• 0 Posts
  • 271 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle





  • Walmart is garbage, but the claim they can eat 30% tariffs because they made billions is by itself not a credible argument.

    They made 16 billion in profit, on the back of 650 billion in revenue. Percentage wise that’s 2.5%. The acquisition cost of the goods is a fraction of their operating costs, but if cost of acquiring the goods was even only 10% of their revenue, the tariffs are enough to push them red.

    If he is right then I would expect a nice analysis of the financials of Walmart showing this is feasible, rather than a hollow rant.

    Alternatively, if it were as he stated earlier temporary pain like medicine to fix the manufacturing imbalance, I would want a more coherent strategy. As it stands, businesses can’t plan around his tariff policy as it shifts day to day without warning. If they did bring home manufacturing at significant expense, they lose because Trump gives in and competition that didn’t bother has an advantage.



  • That seems convoluted but also as stated it wouldn’t be a wash.

    A deduction means pretend that portion of income never existed and the taxable portion of it is not charged.

    Then generally the deduction has to be above the standard deduction to make sense to use, and the standard deduction is just so high nowadays.

    So if you claimed a hypothetical deduction of 1,000, then you reduce your tax burden by only 200 or so, assuming you otherwise had like 20 some odd thousand in deductions to get you close to the standard deduction.

    The only way it would be a wash is if it were a refundable tax credit with no qualifications, and that almost never happens for anything. I could imagine a non refundable credit that would make it a wash for anyone with sufficient tax liability.

    However, this would make the tariffs an utterly pointless needless complication, needing a whole lot more accounting by sellers and consumers just to get to a similar and simpler position of not doing the tariffs in the first place.


  • Sure, you could do something like that to normalize all manner of passwords to a manageable string, but:

    • That hash becomes the password, and you have to treat it as such by hashing it again server side. There’s a high risk a developer that doesn’t understand skips hashing on the backend and ends up insecurely storing a valid password for the account “in the clear”

    • Your ability to audit the password for stupid crap in the way in is greatly reduced or at least more complicated. I suppose you can still cross reference the password against HIBP, since they use one way hash anyway as the data. In any event you move all this validation client side and that means an industrious user could disable them and use their bad idea password.

    • if you have any client contexts where JavaScript is forbidden, then this would not work. Admittedly, no script friendly web is all but extinct, but some niches still contend with that

    • Ultimately, it’s an overcomplication to cater to a user who is inflicting uselessly long passwords on themeselves. An audience that thinks they need such long passwords would also be pissed if the site used a truncated base64 of sha256 to get 24 ASCII characters as they would think it’s insecure. Note that I imply skipping rounds, which is fine in such a hypothetical and the real one way activity happens backend side.




  • Though it could also amplify DDOS. Allowing 72 character passwords lets a DDOS be three times rougher despite being a seemingly modest limit for a single request.

    If a password/passphrase is 24 characters, then any further characters have no incremental practical security value. The only sorts of secrets that demand more entropy than that are algorithms that can’t just use arbitrary values (e.g RSA keys are big because they can’t be just any value).


  • Back in the day, long time ago, Unix would do that, and limit user silently to 8 characters.

    Which then wasn’t great, but a good password would be hard to break even at only 8 characters with equipment of the time.

    We would do a cracking test against the user passwords periodically and ding users who got cracked. Well one user was shocked because they thought their 16 character password was super secure and there’s no way we would crack it. So we cited her password and she was shocked she went through so much trouble only for the computer to throw away half her awesome password.


  • So I just went through something similar with a security team, they were concerned that any data should have limits even if transiently used because at some point that means the application stack is holding that much in memory at some point. Username and password being fields you can force into the application stack memory without authentication. So potentially significantly more expensive than the trivial examples given of syn and pings. Arbitrary headers (and payloads) could be as painful, but like passwords those frequently have limits and immediately reject if the incoming request hits a threshold. In fact a threshold to limit overall request size might have suggested a limited budget for the portion that would carry a password.

    24 characters is enough to hold a rather satisfactorily hardened but human memorable passphrase. They mentioned use of a password manager, in which case 24 characters would be more entropy than a 144 bit key. Even if you had the properly crypted and salted password database for offline attack, it would still be impossibly easier to just crack the AES key of a session, which is generally considered impossible enough to ignore as a realistic risk.

    As to the point about they could just limit requests instead of directing a smaller password, well it would certainly suck of they allowed a huge password that would be blocked anyway, so it makes sense to block up front.


  • I think I heard a plan to argue the amendment intended “exclusively subject to the jurisdiction”, though that requires a pretty huge “reading between the lines” to just invent that extra term. In such a scenario they would argue citizenship of a foreign nation by way of a parent being able to pass on that citizenship disqualifies then for US citizenship. This means that they couldn’t be left nationless even if that sketchy interpreation prevails.

    But the reading of the text pretty much seems clear cut, the only way someone born in US soil could be disqualified is if the US was invaded and it was occupied to the point where US government had no practical authority, like if Japan had kicked out all the US government, judges, and law enforcement to make it clearly obvious there no jurisdiction left…


  • “I don’t think anything went wrong. We just needed more votes,”

    Nothing went wrong except the most plainly important thing to go wrong. Further something that could have actually gone right if they just planned better around one of their members.

    “It was a win-win either way.

    Losing is ok because the Republicans will get blamed… Except this very article where they actually had enough Republicans to get a win and they still boffed it. A rare opportunity for substantiative progress to prove that even as a minority party they can drive common sense legislation and they totally screwed up.



  • I think it was created as a markup to explain why they thought the ambiguous tattoos were problematic, I hope they would have assumed no one would be stupid enough to think he literally had tattoos that managed to be flat perfect text in pure black in a photo.

    But it turns out Trump is literally that stupid. Or it is convenient so he doesn’t have to field answers like “where’s some corroborating evidence to back up the claimed meaning”.

    Of course all of this is almost beside the point. We shouldn’t be doing this in the court of public opinion, it should be in front of a real judge and if deported it should be in compliance with orders that he be deported to anywhere but Salvador, and even if someone deports to El Salvador, we shouldn’t just directly deport straight to a prison that may not even have anything to do with country of origin.


  • Approval ratings get weird, someone with a lower approval rating can beat someone with a higher approval rating.

    So relatively fewer people are “excited” about a democrat candidate. If they have to pick between that candidate and Trump, they may still pick the candidate as the best practical option available, but they don’t necessarily “approve” of the choice they are making. People have a hard time mustering “approval” for a milquetoast candidate, even if that person is the least objectionable to a broad set of folks.

    Meanwhile Trump is making a particular sort of folk very happy, in a way no other modern politician has dared to do. Most people may find it highly objectionable driving a lot of disapproval, but you will have the die hard MAGAs ecstatic about stuffing those brown people into vans and locking them up in El Salvador without any due process.