Qasaur

The modern software engineer throws away the requirements specification because the computers he commands are fast and the people he negotiates with are slow. He ignores archival science because his business records are digital and the musings of a geriatric archivist are not compatible with PostgreSQL 18. He adopts the posture of an industry thought leader on X but has never read a standards document in his life. He believes he has little in common with the Roman aqueduct engineer but finds himself in management meetings pleading for more byte-sized stones for the stone god.

Lawyers are informed by ancient case law and bankers leverage trade instruments with roots in medieval Italy. Why is the software profession so exceptional that replacing hundreds of years of engineering wisdom with blog posts on agentic workflows is considered best practice?

W3C Verifiable Credentials [1] does almost exactly what you suggested and was recently approved as a top-level W3C standard. Adoption has been sluggish outside of digital identity (with Android [2] and the EU digital identity wallet being notable exceptions), but I think it is because the family of standards is relatively new.

[1] https://www.w3.org/TR/vc-overview/

[2] https://developer.android.com/identity/digital-credentials

There is little reason to invent a completely new design system if your goal is to encourage brand recognition and prevent an operator from confusing tools.

Apple/SwiftUI has accentColor for example where you can inject a brand colour. This is subtle but effective for UI differentiation - colour is a design primitive that evokes subconscious pattern recognition and can be more effective than a complicated design framework that forces a larger context switch in the user's mind.

They’ve possibly dug an even deeper hole now.

None of their ISO 27001 certificates, aside from the premium one-offs with the vCISO, are accredited by any reputable ISO accreditation body. I would even argue that IAS, who accredited Prescient Security (mentioned as a reputable body in the article), has a questionable reputation and certainly gives off a pay-to-play impression.

You can look up the names of their partners below. The one body I found that is on the register (Accorp) is accredited by UAF, a known cert-mill accreditation body, and I’m not even sure it’s the same Accorp that Delve has partnered with.

For reference, you want a ISO certificate issued by a body accredited by UKAS (UK gov. adjacent non-profit), ANAB (ANSI), or equivalent, all government-recognised. This is normally the first thing I check whenever someone claims ISO 27001 certification and it is a great heuristic to validate certification rigour.

https://www.iafcertsearch.org/search/certification-bodies

Shockingly low levels of DD by everyone involved here.

The basic principle is to ensure that any machine/workload which joins the network (and processes customer data, in this case extremely sensitive PII) has a cryptographically verified chain of trust from boot to the application-layer to guarantee workload integrity.

NixOS is used for declarative and more importantly deterministic OS state and runtime environment, layered with dm-verity to prevent tampering of the Nix store. The root partition, aside from whatever is explicitly configured in the nix store, is wiped on every reboot. The ephemerality prevents persistence of any potential attacker, and the state of the machine is completely identical to whatever you have configured in your NixOS configuration, which is great for audibility. This OS image + boot loader is signed with organisation-private keys, and deployed to machines preloaded with UEFI keys to guarantee boot integrity and preventing firmware-level attacks (UEFI secure boot).

At this point you need to trust the cloud provider to not tamper with the UEFI keys or otherwise compromise memory confidentiality through a malicious or insecure hypervisor, unless the provider supports memory encryption through something like AMD SEV-SNP. The processor provides an AMD-signed attestation that is provided to the guest OS that states "Yes, this guest is running in a trusted execution environment, and here are the TPM measurements for the boot" and you can use this attestation to determine whether or not the machine should join your network and that it is running the firmware, kernel, and initramfs that you expect AND on hardware that you expect.

I think I'll put together a write-up on this architecture once I launch the service. There is no such thing as perfect security, of course, but I think this security architecture prevents many classes of attacks. Bootkits and firmware-level attacks are exceedingly difficult or even impossible with this model, combine this with an ephemeral root filesystem and any attacker would be effectively unable to gain persistence in the system.

Hetzner is great for dedicated servers, but for those of us who need smaller-scale secure/confidential VMs I'm afraid that there isn't really any other choice than hyperscalers.

Does anyone know if there is a VM vendor that sits somewhere in between a dedicated server host like Hetzner in terms of performance + cost-effectiveness and AWS/GCP in terms of security?

