I live in Oxford, UK and walked past a police van that said "automatic facial recognition in use". Not exactly a good sign without any caveats. I imagine they recorded me staring at their van.
Also docs collaboration, and now video calling as well. And they've just bought Standard Notes, so that'll be next. It's definitely chugging along fast.
I think ultimately it's a consequence of weapons manufacturers in the US is trying to make their products sound more impressive, and in general military terminology is a huge nonsensical mess.
Just consider that "self propelled gun" and "main battle tank" are very different things despite the first being a quite accurate description of what the latter consists of. Or the distinction between a cruise missile and a one way drone...
It’s a bit silly for this situation, but the basic idea of moving from “weapon” to “weapon system” is reasonable, in a 20th century kind of way.
Basically, WWII showed planners they were in the war business not in the ship/plane/tank business. Take navies, for example. For most of the history of the professional navy, the overwhelming cognitive container for “unit in the navy” was a ship. Planners paid for ships to be laid down, admirals planned where they went and captains were responsible for them in all regards. You could reasonable count a navy’s capability by counting the kind and number of their ships: thus and such frigates, ships of the line, etc. However, even before the 20th century naval planners knew and acted like ships weren’t atomic: counting guns on ships of the line as a distinguishing feature or planning a sortie based on available marines both herald what would come later. But mostly we thought of ships as ships. If the enemy was to have 3 battlecruisers then we ought to have 4.
WWII shuffled all that around. At the scale of fighting and industrial demand, the idea of a “ship” or a “tank” or a “fighter” as a unit of analysis started to look tenuous. Successful commanders and (especially) planners noticed that the math worked out much better if we considered units of analysis larger than individual technological objects. The immediate consequence is one starts to think in terms of weapons delivery to the enemy and not the Sherman tank. The primary concerns then (often but not always) shift from characteristics of the weapon as a weapon to: can this system as a collective be built cheaply, can it be deployed + trained on easily, and can it achieve goals in mixed employment.
The same basic idea animated the operations research revolution in warfare, the bam changes from thing to thing_system or thing_platform are consequences of that.
Guided missile launchers are weapons systems, because the projectile and the launcher each are a component of a complete system which requires significant technology. This is in contrast to a firearm, which has all of the technology in the gun and not the ammunition (for the most part) or more simply a knife or sword.
I suppose I'd say: well, no, a gun's ammunition does something significant, but also even if that disambiguation were necessary in a particular circumstance, this article is not that.
Guns, swords, and bombs are weapons. The same, attached to fancy computers that can use them autonomously are weapon systems. At least that's how I've always hears the terms used.
> With the leverage jemalloc provides however, it can be tempting to realize some short-term benefit. It requires strong self-discipline as an organization to resist that temptation and adhere to the core engineering principles.
This doesn't quite read properly to me. What does it actually mean, does anyone know?
I'm pretty sure it means something like this: "Because jemalloc is used all over the place in our systems that run at tremendous scale, some hack that improves its performance a little bit while degrading the longer-term maintainability of the code can look very appealing -- look, doing this thing will save us $X,000,000 per year! -- and it takes discipline to avoid giving in to that temptation and to insist on doing things properly even if sometimes it means passing up a chance to make the code 0.1% faster and 10% messier."
I'm trying to build a nextjs app and it's quite painful. It seems to be more and more focused on SSR, which I don't care about (looking for a static app that calls separate API endpoints). That would have been fine in the NextJS I remember from a few years ago, where static and SSR seemed equally viable, but I can't be bothered now. I'm going to try Tanstack Start.
99% of what you see with the word "server" vs "client" is actually orthogonal to SSR is that wasn't clear.
The React team (really Vercel + Shopify) decided to use the supremely misleading names "Server Component" and "Client Component" for two things that do not affect CSR vs SSR.
Even if you label the root of your app "use client" (thus opting out of all the new complexity around RSC and server actions), it's still getting rendered server side.
Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.
It's something akin to a service provider in SAML parlance, if we are to believe reporting. How can it be air-gapped?
