Arch-TK

    Location: London area, UK
    Remote: Yes (currently full time remote for 6 years, okay with going hybrid depending on distance)
    Willing to relocate: No
    Technologies: Linux, \*nix, Rust, C, Python, (and more), low level (kernel contributor, also experienced in embedded), systems programming, back-end, have even done front-end but it's not my forte
    Résumé/CV: https://kramkow.ski/cv.pdf
    Email: tomasz@kramkow.ski

I've got at least some experience with practically everything you can imagine. 11 total years experience. I've spent the last 6 years in software-focused security but would like to get back to making (secure) things.

Spend a lot of my spare time (inventing and then) solving my own problems using my extensive skillset.

While it's an interesting article, I don't think there's much science going on. There's one variable barely controlled for, compared to the dozen or so variables which weren't controlled.

With long pasta it's not hard, with a tiny bit of experience and attention, to learn how it physically behaves when it's either done or close to it. It's about as easy to learn (experientially) how much it changes minute by minute at that point.

I will stir it to see how it behaves, as soon as I catch it behaving like pasta which is may be al dente I will sample it, if it's still a bit too hard, I can more or less tell if it's going to be one or two minutes. I'm aiming for almost-too-hard al dente to compensate for any further cooking.

Stop even a bit early if you'll be finishing the pasta in the sauce.

I think attempting to formalise cooking techniques is a funny sort of thing... The people trying to do it are clearly into cooking, but if you really enjoy cooking, you're probably better off learning these things intuitively and spending your time learning other skills to expand your general cooking ability.

If the 770 was anything like the N900 then the screen was resistive and the stylus was passive. So you could use your fingers but in my experience, for any finer task, you needed the stylus.

Damn, I really miss the N900. I was seriously using it as recently as about 4-5 years ago.

The fact that 95+% of the population is unaware of the problems with this doesn't make it okay. There are lots of things 95% of the population don't know or think about which we don't just throw our arms up and ignore.

Moreover, age verification is trivial to circumvent or opt out of. The only way to opt out if this thing will likely be to leave the country. Which certainly increasingly seems like a good idea to me.

They haven't specifically said anything, but they have directly compared the ID to phone based payment card systems, which on the google side do rely strictly on a google-blessed android build[0][1][2].

It's also incredibly popular in the security industry (I know, I work in it) to claim that every possible app in existence must:

* Obfuscate

* Do root detection and refuse to work

* Detect attempts to attach a debugger, and refuse to work

* Detect running from a VM, and refuse to work

* Do certificate pinning (although as an industry we've stopped recommending this bullshit practice, although we still insist on it for some things)

* Prevent screenshots from being taken

* Force you to re-authenticate using biometric ID every time you look away from the app

* and... break at the slightest hint of a non-standard build of android

So I don't have high hopes, because the company I work for does work for the UK government, will likely be picked to review this app, and inevitably all that shit is what we'll recommend (although I hope I won't be working here by then because I'm just sick and tired of cargo cult / checkbox security).

[0]: Not because of any specific feature, but solely based on signing keys.

[1]: I believe specifically you have to license GMS integrate them into the build, which e.g. GrapheneOS does not do.

[2]: And no, GOS's sandboxed google services don't fix this problem, Google Pay will still refuse to work.

I currently live in the UK, and I am not significantly restricted from anything (banking, ISAs, investments, healthcare, etc) for refusing to use a Google approved build of Android.

Moreover, I actually on principle refuse to make myself dependant on my phone for these things, which means that (at a small convenience cost) I don't have any banking apps, or investment apps, or healthcare apps, or whatever).

My phone is strictly a general computing device and I on principle only permit a technology into my life if it doesn't impose special restrictions on the hardware/software it works with.

So if the UK government creates a digital ID app which only runs on a phone and which potentially only runs on google/apple approved phone (this is e.g. the requirement imposed by google pay), then that would be unprecedented.

Reduce dependencies on non-UK orgs by increasing dependencies on Google and Apple ... which are ... hold on a minute...

I don't believe control master solves the problem, as long as Ansible is configured to create a new session within the long-running SSH connection then it will still have the session setup overhead. I tested this myself when prototyping the replacement.

However, it looks like pipelining (and obviously forking) could do a lot to help.

That being said, there were _many_ reasons for me to drop Ansible. Including poor non-linux host support, Yaml, the weird hoops you have to jump through to make a module, and difficulty achieving certain results given the abstraction choices.

I think Ansible is great, it solves a problem, but my problem was very specific, Ansible was a poor fit for it, and performance was just one of many nails in the coffin for me.

Yeah I re-read it now and don't feel so strongly about it. But I think its the sentence structure:

"This is the longest a pig organ has survived in a living person"

The pig organ is the first thing mentioned, with the living person last.

Whereas:

"This is the longest time a patient has survived after a pig organ transplant."

This puts the patient first, and doesn't give as much of that kind of vibe.

Edit: Actually, that updated sentence may need some adjustment. I assume when organ transplants fail we don't just let people die with them. So maybe that's why the original sentence had such emphasis on the survival of the pig organ...

I think the person you replied to was objecting to the fact that the wording makes it sound like we're using humans as vessels for extending the life of pig organs outside of pigs.

Not necessarily that 6 months is a short period of time.

I don't think it shows much.

It's one anecdote. In the hierarch of significance this is below even the "one published paper" level which you certainly should also ignore even if you know enough to interpret the paper.

