Hacker News Reader

abadpolion AWS Lambda Web Adapter

For fast iteration, our developers build, test and deploy locally using cdk deploy directly into their dev account, no need to wait around for the pipeline to do all those steps. Then when they’re ready, higher environments go through the pipeline.

CDK has a new(ish) feature called hotswap that also bypasses CloudFormation and makes deploys faster.

abadpolion AWS Lambda Web Adapter

For many systems, the application and the machine are so intertwined as to basically be the same thing.

A lot of web apps are just boring CRUD APIs. The business logic behind these is nothing special. The differentiating factor for a lot of them is how they scale, or how they integrate with other applications, or their performance, or how fast they are to iterate on, etc. The “machine” offers a lot of possibilities these days that can be taken advantage of, so customizing “the machine” to get what you need out of it is a big focus for many devs.

abadpolion AWS Lambda Web Adapter

As the other commenter said, nobody is saying to make your application completely immutable. You still patch it, add features, etc. But now you only have to patch one container image rather than two (or more).

abadpolion AWS Lambda Web Adapter

> The less it changes the the more vulnerable it is, the less compliant it is, the more expensive it is to operate (including insurance), the less it improves and add features, the less people like it.

I don’t follow this. Complexity is what leads to vulnerabilities. Reducing complexity by reusing the same, known code is better for security and for compliance. As a security person, if a team came to me and said they were reusing the same container in both contexts rather than creating a new code base, I would say “hell yeah, less work for all of us”.

There are other reasons why using the same container in both contexts might not be great (see other comments in this thread), but security and compliance aren’t at the top of my list at all (at least not for the reasons you listed).

abadpolion The 10x developer makes their whole team better

And yet if you want to build an empire of rock music, the person who teaches stars to rock is vastly more important than any one star.

Even the 5x dev who teaches just 2 others to be 5x devs is more impactful than the lone 10x dev that ignores their team, and always will be.

abadpolion $2.4M Texas home listing boasts built-in 5,786 sq ft data center

lol “shadow operation” what? This house was built before cryptocurrency was even a thing. It’s an old AT&T switching hub that was disguised as a house so as to not make it an eyesore in the middle of a neighborhood.

abadpolion Texas poised to get own stock exchange – with less red tape than NYSE or Nasdaq

Oracle didn’t move its entire workforce, but it’s inaccurate to say it was “in name only”. Oracle spent hundreds of millions of dollars building a massive office campus near downtown Austin that reportedly has space for 10,000 employees.

I’m curious what other companies you’re thinking of when you say “like many others”, because all of the ones I can think of have moved significant parts of their operations to Texas.

abadpolion Texas poised to get own stock exchange – with less red tape than NYSE or Nasdaq

Both of those events were due to localized weather events that destroyed local power infrastructure (specifically, storms that destroyed overhead power lines). These are things that have not to do with federal regulations, which is the topic of this thread.

And yes, other states have this problem as well. See https://poweroutage.us/about/majorevents.

abadpolion Texas poised to get own stock exchange – with less red tape than NYSE or Nasdaq

> systemic issues dealing with extreme weather (winter and summer) are pretty well known

No they aren’t. They’re often repeated, but they aren’t true.

Texas had a catastrophic “grid failure” in 2021. It hasn’t had any actual issues since. There have been no power outages due to “grid failure” since that one event. The past couple winters and summers have seen several situations where the grid operators have issued warnings, but these warnings are completely normal and are part of the process to inform power producers to not go offline, etc. In software terms, it’s basically the equivalent of “it’s going to be a busy day today, try to avoid doing any deployments to prod unless they’re really necessary”.

Just like the train derailments last year, and the airplane issues this year, the media loves to use the fervor around a single bad event to then create big headlines about every similar event.

Back to the software example, imagine if every big shopping holiday there was an CNN headline of “Amazon told its developers they cannot deploy to prod today. Amazon is worried about an outage!!” And because the layperson doesn’t know any better, they fall for it. But in reality, it was business as usual.

abadpolion Hacker confirms access through infostealer infection [withdrawn]

Just because there isn’t a “novel exploit” doesn’t mean this isn’t a big deal.

Snowflake is susceptible to their SE’s having credentials stolen. These credentials can bypass MFA. And per the article, they have no expiry. That’s strikes one, two, and three.

Snowflake’s security practices lead to a situation where their customers are either required, or at minimum encouraged, to share access to broad datasets with Snowflake employees. That’s strike four.

Yes, there is also issue here that the customers are responsible themselves for not granting too broad access, and that’s on them. But it’s also on Snowflake for not having a better system that doesn’t require this access, or at minimum not having better oversight and control over this transitive access.

