I think you probably don’t realise you hate standards and certifications. No IT person wants yet another system generating more calls and complexity. but here is iso, or a cyber insurance policy, or NIST, or acsc asking minimums with checklists and a cyber review answering them with controls.

Crazy that there’s so little understanding about why it’s there, that you just think it’s the “IT guy” wanting those.

Great link.

I just asked google that exact question and it said “The current world population is 8,171,661,997”

Well good news! Time to let yourself love again!

Eating the onion is sure popular today!

One rich company trying to claim money off the other rich companies using its software. The ROI on enforcing these will come from only those that really should have afforded to pay and if they can’t, shouldn’t have built on the framework. Let them duke it out. I have zero empathy for either side.

The hopeful other side is with a “budget” for the license, a company can consider using that to weigh up open source contributions and expertise. Allowing those projects to have experts who have income. Even if it’s only a few companies that then hire for that role of porting over, and contributing back to include needed features, more of that helps everyone.

The same happens in security, there used to be no budget for it, it was a cost centre. But then insurance providers wouldn’t provide cyber insurance without meeting minimum standards (after they lost billions) and now companies suddenly have a budget. Security is thriving.

When companies value something, because they need to weigh opportunity cost, they’ll find money.

Hold them all to account, no single points of failure. Make them all responsible.

When talking about vscode especially, those users aren’t your mum and dad. They’re technology professionals or enthusiasts.

With respect to vendors (Microsoft) for too long have they lived off an expectation that its always a end user or publisher responsibility, not theirs when they’re offering a brokering (store or whatever) service. They’ve tried using words like ‘custodian’ when they took the service to further detract from responsibility and fault.

Vendors of routers and firewalls and other network connected IoT for the consumer space now are being legislatively enforced to start adhering to bare minimum responsible practices such as ‘push to change’ configuration updates and automated security firmware updates, of and the long awaited mandatory random password with reset on first configuration (no more admin/Admin).

Is clear this burden will cost those providers. Good. Just like we should take a stance against polluters freely polluting, so too should we make providers take responsibility for reasonable security defaults instead of making the world less secure.

That then makes it even more the users responsibility to be responsible for what they then do insecurely since security should be the default by design. Going outside of those bounds are at your own risk.

Right now it’s a wild West, and telling what is and isn’t secure would be a roll of the dice since it’s just users telling users that they think it’s fine. Are you supposed to just trust a publisher? But what if they act in bad faith? That problem needs solving. Once an app/plugin/device has millions of people using it, it’s reputation is publicly seen as ok even if completely undeserved.

Hmm rant over. I got a bit worked up.

What do you do with Home Assistant?

“Oh well I automate a noise complaint form submission. It’s integrated with my noise level detector and with a custom python lookup for the most recent airplane departure”

(that guy probably)

It should make me irrationally angry, but no, it’s a rational hatred. It burns even more intensely.

Running 3x Intel nuc 6th gen in a cluster since I migrated after Nutanix in 2019. Not much power but all I’m running is some docker and random lab stuff on demand for POC and then shut it down. I’ve run whole windows domains with RDS and rdg and broker with fs logix. Otherwise it’s also running two Ubuntu servers hosting pihole and the arr stack and my own instance of rust desk server. I can administrate it anywhere thanks to tailscale and there’s a opnsense router too.

Basically it’ll depend on your expectation and use case, but it’s really light as you’d expect and if these 6 dual core machines can host all that, a modern CPU could do more. Amd or Intel.

Dude, someone corrected your misinformation and you call them a bully?

Yes, they’ve been saying it for a year, at this point they’re repeating themselves: https://www.malwarebytes.com/blog/news/2022/11/nsa-guidance-on-how-to-avoid-software-memory-safety-issues/amp