Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)SP
Posts
0
Comments
121
Joined
2 yr. ago

  • Are you and the rogue chaotic good, or chaotic neutral? It doesn’t seem like you’re clear on this with the rest of your party. Murder (e.g., backstab in the middle of dialogue) is not a “good” action, any way you slice it, even if the spectator is an asshole, evil, or through RP, would have eventually led to combat resulting in death anyways. If you were playing true chaotic, it’s understandable, but it doesn’t sound like that is what was made clear.

    And if you’re trying to force an alignment shift, consider that you may be ruining the enjoyment of everyone else at the table; if I’m playing a lawful good cleric, I’m not sure my character would party with a true chaotic fey, which would essentially end the campaign.

  • Most likely this is referring to Neutron and Starship. There is absolutely no way we could recover a Falcon 9 second stage without massive weight increases, and essentially a total redesign. If they were working on achieving reusability on Falcon, there is zero chance Elon would have the ability to keep it under wraps.

  • From my understanding, the impetus was that F5 submitted a CVE for a vulnerability, for an optional, “beta” feature that can be enabled. Dounin did not think a CVE should be submitted, since he did not considered it to be “production” feature.

    That said, the vulnerability is in shipping code, regardless of whether it is optional or not, so per industry coding practices, it should either be patched or removed entirely in order to resolve the issue.

  • Even if they don’t achieve all five successful launches this year, it is wise for them to start this waiver process now, so it will be on the books for 2025.

    Given that the turnaround time for NTSB investigations plus engineering improvements has been about three months for each launch, they would only be able to achieve four flights per year if each was a failure. But if they succeed, it is unlikely to need the same three months to obtain another launch license… hopefully just a matter of weeks.

    With true rapid reuse, they’re most likely going to be seeking permanent flight certifications for reuse, presuming no flight hardware will need to be replaced between flights. With this type of cadence, the only limit on launching will be how quickly they can refill the tank farms (and, of course, sufficient consideration for environmental impacts and beach closures).

  • Authentication is, explicitly, the process of validating that you are who you say you are. Like biometrics, your username is part of your digital identity. So you are correct in arguing that biometrics alone is little stronger than a username, but by definition, both are part of authentication.

    That said, to securely authenticate your identity, you need to use multiple factors.

  • Could you? Yes. But there really is no point— biometrics alone are only a single factor for authentication.

    You should have at least two of the three— something you are (fingerprint, facial, or retinal recognition), something you have (badge, token, secure device), and something you know (passphrase).

  • DLC itself almost never goes on sale; you’ll be waiting for an eventual game of the year edition like 3-5 years out. CyberPunk 2.0 has all the base game improvements of Phantom Liberty, and easily 100 hours of content without the DLC.

  • Curious to see whether they are able to produce engines in sufficiently large volumes, and, which engines these exports will receive.

    Allegedly, the WS-19 entered production earlier this year, but presumably, those are all destined for domestic J-31/35 production, and exports will continue to use the WS-13E.

  • We need to have capitalism. We need to have economic freedom.

    Freedom to do what, Nikki?

    freedom to do or be anything they want to be without government getting in the way.”

    Freedom to exploit anything for profit, got it.

    So if it’s not illegal, it’s fair game. And guess what wasn’t illegal until the Thirteenth Amendment? And guess what we had to do in order to pass that amendment?

    Fight a civil war, right.

    1. From the title of your article and your executive summary, the premise of your paper is that CVSS is flawed, and CITE is your solution.
    2. From the title of your article, and choice of name, “QHE CVSS Alternative; CITE”. CVSS is a VULNERABILITY Scoring System. CITE, as your propose, is a THREAT evaluation tool. You can see how one could have the impression that they were incorrectly being used interchangeably.

    As you yourself stated, CVSS does exactly what it says on the box. It provides a singular rating for a software vulnerability, in a vacuum. It does not prescribe to do anything more, and it does a good job doing what it sets out to do (including specifically as an input to other quantitative risk calculations).

    Compare what with attack?

    Your methodology heavily relies on “the analysis of cybersecurity experts”, and in particular, frequently references “exploit chains”, mappings which are not clearly defined, and appears to rely on the knowledge of the individual practitioner, rather than existing open frameworks. MITRE ATT&CK and CAPEC already provide such a mapping, as well as a list of threat actor groups leveraging tactics, techniques, and procedures (e.g., exploitation of a given CVE). Here’s a good articlewhich maps similarly to how we operate our cybersecurity program.

    I think there is a lot on the mark in your article about the issues with cybersecurity today, but again, I believe that your premise that CVSS needs replacing is flawed, and I don’t think you provided a compelling case to demonstrate how/why it is flawed. If anything, I think you would agree that if organizations are exclusively using CVSS scores to prioritize remediation, they’re doing it wrong, and fighting an impossible battle. But this means the organization’s approach is wrong, not CVSS itself.

    Your article stands better alone as a proposal for a methodology for quantifying risk and threat to an organization (or society?), rather than as a takedown of CVSS.

  • Glancing through your article, while you have correctly assessed the need for risk based prioritization of vulnerability remediation and mitigation, your central premise is flawed.

    Vulnerability is not threat— CVSS is a scoring system for individual vulnerabilities, not exploit chains. For that, you’ll want to compare with ATT&CK or the legacy cyber kill chain.

  • SpaceX had previously noted that newer boosters have an updated landing leg design with much better stability, which would have survived these rough seas.

    Wonder if they duct tape a new aluminum façade to replace the missing lox tank, and mock it up in Cape Canaveral somewhere.