If windows is encrypted with keys from the TPM anyways, then tailscale doesn't need to encrypt a second time.

Windows also bit me in the ass with this feature, but tailscale not enabling encryption wouldn't have helped one iota.

Local software could be stealing plaintext secrets from your encrypted disk. Physical access is not the only attack vector.

The only way to protect against that is if a secure application boundary is enforced by the operating system. You can make it harder for other programs to uncover secrets by encrypting them, but any other application can reverse the encryption. I don't believe using the tpm meaningfully changes that situation.

I believe certain european countries have or had free universities which instead filter students with incredibly difficult courses. Thousands might enter because both tuition and board are free and they would like a degree, but the university ensures that only a small group make it to second year. I believe the filtering is less intense in later years, since the job has already been done by that point.

Unless you're thinking of huge online courses like Udacity/Coursera, I don't think that's really a thing?

If it is, I'd be fascinated to learn more.

I mean, the logistics would be pretty wild - even a large university's largest lecture theatres might only have 500 seats. And they'd only have one or two that large. It'd be expensive as hell to build a university that could handle multiple subjects each admitting over a thousand students.

At least in Belgium it's quite common for a lot of students to fail the first year (partly due to the difficulty, partly due to partying instead of studying). But it's not like it's really free, the tuition is cheap but the accomodation is expensive. I also don't think it's particularly difficult on purpose to filter out students, it's just that it's not overly expensive and a lot of people are unsure about what to study.

According to [1] at one Belgian university 61.8% of students reached a milestone within 2 years (with 41.4% reaching it within 1 year)

That's quite a high non-completion rate - but it's nowhere near 99%.

[1] https://nieuws.kuleuven.be/en/content/2023/42-6-of-new-stude...

Insider trading consists of an individual who is an insider to a company that is publicly traded, trading stock in that company on information they obtained as an insider.

> When Warren Buffett decides that he wants to buy stock in a company, he knows that if this became public, the target company's stock would go up.

Warren Buffett is not a publicly traded company, and in this hypothetical he is buying stock in another company, which (by assumption) he has no insider information about.

> Insider trading law in the US is about breaching fiduciary duty.

This is false. It's about protecting traders. This is why it applies specifically to publicly traded companies. If it was about protecting shareholders (from what?) then it would apply to all companies.

> Insider trading consists of an individual who is an insider to a company that is publicly traded, trading stock in that company on information they obtained as an insider.

No, that's not true in US law. It doesn't have to be the stock of the company you work for to get you into insider trading trouble.

> Warren Buffett is not a publicly traded company, and in this hypothetical he is buying stock in another company, which (by assumption) he has no insider information about.

Well, that's why your definition is wrong.

> If it was about protecting shareholders (from what?) then it would apply to all companies.

Huh, what? You don't have a fiduciary duty to people you don't work for.

See https://en.wikipedia.org/wiki/Insider_trading#Misappropriati...

> The rationale for this prohibition of insider trading differs between countries and regions. Some view it as unfair to other investors in the market who do not have access to the information, as the investor with inside information can potentially make larger profits than an investor without such information.[2] However, insider trading is also prohibited to prevent the directors of a company (the insiders) from abusing a company's confidential information for the directors' personal gain.

Well, there you go. Any more questions?

Prices are not an end to themselves. Prices are useful because they tell you how much something is worth. If you're trading against somebody who has more information than you, than you are probably losing money, since they wouldn't be making the trade otherwise. Yes, insider trading means that prices will converge on a more accurate value faster, but in the interim anyone trading on the stock is getting screwed. Insider trading is not good for anybody but insiders.

> If you're trading against somebody who has more information than you, than you are probably losing money, since they wouldn't be making the trade otherwise.

Trading while having more information than someone else is perfectly legal.

This is begging the question. Games on linux lack kernel anticheat because linux isn't very popular. Once linux is popular enough, then they will figure out a way to do anti cheat on it in a way that they consider acceptable. Valve already considers VAC good enough, because they want to support linux. Anti cheat on windows works the way it does because that's what's available on windows, on linux they'll figure out some other way.

You could, I dunno, trust your son, communicate with him, and let him make decisions for himself? If instead of wasting all your time on scam products trying to isolate him from the world, you'd spent the same time teaching him to navigate the world, you wouldn't have had any problems, and he would be better prepared for adult life when he doesn't have someone breathing down his shoulder. Just my 2c.

The checked variant just calls the unchecked, and the panicking variant calls the checked variant. They all need to call unsafe code. See here for details: https://doc.rust-lang.org/nomicon/borrow-splitting.html

Then you misunderstand what unsafe means in Rust. Every single Rust binary needs to eventually call unsafe code at some layer of the callstack.

Is creating a TCP socket using stdlib functions unsafe? How about writing to a file? Or acquiring a mutex?

I would suggest doing some more reading before chiming in here :)

You have totally misunderstood what the person you are talking with means by unsafe. Perhaps you should resolve that prior to such condescensions.

Indeed I have haha - my bad :)

Easier to lose context with longer comment chains...

Adafruit sells raspberry pis. This is a blog post not a news article.

I would say "vary" is the wrong way to solve that problem. The issue is that there can easily be a bunch of stupid inconsequential differences between accept headers, far beyond simply asking for type x versus type y. Slightly different priorities, order, including an extra mime in the list, putting some irrelevant format nobody uses first just in case, etc.

An optimal solution would involve: the response listing which alternate content-types can be returned for that endpoint, the cache considering the accept header, if it sees a type from the alternates list higher in the accept header priority than whatever it has in cache, then it would forward the request to the server. Once it had all the alternatives in cache, it would pass them through according to the accept without hitting the server.

The closest existing header to the above would be the link header, if you give it rel=alternate, and type as the mime type. It's not clear what href you would be, since it usually is to a different document, but we want the same url but a different mime type. So clearly this would be an abuse of the header, but could work.

That's tangentially related to the Vary header. Not only Accept can go into its value, you know.

And an optimal solution IMHO would be for the origin server to simply return 302 to a specific resource, selected upon the value of the Accept header:

    GET /thumb.php?id=kekw HTTP/1.1
    Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8

    HTTP/1.1 302 Found
    Location: /media/thumb.jpg?id=kekw
    Vary: Accept

    GET /media/thumb.jpg HTTP/1.1
    Content-Type: image/jpeg

Sure, except I doubt most people want to uglify all their urls with extensions for occasional alternates. Plus, if the url with the extension gets past around instead of the original (as would inevitably be done) you're back to square one.

I had thought about recommending that people just use an alternate link as intended, to point to an alternate format. I think that would work best using existing web standards as intended, but it has the downside of initially serving the original format regardless of the content type.

> if the url with the extension gets past around instead of the original (as would inevitably be done) you're back to square one.

Why? It has no "Vary" header, and it's the one that's supposed to get cached anyhow.

If people see it in the url bar and copy paste it from there. In the case of images if they "copy image url".

Once the US has air superiority, they don’t need their aircraft carriers anywhere close to Venezuela territory. The submarine fleet alone can enforce a blockade.

Point is, a blockade in and of itself is an act of war, and will get the corresponding response. You cannot hope to just starve them out. You can go full ham if you'd like, but that will also get a corresponding response. If you just want "a bit" of war, then you need to leave them an out.

All moot now, as anyone could have predicted, but it was fun to think about.