I suspect GP's question is answered by the fact the system is not in thermal equilibrium. The view the antenna has is approx half of the sky whose temperature is far lower than room temp. Even indoors, the roof of your house is sufficiently transparent in RF that you are still seeing the sky behind.
If the same experiment was done in metal box with everything of constant temperature, I don't think it would be possible to transmit any bits.
But training LLM's is also a task one can do whenever you have a spare GPU-minutes.
I wonder why they don't have some kind of scheduler which makes sure there are never any idle minutes. One would imagine they at least would have autoscaling on their production serving workload and use the freed compute capacity for model training for example.
Google internally has lots of possible redundancy levels for data.
They don't sell any of the lower and less reliable levels to the public, I suspect simply because the reputational damage from losing user data is so bad, and the news will take no notice of the fact the user got a discount for less reliable storage.
Most of Google's customers wouldn't know how to choose anyways, if these were exposed. My memory was quite hazy but I recall having a discussion with my colleague on choosing which Reed–Solomon code for our Colossus files, and apparently the choice was down to RS(8,3) or RS(9,3). I don't think even as Googlers we really had enough information to make an informed choice. Comparatively it was much easier to decide which cells to use for multi-location replication in Placer.
Great. Next can cloudflare stop providing Https to the user (giving the impression of security) when the connection back to the origin isn't strict HTTPS and is often plaintext?
It is more secure (though not end-to-end secure, of course) from the PoV of most threat models because the monitoring most are most concerned about is at their side of the connection (“local infra (often wireless) -> through ISP -> …” or “local -> through ISP -> through state/org level monitoring -> …”).
Tracking you by monitoring the network traffic between CF (or other connection aggregator) and the origins is possible, but usually significantly more effort. Those with reason to be concerned about true end-to-end encryption will know that seeing any CF artefacts means they need to investigate to know if they are getting e2ee or just end-to-proxy.
At a minimum I'd like cloudflare to mark such traffic in some way, and browsers to put a little cross through the "Https" indicator to show the traffic is passing unencrypted across the internet.
That is not a small “minimum”. There are places in the certificate format that a new flag can go, but then all browsers and apps that perform https requests need to be altered to display this in a manner that is:
• consistent
• not overly serious, so users who end up trained to ignore this new signal don't automatically ignore more significant warnings
• (and this is the fun part) communicate this new semaphore signal to the general public without confusing them…
To head off one cynical question: “Why worry about the general public when they wouldn't care anyway and just click through warnings with wreckless abandon already?” - if not the general public then who would this be for? Those who might need to care are already checking if their data is going through CF and so might not to under true E2EE.
They can just add an http header that browsers and browser plugins can listen for, they already add `cf-cache-status: HIT`, so they could add this too:
cf-http-endpoint: 1
or if you want it to match their own terminology[0], it could be:
They could stand up their own version of Let's Encrypt with less than 20 people and $5M/year. It is inevitable. Let's Encrypt had a budget of $3.6M and 13 employees as of 2019 [1], but I don't have recent funding and staff figures as of this comment (replies with context welcome!). Probably spread the cost across the BRICS to make it US sanction resistant.
It’s not merely about setting up a CA. The CA certificates would have to be added to the trust stores of every operating system, browser, framework, and application, creating a sea of security risks for the public. It’s an isolated, privacy-invasive process.
Do you not believe the rest of the world will not move in this direction to decouple from the US? If not, you should consider it is more likely than before. Countries will mandate it if they want it done badly enough, and there is enough open source to own the entire stack (OS, browser, CLIs, etc). It is simply a matter of will, resources, and time, in that order. "You eat an elephant one bite at a time" as the saying goes. Can it be done? Yes. Will it be done? We can only watch to find out.
> The CA certificates would have to be added to the trust stores of every operating system, browser, framework, and application, creating a sea of security risks for the public
surely someone in apple would have run some common neural net architectures through the rtl simulator before tapeout and checked that the performance meets expectations??
Please read the article, it's not the volume of the NTP requests, they're actively sending exploit/attempt to compromise payloads. They're probing things in a way that you would ordinarily only do to your own internal infrastructure.
"They tried all kinds of exploits against me: path traversal, webshell uploads, probing software internals, probing WordPress and other CMS management endpoints, SSRF, Log4Shell, and a lot more."
This is HN plenty of us host servers at home and understand the obviously true fact that you can't really stop it forever.
But that obviously isn't what we're talking about here. We're talking about a massive multibillion dollar corporation breaking the rules of a community project they joined by committing a Jr Sysadmin grade fuck up and ghosting the people who's infrastructure they have now placed in the crosshairs of serious, enterprise grade automated vulnerability testing from a company who might now inadvertently be committing a felony.
That's a bit different than getting a few dozen lazy hits a day because some botnet got to your IP in the Shodan and saw the Plex port open.
I don't disagree with you, I have tons of things that have public interfaces (as mundane as a fully patched wordpress where the wp-admin login is accessible to external blog writers), we get tens of thousands of random shit anything per day. But the problem here is that Tesla is treating NTP pool operators like they are their internal infrastructure. Also because the attribution of the 'attacks' is fairly well known.
I don't go complaining on the internet about the absolute shitflood of compromised routers on broadband ISPs in Indonesia probing my stuff 24x7x365 because I know it would be futile. But if I found one specific american company that was repeatedly probing my stuff all the time? Maybe I'd escalate it.
It's HTTP requests, not NTP requests, and the volume isn't the problem, it's that Assetnote is sending live exploit payloads /at all/ to a stranger on Tesla's behalf
Ask a lawyer about sending an unpleasant letter to the scanner, detailing the situation and demanding that they cease & desist. That clobbers their "we didn't know" defense, and their Legal Dept. will likely order them to stop ASAP.
And how much did this investigation cost, when you account for all the hours spent by investigators, lawers, judges, etc?
My guess is it was a huge net loss for the taxpayer.
The more effective move for the nation would have been for this guys boss to have confronted him and said "computer parts keep going missing on your shift. You have 2 weeks to make sure all the computers are back to their exact original config or we're gonna investigate and you could end up in prison".
IMHO a bigger worry is if they were opening the case then they could have modified it for spying or changing contents. I'd have thought stuff like this should have case alarm notification and inventory change alerts.
Sure, that'd be more "cost efficient", and for a small one-off, probably better. But law enforcement and justice is not a profit center.
Merely making the threats like you specify and even having it restored encourages more crime by making the crime effectively zero-risk — either he gets away with it, or simply needs to restore things to the way they were and the only cost to the criminal is the wasted effort. Makes it so crime pays.
And no, the investigation of watching a bunch of videos to observe the perp opening the computer cases, and writing up a complaint, is probably lower cost than the multiple thefts.
If the same experiment was done in metal box with everything of constant temperature, I don't think it would be possible to transmit any bits.
reply