d4mi3n

47 ms·

271.
by d4mi3n 4y ago
You raise a good point, and I’ve seen this in other contexts. Team wants to be better at X. Y is a tool or process that helps them get there. At some point, the goal of X is forgotten and Y subsumes everything, sometimes to the detriment of
272.
by d4mi3n 4y ago
It is an arbitrary ritual. I never understood why everyone is so dogmatic about planning process. It’s like any other development pattern—it should be adapted to the context it’s in. The whole point of a standup is to keep the a team coordi
273.
by d4mi3n 4y ago
It’ll be interesting to see if this ends up being a real indication that the NSA and similar organizations (FBI, CIA, etc) are pushing for a stop to back doors in the next generation of encryption standards coming out of NIST.
274.
NSA Says ‘No Backdoor’ for Spies in New US Encryption Scheme(bloomberg.com)
2 points by d4mi3n 4y ago|4 comments
275.
by d4mi3n 4y ago
I believe we’re making the same point from different angles: I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity. You (correct me if I’m wrong) are stating that bad actors wi
276.
by d4mi3n 4y ago
Can you clarify? Historically many VCS/SCMs are self-hosting, but I’m not certain that’s what you are asking for. Fossil is a SCM tool that also comes bundled with a wiki and other tools to document a project and store artifacts, if th
277.
by d4mi3n 4y ago
This is odd and completely counter to my own anecdotal experience. SMS messages from large companies I interact with (My bank, cell phone provider) always come from fairly static short codes. The elephant in the room here is that SMS is not
278.
by d4mi3n 4y ago
There has been a lot of pushback on reporting requirements around security breaches. While I think some of the feedback mentioned in the article is reasonable, many companies will not realistically improve their security posture if it isn’t
279.
Businesses Seek to Soften SEC Cyber Rules(wsj.com)
1 points by d4mi3n 4y ago|1 comments
280.
by d4mi3n 4y ago
> In 2022, we are met with self-sabotage and protestware incidents that are on the rise: colors/faker, node-ipc, event-source-polyfill, styled-components, es5-ext You raise a very good point about self-sabotage and protestware. I&#x
281.
by d4mi3n 4y ago
Thanks for the reply Ax! I was familiar with Nexus Lifecycle, but Lift and Nexus Firewall are new to me. Will definitely check them out. What are your thoughts on risks in this space? As a member of an org that thinks about these problems a
282.
by d4mi3n 4y ago
Could you point me at the product from Sonatype you have in mind? I’d genuinely love to see it. I’ve seen their SAST offerings, but not much around SCA/SBOM/supply chain analysis. It’s also worth pointing out that my original comm
283.
by d4mi3n 4y ago
IIRC when I examined this a couple years ago—it doesn’t seem to have changed—this is about NPM signing packages submitted to it’s registry. This can give confidence they packages are not tampered with when one downloads them from NPM. What
284.
by d4mi3n 4y ago
Security is absolutely a people problem, but in general good security tends to make it hard to do dangerous things. I do not believe most development tooling makes it easy to be safe while also making it hard to do generally dangerous thing
285.
by d4mi3n 4y ago
100% this. My CSIO has been harping on this since 2018. I’ve been harping on this since 2019. Security vendors are JUST now starting to provide SCA offerings (software composition analysis, for those not in infosec). Events like these don’t
286.
by d4mi3n 4y ago
I agree with you here, but regardless of how busy a company is it's not unreasonable to expect a minimum-bar of quality of experience. Interviews often set perception of how well a company operates. If you or your company care about yo
287.
by d4mi3n 4y ago
I recently accepted an offer from Shopify and they did a reasonable job. 3 or 4 calls over 2 weeks, with an offer less than 3 days after my last call. Rates were very competitive for my roll and skillset. That said, they do seem to be going
288.
by d4mi3n 4y ago
In the good old days you could embed executable code in a PDF. Interactive flash games. Java applets. Sanity has prevailed and a lot of that just doesn’t work anymore, but IIRC Adobe wanted PDF to be “the” file interchange format.
289.
by d4mi3n 4y ago
Ruby. Python. Several JavaScript NPM packages. Part of the problem here is the standards around CSVs aren’t consistent, nor are they well respected. Things get even weirder when you throw non-Latin characters in the mix. May such parsers pr
290.
by d4mi3n 4y ago
I feel this way about most utilities I deal with. TMobile and Comcast both have terrible UX for their websites. PG&E is a bit better, but only in that it's better organized. I'd love for more services to have simpler interface
291.
by d4mi3n 4y ago
> It has the appearance that it was knocked up in notepad, but after using it, I have a modicum of respect for how it makes government usable. I'd wager that the looks have a lot to do with accessibility. Government sites are intere
292.
by d4mi3n 4y ago
This touches on a theme I see in a lot of US organizations I work at: Lack of accountability at the management and executive level. If you're well established in your career as an engineer today, you have leverage. Many of us have the
293.
by d4mi3n 4y ago
It’s an easy transition to make. I find dialog like this is a lot like a meeting: without a good agenda and some level of rigor it’s easy for a conversation to go places you don’t intend it to go. For me, it helps to pause often and filter
294.
by d4mi3n 4y ago
No idea, but from what I’ve head it’s commonly understood that people who regularly move and exercise will generally have better lymph circulation for that reason.
295.
by d4mi3n 4y ago
Domestic cats are VERY successful hunters in general, with the highest success rates of all animals in that kingdom. That said, I don’t know what success looks like over different kinds of prey. Over the last year or so we’ve also had a pre
296.
by d4mi3n 4y ago
Fun fact: one of the red flag symptoms of a headache or migraine is if it is significantly less severe sitting up vs lying down. Or if it gets worse when you sneeze. I am NOT a doctor, but IIRC this can be a signal of serious issues they co
297.
by d4mi3n 4y ago
> also anyone know how is lymph pumped? I don't think the heart pump lymph so is it stagnant? I have a close friend who is working on getting certified as a massage therapist. Skeletal, muscular, and vascular anatomy make up a big p
298.
by d4mi3n 4y ago
Context, delivery, and choice of words matter. For example: * Give praise in public * Criticize in private * Any criticism offered should be constructive * Any criticism offered should be of ideas and actions, not individuals--regardless of
299.
by d4mi3n 4y ago
It’s a kind of quirky humor that resonates well with a technical audience. I haven’t personally memorized any numbers, but I do know the “Ballmer peak” and “competing standards” XKCDs pop up a lot in casual conversations with my own peer gr
300.
by d4mi3n 4y ago
Ever try cleaning Git commit history? How about having GitHub clear a repository cache containing a secret? You’re not wrong, but this is a whole class of issue that can be avoided for trivial levels of effort.

More ›