who’s very experienced in statistical sampling and to then work with that person to determine a strategy that will meet their goals.

    If they weren’t on board with that plan, then I’d see if they were willing to share their target sample size. If I didn’t have an option for the count I would assume they would be contacting 1% of the population (80 million people). I’d also let them know that being representative and selecting for traits that will make encounters go smoothly are conflicting goals, so I’m prioritizing for representation and they can figure out the “please don’t pull a shotgun out, human!” trait on their own. Depending on all that, I’d recommend an approach that accounted for as much of the following as possible.

    • gender (male, female, non-binary)
    • race
    • culture and sub-culture (so this would include everything from religion to music to hobbies)
    • profession
    • age, broken down into micro-generations
    • mix of neurotypical and neurodivergent
    • different varieties of neurodivergence
    • range of intelligences

  • Traction control and other related features is a bigger deal than AWD in my opinion. In the past five years I’ve had AWD engage maybe twice.

    Also, you can replace two tires at once as opposed to all four, depending on the specific vehicle and how much the difference will be between the tires you’re keeping and getting rid of. You only need to replace all four if the difference is enough to cause issues.

    There are a ton of crossover SUVs with FWD, though. Here are a few:

    • Honda CR-V
    • Toyota RAV4
    • Lexus RX 350
    • Toyota Highlander
    • Hyundai Tucson
    • Hyundai Palisade
    • Kia Telluride
    • Nissan Kicks
    • Nissan Rogue
    • Nissan Murano


  • Pretty sure you’re right - there’s the concern of the resources / energy needed for recycling but also, recycling decreases the need for new materials enough to offset that.

    That said, AFAIK paper and cardboard are the only thing that can be both composted and recycled, so the advice of the person you replied to is still generally good.

    This is the guidance I’ve seen on the topic:

    Recycle:

    • clean, dry paper
    • clean, dry cardboard

    But compost:

    • soiled and wet paper/cardboard
    • pizza boxes and other similar things
    • paper towels
    • paper/cardboard egg cartons

    Don’t compost (throw away if unsuitable to recycle):

    • glossy paper
    • paper with plastic attached
    • anything (e.g., paper towels) with cleaning chemicals or other substances unsuitable for composting on it




  • Every single App Store out there uses “free” to refer to propriety software today, because it’s free.

    “Free” as an adjective isn’t the issue. The issue is the phrase “free software” being used to refer to things other than free software. And afaict, no app store uses the term ”free software” to refer to non-free software.

    The iOS App Store refers to “Free Apps.”

    Google Play doesn’t call it “Free Software,” either; they just use it as a category / filter, e.g., “Top Free.”

    There’s a reason many are … starting to refer to such software as “libre”, not “free”

    Your conclusion is incorrect - this is because when used outside of the phrase “free software,” the word is ambiguous. “Software that is free” could mean gratis, libre, or both.