And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
If you can't implement it securely then perhaps such an undertaking wasn't a good idea? In the vast majority of cases I don't see why PII ever needs to be available over the network for remote queries. For the purpose of verification isn't it sufficient to verify hashes or better yet to attest via smartcard?
That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
And it's pretty clear to me that they were criticizing storage of sensitive data in a database that isn't properly secured and they simply misused the term "airgapped". The database in question was easily accessible from poorly maintained development infrastructure.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)
I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
some report it's basically the code and certs responsible for BankID SSO
No. CGI has nothing to do with BankID.
IMO the most credible reports suggest that the source code and data involved are related to these four services:
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies
https://www.cgi.com/se/sv/business-process-services/elektron...
"With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency
https://www.cgi.com/se/sv/business-process-services/e-tjanst...
"SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked
These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.
That's incorrect. Skatteverket used CGI for BankID-login, I don't know if they still do. I have personal experience working on a BankID-login using CGI for another company and it is still active.
Edit: I just confirmed Skatteverket still uses CGI for BankID-auth. "funktionstjanster" is CGI.
OK, let me rephrase that: CGI, while they may "have something to do" with BankID in the sense that they have developed systems that integrate with it, does not itself develop BankID and does not hold any private keys for BankID.
To the best of my understanding it means that a system made by CGI for digital signing of documents (as in: you get something like a PDF from a government agency and need to digitally sign it and send it back) has had its source code and/or some data belonging to it leaked.
Skatteverket, the Swedish tax authority, has been quoted in media as confirming that they use CGI's system for digital document signing but that none of their data nor that of any citizens has been leaked.
"One of the government agencies that uses CGI’s services is the Swedish Tax Agency, which was notified of the incident by the company. However, according to the Swedish Tax Agency, its users have nothing to worry about.
“Neither our data nor our users’ data has been leaked. It is a service we use for e-signatures that has been affected, but there is no data from us or our users there,” says Peder Sjölander, IT Director at the Swedish Tax Agency."
So if no data was leaked from the tax agency or from the users, then the leaked "digital signing documents" must have belonged to the only remaining party, which is CGI, so perhaps they were just some marketing documents about the benefits of their digital signing service?
The original phrasing from the attacker, from the website that put the data up for download/sale, was ”documents (for electronic signing)” which implies that they’re documents that would be signed in said system. I would take all of this with a large helping of salt though. CGI claims it’s not real production data anyway; maybe it is and maybe it’s not.
The best case scenario is in line with what CGI claims: these are lorem ipsum fake docs from an old git repo for a test instance of the system.
If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card.
Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
I apparently didn't phrase that very well. If what is the case? I was trying to ask which case was the case, not trying to claim that something specific was the case.
I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
In Portugal we were early adopters for digital signatures on citizen cards.
You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used.
Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
Signed documents can be as simple as an ID of the transaction, a statement in text, PII data that identify what you sign, or a store of larger PDF files for download and verification. We do not know. I base this on how signing works technically in Sweden.
We might've lucked out here, there is some signature data on ID cards today and official _plans_ to make a government backed signing service, but practically _nobody_ uses them in practice to just revoking all those keys will be a minor issue.
Currently most Swede's use a private bank consortisum controlled ID solution for most logins and signatures.
> I think microservices emerged for a different reason: to make more efficient use of hardware at scale.
Scaling different areas of an application is one thing. Being able to use different technology choices for different areas is another, even at low scale. And being able to have teams own individual areas of an application via a reasonably hard boundary is a third.
I just wish that in those cases the interviewee gives feedback and allows you to rewrite instead of just failing you. I mean in practice nobody writes library functions themselves unless absolutely necessary, but I get that for some positions you have to demonstrate that you can write lower-level code if you have to.
I think that it was probably a poorly designed question, but surely you could throw the interviewer a bone by giving a custom answer after they reject the library.
I love how your answer was straight, to the point and leverages existing standards, then scrolled up to the question and had to go through someone else's thorough, multipage response. Full marks to both answers!
reply