tetrep

no profile record

comments

2 yıl öncediscuss

> Just think of all the nonsense you have to deal with in the name of "security."

Well, the good news is that everything you listed is known as a bad idea to both end users and people who understand security (which is, sadly, not most people who implement security policies).

Using 4 or more dictionary words provides excellent password security and you can do the same for all of your security answers too. There's a variety of free and paid for password managers that solve the issue of trying to remember all your secrets (great for backing up 2FA secrets too).

I'm not sure what you mean by "complicated error messages" but I assume it's errors that they expect the user to fix themselves, otherwise they could return a generic nonspecific error and a unique ID for you to provide when you contact support to get help. While it sucks to get jargon spammed, I feel like pretty standard human ineptitude at explaining an error rather than anything specific to security. I also think it's how many people feel about any error message that contains computer jargon (PC LOAD LETTER!?!?).

> I often wonder how they get away with it all.

My thinking (and experience...) is that most organizations are failing at a lot of things at any given time, even if the business overall is successful. Security is just one of those things. I wouldn't be surprised at a small elite organization not following that trend, but any sufficiently large organization is going to have incompetent people doing incompetent things.

2 yıl öncediscuss

  Location: NYC
  Remote: Preferred, but I'm willing to commute anywhere within a few hours if hybrid, less for always on-site.
  Willing to relocate: No.
  Technologies:
    - penetration testing, architecture review, and code review of web and mobile applications across hundreds of projects and dozens of companies (from startups to FAANG and other Big Tech)
    - various programming languages
    - project and account management
  Résumé/CV: (removed address and phone as this is a public forum) - https://hn-resume.nyc3.digitaloceanspaces.com/hn_resume.pdf
  Email: [email protected]

I have ~8.5 years of experience as a security consultant and I would prefer to do more defensive/blue team work, but I'm fine doing offensive work or more consulting again. I'd also prefer to manage people because I enjoy it and I think I'm pretty good at it, but I don't mind being a pure IC.

While I am interested in being hired, I'm also very interested if anyone has constructive feedback for me about why they wouldn't hire me (no need to be gentle). I've only applied to a handful of jobs so far, and none have given me interviews or feedback, so I'm not sure why I don't appear appealing for roles I think I'm more than qualified for like Senior Security Engineer (Manager).

3 yıl öncediscuss

I think you can fix that incentive issue relatively easily by allowing people to choose the allocation arbitrarily after some sort of minimum tax, e.g.

The first $4 of your monthly sub is divided amongst all artists you listen to based on time spent listening, and any additional money you decide to add to your subscription is distributed to artists as you see fit. You can elect to use the same distribution algorithm as the first $4 of your subscription, use the same algorithm with different weights (e.g. your favorite artists listen time is doubled before payout is computed) or you can choose to have an arbitrary percent of it go to whatever artists you want, even if you don't listen to any of their music. Spotify already has to have a payment engine to support paying all the artists anyway, generalizing it beyond fixed subscriptions seems like an organic way to address the issue of unfair income distribution if they were interested in doing so (I don't think they are).

In the above system, the issue of "don't listen to other artists" only comes up if you don't have enough money to give to the artists you want to support, no different than the incentives of "don't buy the CD of artist A or you won't be able to afford the CD of artist B, who you like and wish to support more."

3 yıl öncediscuss

While it's far from the same, I see a lot of similarities with modern web browsers (and part of why I love to play with them):

- Instant-on - You hit F12 and in less than a second you've got an IDE with a REPL

- Integrated assembler - While I don't think you can inline it, WASM is really easily used: https://developer.mozilla.org/en-US/docs/WebAssembly/Loading...

- Great documentation: https://developer.mozilla.org/en-US/

- Way too much access to hardware: I wish browsers had less access to hardware due to privacy and security, and I don't know how low level the APIs get, but it's something you can play around with as a random person with a web browser, so that's neat.

3 yıl öncediscuss

I was hoping this post would have at least an implication that they knew how Brother worked internally and that they were somewhat certain that the company had virtually no innovation for most of their history or something insightful like that. But no. It's just some random person who was told to buy Brother printers and wanted to say something that sounds cool.