Once these accounts are granted access to a customer’s data, they aren’t “demo accounts” anymore. They’re real accounts, with real, very valuable data, and they should be treated as such.

Edit to add: it is worth noting that Snowflake claims the demo account did not have access to customer data and wasn’t the source of the leak, which is in contradiction with what the attackers claim.

abadpolion Hacker confirms access through infostealer infection [withdrawn]

Why in the world would obtaining a Snowflake employee’s credentials allow you to then obtain Snowflake’s customers’ data? Doesn’t this imply that people working at Snowflake can see all of the data that I put in it?

Admittedly I don’t have much experience with Snowflake, but as a baseline I expect better from a “cloud storage giant”.

abadpolion Things you wish you didn't need to know about S3

This almost certainly has nothing to do with “saving CPU cycles” and is most likely just that whoever created the Cloudwatch console used the same rounding that is used for all other metrics in CW, rather than the proper calculation for disk size, and it was a small enough issue that it was never caught until it was too late to change it because changing it would disrupt the customers that have gotten used to it.

abadpolion The hail in Texas was so big Tuesday that it required a new description

It’s different because the National Weather Service uses “grapefruit-sized” specifically to refer to hail that is more than 4.5 inches in diameter but no more than 5 inches in diameter. It isn’t “any hail that is about the size of a grapefruit”.

This hail was bigger than 5 inches, so NWS needed a new term for it per their estimation guidelines.

abadpolion Where are the builders?

I’m in the same position as you, and I agree wholeheartedly. The one thing I’ll say is that I think 20 years is optimistic.

I’ve been involved in a few huge, greenfield projects that were mostly building new things from the ground up. There was an air of “true” building around. But it was astonishing how quickly that faded away. It took less than a year after our first launch for a lot of people to start leaving the team, citing reasons like their job was now just drudgery maintenance work or small feature adjustments, which is definitely less attractive and inspiring.

And that is reinforced by career paths as well. See: the trope about Google promotions based on new launches, not bugs fixed. And people definitely idolize “the engineer that built Linux” more than “the engineer that has patched 1000 linux bugs”.

abadpolion 300k airplanes in five years

Seems like an overstatement to say “an entire cemetery”. Per the Wikipedia page, the cemetery is 120 acres with 200,000 grave sites, but only 78 of the graves are RAF students (which still is a terrible amount of people to lose in training, of all things).

abadpolion [dead]

https://www.uscis.gov/humanitarian/victims-of-criminal-activ...

> The legislation was intended to strengthen the ability of law enforcement agencies to investigate and prosecute cases of domestic violence, sexual assault, trafficking of noncitizens and other crimes, while also protecting victims of crimes who have suffered substantial mental or physical abuse due to the crime and are willing to help law enforcement authorities in the investigation or prosecution of the criminal activity.

abadpolion Passkeys: A shattered dream

Great in theory, but in practice there are still a frustrating amount of websites and services that put a low upper limit (usually just one or two) of the number of keys you can enroll.

This effectively makes it impossible to do what you’re saying. It sucks.

abadpolion Google Earning Q1 2024 [pdf]

Seems like a situation where it’s worth it to be cognizant of your bubble.

I don’t know exactly what you meant by “our demographic”, but I’m a frequent reader of HN, work in tech, and generally stay up to date with all things tech, and yet… I don’t know if a single person that doesn’t still use Google as their go-to place for information. Before this comment I had never even heard of Perplexity or You.com. /shrug

abadpolion MemoryDB: A fast and durable memory-first cloud database

Uptime and durability are not the same thing.

abadpolion MemoryDB: A fast and durable memory-first cloud database

This post is about MemoryDB, not EC2, and the very first sentence of the linked paper states 11 9s durability.

abadpolion Tesla recalls all cybertrucks for faulty accelerator pedals

Of course Elon gets treated differently. No other car company CEO is on Twitter drawing attention to himself like Elon. Tesla itself is also the darling car company of the decade, with the highest market cap. And the Cybertruck, by design, is basically a celebrity on wheels on every road/parking lot it traverses.

I’d be blown away if a full recall of the cybertruck wasn’t top headline news.

abadpolion Inside Amazon’s Secret Operation to Gather Intel on Rivals

Pretty much any big project at a big company is going to have a “guidelines on what to say if the press or someone asks you about your work” document. It’s mandatory training at most companies. I’ve never been on a project that didn’t, and none of them are things I would consider even close to unethical.

This team sounds interesting but I get the feeling the WSJ is trying hard to make it seem like some sort of clandestine spy operation. This practice isn’t uncommon… I’ve worked at airlines and they sometimes have people fly on a competitor airline and they don’t broadcast broadly “hey united flight attendant!! I work at American Airlines!” but it isn’t because they’re trying to be a spy.

