jeremymcanally

14 ms·

31.
by jeremymcanally 4y ago
> Neither feature testers (does it behave as expected) or security testers (is it secure as it does it) are expected to write fixes. Writing fixes needs to be planned in the sprint and is better worked on by an expert on that system. ...
32.
by jeremymcanally 4y ago
I have no idea how their team was composed previously, but it could be that they had a lot of folks who were analysts but weren't contributing much to remediating issues. It sounds like (and I have no idea again) that they're hir
33.
by jeremymcanally 4y ago
> I mean, most banks don't require ID to make a deposit. Due to money laundering regulations, that isn't really true anymore. Most banks straight up won't take cash deposits into someone else's account, identificatio
34.
by jeremymcanally 4y ago
Finally, someone with a sensible position on this. Interviewing sucks, but the people on the other side of the table don't know you or your skillset. You have to give them some sort of objective information to work with. The positio
35.
by jeremymcanally 4y ago
But I can definitively say that any repo access is heavily logged. And this info is from like almost 10 years ago when I had first hand experience. I know they've upped their game in terms of repository access gating since then.
36.
by jeremymcanally 4y ago
I use mine daily for a few things, and I'm not a content creator. The Zoom buttons are great because it's one tap access to mute/unmute or video on/off regardless of what window I have on top at the time. I set my othe
37.
by jeremymcanally 4y ago
We use Doppler and some other custom built tooling, and it works really well. The Doppler pricing is really fair IMO, and their tooling adds a lot of value for us so I'm OK with paying for it. Software security is rarely free (even wi
38.
by jeremymcanally 4y ago
> Using their initial foothold of OAuth user tokens for GitHub.com, the actor was able to exfiltrate a set of private npm repositories, some of which included secrets such as AWS access keys. Keep those keys out of source control, folk
39.
by jeremymcanally 4y ago
You think you waited a long time? I wrote a patch to add this to GitHub when I worked there in 2011-12! :) It was rejected at the time by some folks for various “product” reasons, but I’m glad to see it finally become a thing.
40.
by jeremymcanally 4y ago
How do you read this as the database had tokens in it? > Separately, our investigation also revealed that the same compromised token was leveraged to gain access to a database... EDIT: Ah yep you're right. Two tokens in play there:
41.
by jeremymcanally 4y ago
The bigger question to me is how did they leverage a GitHub OAuth token to gain access to an internal database unless they're storing that config in their codebase. If that's the case...yikes.
42.
by jeremymcanally 4y ago
There are several things they could check and factor into the score before banning someone. Client source (if the use the website 100% of the time and suddenly this was from the Android client for example), IP address (do they tweet from t
43.
by jeremymcanally 4y ago
I'm assuming when the account is restored, the offending tweet will be gone, but I'd be interested to know if it was tweeted by an app that was authorized via OAuth (which one could see from the "source" attribute of the
44.
by jeremymcanally 4y ago
> Among bootcamp students, There is this constant unhealthy comparison going on in their minds with the people who graduated from a Uni. I sympathize with that (as someone who never went through uni for CS or a bootcamp), but at the same
45.
by jeremymcanally 5y ago
I'm 100% sympathetic to their growth issues, trust me. Their support team is stretched very thin, and I always try to be really understanding when tickets sit unanswered for a bit. At the same time, if they're cutting off someon
46.
by jeremymcanally 5y ago
Perhaps it’s all ratings then because we’ve shipped 100% on time, pay someone to respond to customer messages within 8 hours, and we still somehow don’t meet the criteria.
47.
by jeremymcanally 5y ago
I agree, but we've really tried everything to be honest! We put comparative photos on there, mention comparative sizing (e.g., "This is about the size of a normal business card"), and so on. Still, people get it and think i
48.
by jeremymcanally 5y ago
The first two bullets are fairly reasonable (especially shipping on time...24 hours response isn't great but whatever), but expecting that high of a 5 star rate is almost unheard of. I see shops that do it, but we get 4 stars quite of
49.
by jeremymcanally 5y ago
Yeah, as someone who sells five figures on Etsy every year, the fee increase (while crappy) isn't shocking or offensive. It's the other things they enumerate in the demands that are chafing us. I don't even see how things li
50.
by jeremymcanally 5y ago
The main thing Etsy offers sellers is buyers' attention. My wife and I have sold on Etsy for almost 15 years (!!!), and she started selling from the first day she opened a shop selling bow ties. Over the years, it's very rare we
51.
by jeremymcanally 5y ago
Anecdotal, of course, but my wife used to wander around downtown and SOMA when she would accompany me on business trips circa 2011-12 to SF. When I went back in 2019-20 after not having been there for 5+ years, I was shocked. I did my bes
52.
by jeremymcanally 5y ago
Sequoia Capital | SRE/DevOps/Application Ops | Menlo Park, CA / Remote | Full-time | https://www.sequoiacap.com We're looking for someone to come and help us level up our cloud infrastructure and application
53.
by jeremymcanally 5y ago
Why would they pivot their entire logistics workflow and supply chain to something that likely isn’t profitable for them outside of a pandemic? They did Pick and Click (ie, curbside pickup) at all their stores, which we did several times.
54.
by jeremymcanally 5y ago
We switched to Rollo a while ago and haven’t looked back. It’s faster and way more reliable than our pretty dang expensive Dymo. They also offer a wifi model now that we’re eyeing but the one we have works so well I don’t see us upgrading
55.
by jeremymcanally 5y ago
I locked GitHub’s user table in the middle of the workday by adding a column. Oops.
56.
by jeremymcanally 5y ago
This post (while not wrong that the docs lack in a lot of areas) is written with apparent ignorance of how documentation is generated and published at Apple. Right now creating the code and docs are mostly decoupled. Having worked in the
57.
by jeremymcanally 5y ago
Even if everyone's prices were MSRP (which they aren't), why pay ~10% more for an item at a local store who has to pay sales tax when I can just order it and have it brought to my door for a lower price? A lot of Amazon's gro
58.
by jeremymcanally 6y ago
Also, if we’re being honest, a pack of software nerds on a website don’t have the deep expertise on every topic like they think they do (speaking as a software nerd on a website myself :)). The stuff that gets posted here sometimes is...fas
59.
by jeremymcanally 6y ago
I've never done an interview at a place like that where I've worked (even in my early career), but you're very, very likely correct if you want to get into a FAANG early in your career without being able to "shop" a
60.
by jeremymcanally 6y ago
Really? I mean I've worked at GitHub, Apple, and now Sequoia Capital and get paid pretty well. I'd say wealth is a pretty important factor to me in choosing a job. I'd just rather find teams in those organizations that don&

More ›