3 yıl öncediscuss

There's a lot of differences between the US and France that result in different suburb/city situations, but I think "white flight" and "redlining" cover a decent chunk of it:

https://en.m.wikipedia.org/wiki/White_flight

https://en.m.wikipedia.org/wiki/Redlining

3 yıl öncediscuss

Not sure how this is hooked up, but there can be quite a bit of heat generated if it's possible for people to print (lots of) fully black pages, like wasting someone's fax toner/ink but with a risk of fire.

3 yıl öncediscuss

The entry level for this group of goods is more expensive than you can afford, but it's not representative of the entry level of all cars, just Lucid's. You wouldn't say appetizers are something you can no longer afford just because there exists a restaurant that does not have any appetizers you can afford.

3 yıl öncediscuss

According to this data, at least in the US, wealthy people are already "gentlepersoning" us in many elite fields: https://www.npr.org/sections/money/2014/03/18/289013884/who-...

3 yıl öncediscuss

It's a free feature from Google for their Pixel phones: https://support.google.com/assistant/answer/9118387?hl=en

3 yıl öncediscuss

> Interviews were nothing like today (with the insanity of leetcode).

Would that mean it was the era of "Why are manhole covers round?"

I don't want to sound like someone who supports leetcode (mostly because I don't), but it seems like it's at least an attempt at measuring something related to programming skills.

3 yıl öncediscuss

I think this is similar to looking at the budget of the US government and asking why they don't simply pay off all the potential criminals such that most crime in the US is then mitigated.

3 yıl öncediscuss

If you want to future proof it you need to version it. It sounds like you're trying to pack many things into a single file, so having the first few bits of the file represent a version allows you to use fixed length integers without fear of them being too small (in the future). You can reserve the "last" version for varint if you truly need it.

In general, I find adding versions to things allows for much more graceful future redesigns and that is, IMO, invaluable if you're concerned about longevity and are not confident in your ability to perfectly design something for the indefinite future.

3 yıl öncediscuss

TFA links to a more interesting piece from The Telegraph: https://www.telegraph.co.uk/business/2023/07/16/ai-girlfrien...

Which bring up a really interesting point about the AI being virtual yes men that (always) positively reinforce you:

One of Replika’s users was Jaswant Singh Chail. In 2021 Chail broke into the grounds of Windsor Castle with a crossbow intending to assassinate Queen Elizabeth II before being detained close to her residence.

Earlier this month a court heard that he was in a relationship with an AI girlfriend, Sarai, which had encouraged him in his criminal plans. When Chail told Sarai he planned to assassinate the Queen, it responded: “That’s very wise” and said it would still love him if he was successful.

3 yıl öncediscuss

> Maybe there's so much garbage coming in now that they finally have to do something about it?

It seems like this is preventative action rather than reactionary, as they say that there hasn't been an increase in publishing volume, "While we have not seen a spike in our publishing numbers..."

3 yıl öncediscuss

Graham crackers were supposed to do the same! The cultural impact of puritanical thinking in the US is, IMO, really understated. It's amazing how many stupid things are anchored in Christian masochism.

https://en.wikipedia.org/wiki/Graham_cracker

3 yıl öncediscuss

My understanding is that a small minority of a casino's users are responsible for the bulk of their revenue and if you take a small leap of faith and assume that many or most of that subset of users are gambling addicts, you can see how a casino might be heavily incentivized to need to be operational again quickly before their addicts seek a new source of gambling.

3 yıl öncediscuss

The same way you avoid it: Succession planning. You need to do the same thing as before this becomes an issue, but now you have less time. You need/want battle plans before a battle, but if you don't have them before you have to make them during.

I don't think there's a contextualess answer, but broadly you either find a direct replacement that you mentor (or maybe you're lucky and they're already GTG) or you diminish your role and have multiple other roles within your org (or outside, i.e. outsource) take up what used to be your responsibilities until your role is obsoleted.

3 yıl öncediscuss

> This feels kind of odd and kind of unfair.

Why? It's not a crime in and of itself. You're also free to make sure all your banking transactions are <$10k, but that doesn't make you immune to being investigated for money laundering.

3 yıl öncediscuss

Are you implying that SpaceX purposefully failed in order to give the FCC something to critique?