IE stood for a lot of things, and I'm guessing they're talking about the "failing to implement standards" part rather than the "websites that proscribe use" part.
for example, on my required to use website dfas.mil, I get the following message impeding any loading of the site:
> Our website has detected that you are using an unsupported browser that will prevent you from accessing certain features. An update is not required, but it is strongly recommended to improve your myPay experience.
> The current list of browsers supported by myPay includes:
that completely misses the point of the IE problem, which was developers forcing IE due to not testing any other browsers. badges saying "works best/only in IE" were not due to any failed standards IE didn't meet.
i think as developers it's easy to forget that, and just think about our own difficulties having to maintain IE compatibility. but that was the post-IE transition era, not really having to do with the "IE problem" of being forced to use IE for certain sites as with Chrome today. At least IE back then wasn't spyware like Chrome is today.
Yes, your intuition was right about that! But even back then they were aware that the mineral ones lasted longer. I imagine a high-quality book about color like this would go for the "big budget" paints that lasted.
The fact that only one copy was made suggests it wasn't really intended as a mass-produced book, but as an individual item, perhaps to show to visitors or clients.
This was really interesting, but very hard to follow. I may be slightly outside of this space, but I would have liked a little bit more explanation. I felt like this was skipping a lot of motivations, goals, and steps.
Actually, reading it again from the bottom up, it sounds like this is the thought flow:
1. You want to know if your os is vulnerable
2. You need a vex feed (sbom? the vulnerability report itself?) for your os
3. sbomnix provides a mechanism for getting sbom from a flake, but not a full os, and that can be compared to the advisories. But here it reports a false positive.
4. (Logical jump: we can use vex as an additional layer to disable irrelevant advisories based on system config) Here's an example of adding a vex (edit: not-)vulnerability report to a package conditional on config (sshd)
5. `nixos-vex` is a module to make it easier to integrate these reports (removing the boilerplate from the example)
Maybe this is a TLDR?
- sbomnix already provides package sbom in standard format which produces a conservative set of reports (superset) for a system
- `nixos-vex` provides a mechanism for integrating conditional vulnerability reports into nix packages
- Someone (also nixos-vex?) starts adding vulnerability reports to existing modules like ssh
- Combine them to get full coverage
I guess the comparison to govulncheck was that this is also like reachability analysis, but this is completely different - reachability analysis is calculatedly correct. This requires hand-annotation that could have issues and produce false positives or negatives. And you need to add each report manually and keep it synced with the database. I feel like this could be better than nothing (how much effort would it take to maintain?) and the "default conservative" approach is good.
Is the idea you'd only do this for long-term unfixed issues, and for the ones that do get fixed you'd just tolerate a few extra system upgrades? But is it easier to add this annotation to nixpkgs than it is to get pam/sshd fixed upstream?
Edit: I think "Finally we have the payoff" came several paragraphs too early. `sbomnix` reporting a false positive isn't payoff, and isn't anything to do with vex.
2. We want the vulnerability report, which is usually generated from the SBOM (versioned list of software components). The VEX feed helps to supress false-positives when generating the vulnerability report
3. Yes. It works for any flake (including full OS) or store path.
4. Yes
5. It is not just removing the boilerplate from your config, but to centralize triage decisions. If we codify the decision if a vulnerability affects a specific configuration, this check is free. I would love to contribute this back to the nix ecosystem, because package maintainers are in a better position to write these conditions.
> But is it easier to add this annotation to nixpkgs than it is to get pam/sshd fixed upstream?
It is possible to improve the scanner implementations and CVE databases to remove these false-positives without VEX, e.g., making better use of package URLs and/or CPEs, but this requires tooling support and better data sources.
In the meantime we have to make due with VEX and craft statements for systems we need deploy today.
The missing thing is "your" from the original. The title makes it sound like a notice for people looking to get into the onion's business. The actual title is perfectly clear.
I'd be surprised if the anti-clickbait title filtering is a net positive.
In the end they removed them once the contract expired.
But it got me curious, is there no way to get out of a contract once signed? I know contracts have breach clauses and stuff, but if the college paid up front is there literally no way for them to breach the contract after that? Hiring security to physically block the Flock people from uncovering the cameras?
This review shows mostly one thing: the science on this sucks. Look at the data they collected. Studies over 7 days, 2 weeks, 4 weeks... the longest one was three months and didn't even really differentiate these 2g/kg bodybuilding levels of protein intake from the average ones. An experienced natural lifter will probably need a year to see truly measurable benefits from training. And unexperienced lifters will probably see good results even with a shit diet because of basic adaptions.
Welcome to the world of exercise and dietary science. It’s not great, largely because there’s no money in it and blinding is frequently impossible. This is why meta analysis is so popular.
Protein supplements alone is like a $30B dollar market and protein foods in general is >$100B. You'd think they would find some money in there. By comparison, the hair loss market is less than $10B and they have been putting out a few really high quality studies over the years. But I guess people affected by hair loss have higher agency than others.
The thing is that investing in large scale nutrition studies has no payoff. If Optimum Nutrition hypothetically proved conclusively that 1g protein/lb body weight grew more muscle than .8g, any growth to the industry would be general and not specific to their company. Basically there’s no return on investment.
A new baldness fighting drug gets patent protection and exclusive market rights.
I guess that’s an interesting comparison. There are decades of studies about protein intake, but many (most?) seem to be small.
If I had to guess, in addition to there being basically no money in it, it’s probably hard to get people to sign up for strictly compliant diets for long periods of time. Letting someone roll your head with a Dermaroller a couple times per week is comparatively a small investment in time and effort.
I can't imagine shaving your head and regularly treating it with betadine and saline before dermarolling for three months takes less effort than adding a daily protein shake to someone's diet. Dermarolling is also not pain free. So people suffering from hair loss absolutely have higher agency here.
You can’t just add a protein shake to someone’s diet and pretend that’s a meaningful measure. If the goal is to demonstrate that a higher protein diet is meaningful, then you need to pretty strictly track total protein (and probably total calories).
> So people suffering from hair loss absolutely have higher agency here.
That’s valid. Guys suffering hair loss are likely a lot more motivated than guys who opted into a protein study for $100 or whatever.
Most studies are actually done by having people just write down what they eat (or even just take a photo) in an app. This stuff is trivial. Applying a dermaroller and scalp products correctly at home is pretty complicated by comparison.
Something I've been thinking about is I don't go outside a lot because of mosquitoes (not even due to the risk of disease). Most of the spring/summer/fall other than walking to/from destinations I stay inside. I don't hang out at the park, I don't eat outside, etc etc. I think there are probably a lot of people like me here.
I think when you're inside all time time, it's harder to care about stuff outside - climate change, but also things like pollution and walkability.
If we eliminated human-biting mosquitoes, how much of a positive effect would it have through people just interacting and caring about the outdoors more?
reply