• 0 Posts
  • 6 Comments
Joined 1 year ago
cake
Cake day: August 3rd, 2023

help-circle

  • There are lots of reasons to dislike Trump or question his ability to be a good president, but whether he uses adult incontinence products should not be one of them.

    A lot of people will experience incontinence issues at some point in their lives (roughly 1 in 3 women and 1 in 4 men), so it’s a surprisingly normal thing. Obviously not all of those people will need or want to use incontinence products, but many do, at least in some situations. That can be anything from relatively small liners designed for light leakage all the way to what many people would consider a “diaper” designed for greater absorption. In any case, none of those products prevent people from living normal lives and doing whatever activities they want with their day. I mean astronauts and fighter pilots wear them sometimes, and they have notoriously rigorous schedules and extremely demanding jobs.

    The idea that it should be treated as a disability because he’ll need to take longer toilet breaks is absurd. Different people take different amounts of time to go to the toilet, for any number of reasons, and many people who use incontinence products are perfectly capable of doing what they need to do in a “normal” time. I also just think it’s ridiculous to be considering how long it takes for someone to go to the toilet as part of their eligibility for a certain job. People should be allowed to take however long they want to go to the toilet, without concern for whether it’s taking too long. It’s really just basic human decency and respect to allow people to manage their own body.

    Finally, it’s worth noting that if Trump uses incontinence products, he faces a uniquely difficult situation because men’s toilets are often not equipped with facilities to dispose of sanitary products. Women’s toilets almost universally have bins or other systems to dispose of sanitary products, but it is relatively uncommon for men’s toilets.This means that men are often forced to either dispose of these products improperly (flushing them down the toilet, leaving them somewhere that isn’t designed for it, etc.) or taking the used products with them to dispose of elsewhere. Neither of those is a good option. Purpose built facilities to dispose of products like that should be available universally in all restrooms.


  • From what I’ve read, it sounds like the update file that was causing the problems was entirely filled with zeros; the patched file was the same size but had data in it.

    My entirely speculative theory is that the update file that they intended to deploy was okay (and possibly passed internal testing), but when it was being deployed to customers there was some error which caused the file to be written incorrectly (or somehow a blank dummy file was used). Meaning the original update could have been through testing but wasn’t what actually ended up being deployed to customers.

    I also assume that it’s very difficult for them to conduct UAT given that a core part of their protection comes from being able to fix possible security issues before they are exploited. If they did extensive UAT prior to deploying updates, it would both slow down the speed with which they can fix possible issues (and therefore allow more time for malicious actors to exploit them), but also provide time for malicious parties to update their attacks in response to the upcoming changes, which may become public knowledge when they are released for UAT.

    There’s also just an issue of scale; they apparently regularly release several updates like this per day, so I’m not sure how UAT testing could even be conducted at that pace. Granted I’ve only ever personally involved with UAT for applications that had quarterly (major) updates, so there might be ways to get it done several times a day that I’m not aware of.

    None of that is to take away from the fact that this was an enormous cock up, and that whatever processes they have in place are clearly not sufficient. I completely agree that whatever they do for testing these updates has failed in a monumental way. My work was relatively unaffected by this, but I imagine there are lots of angry customers who are rightly demanding answers for how exactly this happened, and how they intend to avoid something like this happening again.



  • I’m not the person you responded to, but the Assistance and Access Act 2018 is probably a good place to start. Here is a page from the Aus Government about it, but the very short version is that the government can ask tech providers to assist them with building capabilities into their systems to allow the government to access data to help with the investigation of certain crimes. In some cases these will be voluntary requests, in other cases they will be requests that must be fulfilled, including asking providers to add capabilities that the government has developed.

    There’s a lot more detail about it, and the government insists that they won’t ask providers to create systematic weaknesses or to decrypt communications entirely, but it’s not clear to me exactly how those ideas are actually implemented. Unfortunately, much of the process (likely the entire process) is not made public, so as far as I’m aware there aren’t any good examples of requests that the government has made and what sorts of things have or haven’t been implemented.


  • Although I might be telling you something you already know (and at risk of sounding really boring); it sounds like what they’re really doing here is standing up a system that is certified to handle data up to “top secret” classification. The fact that such a system exists, in and of itself, is clearly not a secret.

    There are a huge number of requirements for systems handling data like that, everything from specific requirements for how physical cables are labelled, to which cryptographic algorithms are used for encryption, all the way through to corporate governance and management plans within the organisations that are involved. It is essentially a giant exercise in bureaucratic box ticking (although I can understand why governments want to be thorough about this stuff).

    After completing that entire process, what you’re left with is usually a fairly standard computer system, plus a whole bunch of assurances that this specific system is okay to use for “top secret” information. The actual capabilities of the system (and certainly the data within it) may well be top secret, but the existence of the system isn’t.

    It’s broadly similar to the GovTeams PROTECTED system. The existence of the system itself is public information, complete with a relatively slick website, but the actual access to the system is controlled. A quick glance at that website makes it clear that GovTeams is essentially just MS Teams / MS365 but certified for “PROTECTED” information. In the same way, I would bet money on it that this "top secret " cloud system ends up just being a fairly standard commercial offering from a major cloud provider (Azure, AWS, etc.) which is approved for storing top secret information after the parties involved complete the required box ticking.