HenriTEL

From my understanding it's the contrary. The success of Stuxnet relied on the fact that siemens recommended to not change the default passwords as it could affect the operations of critical infrastructure, which is not exactly what I would call defense in depth. Modern defense in depth would require the use of 2FA for manual access (in addition to strong passwords).

That's very refreshing and there must be a lot of work behind the scene to properly update services and their dependencies without outages. I'm also curious about how database migrations are dealt with.

I'll keep following that space as they have well identified the problem and its root causes. The CNCF is happy of their "ever-growing global community", reaching 173 projects and over 220,000 contributors. Good for them.

> So it's more sustainable to have two cars instead of one? Depends on the cars but if the second one is a small EV yes, you're better using that for your daily commute. The larger one should last longer, mitigating the production cost over the long term.

Still in towns like Paris you should favor bicycle or public transportation. You can also have a smaller EV and rent a larger one for the long trips.

No, even the long range still has a 150kg margin. The problem is that people use their large car to go on vacation with the children for their work commute, be it an SUV or a long rage EV, that's not sustainable. Especially in a town like Paris where you have good public transports (could be better, granted).

Actually only EVs above 2 Metric Tons are concerned, which is fair IMO.

That makes sense. I'll also grant that one of the most effective security measure is to deny by default and only allow stuff explicitly (with a single, controlled app store in this case). Personally I think the reasons for those security measure are not worth the freedom limitations and I guess that's why I've never been a fan of the apple ecosystem.

Like everything it has its pro and cons. One of the con is that it favors a strong coupling between data and operations. Which mean that a change at one place is likely to change/break things elsewhere.

That really is the elephant in the room IMO. How can it be so terrible from a security perspective on one platform and ok on another one?

Is my laptop really that different from my phone? People may have different usage but they both contain sensitive data and are meant to be used in public places. We just operate one with a touch screen and the other with a keyboard + track pad.

As the original comment states, there's not magic sandbox solution. It's a hard problem. The average user should be able to grant or deny capabilities. For things like location it's easy but when you think about the botnet case, things get tricky. What ip ranges do you allow?

pop() would have been a much better example, as ruby providing delete_at is a mistake IMO, since it runs in O(n), chances are that you're using the wrong data structure. Go providing append but not pop is inexplicable

Still it's quite rude when some people spend a lot of time on some part of the codebase only to find someone rewrite it without discussing it first.

Also the point here is about cognitive cost of working on the refactored code, not broken functionalities.

It seems like there was a lot of pressure to meet the deadline and everybody overworked in this environment. A perfect example of normalization of deviance. It's a shame that there still exists many workplaces like that. It's our duty to be aware of what's happening around us and tell the guy - Hey, what the fuck are you doing here? Get home, that's no critical emergency.

Yep. Beyond the technical issue this story shows a people management issue.

That's not a good advice IMO, as most sudo commands will mess-up just one host, and it's something you should generally be prepared for. You're more likely to develop a culture where engineers think about hosts as critical resources whereas they should be generally considered as instances that can be thrown away. It's better to identify hosts that are SPOF and be cautious on those only.

I can think of a larger blast radius when deleting files on a shared mount point for example but it's not representative to the regular use of sudo.

HTML is ok, you don't have that many elements anyway. JS is fine too, learning the basics of OOP and any imperative language compounds. But css? oh boy. It feels like a Frankenstein monster where each improvement comes with its new set of ad-hoc features. `grid-template-rows: masonry;` wtf is even that?!

Oh and by "mastering css" we just mean to learn the basic box model (width, margin, padding), units (em, rem, px, %, vh, dvh, lvh, etc.), the normal flow of each HTML element, the display basics (inline, block, contents, none, initial, revert, inherit, unset, etc.), positioning (relative, static, absolute, etc.). Flexbox and Grid deserve their own chapters. Ah there's also those capabilities for elements to float and overflow... Also, those are just the basics for positioning we didn't cover things like colors and selectors. Feel free to explore, deep dive and stay up-to date (it's moving fast) so that you can become a real css master!

Maybe it's just a mess that no sane person want to learn. Semantic html is really about creating blog posts, there's not much elements provided beyond that. If you want to create an e-commerce website for example, there is no "card", "carousel" or "popover" element. You have to make them yourself based on existing elements which then makes the css styling confusing.

I think one of the reasons there's not much unionization in tech is that the market balances itself. When your skills are in such high demand, the market has no borders and investors queue to fund startups, working conditions naturally goes up. But it goes both ways. When a given company decides to cut costs or change some working policy you can't blame them, especially when they still pay way above the local median and provide astonishing perks. Also you don't need unionization to have your conditions written in your contract. Certain professions deserve better working conditions, I don't think SWE is one of them,

Come on, the previous Threads was also Instagram’s standalone messaging service.

> The Google VRP Team recognized our work by awarding us a $500 reward for uncovering this vulnerability. They believed the impact on the application wasn't severe enough to warrant a larger reward.

Exposing email and private keys of GCP accounts only gives you $500 reward? WTF. Google being Google I guess.

I know, but not by much, they were both announced in 2007.

True. The Iphone is an Ipod Touch with a sim card.

That's a fairy tail. The global cryptocurrency market cap is $1.13 Trillion as of today and there's no sign that it'll be back to its peak.

There's also this non intuitive fact that the critics you'll hear about are usually judgment free, at review time. Whereas you'll be judged harshly on your committed code and will probably never hear about it. We could summarize it with something like "hard critics prevents hard judgments".

The ability for the app store to take a percentage of each in-app purchase blows my mind. Same for the private copying levy that can take a percentage on each storage device sale.

This is power abuse and it's a shame that the judges let it pass.

To be honest I never really believed in the original business model: - subscriptions for companies and proprietary software - Deals with 3rd party integrations

It's cheaper and not more difficult to self-host most parts now a day, and improving (k8s, helm charts, things like flux and gitlab). The hard part being to actually write those integrations (github actions). You also have more flexibility as you can run whatever code you want on your infra.

So it was a matter of time that things would change (less features for free tiers, ads or another way to make money out of the user base, like with copilot)

> On the one hand we happily train humans on GPL code. Those humans can then write their own functions,but for trivial functions they're gonna look a lot like GPL Source.

Exactly. People are getting mad that Microsoft is making good money while the people who made all that free software available mostly did it for free (like in no money and no recognition). It can sound unfair but that's the deal. If you didn't want people or AI to learn from your code, open source was not the right option.

No, it's an ecological movement. The goal is not to help the poor but to fight climate change. I agree with the second part tho. This phone is still pretty complicated to repair. It's much easier than for the average smartphone but still simple things like changing the battery involve tricky steps like disconnecting the fingerprint reader and motherboard cache. And yeah the real obsolescence issue is on the software side.

OP just discovered that computer science is 99% about data manipulation, duh.

> people who saw it knew who made it

Yeah for a small subset of insiders to a small subset of creators. Really that was already a fiction prior to stable diffusion.

And then why human-made artwork would not need attribution of prior work that influenced it but AI made work would require some. We could extend the right to cite there and if we can't make it obvious that more than 10% of a given image was from another one, attribution makes no sense.

Having information in your colleagues heads only is exactly how you create organisational friction to begin with (now newcomers are likely required to ask questions to your team directly). Also over time this information gets completely lost (forgotten by people or when they leave the company).