MrDarcy

9 ms·

91.
by MrDarcy 10mo ago
For both home and travel routers OpenWRT is far and away superior to Unifi gear. Usability, configurability, and especially security.
92.
by MrDarcy 10mo ago
Counterpoint: most likely no, it really is about all the downstream impacts of critical and high findings in scanners. The risk of failing a soc2 audit for example. Once that risk is removed then the value prop is also removed.
93.
by MrDarcy 10mo ago
Right and in my example it would be the principal of the service account, not the compromised AWS account. If you ran a cloud trail query that's essentially "Did Alice access user data in S3 ever?" the answer would be "N
94.
by MrDarcy 10mo ago
What do you mean by “trust cloud trail” So cloud trail shows the compromised account logging into an EC2 instance every day like normal. Then service account credentials are used to access user data in S3. How does cloud trail indicate the
95.
by MrDarcy 10mo ago
Unless the attacker used any one of hundreds of other avenues to access the AWS resource. Are you sure they didn’t get a service account token from some other service then use that to access customer data? I’ve never seen anyone claim in wr
96.
by MrDarcy 10mo ago
Reading it with hindsight, their problems have less to do with the technical trade off of micro or monolith services and much more to do with the quality and organizational structure of their engineering department. The decisions and reaso
97.
by MrDarcy 10mo ago
And off by one errors.
98.
by MrDarcy 10mo ago
This is a land grab and not much else.
99.
by MrDarcy 10mo ago
This is nonsensical. Most F500 companies are globally distributed. Most of onboarding is gaining access to systems. It’s far easier and more efficient to search slack, find the person you need to talk to and DM them in your first week than
100.
by MrDarcy 10mo ago
The ivory tower standing in the way of delivering value I think.
101.
by MrDarcy 10mo ago
This matches my personal experience having worked with OpenStack.
102.
by MrDarcy 10mo ago
“Show me the incentive, I’ll show you the outcome.” -Charlie Munger
103.
by MrDarcy 11mo ago
The idea is sound but the feeling of hate is perhaps strong. It’s understandable there’s no incentive to pay for open source software, and doing so would be seen as an unnecessary allocation of resources that could better be allocated elsew
104.
by MrDarcy 11mo ago
In the 2000’s Python was also a sysadmin language. Edit: But I see your point, Google SRE’s around the late 2000’s reached for Python more than Perl.
105.
by MrDarcy 11mo ago
This is correct and applies to security in general. Security is one facet of reliability.
106.
by MrDarcy 11mo ago
I honestly don’t understand why you’re presuming to tell me what I think. I consider myself a craftsman. I craft tools. I also am a manager. I also am a consultant. I am both a subcontractor and I subcontract out. Above all else I’m a hack
107.
by MrDarcy 11mo ago
I’m a hacker and I’d show respect to that latter person if they did the subcontracting and reviewed their craft well.
108.
by MrDarcy 11mo ago
Universities are a special case. They generally don’t spend money because of the red tape. In much of corporate America expenses under $100 give or take don’t even require documentation, so a $50/month support subscription is easily pu
109.
by MrDarcy 11mo ago
Stop spamming.
110.
by MrDarcy 11mo ago
Same in terms of time spent. The hypothesis graphql is superior passes the basic sniff test. Assuming graphql does what it says on the tin, which my understanding is it does based on my work with Ent, then the claim it’s better for tool an
111.
by MrDarcy 11mo ago
The joke is that it looks like a joke but isn’t in the same way a sociopath will explain in detail exactly how they’re going to fuck you before they do knowing you won’t believe them because it’s all a joke in a joke that isn’t real.
112.
by MrDarcy 11mo ago
No professional engineer uses the AWS console to provision foundational resources like VPC networks.
113.
by MrDarcy 11mo ago
How is that relevant? The user agent (browser) handles the transport.
114.
by MrDarcy 11mo ago
Love haproxy but if we’re shilling projects istio is superior. Multi cluster, hbone, ambient.
115.
by MrDarcy 11mo ago
Even if you ask people to look they won’t look. You really gotta sell yourself and have an influencer mindset to motivate someone to go look at code you’ve published. This is it should be. It takes time and effort to try someone’s idea. R
116.
by MrDarcy 1y ago
The crux of the issue is reasonable people can disagree on what is OK at a large org. Security, like every human, believes they’re the good guys. Platform teams cannot enforce the principle of least privilege. Truly a paradox.
117.
by MrDarcy 1y ago
There aren’t many situations where expecting everyone to explain everything in every detail is correct, but there are some. Many of those situations where it is OK are down at the foundational level of the internet itself, which is what lin
118.
by MrDarcy 1y ago
Is the mapping of use cases to software functionality not a power law distribution? Meaning there are a few use cases that have a disproportionate affect on the desired outcome if provided by the software?
119.
by MrDarcy 1y ago
I believe so. For me it was helpful to visualize getting up and convincing the judge of the damages. I’d run a PnL, get average daily income from visitors, then claim that loss as damages. In court I’d bring a simple spreadsheet showing t
120.
by MrDarcy 1y ago
File a small claim for damages up to 10,000 to 20,000 USD depending on your local statues. It’s actually pretty quick and easy. They cannot defend themselves with lawyers, so a director usually has to show up.

More ›