The subsidiary is literally called “big river” (Amazon is a big river), the employees of Big River listed amazon as their employer on LinkedIn, and it took a simple google search to see the owner of Big River was Amazon… they weren’t exactly trying hard to hide it. A spy operation this was not.

abadpolion Pacific castaways' 'HELP' sign sparks rescue mission and family reunion

The P-8 is a submarine hunter, and has a small weapons bay and drop chutes that can be used to drop torpedos and sonobuoys while in flight. I imagine they used the same capability to drop the survival packs.

There’s a pic of it here: https://www.twz.com/40859/the-case-for-stripping-the-p-8-pos...

(I have no opinion or endorsement of the other content in that site, just merely was looking for a picture)

abadpolion Microsoft employees exposed internal passwords in security lapse

I see! I think it’s a good idea, and I personally think that would be a good and overall positive role!

However in my experience in a big org, #1 happens frequently enough where it basically would be needed at all times, and would need a security person (or entire team) dedicated solely to that purpose. And sadly in my experience, companies are not willing to spend the money, or able to hire enough security people, to have that level of a dedicated security concierge for every team that needs it.

abadpolion Microsoft employees exposed internal passwords in security lapse

IME many security people are already on call. What you’re describing is one of the roles of Security Operations Centers, unless I’m misunderstanding what you’re suggesting (which I think might be the case!)

You can’t rely on that as a fix though, because it’s inherently reactive, when what you really want is proactive protections. By the time you get paged about a breach, it’s already too late.

abadpolion Microsoft employees exposed internal passwords in security lapse

_Every single person_ in the security industry that I know is on the verge of burnout because we’re all running around trying to answer questions from other teams as fast as possible, but there just simply aren’t enough security people to go around, and I don’t think there ever will be. My security team coworkers each have a backlog of 50-100 unread slack DMs from developer teams looking for guidance at any given time, and it’s been that way for years. My team has been attempting to hire nonstop, but the pace of hiring can’t keep up with the demand.

Honestly, 1 week sounds totally reasonable to me. If you’re at the point where you need an answer immediately or it’s going to delay your timelines, then you didn’t plan your timelines very well, or you waited too long to engage your security team. You have to keep in mind that while you might be laser-focused on your app and think it’s the highest priority, your security team is likely dealing with hundreds of apps, each of which all claim to be the highest priority. Triaging has to happen, and it doesn’t always go in your favor. It really sucks for everyone involved, but I don’t see a good fix for it.

The sweet spot is empowering teams to make most security decisions on their own so the capacity of security people can be spent more wisely and development teams don’t have to wait for an answer except for in very rare cases, but the pessimist in me thinks we’re already too far behind on this and technology (and the opportunity for new security dangers to arise) moves too fast for us to ever catch up.

abadpolion Microsoft employees exposed internal passwords in security lapse

At my company, the big thing that I think would help is if people would stop treating data engineers as if they are a cheap way to get both software engineering + data analytics in one package. They’re not. Data engineers are brilliant at data things like writing complex pipelines and wicked queries, but they just aren’t as good at writing secure code. Meanwhile, software engineers are the opposite.

Data engineering teams need at least part of their team to be designated software or systems engineers that are experts in stuff like how to create a robust cloud environment. This is not only beneficial for security, but also for cost optimization, performance, operations, etc! It drives me crazy when I see a data engineer or marketing team told they have to fend for themselves when trying to figure out how to build a cloud environment.

abadpolion Microsoft employees exposed internal passwords in security lapse

Hit the nail on the head. As a security person, the marketing and data engineering teams at my company are what keeps me up at night.

They inherently desire to work with the company’s Crown Jewels of data. They want unfettered access to, and want to give other people access to, an entire data warehouse of some of our company’s most sensitive customer information. And when it comes to securing it properly, they often do not have the same engineering capabilities as software teams.

abadpolion Amazon increased US plastic packaging despite global phase-out

Even that thread is strange to me. There’s some people saying it takes 5-7 days to get delivery to Raleigh, while there’s also multiple people disagreeing saying they get 1-2 day delivery to east Memphis (less than 10 miles away).

abadpolion Amazon increased US plastic packaging despite global phase-out

My friends and coworkers are geographically diverse as well. My original comment still stands.

Even my friend who lives in rural nowhere is one of those people who in the past has raved to me about how they order everything from Amazon because it’s even faster than going to the store. Parts of my family live about 3 hours from the closest big city and they still love Amazon as well.

There’s definitely got to be a geographic proximity factor to it and I’m definitely not saying your anecdote is invalid, but I find it very interesting that I’ve literally _never_ heard anyone in real life complain about Amazon shipping times, while I see it frequently on HN, to the point where if you only read HN you might think it was the majority viewpoint.