HackerLangs
TopNewTrendsCommentsPastAskShowJobs

kstrauser

32,778 karmajoined 15 ปีที่แล้ว
I make things. I’ve learned a lot from messing up along the way. It always works out OK in the end.

I don't speak for my employer, obviously. I barely speak for myself half the time.

I blog at https://honeypot.net/

Write me at [email protected]

Submissions

Droid Shield 2.0: learned secret detection

factory.ai
2 points·by kstrauser·9 วันที่ผ่านมา·1 comments

An Investor Dared Him to Quit School. Now He's Building a $1.5B AI Startup

wsj.com
7 points·by kstrauser·3 เดือนที่ผ่านมา·0 comments

Show HN: Little Fluffy Clouds: Combine a bunch of small adjacent networks

github.com
2 points·by kstrauser·10 เดือนที่ผ่านมา·0 comments

comments

kstrauser
·เมื่อวาน·discuss
In my experience, yes. At the peak of a scraper flood I was dealing with, I'd say about 90% of the traffic was from a unique IP. I'd never seen anything quite like that before.
kstrauser
·เมื่อวาน·discuss
I think it was the latter.

And the cruel irony is that these are FOSS Git repos I'm publicly sharing. I'd've been fine with them cloning the repo and analyzing away to their heart's content. That's not the way their scraper's wired, though.
kstrauser
·เมื่อวาน·discuss
I just tailed the web logs for a bit and saw that it was wild. For fun, I fed 10 minutes of logs into an AI and it picked up a lot of signal I didn't catch at first glance, like clients claiming to be MSIE 7 on Android 3 and such. I added some reject rules to the webserver in front of Forgejo but that only made a dent in the traffic, alas.
kstrauser
·เมื่อวานซืน·discuss
You’re so right. I have a public-facing Forgejo server. Before configuring Anubis, scrapers were sending it about 600K requests per day. Copying and pasting from my blog post about it:

* For every Git commit, fetch the version of every file in the repository at that commit.

* See git blame for every file at every commit.

* Attempt to download the archive of each repo at every commit.

* Run every possible pull request search filter combination.

* Run every possible issue search filter combination.

* Fetch each of those URLs at random from some residential IP in Brazil that had not ever accessed my server before.

Afterward, it dropped to several hundred. Expect anti-attack features to keep getting stranger and more visible as scraper get still more aggressive.
kstrauser
·เมื่อวานซืน·discuss
In a project like PostgreSQL, those scars are reflected in unit tests demonstrating that they’re fixed. It’d be hard to pass its test suite and not be as robust as the original.
kstrauser
·เมื่อวานซืน·discuss
Python doesn't have variables in the C sense. It has pointers to objects (aka "names"), and the "=" is a pointer assignment operator.

So:

  i = 23  # Create an int(23) object and store its address in i
  i = "foo"  # Create a str("foo") object and store its address in i
i isn't typed. It's a reference to a thing with a type, not a thing with a type itself. It's also pragmatic, in that 99.9% of cases, `1.5 + 2` has a completely obvious meaning. I don't recall ever seeing int+float being the source of a Python bug. Surely someone has, but I haven't.

> Python's strong typing mostly boils down to some operator rejecting mixed types.

Well... yeah. Turns out that plus duck typing is very nearly all most people want out of a type system. I went from Python to Rust and found nearly no difference in how they handle types, except Rust does it at compile time. Judging from the number of people I've seen make the same migration, that seems to be common. And yet no reasonable person makes claims that Rust is weakly typed, even when IMO it's basically Python but enforced at compile time.
kstrauser
·เมื่อวานซืน·discuss
That's fair, and I don't claim that I have the canonically correct answers. My broader claim is that I don't think I've ever heard someone say ugh, I despise that my bucket of bytes has an associated type! The real discussions weren't against types, but against various type disciplines.

For example, I find it highly annoying to have to sprinkle type annotations all over the place when the compiler isn't smart enough to figure out what I mean, in the absence of ambiguity. Like imagine this C code:

  int main() {
      int i = 23;
      auto j = i;
      printf("i = %d, j = %d\n", i, j);
  }
There wasn't a great way until recently (C23, I think?) to say "just make j whatever type it needs to be here and don't pester me with it". Contrast with Rust which is strongly, statically typed but also infers types where it can:

  fn foo1() -> i8 {
      23
  }
  
  fn foo2() -> String {
      "foo2".into()
  }
  
  fn main() {
      let f1 = foo1();
      let f2 = foo2();
      let f3 = f1 + f2;
      println!("Hello, world!");
  }
Here, that bit in "foo2" says "cast this str into whatever type you can infer it's suppose to be". Since it's going to be the return value of a function that returns a String, it must be a String, so Rust casts it to a String. Similarly, the first line of main() says f1 is an i8 because it's assigned to something that returns an i8. f2's a String for the same reason. The f3 line is an error because you can't add an i8 and a String, and Rust can figure all that out without having to annotate f1 or f2.

I love Rust's typing because it's helpful and makes strong guarantees about the program's correctness. I'm not "anti-typing" at all. I'm just not a big fan of languages that make you annotate everything everywhere. Back when such arguments were in fashion, a pre-auto C fan might reduce my whole argument to "you don't like typing, newbie!", which would make me roll my eyes and hand them a lollipop.

