Cute, but I wish they'd spend more effort fixing all the bugs in Apple Music on macOS, and improving their navigation and recommendation algorithms.

The thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.

It was a selfish, PR exercise. He could have done it quietly. He could have just made sure his customers got an emergency patch quietly. (those who are willing and capable to patch) It is not common that anyone in the public could use his source except for his customers. It is difficult to just build from his source and drop it to any operating system and setup and expect it to work (let alone compliance and other requirements). Instead, he expected the public to thank him like he was actually doing an act of good. Loss for words, to be honest.

> He could have just made sure his customers got an emergency patch quietly.

I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.

> but it clearly prioritized Chainguard customers over the broader ecosystem.

I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.

The important thing here is that we know Chainguard's word cannot be trusted.

Chainguard will lie and cheat to put themselves first. Not their customers, but themselves. These are just plain facts.

You can't agree to an embargo and then just ignore it when you feel like it. What other things are you willing to go back on your word for, especially when you know for a fact you are putting people in danger.

it was easy to find if you had the tokens even without the chainguard patch

The bragging by the discoverer made everyone start looking. Then when the PHP foundation made the announcement on the website there was a mad scramble. Up to 18 hours before release there were already demos. Look I get that it's a rock and a hard place but frankly at that point you should release the patch. I know there was a lot of fear over picking the wrong patch but having nothing is still bad.

and like I said in my other comment here, they could've released an OOM-only fix that would've not revealed the actual full exploit but would've protected everyone, but they decided that the only way would be to fix the whole thing and release that... it's very stupid, but seems like it's expected from them, considering it took them 2 months to get to a fix

None of the test certs would be used for real, whether they're intermediate or leaves.

They'd be created with big red warning signs, installed into browsers and other places by anyone who wants to test, and then publicly revoked every month. Rinse, repeat.

You can do that, and I'm sure people already do. But you can't truly test things at scale. Are OCSP servers going to get overloaded? What about IoT devices and things out of support? You have deployments which configure their systems in non-standard ways, maybe some corporate manager decided to mandate cert pinning.

The original comment was to do a fire drill and revoke live certificates to force everybody to participate in the test.

You can have a fire drill and evacuate an office building, but you can't hold a full-scale forest fire/volcano/hurricane drill and evacuate 3.5 million people to test mass evacuation routes, and also you got the edge cases that don't participate in drills, like homebound seniors or hospitals, where disaster strikes.

Unironically yes, in some ways.

It's a godsend for those looking to do what they want with old hardware. You can now pretend to be the authoritative domain for updates.

Any world where sufficiently wealthy capitalists can bend the govt to their will, i.e., most of them.

> explain away dark matter

This kind of presumes dark matter has been definitively proven already, though.

From the outside, CDM may be a better theory than MOND, but it doesn't seem settled to me. I haven't heard anyone describe it as a "Law" yet.

Couldn't someone equally characterize the creation of dark matter as "adding and tweaking mass until you fit the data"?

Man, you're doing the thing I just complained about, where you implicitly frame MOND and CDM as the only two alternatives! :P

Fair, I'm not a physicist. I don't really know the more obscure variants of dark matter and modified gravity theories.

But what about you? Are you not doing https://xkcd.com/2501 ? Is your expectation reasonable on HN?

Can you expand more on #5?

It seems that having some galaxies without dark matter is also pretty bad for CDM. Why would CDM be absent in those cases? Without an explanation, isn't it bad for CDM (as well as MOND)?

Nobody wants a theory where exceptions can be hand-waved away as "Oh, that galaxy must not have DM" or "That galaxy has too much/too little/different balance/etc".

Right. MOND has one tuning parameter, but effectively CDM has infinite tuning parameters, and (worse) they can be tuned on a case-by-case basis.

What the article above posits, that dark matter could be stripped out from a galaxy after a collision.

Right, I read that as a possible explanation, but that's not the root explanation.

Roughly, my question is "Don't we see other post-collision galaxies that still have dark matter, and if so, why?"

If we have two identical scenarios with different outcomes under a theory, that doesn't bode well for the theory.

I had the Action Max they featured here. It was...terrible.

Based on the timing, I'm deeply surprised it came out 2 years after the NES was released in the US, but I suspect it was way cheaper, and bought by some number of clueless parents.

Interesting, but as a former neuroscientist, when I see him write the following about the misinterpreted cat/car neuron from "Zoom In":

> Part of the reason was not knowing about generalized pose neurons

I have to ask, did they not look up how the human visual system works? The primary visual cortex has any number of early neurons that are spatially-tuned for various shapes and edges, and this is pretty basic knowledge.

In fairness, neural networks are more divergent from biology than a lot of people think, but it seems there's still low-hanging fruit to be grabbed with a minimal collaboration.