rectang

29 ms·

601.
by rectang 2y ago
When bug bounties are priced low, it also irks those among us who care about security — for the sake of the organizations we work for, for the sake of our end users, and for the sake of the world at large.
602.
by rectang 2y ago
My initial thought was that in certain English accents, including some from the northern parts of the UK, the r is "flapped" or "tapped" similar to an r in Spanish. With a tapped r, the pronunciation of "Rick"
603.
by rectang 2y ago
Fine by me. Tech companies can sort themselves into groups: those where such discussions are welcomed and those who run from them. And I'm happy to see a manager put the "people" section above the section on "technology
604.
by rectang 2y ago
> Because they feel the same way about your side. Yes, this is surely true. > So maybe the issues are actually with both sides. Not necessarily. Is Russian resentment of Ukraine equivalent to Ukrainian resentment of Russia merely
605.
by rectang 2y ago
> Being very anti-LLM code instead of trying to understand how it can improve the speed might be detrimental for your career. > I'm in charge of maintaining all processes around LLM keys Does management look to you for insigh
606.
by rectang 2y ago
I don't think AI is an exception. In organizations where there were top-down mandates for Agile, or OOP, or Test-Driven Development, or you-name-it, those who didn't take up the mandate with zeal were likely to find themselves ou
607.
by rectang 2y ago
This has been true for every heavily marketed development aid (beneficial or not) for as long as the industry has existed. Managing the politics and the expectations of non-technical management is part of career development.
608.
by rectang 2y ago
The cloud products could be created with hard stops, but the vendors choose not to do so. It's a constant, exhausting fight to engineer projects to avoid the risk of business-destroying overages when those projects don't need to
609.
by rectang 2y ago
Enshittification at cloud providers guarantees that in order for some department to hit the numbers ownership demands, an ever increasing number of customers must get screwed with overage bills.
610.
by rectang 2y ago
The worst case for a traffic spike on some hard-limited service is the service becoming unavailable. The worst case for a traffic spike on an unlimited service is financial calamity.
611.
by rectang 2y ago
It's easier to beg forgiveness than to ask permission, and it's easier still to do neither.
612.
by rectang 2y ago
See https://news.ycombinator.com/newsguidelines.html and search for "politics". Additionally, political discussions on HN are hamstrung by the guideline to "assume good faith", which doesn't work we
613.
by rectang 2y ago
I'm skeptical that the intentions of the Wells Fargo executives were pure and white as the driven snow. The incentives align to encourage executives to commit crimes in service of short-term gains — even in the extreme case of Wells Fa
614.
by rectang 2y ago
> do you object to biblical references, or to references to particular experiences that only some people have (heartbreak, death of a father)? I mean allusions as discussed in the NYT article: "poetic references", or what we
615.
by rectang 2y ago
Allusions are elitist. Art always exists in some context, even if it's only the language of the work and its setting. Allusions add to that context, but in a way that insidiously empowers a handful of authority figures. Allusions make
616.
by rectang 2y ago
The math pages on Wikipedia value correctness above lay comprehensibility. It's easy to understand how this happens: a learned mathematician points out that a simplification for the purposes of making an explanation more approachable i
617.
by rectang 2y ago
From upthread: > This is assuming that the audit consists of validating dependency authorship, and not the more labor-intensive approach of reviewing dependency code. So, obviously: authors. I took your reply of "hard no" to
618.
by rectang 2y ago
I dunno! Sounds complicated. The obvious answer is "N crates is N dependencies", because each crate represents a discrete sequence of atomic software release packages. In the absence of a standardized mechanism to group crates to
619.
by rectang 2y ago
> "how many owners am I depending on" Yes, knowing that would be helpful! Is there a way to whitelist owners/publishers in Cargo?
620.
by rectang 2y ago
When a primary dependency is added to a project, its publishers are evaluated for trustworthiness; it's possible that a dependency might be ruled out if its authors seem sketchy or insufficiently concerned with security. Different org
621.
by rectang 2y ago
It remains relevant to programming language choice because the "best in class" libraries in Rust often have lots of dependencies, thanks to Rust culture and cargo's design. I'd like to be able to pick a few libraries wit
622.
by rectang 2y ago
I care less about the quality of the dependencies than about the burden of protecting against supply chain attacks when there are a lot of dependencies.
623.
by rectang 2y ago
I should clarify that I mean auditing dependency-publisher authentication, rather than full code review. This returns us to status quo ante, back before supply chain attacks were something we worried about. Bugs and such from dependencies
624.
by rectang 2y ago
> I don't have access to the closed-source repo to run `cargo tree` to see where `unindent` is used from, but why do you feel this is an invalid crate to pull in? Each additional dependency imposes an ongoing audit burden on the d
625.
by rectang 2y ago
I suppose you could say that the audit burden scales linearly with the number of module publishers, with a small additional amount on every release point to confirm that the publisher is still who they purport to be and hasn't been com
626.
by rectang 2y ago
Yes, the amount of effort it takes to audit dependencies scales roughly linearly, so unless you're going to blindly install them, choosing to use a project with so many dependencies means taking on a tremendous amount of ongoing work.
627.
by rectang 2y ago
Conscious of the effects of structural racism.
628.
by rectang 2y ago
Greenland doesn't have "growing strategic significance", except insofar as Trump has imperialist designs on it and the geopolitical consequences that flow from that.
629.
by rectang 2y ago
> Or will my fantasy come true that all roads, infrastructure, homes and businesses move underground? Accursed Gamelans. https://www.youtube.com/watch?v=tytrgmVIwlg&t=114s
630.
by rectang 2y ago
Haha, had it been a cement mixer ring bearing, then there would have been another explanation for the reports that it fell red hot from the sky — that they were as fanciful as the reports of mysterious drones infesting New Jersey (which see

More ›