FWIW, I think TypeScript's pretty great. I never like JS. I tolerated it, and could use it, but didn't enjoy it at all. TS is fun, though.
kstrauser
·เมื่อวานซืน·discuss
I don't recall anyone disliking types. Lots of people disliked static typing, or more directly static, explicit typing. For instance, I've been around many conversations over the years where people would say goofy things like they couldn't use Python because it's untyped. That's insane: Python is strongly typed. It's also dynamically typed, which is a different dimension.

There are some genuinely untyped languages, or more typically "stringly typed" ones. I hacked around on AREXX as a youth, where all values are strings, even when they look like numbers. Most of the Unix CLI tools like sed could be, uh, said, to be stringly typed. Most of the "discussions" about typing, though, involved Python and similar dynamically typed languages. I don't think I've ever heard someone claim that weakly typed or untyped languages were great for building large project. I've heard plenty of people claiming that Python couldn't be used to build large projects because it was dynamically typed, or "untyped" as they wrongly described it, which was confusing to those of us using it to build large projects.
kstrauser
·4 วันที่ผ่านมา·discuss
Huh, good point. I have a shocking number of visitors saying they use IE 7 on Mac OS 9 on Intel.
kstrauser
·4 วันที่ผ่านมา·discuss
Here's one list of medicines containing alcohol: https://www.hpspmonitoring.com/Content/Oregon/Resources/Medi...

You don't have to be a special kind of dumbass to take, let's see, NyQuil when you're sick.
kstrauser
·5 วันที่ผ่านมา·discuss
It would be, but I've never heard anyone making that claim, certainly not in this thread.
kstrauser
·5 วันที่ผ่านมา·discuss
True that. Darned if I have any desire to verify! It doesn't matter one whit to me.
kstrauser
·5 วันที่ผ่านมา·discuss
That's exactly right. Between us, I don't understand furries at all. It doesn't remotely interest me and I can't really even imagine being interested in it. And that's OK! Someone else being into it doesn't harm me in any way. If it brings someone else joy, I don't have to understand it. I'm just glad my friends have a fun thing they enjoy with their other friends.
kstrauser
·5 วันที่ผ่านมา·discuss
That's possible, too. There's not a lot of respect for arbitrary rules that don't seem to clearly benefit any legitimate purpose, and people don't tend to limit that thinking to one arena.
kstrauser
·5 วันที่ผ่านมา·discuss
That makes sense. And I do strongly believe in the "virtuous circle" bit: people who aren't OK with others being themselves tend not to feel comfortable at, or get invited back to, events. That would make it more comfortable for the next event's attendees, making it less pleasant for the remaining pains in the necks, and so on. I've participated in conversations like:

Q: Why do rightwing websites keep getting hacked?

A: Because none of the best infosec people want to work where their friends wouldn't be welcome.
kstrauser
·5 วันที่ผ่านมา·discuss
My hypothesis, based purely on personal experience and what friends have told me. I am not a furry.

I feel like infosec was one of the earliest "no one cares who you are if you have skills" user groups. Online, you were just a handle. Man, woman, both, neither, no one knew until if/when you met up IRL. Until then, all you had was your reputation. I think that led to people having a pretty good idea about the attitudes of people they were talking to online, staying away from people who were going to be jerks about identity or pastimes, and a lot of conversations like "General Mayhem is weird, but he's our weird, so no one mentions that fox tail he wears everywhere."

Over time, that was a positive feedback loop: people who weren't cookiecutter felt safer around infosec folks than most other crowds. => That increased the "weird density" of infosec meetups. => People who don't like being around uncommon appearance or behavior stayed away from infosec meetups. => Those meets became safer for uncommon folks. => Repeat.

I don't know if that's right, but again, that's what friends have expressed to me before. It seems plausible.

Note: When I say weird, I mean it affectionately. I've never met anyone in infosec who didn't have some quirk not far below the surface. Frankly, I love that. And because of that, and the virtuous circle I described, I've never had one single person in infosec confess to me that they weren't OK with gay or trans or furries or other type of behavior/identity/etc. I'm a straight white middle class dude, and unfortunately I have had people confess such things to me in other circles, mistakenly assuming that since I was in their demographic, I'd agree with them or at least be OK with it.
kstrauser
·5 วันที่ผ่านมา·discuss
I appreciate the semantics and locality of that, too. When you glance at it, you understand that specific tradeoffs are happening right here, and here only, without some CLI arg changing them for the entire program. It’s kinda like unsafe, but for math.
kstrauser
·9 วันที่ผ่านมา·discuss
Factory's Droids write, refactor, and commit code autonomously at a volume that no human reviewer can completely monitor. Keeping autonomous software engineering safe at enterprise scale means secret detection that is trustworthy but doesn't introduce unnecessary friction.
kstrauser
·9 วันที่ผ่านมา·discuss
Factory | Security Engineer | ONSITE, San Francisco, CA | Full-Time

- also -

Factory | IT Operations Specialist | ONSITE, SF, CA | Full-Time

My team at Factory's growing. Come work with me to beef up 1) our security stance, and 2) our IT program. We're growing rapidly and I want to get ahead of scaling issues. You'll work directly with me, with agency to define and evolve your own role. Today we need hands-on-keyboard IC work. Want to grow that into a director-level role? This is the time to join.

My short endorsement: I love coming to work every day and building the future along with a lot of the smartest people I've ever met, with a workplace culture that I'm proud to be a part of. You should come help me make it even better.

Security: https://factory.ai/careers/software-engineer-security IT: https://factory.ai/careers/it-operations-specialist
kstrauser
·10 วันที่ผ่านมา·discuss
Me: You know, these ugly creeper peepers could not possibly make me want them any less.

A PM deep in the heart of darkness: Hold my creatine.