• 2 Posts
  • 82 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle


  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.










  • ricecake@sh.itjust.workstoScience Memes@mander.xyzBalls
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 month ago

    So, at the time (1930) ball jar actually would have qualified as big business in the sense that you mean.
    Home canning was very popular and they consistently bought out smaller companies.
    Since they were privately owned, it’s tricky to find specifics about value, but they were “found a university”, “own a company town or two”, “chairman of the federal reserve” levels of rich.

    So actually a pretty good use of government.



  • ricecake@sh.itjust.workstoScience Memes@mander.xyzBalls
    link
    fedilink
    English
    arrow-up
    259
    ·
    1 month ago

    The weird thing is, they don’t actually sell the jars anymore. “Ball jars” are not made by the ball jar corporation after their antitrust lawsuits for being a fucking jar monopoly. So they sold the “ball jar” rights and now only do aluminum cans for food packaging and high end satellites and satellite launch systems.



  • "I, like so many Americans, worked in a fast food service job. Unlike so many Americans I was able to pursue a career in the field my degree was in, which is an opportunity not given to far too many of our younger citizens. While pursuing those opportunities I tried to focus my resume on the achievements most relevant to the jobs I was applying for. Only after working in law and politics for years did I see that a dozen things needing your immediate attention with a constant time sensitive to-do list was a bit more relevant than those hiring managers would have been able to see. " Then some chatter about not expecting her time working there to come up as an attack, since resume writing and a job not aligned with your aspirational career are pretty normal occurrences, and not knowing that is kinda weird.

    I don’t think it’s too hard to politely say that McDonald’s was not the career she was aiming for. It’s basically an acknowledgement that her parents weren’t rich and hiring managers get picky about resumes. Which is honestly a relatable narrative to a lot of people.


  • I wouldn’t say there’s no such thing as a labor shortage, we just don’t really have one now and haven’t for a while. It’s like saying there’s no such thing as a food shortage because in periods of high demand you can always just pay exponentially more money and get it.

    If the rate at which labor costs are rising far outstrips the rate at which demand is growing across an industry, not just a business, that’s a sign that the supply of workers is lagging behind the demand growth. Usually seen when there’s a time lag between when demand can start to rise and people from other sectors can move over, like in medical fields or fields with high technical requirements.

    It’s still not the workers responsibility to take lower wages to keep a business afloat, but that doesn’t mean there haven’t been times when it’s been legitimately infeasible to fill a position.
    Businesses and in some cases governments just need to be forward thinking and give incentive to start training for the career before demand starts to outstrip supply.
    Smart places with nurse shortages will do stuff like pay for your training in exchange for a set number of years working for them at a market wage.



  • So, two things: I never said people should be billionaires, I said there’s a difference between her and Bezos. You can’t pretend that a $12 album, or Spotify streaming costs are the same as making people pee in jugs for minimum wage. One of them is actually doing things that people like in exchange for money, and people are saying “yes, I would like to spend my disposable income on this luxury good” often enough that she has more wealth than she can ever spend. Extracting wealth isn’t the same as exploitation.

    Second, if you exclude the value of her music catalog, she’s not a billionaire. If she sold every piece of real property she owned, and gave away every last penny, he net worth would still be in excess of $500M on account of that. It doesn’t seem quite fair to say that someone is terrible because the things they made are worth more than an arbitrary line of “a few million”. Saying that someone is hoarding by just owning something they made that people say is worth a lot of money is judging someone for something largely out of their control.

    None of this has anything to do with someone being “left leaning” in any case. Left leaning isn’t some short hand for ethical purity of being a member of the proletariat or even the working class. Saying that someone who publicly and materially supports progressive causes is “left leaning” seems pretty fair and reasonable.

    I don’t particularly care about swift being some bastion of goodness. I also don’t actually care if someone has a billion dollars. I do care if they exploited people to get it. I care if they exploited people to get less than a billion. So lumping people together by the number without focusing on the conduct misses the point.