awsthro00945

>You shouldn't lose all rights

I'm not a huge fan of this monitoring, but why be so dramatic? You aren't losing any rights here, let alone all rights. You do not have a right to use your employer's computer without your employer's permission.

If you want to do something that isn't monitored, just use your own computer instead of your employer's computer. You should be doing this anyway, keystroke monitoring or not.

The purpose of the monitoring is to prevent data theft, and is specifically for customer service associates. Customer service associates have access to sensitive customer data that even management or IT employees do not have.

LinkedIn is definitely higher (dunno about GitHub), but in almost every discussion I've seen about comps, LinkedIn is always talked about separately from MS. On levels.fyi, for example, LinkedIn is in it's own section separate from MS.

Amazon is lower than Google, FB, and Netflix, but still quite a bit higher than MS. According to levels.fyi for engineers all at the same level (~5ish YOE):

- MS: $185k

- Amazon: $230k

- Google: $267k

https://www.levels.fyi/2020/ is a decent resource. The numbers are fairly accurate, IME. You can also lurk around Blind if you want to get a sense of salaries in tech (warning though: Blind is completely obsessed with salaries, to the point where its unhealthy).

You'll actually notice that none of the FAANG are on the top 10 of that list. FAANGs definitely pay well, but these days "FAANG" is outdated, IMO. I've seen it "FAANGMULA" sometimes (FAANG + Microsoft, Uber, Lyft, Airbnb) but even that still leaves out other high payers like Stripe, Box, Bytedance, etc.

Apple is part of this society, and has a responsibility (not to mention a direct interest) in helping to solve, or at the very least to not make worse, its society's problems.

The same goes for you, by the way.

I read this, and my first thought was "what are they supposed to do? buy houses for all these people? Yea, Apple could afford it, but then they'll be sending the message that if you want Apple to buy you a house, all you have to do is pitch a tent on their lawn".

And then it reminded me of a quote from The West Wing, after Toby uses the president's name to pull some strings for a random homeless person he happened to run into:

> President Bartlet: "Toby, if we start pulling strings like this, you don't think every homeless veteran will come out of the woodwork?"

> Toby: "I can only hope, sir."

I know that "solving" homelessness isn't really as simple as just having the wealthiest company on the planet buy homes for people, but... it could be a start.

It doesn't seem like they ignore it. Sailors might be a decent analogue for astronauts while isolated within a space vessel, but that's not what this experiment is. NASA wants to research the environment while on a Martian surface mission, including doing stuff like suiting up in spacesuits to go do work outside, deal with communication delays, and having research responsibilities.

It's somewhat similar to being confined on a sailing ship, but is still different, and the minute details really matter for something like this.

I mentioned it in my earlier comment but in my experience it really comes down to continued funding and not "half assing" efforts. The successful homeless shelter I mentioned earlier is not a revolutionary shelter that is doing vastly different things, it's just a shelter that, due to outside donations and support, is able to actually follow through on things like providing security, nutritional food, community building, and opportunities to gain work experience.

In contrast, some of the other homeless "shelters" I've seen are just barely funded enough by the city to keep the roof from leaking and the lights on with minimal staffing. That just doesn't work.

>1. Can they safely store valuables?

The camps in state's major cities notoriously have armed guards to prevent people from looting or moving the tents, and given that these tents already have all kinds of other furniture like couches, chairs, cabinets, etc, I wouldn't at all be surprised if they have lockable cabinets or drawers. One of the camps nearby has actually formed a "governing board" where they assign people jobs in the camp such as security, gathering more materials and food, etc.

>So if someone can shower, has internet access, can keep a work laptop without it getting stolen, and has been homeless for <5 years then yes, let's exclude them.

AFAIK the vast majority of homeless people in my state's major cities have only been homeless since last year.

So I guess we can remove at least 10k people from the US's homeless statistics now?

I dunno the last time you went and visited a homeless encampment in the US, but many of them do indeed have showers and internet, too (sometimes provided by the government, other times just because these tent cities are legitimate cities).

I've seen a lot of tents with cooking areas too, and some even with portable generators, TVs, and fridges.

So can we exclude them from the homeless statistics yet?

Do yourself a favor and don't make assumptions about me. I've volunteered at homeless shelters before. At a previous company, I was in charge of working directly with a homeless shelter to organize volunteer events for my colleagues. I have firsthand experience at homeless shelters that have successfully become shelters where people really want to be there rather than on the street because of the services and environment they provide.

>Homeless shelter's don't help, they're ridiculously dangerous to be in.

Then solve this problem.

