Hmm, I don't know the area well; why would 2FA have been relevant here? From the (unverified) story, the account was administratively handed over via support; there was no indication from any party that the account was hacked. So 2FA prompts would never be part of the picture.
At scale, testing software is appreciably more expensive than using hardware. That's why at most people test a tiny slice of it, and ships out broken software in the hopes of fixing it later. Testing hardware is expensive because nobody thinks it can be fixed cheaply afterwards.
That's why we have Android Auto: move the updates to a thing that already has frequent Internet connection, and if the update goes wrong it's clearly the fault of this other company, plus the car itself still works fine.
Jeep already had an OTA the broke the ability for the car to be driven.
I keep getting things like "denial of service when the SCSS or whatever parse is given malicious input”. Great, that's part of the build chain, all of its inputs are stuff we control. Why do we care.
But updates to broken packages are still allowed: if a new version is pushed within the three days, it does not reset the cool-down. You just get a pull request to update to a known-bad version instead.
I think it's implied to be refusing to unpublish at the request of the author; unpublishing due to outside forces is probably inevitable. If some unsupportable content got introduced in a new version (e.g. xz), at least the historical versions would be kept.
That of course brings in questions of cost, trust, and governance, so there's definitely a trade-off…
For some reason, that holds an appxbundle per the article. I'd suspect they needed to run some pre- or post-install code (maybe to check for their hardware?).
Don't forget the insurance, plus the hospital has costs that must be paid for too. A surgery with _just_ the surgeon and no support staff isn't one I'd want to be in.
This is the sort of trademark violation where I can get behind proper enforcement. It's using the name of an unrelated project for advertisement (attention).
While that's still pretty vague, it sounds like the issue was that something running as SYSTEM (the page seems to indicate some part of Windows Update) was not correctly checking if inetpub was a symlink or something along those lines. It also links to a script to set ACLs on that directory; presumably that's not possible to do if the directory doesn't exist.
It would probably be better to fix whatever component to not have the link traversal bug, but maybe there's some reason that makes the proper fix infeasible…
It sounds like it's the editorial decision (of what to promote) is the accountable thing; that seems reasonable to me. Looking at the comments on that thread, it sounds like non-editorial sorting ("simple categorization and indexation") would still be fine.
That's because the client certificate interface in browsers is supremely dumb. It always just lists all certificates you have, with very little context in the UI, and hopes that's good enough. I believe that's part of the reason client certificates are not poplar; having actual users deal with that is terrible, and the browsers (in practice, Chrome because of its overwhelming market share) isn't incentivized to fix it.
There's the https://en.wikipedia.org/wiki/Ideographic_Description_Charac... that kind of does that. The problem is that there's character divergence (see all the brouhaha about Unicode Han unification), so there needs to be something else to select variants too.
As a reference, I don't believe any of the pre-Unicode CJK&c encodings attempted that.
Isn't the post office heroics normally when it's not deliverable? If the sender wrote down 744 Evergreen Terrace but they meant 742, that mail will be delivered to your neighbor and hopefully they'll redirect it to you.
I haven't used EDN, but I know YAML has an equivalent feature, and that had been a security issue in some instances because it deserialized into objects the system wasn't expecting. Perhaps their deserializer had learned from that doesn't have that issue?