It's really good she lived for 50 years with an kidney transplant. But it is a massive stretch to say that she willed herself to last that long.

SSH is slow, but in my experience the primary cause of slowdown is session setup.

Be it PAM, or whatever OpenBSD is doing, the session setup kills performance, whether you're re-using the SSH connection or not, every time you start something within that connection.

Now obviously for long running stuff, that doesn't matter as much as the total overhead. But if you're doing long running ssh you're probably using SSH for its remote terminal purposes and you don't care if it takes 0.5 seconds or 1 second before you can do anything. And if you want file transfer, we already had a HTTP/3 version of that - it's called HTTP/3.

Ansible, for example, performs really poorly in my experience precisely because of this overhead.

Which is why I ended up writing my own mini-ansible which instead runs a remote command executor which can be used to run commands remotely without the session cost.

Is this multiplayer? There are a lot of delivery people walking and jumping erratically.

Horizon is the cherry on top.

The NHS may lack funding, or it may not. But what is certain is that if you know how the NHS operates internally, or you know someone who does, then it's extremely evident that the NHS is severely mismanaged by administrators who definitely are not underfunded.

I think saying "the NHS is underfunded" all day is just ignoring the other major issue: even when the NHS has funds, they squander most of them.

I don't think solving just one of them will solve the whole problem, but maybe solving the blatant corruption at the NHS's administrative level might improve their financial situation by virtue of the money not lining the pockets of the rich.

"The new digital ID will be held on people’s phones"

Is the implication here that it will become a legal requirement for me to own a modern phone (will it have to be a google/apple blessed phone?) in order to get a job in the UK?

Quicksort in FP?

Surely you mean mergesort, that's the classic FP sorting example.

The steam deck happily provides an enjoyable experience running Cyberpunk 2077.

It's limited, but the limitations in a large part cancel out. It's still very capable.

> Presumably you also often choose being screwed over being socially ostracised?

No, I only choose being screwed over being homeless, or jobless.

Which didn't use to be a particularly likely scenario but the tides are turning.

I don't care about being socially ostracised for refusing to ever use WhatsApp for example.

We teach children not to cave to peer pressure as if it was a choice they could make, and now you're claiming that caving to peer pressure is not something people choose.

Thanks for clarifying! So basically his van kept getting towed and he kept losing business as a result? Presumably it also cost him to recover his vehicle. So in summary, if you got on this list you're just permanently screwed in SF? And you can get on this list by paying a fine twice by accident?

> "?towid=1"

Funnily, incrementing that number in the country I live in would itself be a crime. If the company I did this to found out, they could probably take me to court and win.

A wonderful world we live in. :)

I'm curious, how did his name being on this list significantly affect his business?

I live in a different country and I can't imagine checking the "traffic fine registry PDF on a random government website" when considering which plumber to hire.

I don't doubt that this caused him problems, I'm just trying to understand how.

Either people are broadly ok with being screwed (my personal experience suggests this) or there is a grand conspiracy to prevent anyone who is not screwing their customers from competing in the market.

Maybe it is the latter, who knows. But what I do know is that the non-screwing options exist, but are often less popular and more expensive (either in price, time, or effort).

And this annoys me to no end. Because _I_ don't want to be screwed. But whether I get screwed or not increasingly depends on how much those around me are willing to get screwed or not.

Show examples please.

Rusty rust?

I don't think there is such a specific thing and certainly disagree that all idiomatic rust is somehow slower by default.

You can write rust like you might write a higher level language and then that can end up slower but if you write idiomatic low level rust, the performance is much harder to compare with C. There are things which will be faster in C and things which will be faster in Rust but broadly things will be extremely similar in performance.

I write bare metal embedded rust a lot these days and there are quite complex concepts you can represent in rust which make your code a lot safer without a performance hit.

safelinks keeps getting mentioned.

Here:

    #!/usr/bin/env python3
    from urllib.parse import urlparse, parse_qs
    from sys import argv
    print(parse_qs(urlparse(argv[1]).query)['url'][0])

This is unsafelinks. Pass it a safelinks url, and it will print the original URL. Very important when you have a one-time-use link which safelinks can break.

In my personal experience as someone who has spent the last 6 years of his career in the security industry, almost nobody actually uses CVSS the way it is intended, they just almost arbitrarily tweak the CVSS inputs to produce an output they like.

You are correct that the attack complexity probably shouldn't be high in this case. But presumably the person calculating the CVSS score thought it was too high if attack complexity wasn't set to high.

CVSS has other issues, like people trying to apply it to things that are not vulnerabilities. I would ignore most CVSS scores you see and just read what the issue is instead and make your own judgement call.

Maybe, who knows. It was an example. All I know is countries like Denmark and maybe soon all of Europe seem completely carefree with regard to making citizenship depend on device ownership so...

Quite a few banks in the UK now require an app, and that's a liability for me as who knows when they'll arbitrarily decide to lock me out of my account because I am not running stock google android.

The bank I'm with uses a hardware token which I can tolerate because, while it does require a codependence on hardware, at least the hardware is provided for free by the bank. I can also manage my account over the phone without the hardware.

I can do the things that are hard to start but fine to continue. But sometimes you have a very long slog which is hard to start and hard to continue and hard to finish. That's where the difficulty lies.

It briefly compromised the custom patched Debian version of OpenSSH. The issue had nothing to do with OpenSSH itself.