The problem I constantly see with homelessness in America is that municipalities constantly half ass every attempt to fix it, and then throw up their hands and say "well that didn't work, I guess there's nothing we can do!" Building homeless shelters without making them safe places to be is the perfect example of half-assing. I mean ffs, it's in the name: shelter. A homeless shelter not being safe doesn't mean that homeless shelters don't work, it just means your execution was shit.

That still leaves the same question, though. In the US, many municipalities designate certain areas as government-sanctioned camping grounds where "economic refugees" can stay while they don't have a permanent place to live. Does that count as "temporary housing" and can we exclude them from the homeless numbers as well?

Massaging the numbers seems silly to me. At it's core, we're talking about how to solve the issue of unhoused people that require government assistance. Syrian refugees were/are an unhoused population that required government assistance. US tent-livers are unhoused populations that require government assistance. It's perfectly acceptable to include them in the same conversation. If the strategies that were applied to helping Syrian refugees find housing can somehow be helpful when helping LA tent-livers find housing, then it should be part of the same conversation.

For as fundamental and important as encryption-in-transit is, it's always baffled me that there isn't a simpler, easier solution to accomplishing it on private networks. Everyone knows its important, and everyone wants to do it, but it's just such a pain in the ass and so prone to error that even some top security leaders will tell you not to bother because it's such a footgun.

We really need something to help make the process simpler, like how Let's Encrypt made public HTTPS so much easier to do for even the smallest of websites.

No, the linked article specifically states that union literature is not given any special treatment, at all. Companies can indeed restrict it from being spread, even in break rooms, if: 1) not spreading materials in the break room is necessary to maintain work productivity, and 2) all other materials are treated equally and are also not allowed to be distributed in break rooms.

edit: the above is actually for union discussions in break rooms. It's not clear if the same rules apply for literature in break rooms, but given that other parts of the article specifically call out that all literature must be treated equal in other areas (ie not break rooms), I'm not convinced that it doesn't apply.

The stance of the NLRB regarding union materials is that it is explicitly not given any special treatment, neither in regards to protecting its spread, nor in regards to preventing its spread. It must always be treated equally to materials on other topics: either everything is banned, including union materials, or nothing is banned, also including union materials.

I create various accounts for posting on HN that I cycle through, because there are some individuals on HN that participate in ingenuine ad-hominen attacks (case and point) rather than actually engaging in the discussion at hand. Because of this, I try to limit my personal details shared via HN accounts.

This particular account was created because it was a throwaway to respond to a post regarding working conditions at AWS, hence the name. I am not shy about the fact that I work at AWS, and if you read my comment history you'll find that I think it's a garbage company that I am currently trying to leave, and I support unionization of workers.

But none of that actually addresses the question that was asked of you. Where are you getting your information that "They can't ban some and allow some, which is what happened here."? Because that information is not in the article, and it seems like you're just making it up. If there is such information available somewhere else, I'd like to read about it.

If you have an actual answer to the question at hand rather than trying to avoid the question and make dumbass assumptions based on my username, please do respond. Otherwise, I'll just assume that you are resorting to ad hominem attacks because you don't actually have any facts to back you up.

How do you know that's what happened here? The OP linked article does not contain such information.

Ironic, because the comment you are replying to is completely wrong.

Labor laws are stupidly complicated and a single one liner from an HN comment is almost guaranteed to be wrong in some way. You shouldn't believe anything you read in an HN comments thread about them, on either side of the issue (including this one, because I'm probably wrong in some fashion too!)

In this particular example, it's not a false equivalence at all. The NLRB specifically does not give special protection to union literature. As long as the employer treats all literature equally (such as soccer literature, harry potter literature, etc), they are allowed to ban non-work literature in work areas during work time. Union literature does not get any special treatment.

see: https://www.nolo.com/legal-encyclopedia/shop-talk-rules-unio...

You really underestimate. Even standard entry-level developers are under NCAs, and I've had a former colleague (who was certainly "typical", and an additional $200k would have been life changing for them) who was hit with one. I have many other colleagues (again, just "typical" people) who lost out on job offers because the new company didn't even want to deal with the threat of an NCA.

It is "on" by default, but the user still has to have the 'ssm:StartSession' permission (and probably others) to open the SSM session, and for some(?) operations you also still need to have the appropriate credentials (ssh keypair or a password) to login via SSH.

SSM Session Manager is one of the (if not the) preferred way to manage SSH access to instances in AWS. It's kinda hairy to set up, but it removes the need for bastion hosts/jump boxes for most use cases. From my experience I would say it is quite common.

