Do you have the CVE number? That's not unreasonable per se, but it could be bogus as you say. A CVSS (base) score is a measure of intrinsic severity of the vulnerability in isolation which is somewhat unintuitive.
A high severity CVE can have zero impact on your system because the vulnerable code path is unreachable, and a pair of low severity CVEs in your system components/libraries can compound and create a critical vulnerability in your system.
I think OP's point is that, if the attacker already has root, they haven't gained any new capabilities from the CVE. They could just do whatever they wanted much more directly. Therefore, the inherent risk seems fairly low.
> At the case level, we find that in countries such as Denmark with available wind and solar energy resources, nuclear power does not seem to be part of the least-cost solution, neither in today's energy systems nor in future systems of climate neutral societies. This conclusion is valid for the present cost of nuclear power in Europe as well as for IEA/WEO future expectations.
> system costs are comprised by overcapacity of the technology itself, electrolysers and hydrogen storage, back-up power, influence on spinning reserve and transmission systems cost.
Green hydrogen storage solution has shown to be much more expensive than what earlier studies predicted, and are still not economical competitive to be used in industries that need the hydrogen itself rather than burning it for electricity.
> Thus, the simulation of, e.g., nuclear power involves back-up-power and peak-load power in order to cover all hourly electricity demands in a least-cost manner
This is an assumption that they don't explore.
> It should be emphasized that all the alternatives have exactly the same use of biomass and they all contribute with carbon for CCU, CCS and biochar to achieve a fully climate neutral society in all sectors including agriculture, industrial processes and LULUCF.
Again, they explicitly claim that all their solutions must burn fuel for electricity.
> The “LC mix biomass restricted” alternative is still comprised by a least-cost combination of offshore wind power (84%), solar PV (13%) and CCGT (3%)
> CCGT and therefore also the least-cost mix either use natural gas or biomethane
CCGT, as is thermal power plants, which is what is exactly what Sweden is constructing and what I linked above. A combination of wind, solar, and burning fuel for power. The difference between LC mix biomass restricted and least cost mix is how much fuel that grid is expected to burn.
Their model of just 3% CCGT do fly a bit against what Denmark is doing. They have over 100% wind capacity, and yet need to import almost 50% of the energy demand. Reducing that imports to 3% seems a bit like wishful thinking.
If the intent was disprove the need for thermal power plants by linking to that study, then the study itself disproves that in no unclear terms. The result of the study is that combining wind, solar and gas is the cheapest strategy to generate electricity.
Because there's no theoretical room for fraud if you design the paper ballot system correctly so that the process is observed by independent and opposing parties and everyone is doing their job.
The key point being "everyone is doing their job". You need to make the system so transparent and involve so many observers/auditors that there's nowhere for corruption to hide.
If you threaten the opposition with prison (or worse) if they tell anyone about your fraud then you don't have a democracy to begin with. The only way to preserve any semblance of legitimacy is if you manage to keep thousands to tens of thousands of people quiet on all of this.
It doesn't matter, if the counts were changed after being handed off to election authorities higher up, it would be caught by observers who have the real counts as soon as the incorrect numbers were published.
> That doubt usually turns out to be politically motivated rubbish.
That doesn't matter. The system is dependent on people's trust in the system. Sooner or later that trust will be eroded, you might hear convincing reports of external influence, people might be duped by a persuasive authoritarian candidate, it doesn't really matter.
Fear, uncertainty and doubt are enough for the system to lose legitimacy and spreading FUD about things people don't really understand is really easy, history is filled with examples of this.
Even if the average person had a working understanding of cryptography, which I think is highly unrealistic to begin with, that wouldn't be enough to give the system credibility.
For the system to be credible and resilient against coups it must be possible for the average person to audit the system end-to-end. This is impossible to achieve with online voting, yet trivially achievable with paper ballot systems:
An observer can verify that ID is being verified, that voter list is managed correctly, that every person is issued 1 ballot.
When votes are being counted they can see each ballot and count along with the officials. The number of ballots in the box must match the number of issued ballots based on the voter list.
They can get a copy of the report where they verify that the counts are correct. Then they can verify that the authorities indeed used the same numbers for their polling place in the final counts. And because you have cooperating like-minded observers in every polling place, you know that the final count is correct.
Hold on, is there any evidence of this? This is a very delicate topic and gut reactions are often wrong. Playing violent video games doesn't cause violent behavior, for example.
We should be preventing harm to real children, as well as treating/managing people's psychological disorder of being attracted to children (instead of simply criminalizing it).
The war on drugs comes to mind - it criminalized a substance use disorder, gave power to organized crime, made it harder for people to seek help, allowed the market to be flooded with the most harmful versions of those substances which ultimately killed more people than it saved.
Yes it would. It's not perfect like a literal air-gap, but it's the bare minimum. Had the agents breached a real, properly configured firewall product, that would've been a real watershed moment.
Except they're correct. In a proper sandbox a bug in Artifactory wouldn't allow you to access the internet. There was no effectively no sandbox unless you consider Artifactory to be a sandboxing solution, which it's not.
Artifactory should be inside the sandbox, it's not a sandbox in and of itself.
This is exactly the same problem as forwarding ports and exposing all of your internal services to the internet, but from the opposite direction - a bug in any of those services will allow the attacker to gain a foothold inside your network (or in this case, allow the agent to gain a foothold outside of its "sandbox")
A high severity CVE can have zero impact on your system because the vulnerable code path is unreachable, and a pair of low severity CVEs in your system components/libraries can compound and create a critical vulnerability in your system.
reply