Basically TPM/vTPM + AMD SEV/SEV-SNP + UEFI Secure Boot support. I've scoured the internet and can't seem to find anyone who provides virtualised trusted computing other than AWS/GCP. Hetzner does not provide a TPM for their VMs, they do not mention any data-in-use encryption, and they explicitly state that they do not support UEFI secure boot - all of these are critical requirements for high-assurance use cases.

Have you?

Financial crises have been more severe, longer, and more sustained since the introduction of central banking. Let us also not forget that the industrial revolution and the extraordinary growth of Western economies in the late 1800s were mostly conducted under free banking without a central buyer and lender of last resort, and in some jurisdictions where a central bank existed it was regulated to follow a strict gold standard.

Sure, but ransomware is just extortion and that is a concept that has existed for time immemorial. I think ransomware is a relatively small part of the global volume of generalised extortion which is almost certainly mostly settled in fiat and not crypto.

>Buying drugs, money laundering, rampant speculation, rug pulls, fraud, high fees, inefficiency, horrible UX, irreversible SFYL, and destroying the climate.

Every one of these charges happens every day and in some of them to a much greater scale in fiat, especially climate destruction due to inflationary monetary policy, which encourages consumption and waste and punishes thrift and savings.

"The root problem with conventional currency is all the trust that’s required to make it work. The central bank must be trusted not to debase the currency, but the history of fiat currencies is full of breaches of that trust. Banks must be trusted to hold our money and transfer it electronically, but they lend it out in waves of credit bubbles with barely a fraction in reserve." - Satoshi Nakamoto

- 1721 Mississippi bubble (https://en.wikipedia.org/wiki/Mississippi_Company)

- 1813-1836 Second Bank of the United States (https://en.wikipedia.org/wiki/Second_Bank_of_the_United_Stat...)

- 1933 FDR gold confiscation (https://en.wikipedia.org/wiki/Executive_Order_6102)

- 1939 UK gold confiscation under guise of national security (https://en.wikipedia.org/wiki/Operation_Fish)

- 1971 unilateral termination of gold convertibility (https://en.wikipedia.org/wiki/Nixon_shock)

- 2008-present ECB/Fed/BoJ/BoE/global QE (https://en.wikipedia.org/wiki/Quantitative_easing)

I don't know about the author but I have a feeling that the track record of central banks isn't exactly stellar, and I'd much rather trust a decentralised system with zero ability for sustained debasement than trust a small centralised group of people who have time and time again abused that trust.

>From my point of view serfdom is the (block)chain. Only people with enough stake or those who pays are in control.

I disagree with this but even if one assumes this to be the case, I'd much rather prefer a monetary system subject to the control of free market forces rather than the modern monetary system which is subject to a small group of unelected and unaccountable technocrats operating under the feeble assumption of central bank independence and whose power is extended through coercion and not voluntary association.

The United States taxes its citizens globally regardless of residence, yes. One of the only countries in the world that does that (the other is Liberia AFAIK).

Seems like India does this well and they are the world's largest democracy and much poorer than the average American. Poverty is not an excuse for government incompetence (or even malice).

https://en.wikipedia.org/wiki/Voter_ID_(India)

I can see why a tiny minority of people would be disenfranchised, but unfortunately compromises have to be made to have a fair and rigorous election system. Edgecases exist where people slip through the bureaucratic cracks but those exist here too and I see no one complaining about it. If you for some reason lack identification papers you'd try to fix it by going through the processes that we have to verify your identity. Nobody ever complains and says that the system is actively disenfranchising them as that is patently ridiculous.

Then perhaps the federal authorities should push for federal ID cards so people can actually identify themselves when voting. It is beyond me how the State can enforce a non-voluntary tax liability on a citizen but has no way of reliably identifying said citizen - it doesn't make any sense whatsoever. ID cards in Sweden cost roughly 350 crowns, which is around 40 USD. If people can't be bothered to get one of those cards to vote in an election then I see no reason to accommodate them as the fee is so low and 99.9% of people can afford it. If they can't, they can ask a friend or election official to validate their identity at the election booth. I'm sure the government could provide ID cards free of charge cross-referenced with biometric data to avoid duplicates. This isn't a difficult problem to solve but it seems like the Democrats are trying to stonewall it any chance they get.

