• 0 Posts
  • 325 Comments
Joined 11 months ago
cake
Cake day: June 5th, 2024

help-circle














  • Yeah, if you ever need stories on just how stupid senior managers can be, look at supply-chain case studies. And don’t blame the accountants: it’s their job to report costs, but it’s the job of the managers to deal with risk. And running ultra-lean JIT comes with the risk that a five-minute delay in delivery of some critical component can shut down your line. It’s not the beancounters’ job to have appropriate plans in place to prevent that from happening. It’s the biz-school bell-ends who are asleep at the wheel or thinking that they’ll just pretend there’s no risk and hope they’re lucky enough to translate those low running costs into their quarterly bonuses. And the contingency planning if the supply chain does glitch? Often it goes no deeper than having a scapegoat lined up.



  • FOSS is certainly easier to audit, though there’s still a risk of malicious contributors introducing backdoors or other exploits.

    And just to be clear, there are groups within China who are relentlessly executing cyber-attacks against European and US assets. China’s not the only source, but it’s the biggest (at least based on what we’re seeing at my workplace, which includes a high-volume website). And nothing happens in China for long without the CCP’s approval. So, at least de facto, assume that’s in line with Chinese government policy.

    The best course of action is to never assume any third party is going to protect your data unless someone credible has independently confirmed it. Don’t buy internet-connected devices unless there’s a damned good reason for them to be connected, and even then, firewall the hell out of them and make sure there’s no path from such a device to your sensitive data. If you have a home LAN for your various connected devices, keep that stuff logically (and ideally physically) separate from your personal data.




  • The CLOUD Act is to allow data stored outside the US by US-based cloud providers to be accessed by selected foreign countries that have issued subpoenas and have requested US government assistance. It’s not a backdoor per se, and anyone with any sense encrypts their data before uploading it to the cloud instead of relying on cloud provider encryption services. Even if the US government weren’t snooping, there’s the risk that a cloud provider could be compromised by other hostile actors. Though it’s not all that wise to assume that cloud providers’ encryption services don’t have backdoors, unless that’s been confirmed by an impartial third-party audit. I know of no such audits.

    The PATRIOT Act is a human-rights nightmare for many reasons, but doesn’t grant the US government anti-privacy powers that the CLOUD Act doesn’t. It’s just more vaguely worded.

    And if you really want some worse Kafkaeque misery, FISA warrants will give you plenty if your or your firm’s name is on one.