I'm not sure if this is just a rhetorical question or a real one?
Because I didn't claim it isn't negligence. It is negligent, however, it is not a problem solvable by just pointing fingers. It's a problem that solvable through more strict regulation and compliance.
Cyber security is almost exactly the same as safety in other industries. It takes the same mindset, it manifests in the same ways under the same conditions, it tends to only be resolved and enforced through regulations....etc
And we all know that safety is not something solvable by pointing fingers, and saying "Well Joe Smo shouldn't have had his hand in there then". You develop processes to avoid predictable outcomes.
That's the key word here, predictable outcomes, these are predictable situations with predictable consequences.
The comment above mine is effectively victim blaming, it's just dismissing the problem entirely instead of looking at solutions for it. Just like an industry worker being harmed on the job because of the negligence of their job site, there are an incredibly large number of websites compromised due to the negligence of our industry.
Just like the job site worker who doesn't understand the complex mechanics of the machine they are using to perform their work, the website owner or maintainer does not understand the complex mechanics of the dependency chains their services or sites rely on.
Just like a job site worker may not have a good understanding of risk and risk mitigation, a software engineer does not have a good understanding of cybersecurity risk and risk mitigation.
In a job site this is up to a regulatory body to define, utilizing the expertise of many, and to enforce this in job sites. On job sites workers will go through regular training and exercises that educate them about safety on their site. For software engineers there is no regulatory body that performs enforcement. And for the most part software engineers do not go through regular training that informs them of cybersecurity safety.
This is probably one of the most security ignorant takes on here.
People will ALWAYS fuck up. The world we craft for ourselves must take the "human factor" into account, otherwise we amplify the consequences of what are predictable outcomes. And ignoring predictable outcomes to take some high ground doesn't cary far.
The majority of industries that actually have immediate and potentially fatal consequences do exactly this, and have been for more than a generation now.
Damn near everything you interact with on a regular basis has been designed at some point in time with human psychology in mind. Built on the shoulders of decades of research and study results, that have matured to the point of becoming "standard practices".
It's not as easy to defeat as just changing the pixel....
CSAM detection often uses existing features for image matching such as PhotoDNA by Microsoft. Similarly both Facebook and Google also have image matching algorithms and software that is used for CSAM detection which.
These are all hash based image matching tools used for broad feature sets such as reverse image search in bing, and are not defeated by simply changing a pixel. Or even redrawing parts of the whole image itself.
You're not just throwing an md5 or an sha at an images binary. It's much more nuanced and complex than that, otherwise hash based image matching would be essentially useless for anything of consequence.
The language it's written in has very little, almost nothing, to do with how efficient larger applications are.
This is almost entirely up to the design and day-to-day decisions of the developers. These almost always outweigh the efficiencies of the underlying languages themselves (within reason).
A single location of poor data access patterns could negate the aggregate performance gains of your entire application, as an example. A framework that prevents you from making simple mistakes and drives you towards more efficient patterns goes much further than the language is written in.
Between Rust, C#, Java, and Go you're essentially even on performance for large applications (with C# pushing ahead of the pack). What you are not even on is engineering efficiency, it's going to take considerably longer to build the same set of features in rust than any of the others listed. And the performance is likely the same, potentially even worse depending on the maturity of the ecosystem.
Rust is a great systems design language and a great language to choose when developing high efficiency libraries & frameworks for I/O and data processing. It's not really a great choice for application development due to how slow it is to actually get things done in.
I fully expect to see alternate backends written in more operationally efficient languages over the next decade that will catch up to the official Lemmy codebase, and potentially even replace it. It actually sounds like a super fun project, funding is always a problem though.
I would pick up the dilute serum from the allergist and transport it myself. It's specifically created for just me (The exact serum), so it's not something attainable from the pharmacy.
Thank you so much for the knowledge! I'm going to take this and see what I can do. Thank you 🙏
Yeah, I thought it sounded unhinged. But I'm desperate, and don't want to put myself at risk of a preventable death.
I've spent the greater part of my life as a shut in largely because I'm a sniffling, coughing, sneezing mess all day and night every day for 6-8 months of the year. And simply a sniffly mess for the rest.
I had one good summer last year and I can't believe what I'm missing. Being able to do activities like hiking, or biking, going to the grocery store without being treated like I have the plague. Actually being able to go out to a restaurant or public places. Making friends, and actually being able to join them. Going to the movies...etc Not having to carry a whole-ass box a Kleenex with me everywhere I go.
It made me into a desperate man, realizing how much life I'm missing.
The comments here are fantastic, and incredibly helpful.
My allergist mentioned these, and noted that this is likely to be ineffective for me. Insurance also didn't want to pay for it, though they shoveled out $4k for the serum for shots.
If I can't get shots here though, I'll try anything.
