tetha

27 ms·

331.
by tetha 2y ago
I still have some german documentary about a man defusing these things burned into my head. He was asked why he wasn't wearing any safety equipment while working on these large bombs. Well for smaller amounts of explosive chemicals, th
332.
by tetha 2y ago
Mh, chemical stability is usually meant in a more delicate way. There are explosives that need other explosives to set them off. If someone gave you a pound of C4 and then evacuated your neighbors, you would probably need to do some researc
333.
by tetha 2y ago
This is something I'm starting to pick up and use from a mentoring and onboarding perspective. By now, I fairly openly wonder if someone needs conceptual or architectural clarification, technique on handling a thing, or a solution righ
334.
by tetha 2y ago
Personally, I'm worried about the CPU of my application servers if a cost-oriented hash function has to process your 4GB large password. Though imagine how much clout we could get from all the bogus DoS CVEs this could find. But jest a
335.
by tetha 2y ago
Interestingly enough, the very lawsuit-happy nature of a major german party has "backfired" quite a bit recently. A security researcher was found not guilty of circumventing security measures or accessing authorized computer syste
336.
by tetha 2y ago
Mjeah. It is our goal at work to enable our teams to deploy changes to their systems in production within minutes. And this works and the teams utilizing it get commended for it. But I also need to plan and execute a major database upgrade
337.
by tetha 2y ago
Linux huge advantage: It gives you huge flexiblity and very sharp knifes. Linux drawback: Well, see above. It takes getting used to if. As I keep joking - nuking your first production system is a bit of a rite of passage as a linux admin. M
338.
by tetha 2y ago
Truth. At the same time, phasing out and introducing crypto primitives takes 10 - 20 years across the industry due to inertia from unmaintained systems, legacy code, compatibility, fear and such. So the growing interest to move to quantum
339.
by tetha 2y ago
In my personal experience, it strongly depends on both the genre, and also if it is the first playthrough. For example, for a point & click adventure, external knowledge can destroy the immersion and overall spell of the game very quick
340.
by tetha 2y ago
CAA records may help, depending on how the attacker uses the certificate. A CAA record allows you to instruct the browser that all certs for "*.tetha.example" should be signed by Lets Encrypt. Then - in theory - your browser could
341.
by tetha 2y ago
Hm. This is crypto from 30 years ago. And from reading around, the OTP generation never left UK jusidiction, so it would be a black box to attack. Handwaving how this is trivial to defeat with current compute and crypto analysis with full i
342.
by tetha 2y ago
> - You can force 2FA, again for every service the company is using that supports SSO. This can also be a way to balance security and user convenience, which should not be underestimated. If a user has to do the MFA dance (Duo Pushes, TO
343.
by tetha 2y ago
On the MySQL vs Postgres topic: We migrated for two reasons. The first is that I consider everything remotely owned by Oracle as a business risk. Personal opinion and maybe too harsh, but Oracle licenses are made to be violated accidentiall
344.
by tetha 2y ago
Very much what I recommend our teams as well. And you can totally start with something careful. Does a single IP really need 50 requests per second? Like, sure, I have services at work where the answer is "yes". But I have 10 - 20
345.
by tetha 2y ago
It might be a reference to the blue-team red-team asymmetry, and how in cybersecurity the attacker has an advantage. The attacker there only needs one success and can rapidly try different avenues, while the blue team just needs to miss pat
346.
by tetha 2y ago
This reminds me of a fun thing I hacked up at a game shop. We were implementing some new feature involving a probability distribution and were somewhat stumped on how to make sure it worked right. Eventually I setup something simple to exer
347.
by tetha 2y ago
> Wouldn’t a more sophisticated macro system still generate a bunch of extra code and result in slow compile times? Not necessarily. The preprocessor code here picks up the original source, and blows up the initial code (which is about &
348.
by tetha 2y ago
I'm not actively using it, but I'm interested to play around with this for a bit. At work, we have architectural decision logs, for example how to structure our authentication, how to deploy services and such. Some of these decisi
349.
by tetha 2y ago
I kind of have the same thought. This very much looks interesting and I like the whole folk/medieval metal scene quite a lot. But the realist and the person in my who doesn't like spending money both agree: If $350 - $500 are on t
350.
by tetha 2y ago
This is such an infuriatingly dismissive and abrasive answer, even with not being part of that community. All metal is just trivial guitar play and angry shouts right? Paintings are just the correct application of colors and other materials
351.
by tetha 2y ago
I arrived at a similar conclusion, just from the other direction: It is really hard to get people to document. It is even harder to get those people to care a little bit about formatting. Markdown is... limited, I acknowledge. But with a ve
352.
by tetha 2y ago
I mean realistically speaking: If I can do `foo = <paste>`, check `typeof(foo)`. and output foo again to double-check what the REPL thinks foo contains, then I'm pretty safe to `eval(foo)`. Sure, you could fake it with custom obj
353.
by tetha 2y ago
Nah, short and single-line functions can be good. Something I'm happy about is if I can create an object to implement some isolated part of the domain in a way that's obviously correct and consistent within itself. For example, cu
354.
by tetha 2y ago
Heh. We're in the process of moving a service for a few of our larger customers over due to some variety of emergencies, let's keep it at that. It took us 2-3 days of hustling to get the stuff running and production ready and prov
355.
by tetha 2y ago
> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? Turn of all of your developer knowledge for a minute. You cli
356.
by tetha 2y ago
Music isn't very different either. A common recommendation is to first learn to play songs you like, and then to start diverging a bit and to adjust the things you don't like and merge the ideas you like later on.
357.
by tetha 2y ago
We pentest all of our developed applications annually and on top, a few customers have internal regulations to pentest applications they use, so some of our applications run through 3-4 pentests per year. This is pretty useful to stay up to
358.
by tetha 2y ago
Our worst outage occurred when we were deploying some kernel security patches and we grew complacent and updated the main database and it's replica at the same time. We had a maintenance with downtime anyway at the same time, so whatev
359.
by tetha 2y ago
This makes me glad I finally talked people at work into running our annual pentests of our products on production, and putting the entire production infrastructure in scope. Focus may be on a specific product or system, but everything is in
360.
by tetha 2y ago
The article lost me at a certain point, somewhere around the "solving the conondrum". It lost me, because we have two estimations - an overall size guess of an epic and an actual implementation estimation of an epic. Like the over

More ›