I don't understand why voter ID is such a big deal in the United States. In my country (Sweden) you cannot vote without identifying yourself with a state-issued ID card or passport, no exceptions. If you for some reason lack both you need to have someone that can affirm your identity (and they need to show their own identification papers). Nobody complains about it because it is a necessary precondition for a fair and rigorous democratic system and everyone implicitly agrees upon this. If you don't like it then don't participate.

I don't buy the argument that it disenfranchises voters. Even the poorest in my country are able to vote despite having these voter ID restrictions. India also has some form of voter ID too, and their population is almost triple the American population and substantially poorer.

I can't help but think that there is some kind of malicious intent behind the opposition to voter ID, but it is unfortunately very difficult to prove.

My father used to be a programmer back in the 1960's for the IBM 700 series mainframes, writing programmes and simulations in FORTRAN 4 (and I think some assembler, too) for our now-defunct shipbuilding industry (Sweden). The stories he told me about how debugging back then included manually going through series upon series of punchcards (often by laying them out on the floor in his house and crawling while reading) humbles me somewhat to how far we've come in the industry where debugging something is as easy as pressing a button and getting instant feedback. Back then results from a compute had to be processed overnight even for relatively simple programmes.

One thing we've seemed to regressed on though is the professional stature of our industry - back then private offices were the norm and the Orwellian open-office hellscape of today was no where to be found.

There have absolutely been cases in history where other forms of "money" have been used, but in a long enough timescale of a civilisation, gold and silver are organically adopted as money due to their unique properties that make them suited for it. Fiat, shell beads, and other forms of currency are exceptions to the rule.

Hyperinflation is the phenomenon when people wake up and realise that real estate and prices rising is not a function of real prices increasing but rather their money losing value. We already have extreme asset price inflation (not to mention the rapid expansion of the monetary base). In my opinion it is only a matter of time before people realise what is going on, start dumping their dollars/euros/pounds/etc., and use something else for their daily transactions and savings, probably crypto at first. It is worth noting that every fiat currency throughout history, without exception, has eventually hyperinflated and collapsed to nothing.

They insist on enforcing inflationary monetary policy because it is thinly-veiled regulatory capture. No matter what the academics say to try and justify it (it is not justified and does not hold up to critical analysis, see the Cantillon effect), inflation is phenomenon that redistributes purchasing power from the people to those who are relatively closer to the central bank and the printing press (they can purchase assets and spend money before inflation hits the rest of the economy).

Krugman in his usual arrogance neglects to consider the price and indeed monetary history of gold. It is and always has been "real money" and most people either consciously or subconsciously trust gold more than the pieces of paper we call money, and its price is not a reflection of people chasing returns but rather people having less faith in the current monetary system (which is backed by nothing). The record physical delivery orders at Comex proves this [1].

If the dollar hyperinflates, where would people go? Crypto is obviously interesting, but gold is the supreme form of money that requires zero trust (while crypto is near trust-less, you still need to trust the cryptography to be secure).

[1] https://reuters.com/article/gold-cme/102-tonnes-of-gold-chan...

It's not vanity, because governments have dugged themselves into a hole where pension funds and others have invested enormous amounts of money in equities (seeing as bond returns are non-existent due to the aforementioned stimulus) as well as venture capital. Allowing the market to reset and recalibrate itself would also mean wiping out a lot of pensions as well as investments from wealthy donors, which is bad for votes.

The sad thing is that this erroneous monetary policy will only stop if politicians and central bankers are willing to stomach a harsh market recalibration, but seeing as they seem to not be willing to do that judging from their recent actions so I fear that this systemic malinvestment and inequality will just get worse and worse until something breaks.

Urbit is a pretty good example of this.

>We can choose where to draw the free speech line and still uphold the principals of a free and open society.

Don't you see the irony in this statement? Everyone is free to say what they want except what you or the government deem to be wrongthink. That does not sound like a free or open society to me.

Somewhat off-topic, but why does the IEEE (a non-profit) have annoying ads on their site? I'm not using an ad-blocker and as soon as I clicked the link I was bombarded by one big half-page ad and a bunch of other ads that are irrelevant to the content of the article.

I would have thought that their very expensive membership fees and article/publication fees would have covered their operating expenses.

