sandeepkd

7 ms·

121.
by sandeepkd 2mo ago
Its an organic cycle, as the company grows big the number of relevant areas grow too and inter team communication becomes way too costly/impractical. The big company becomes a group of informal small companies, each running in their ow
122.
by sandeepkd 2mo ago
The messaging is what questionable here. This just opens up the door to commit hacks openly if other party has not secured properly. The definition of being a bad actor gets diluted here.
123.
by sandeepkd 2mo ago
> Apple now tries to shift the blame to “residual access”, but they also don’t disclose that this is a common issue with Apple which is caused by them failing to properly manage system access when people leave. I have been fixated on thi
124.
by sandeepkd 2mo ago
Thanks for sharing, it was really good read. The authors in the article have done a good job for sure to validate their hypothesis and make it work for a particular subset of problem. 1. Local hardware, no networking or HTTP requests 2. No
125.
by sandeepkd 2mo ago
> There’s no doubt that AI has already improved the productivity of engineering teams Thought it might be an interesting read, however have up just after reading the first line. For the context, code had always been a copy-paste exercise
126.
by sandeepkd 2mo ago
I love the idea from a personal note collection perspective, however as a blog I feel that it can be taxing to be able to read so many different handwriting styles
127.
by sandeepkd 2mo ago
> And we can also implement llm inference deterministically if we want, it’s just that it’s not worth the loss in performance to do it. My understanding is thats not possible (different from being practical), wonder if you have any liter
128.
by sandeepkd 2mo ago
From what I have seen personally over the last 8-12 months, I find this kind of complain ironical in most scenarios. Most of the people complaining this are comfortable with their own usage and distribution of LLM generated content and feel
129.
by sandeepkd 3mo ago
For the sake of discussion lets leave the business aspect. What you are offering is a service for managed database, similar to lot of cloud providers. What you have on the top of it is a OAuth2 process to obtain relevant credentials. From p
130.
by sandeepkd 3mo ago
Thats the point, the short lived credentials would have done much other than adding more step of getting the secrets again which is why I am questioning the discussion of that in a root cause analysis itself. Adding one more layer does not
131.
by sandeepkd 3mo ago
Agreed its a tool, and it does not looks like any vulnerability was exploited on their end. However part of the blog is confusing to me. Long lived keys vs short lived have their own space in discussion, there are use cases, pros & and
132.
by sandeepkd 3mo ago
It might be helpful here to categorize the data as sensitive, personal, financial, chat, public comments as such and then apply the probability model on a given category. I would probably call the AI coding as misnomer too, what you have is
133.
by sandeepkd 3mo ago
Got drawn to the topic, however usage of authentication and authorization seem like misnomer here, the core topic seems to be data ownership The concept on a surface level to have ownership over the data makes a lot of sense and to a large
134.
by sandeepkd 3mo ago
I have worked both in Enterprise and some FAANGs, a company serving enterprise customers has a higher bar for security expectations. FAANG companies do not fall in that bucket and thus is somewhat acceptable.
135.
by sandeepkd 3mo ago
Its feels like a pretend play of adults in some sense, Anthropic is really trying to make people believe into the picture they present to everyone. To me its either 1. Using the HG and OpenAI incident as an opportunity to wash away what Ant
136.
by sandeepkd 3mo ago
Tried to poke a little to see if I can find any name (I could not). Challenge with this domain is the TRUST anchor. As an organization/company you have to establish yourself first (directly or through reference) otherwise its hard for
137.
by sandeepkd 3mo ago
I think the question for CI costs is still out there. While I do not think it should be in tunes of thousands a day but thats the skepticism presented in the article. True costs are really important to make a good decision in situations lik
138.
by sandeepkd 3mo ago
Usually government mandating something is concerning cause it seems to favor the government for its existence. However with EU commission its actually interesting combination, its representing multiple individual governments at once which s
139.
by sandeepkd 3mo ago
This is more of a way to create a unauthorized toll tax on highway. There is a problem indeed, however if the proposed direction by cloud flare is to solve it or benefit out of it is a debatable topic.
140.
by sandeepkd 3mo ago
I get a mixed feeling about all this. Cloudflare is unilaterally making all these decisions which impact the whole internet traffic flow. Taking the lead is one thing, however decisions like this should have the direct involvement of Intern
141.
by sandeepkd 3mo ago
Ideally yes, the TLS termination does not need to happen for caching purposes. Challenge is that in practice every business wants to be sticky and try to provide more functionalities which do require TLS termination. Most people either trus
142.
by sandeepkd 3mo ago
I think a lot of these kind of posts are standalone assessment of your problems, understanding and solutions. Its debatable to term something as lack of expertise if one is trying to work with default settings of a tool and expecting a cert
143.
by sandeepkd 3mo ago
I think the timeline is critical here and should be highlighted. Self hosting email server was something that worked out just fine in the past (used to host until 2014), however things have changed a lot with the scale of abuse. its not wor
144.
by sandeepkd 3mo ago
> you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. Its digression from the original topic, still, it goes way far than that, these certificates a
145.
by sandeepkd 3mo ago
On a different note, adding a file on webserver is one of the ACME methods (HTTP-01) to get a SSL/TLS certificate so it is indeed considered as possession method in real world already
146.
by sandeepkd 3mo ago
To clarify, my observation is around how it might have happened, not if this is the right way to do it
147.
by sandeepkd 3mo ago
In the absence of actual details its hard to say what was considered for making this decision. If I have to take a wild guess then being able to demonstrate the control on the webserver hosting the content could have been one way to prove o
148.
by sandeepkd 3mo ago
Almost every API caller has to add the logic for retries based on the response codes, centralizing it with the gateway optimizes the repetitive code across the clients. Trip breaker patterns are good for resource usage on both sides (client
149.
by sandeepkd 3mo ago
It works great for static credentials. As a product I think about adding couple more things that might be helpful here (Btw I am not the client for this, I just happen to know them as practical problems) 1. Support for OAuth Client credenti
150.
by sandeepkd 3mo ago
I try to be accurate when sharing information like this. Some things are fact and some things are opinions, I already tried to annotate the opinions as interpretation. Most of the information is first hand, I was a member of FIDO alliance i

More ›