At the US rental companies I've used, CDWs specifically do cover those things, and in fact cover pretty much everything related to any damage of the vehicle (with caveats, like you were using the vehicle for something illegal). I guess the US/UK difference is good to keep in mind next time I head to the UK.

https://www.avis.com/en/help/usa-faqs/cdw-insurance

https://www.avis.com/en/products-and-services/protections/lo...

I have no clue why you're being downvoted (and I'm being downvoted now too, lol). If you hit a rock in the road, or a pothole, or a tree, it is covered under collision insurance.

For posterity: https://www.investopedia.com/terms/c/collision-insurance.asp

> ... it will cover damage from potholes, and accidents involving an inanimate object.

The problem is that during the sales process, the client is led to believe that the "mutually-satisfactory state" that they are paying for is a certain bar of quality and will be built by "the A team".

But then, after many months and likely hundreds of thousands of dollars are already spent, their bar for "mutually-satisfactory state" has been lowered to "I guess we will accept this pile of mediocre shit that the D-team built, because we already wasted months on this and we are desperate for something, and it would be too expensive and just waste more time to try and argue with the consulting firm to fix it".

I spent a long career as a consultant at one of the top "prestigious" firms. Consulting firms almost always prey on this hope that the clients won't complain too much, even though everyone knows the end product that is delivered isn't anywhere close to what was pitched during the sales phase.

>You clearly have no clue how it looks inside the board rooms and executive offices of some of these huge companies. This type of stuff is treated the exact same way as if a 400m building burns down.

I sit with CISOs daily discussing this stuff. $400m expenditures is enough to scare the shit out of them. A $400m building burning down would have CEOs fired (see: Equifax CEO being fired after breach). I don't know what fantasy land you live in, but you're either delusional or lying.

>If a company can weather the storm, there is no long term impact.

That's not what impact means.

>If you look at equifaxes breach, it hasn't depressed their revenue.

This means nothing. It's possible that with an additional 50% of their yearly net income freed up, they could have massively increased their revenue by spending that on product development or sales efforts. You cannot draw any conclusions simply from the fact that their revenue hasn't decreased.

>Over the long term, it has had very little effect on the company long term, which is my entire point.

On the other hand, it may have had an enormous impact. In a time period where every other company is seeing massively rising profits and stock prices, Equifax has been relatively stagnant. Your point has no standing.

>If you compare year over year, many of the things they attribute to the breach are actually just IT/overhead costs they were able to shift to a loss.

No, it's not. Read the 10-K. It includes pages upon pages of the breach-related expenditures, including hundreds of millions of dollars spent on extra stuff like credit monitoring, legal fees, and professional services costs. That's not "just IT/overhead costs".

Just because a company was planning to spend $400 million anyway doesn't mean that having to spend that $400 million on breach-related expenses is no impact. The budget doesn't just come out of thin air, it gets allocated from other places. Spending $400 million on breach-related expenses means not spending that $400 million on something else like product development, research, marketing, or other company initiatives. The impact is enormous.

>In the grand scheme of things, it really isn't a huge impact to them.

You have no clue how businesses work if you seriously think that an additional, unexpected $400 million in expenses (almost 50% of their yearly net profits) "isn't a huge impact to them". That's really all that has to be said here.

>Dude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line.

I'm looking at Equifax's 2018 statements right now. With Operating Revenue of $3.4 billion and profits of $850 million, they had $400 million of expenses related to the breach. "No major impact" my ass.

See: https://news.ycombinator.com/item?id=27719281

Literally the first company I pulled up, Capital One, has this in the 2020 10-K:

>During the year ended December 31, 2020, we incurred $66 million of incremental expenses related to the remediation of and response to the Cybersecurity Incident, offset by $39 million of insurance recoveries. To date, we have incurred $138 million of incremental expenses, offset by $73 million of insurance recoveries pursuant to the cyber risk insurance coverage we carry. These expenses mainly consist of customer notifications, credit monitoring, technology costs, and professional and legal support.

Go look at Equifax's 2018 10-K and it has pages upon pages talking about the impact, including:

> During the year ended December 31, 2018, the Company recorded $401.2 million of pre-tax expenses related to the 2017 cybersecurity incident and insurance recoveries of $75.0 million for net expenses of $326.2 million. Costs related to the 2017 cybersecurity incident are defined as incremental costs to transform our information technology infrastructure and data security; legal fees and professional services costs to investigate the 2017 cybersecurity incident and respond to legal, government and regulatory claims; as well as costs to provide the free product and related support to the consumer.

For Equifax, there is also an additional $112 million (net, after insurance recovery) in breach-related expenditures in the 2017 10-K.