It's only a problem if you subscribe to (in my opinion, the flawed and incredibly destructive) modern economic theory which is largely a continuation of the Keynesianism of the mid-20th century. Ask any economist why deflation is a bad thing and they will generally tell you that it is because they want to avoid a deflationary spiral with collapsing prices and high unemployment, which is why they want to ensure that consumers mindlessly consume and ensure that prices are kept "stable" (in their opinion, stable prices mean a positive inflation rate of 2%, which in my humble opinion does not make sense in pure mathematical terms).

However, there are two fundamental and overlooked errors in the assumptions that underlie this theory:

a) there is an assumption that consumers/agents are homogenous in their preferences and that people would rather starve to death than give up the opportunity to spend their money when it is worth more in the future. No sane person is going to wait one year to wait out some insignificant appreciation in the value of the money. People will still need to consume food and many of them would prefer to buy things now than in the future (consumer time preference, i.e. the desire to want things now rather than later, is always positive). For some inexplicable reason, time preference is completely ignored in the foundations of the theories that underpin modern monetary policy.

b) the second main assumption is that money saved is money that is unproductive. This is false: savings lead to investment in the economy as resources that would otherwise be consumed are redirected into lengthening production structures in the economy. Put simply, this means that if more people put money in the bank, the bank will have more money to lend out and interest rates would fall, allowing entrepreneurs and companies to invest in production structures which in the long-run will lead to higher quality goods and cheaper prices.

Of course, in the current highly distorted economy, deflation is disastrous as companies which are addicted to debt will need to be liquidated as there is no longer a steady stream of money coming in through inflation. This will likely lead to a severe recession, but this is not a bad thing as in the long-run the economy is better off as inefficient businesses who are addicted to debt and cheap money will no longer be able to operate, and clever entrepreneurs will be able to take their place.

It is savings that build up capital structures in the economy, not consumption which largely distorts and even destroys said structures, and the faster we stop this destructive inflationary monetary policy the faster we return to sustainable, fair, and real economic growth.

How do you deal with taxes in a distributed team like yours? I was looking into doing something similar to what you are doing but it seems like the complexities involved with taxation are enormous as you would need to pay corporate tax in every country you live in since the "place of effective management" of the company is shifting every time. Feels like this is a ticking time bomb and that you're opening yourself up for a major liability in the future if you are not careful.

Might be different for SaaS companies though where servers are distributed, haven't looked into that.

It is not impossible to build a system that can handle this on x86_64, it's more a question of software architecture rather than hardware architecture - modern computers are insanely powerful.

I've never really understood this way of thinking. In my experience, it is trivial to maintain cross-platform applications if you encourage code-reuse in the logic layer and tailor the UI/UX experiences for the platform you are targeting. In practice this usually means writing the client business logic in a high-performant language that can target multiple platforms (I've only used Rust for this, but there are other languages out there that would work well with this approach as well), and using FFI when interacting with the UI layer. Combine this with good message passing practices (to homogenise serialisation/deserialisation and avoid the complexity of having hundreds of different FFI functions with various parameters) and you've got something that is easily integrated in platforms with little headache.

I've seen great success with this approach for most platforms including mobile as it provides the end-user with a great user experience (you can use all the native UI APIs which provides an experience that the user is already familiar with) as well as extremely high performance with a high degree of code reuse.

>Bitcoin lightning makes higher throughput blockchains irrelevant.

Lightning is a UX disaster that is not easily solvable as the headaches are part of the protocol itself (opening/closing channels with nodes etc.). I've used some of the various apps that have been released and I find it very difficult to see how "normal" people are going to understand and use it at all. Instead of trying to innovate with new blockchain designs, there is a significant amount of minds trying to hack together bandaids for Bitcoin, a protocol and blockchain that has already been crippled by Blockstream and the scaling debacle.

If one steps back and takes stock of the ecosystem, I find it very difficult to see what value proposition BTC has other than reputation and being a first mover. Store-of-value is something that Monero can do better as it guarantees privacy which I'm sure a lot of people would like. Instant transactions is something that NANO has solved on the protocol/blockchain layer (and without using clunky hacks like Lightning) whereby transactions are settled almost instantly and at zero cost.

Quite frankly, the only thing BTC has going for it is brand value - technically it has already been superseded by other protocols, but BTC maximalists (such as the author of the article) are ignoring this reality likely due to sunk-cost fallacy.

So no, I disagree strongly with the author. There is a lot that can be built within the cryptosphere, and I think trying to gatekeep innovation by limiting it to the BTC protocol is extremely disingenuous.