Unless you know all the terms the valuation is pretty meaningless. For example if I invest $500 for 1 share of your startup with an extra clause saying that I get the first $500 if you ever sell the company at any price then you could claim I valued you at $500 a share but since I make a profit if you sell the entire company for over $500 you could also I valued you at $0
I share your feelings. What it most brings to mind for me is the infamous StackSort from the image alt text on XKCD comic 1185 (https://xkcd.com/1185/)
CORS today is just an annoying artifact of a poorly conceived idea about domain names somehow being a meaningful security boundary. It never amounted to anything more than a server asking the client not to do something with no mechanism to force the client to comply and no direct way for the server to tell if the client is complying. It has never offered any security value, workarounds were developed before it even became a settled standard. It's so much more likely to prevent legitimate use than protect against illegitimate use that browsers typically include a way to turn it off.
With CSRF the idea is that the server wants to be able verify that a request from a client is one it invited (most commonly that a POST comes from a form that it served in an earlier GET). It's entirely up to the server to design the mechanism for that, the client typically has no idea its happening (it's just feeding back to the server on a later request something it got from the server on a previous request). Also notable is despite the "cross-site" part of the name it doesn't really have any direct relationship to "sites" or domains, servers can and do use the exact same mechanisms to detect or prevent issues like accidentally submitting the same form twice.
CSRF wouldn't work as easily if CORS (or, more precisely, the single origin policy that CORS allows you to circumvent in controlled ways) weren't there. And both cookies and TLS also rely entirely on domains being a meaningful security boundary.
Without the SOP, evil.com could simply use JS to read the pages from bank.com, get a valid CSRF token, and then ask the browser to send a request to bank.com using its own CSRF token and the user's cookie. This maybe could be circumvented by tying the cookie and the original CSRF token together, but there might be other ways around that. Plus, if the browser wasn't enforcing the SOP, then the different tabs might just be able to read each other's variables, since that is a feature today for multiple tabs accessing the same origin.
I’m not sure in what world domains aren’t a meaningful security boundary, but cross-origin prevention is absolutely necessary in a world with private web apps and scriptable browsers.
Maybe you are of the opinion that the web should have stayed document only and apps should have stayed native binaries, but as far as the web is concerned the default cross-origin request policy is a critical security pillar.
well it does make sense to assume that by default different origins belong to different people, and some of those people don't have to behave friendly to each other.
There is little server can do with that, because of the request-based model. The state that persists between requests lives in cookies, and it's browser job not to expose those cookies all around. Turning off single origin policy would be a terrible idea. For one, it makes CSRF work by not allowing cross-origin reads.
> the AWS team has implemented it poorly by enforcing it
This is whiny and just wrong. Best behavior by default is always the right choice for an SDK. Libraries/tools/clients/SDKs break backwards compatibility all the time. That's exactly what semver version pinning is for, and that's a fundamental feature of every dependency management system.
AWS handled this exactly right IMO. Change was introduced in Python SDK version 1.36.0 which clearly indicatesbreaking API changes, and their changelog also explicitly mentions this new default
api-change:``s3``: [``botocore``] This change enhances integrity protections for new SDK requests to S3. S3 SDKs now support the CRC64NVME checksum algorithm, full object checksums for multipart S3 objects, and new default integrity protections for S3 requests.
You're not wrong - the semver doesn't indicate a breaking API change. But, to be fair, this wasn't a breaking API change.
Any consumer of this software using it for its intended purpose (S3) didn't need to make any changes to their code when upgrading to this version. As an AWS customer, knowing that when I I upgrade to this version my app will continue working without any changes is exactly what this semver bump communicates to me.
I believe calling this a feature release is correct.
While I agree that the author is just whining about this situation and that AWS did nothing wrong, I'd argue that a change in defaults is a breaking change.
I don't think that's the case? AWS didn't fix a bug or removed some UB.
That's closer changing default key-binding. Anyways, all I'm saying - I would have considered it a breaking change because it changes default behavior.
Correct, I just would appreaciate that change in default behavior would be treated as a breaking change. It's really no that hard to grasp and many OSS projects treat it as such.
Potentially unpopular take but I don't think free services linked to physical goods are a good idea in practice. Maintaining such services costs money forever, companies can't sustain that as a business model, so the market is littered with hardware that is now useless because the services it required has gone offline. If there's something to gripe about here it's that Mazda removed the fob-based remote start, or that $10/month is too high, but it should not be that they're charging a maintenance fee for something they have to maintain.
This is definitely worthy of concern. There's an infamous case where an AI was trained to detect cancer from imaging but all the positive examples included a ruler (to measure the tumor) so it turned out it just was good at detecting rulers.
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9674813/#:~:tex....
Definitely agree liquidation is non-starter here. They don't sign long term deals with their own customers so WeWork's only real asset is the brand. What the creditors will do is take over ownership from the equity-hodlers, then try to milk the brand for any remaining value. It's conceivable many of the building owners might actually do ok directly operating WeWork branded spaces and keeping the margin that used to go to WeWork for themselves.
The insurmountable problem is that the practical interests of "consumers shopping on Amazon" don't actually align with the abstract interests of "consumers in general" that the government is purporting to defend. On Amazon we want to find the right item (search, description, reviews), have strong confidence in the inventory and shipping promises (fulfilled by Amazon) and have reasonable confidence we're not getting screwed on price including shipping (Buybox, Prime eligible etc). If you chop those things apart it becomes essentially impossible to offer the overall experience that consumers clearly prefer.
The cause of this is that it should be an anti-trust violation for any wholesaler or manufacturer to dictate retail prices to the retailer. They agree on the wholesale price because that's what they're negotiating with one another, then the retailer chooses the retail price in their store.
Now if Amazon wants the MFN clause, no problem -- but it's the wholesale price they can't sell to someone else below, not the retail price. If Amazon wants the lowest retail price, that's up to them.
Since I haven't seen it mentioned I'll throw out the Rails/Merb split in the late 00s as a significant momentum killer for Rails (and, by extension, Ruby). Rails 3 reunified them but I don't feel like it ever fully recovered it's developer mindshare, and the timing was such that it really opened the door for rivals like Express (Node) and Django (Python) to gain traction.
Adding a veneer of security isn't necessarily superior to leaving it out altogether. Systems of this sort are best secured at the network level, i.e. only trusted hosts should be able to connect to it. Redis is a good example of where this has been tried: it does support password based log in, but the password is stored and transmitted in plaintext, and a redis server will happily accept thousands of auth attempts per second making brute forcing a viable attack. Rather than improve the auth system Redis has instead doubled down on encouraging appropriate network level security by defaulting to only being accessible to the local host, so admins have to go through an explicit step (with warnings) before they can just expose it to the internet.
