blablabla123

Isn't there always a sidechannel in a social network?

Even if it doesn't fully block, it makes stalking etc. more annoying.

Scrum can be stressful but as the graph rightly shows peak stress for Waterfall is way higher. I've been working more than a decade with Scrum. Every time I don't it shows, lower productivity, even higher stress, bogus tasks. If people want to do Waterfall fine, but then please also have proper project management with Gantt charts. Otherwise it's just Cowboy development

For a product: Delphi 2. I don't think I ever saw a better offline documentation which is so self-contained

For a project: MDN, they refactored the Web's JS documentation

Yeah the question is always if the cure is better than the disease. I'm quite ambivalent on this. On the one hand I tend to agree with the "Anti AV camp" that a sufficiently maintained machine can do well when following best practices. Of course that includes SIEM which can also be run on-premise and doesn't necessarily have to decrypt traffic if it just consumes properly formatted logs.

On the other hand there was e.g. WannaCry in 2017 where 200,000 systems across 150 countries running Windows XP and other unsupported Windows Server versions had crypto miners installed. It shows that companies world-wide had trouble properly maintaining the life cycle of their systems. I think it's too easy to only accuse security vendors of quality problems.

Coming from Physics the first time I heard detailed information about Mathematica (in contrast to Maple) and the Physics related work from a Professor it was also accompanied with a huge disclaimer. Reflecting further on this, a lot of this is very niche and seems to be not explored fully in the spirit of peer review

True, while in the 90s/00s I used carefully built computers eventually I turned to laptops. Running a (powerful) 400+ Watts box that isn't mobile is very nice to have but won't really work for me anymore.

I must admit I therefore was only vaguely aware of the site. (During "my time" Tom's Hardware was quite a thing but probably they cater mostly to overclockers and gamers)

Would be nice to see a renaissance of DIY computing though. MacBooks do become a little bit boring :) On the other hand I do run a small homelab by now

It's a very strange filter though. At my current job there's a multi-stage hiring process with leetcode tests. And yet most people lack substantial domain knowledge, it's really frustrating. In fact the code base hardly has a visible architecture

Yeah sometimes people advocate for it but might end up making problematic decisions when it comes to voting. Many people may vote after all but if it's not based on news it can be problematic. Solely relying on Wikipedia or History might not give full context and could overly rationalize the decision making. After all, people want their policy makers to make their inhabitants happy (irrational) and not just optimize a (simplified yet rational) metric.

I don't think though there is unbiased news. Generally a classic recommendation has been to read across multiple sources.

> There is sparsely little real “engineering” that goes on in the field of “software engineering”, industry wide

There surely is actual engineering but it's scattered unevenly across companies. It's funny that Crowdstrike did fuzz their code but didn't even check for correct arity. I think that the Cybersecurity industry isn't such a strong adopter of sophisticated engineering techniques as for instance in Web development where new testing techniques evolve every few years.

Changing units in Electrodynamics for instance comes with unexpected factors in formulas though, indeed containing π. (CGS <-> SI)

Comparing programming with plumbing seems comparing apples and oranges. In such jobs people probably dream of the worst imaginable IT micro managers. Such companies are typically lead by a bunch of furious old guys that do nothing. It's hard to take such an assessment seriously made by people who never worked in a similar job.

While Clowdstrike Falcon EDR is in some sense an AV on steroids and Crowdstrike not only does EDR. While they are obviously deployed on lots of systems, less than 1% of Windows systems means it still operates in an absolute niche. Most people didn't know CS even fewer know any of the competitors.

I think one massive difference between CS and AV is also, you don't expect a human to be in the loop because it would be too expensive. Nor would it be feasible for consumer software because of privacy.

Also even within this small niche, the solutions are very heterogeneous and make little sense for single boxes - in fact may even be designed to run on a network level.

On the other hand OpenBSD doesn't require very frequent patching assuming a default install which comes with batteries included. For a web server there's just one relevant patch since April for 7.5: https://www.openbsd.org/errata75.html

The attacks with the biggest impact are usually social engineering attacks though. It can be as simple as shoulder surfing, tailgating or as advanced as an AI voice scam. Actually these are widely popularized since the early 90s by people like Kevin Mitnick

That. Also not educating users is a bad idea but it also becomes quite clear that the article was written in 2005 where the IT/security landscape was a much different one.

I also use a README.Md in a private repo plus I keep interesting ideas/links in it. Pretty messy at the beginning but works really well to get something off the ground. Once these things are done, things become more clear I think and I switch to implement what I feel like. And possibly open-sourcing it. (For more ambitious long-term efforts I guess some issue tracking makes sense though at that point)

> Agriculture and food production are responsible for ∼30% of greenhouse gas

The title seems a bit misleading

Yeah this seems indeed missing details. It's not the candidate's responsibility to guess what the hiring manager is really looking for and kind of normal to get the best position possible. That said, the hiring process seems utterly broken if it wasn't possible to distinguish a junior from a senior.

edit: personally I think though that the company should take responsibility and make sure the employee either gets ramped up or a very smooth exit financially since the application probably meant he missed other options

Commercial part aside, what works is finding a community that resonates with what you do and announcing your code release there. Maybe something in the F# or FP space? Considering the commercial part though, I think it should be very clear how the project is self-sustaining without add-ons that need to be bought. If you plan for companies contributing, probably collaboration with some foundation that runs similar projects makes things easier

Yeah but it's hard to understand unless doing a lot with auth. Indeed "don't roll you own crypto" but you don't need a PhD in Mathematics to roll you own auth. Sometimes it's necessary and even if not, it's good to know what could need work.

...which is sometimes incredibly hard and it might not be possible because it's such a niche topic or people might be just wrong. Just thinking about Urban Myths, Conspiracy theories etc. where even without a niche factor things may sound unbelievable but actually disproving can be effort that is out of proportion

That, the whole pop-up idea was just copy&pasted. It's possible to make commercial websites without it when turning off tracking without logging or having to explicitly opt-in, possibly for added value. There's a lot of confusion while the law is mainly about differentiating which data is needed to operate and which is purely nice to have. That said, there are plenty of GDPR-compliant services that keep data for 10 years mostly in finance or auditing related use cases and nobody bats an eye

Kind of interesting actually. In the 2000s/2010s it was quite normal that distributions provided modified packages. Maybe not necessarily function-wise but theming, config files to a degree that interoperability wasn't the best. Even more funny that this is done now by Debian which always had a reputation of providing vanilla packages... But I guess after the xz debacle this is getting a new kind of attention

They really stretched regulations and started building - with the possibility for approval being denied thus the whole thing having to be teared down. Basically creating facts, I think that has created immense pressure on local politics/regulators. Also considering the region has lots of structural problems. It's quite incomprehensible to me why it wouldn't have been possible to build it a few kilometers further where there's no water protection area. Not to mention they had a number of water contamination incidents since then

No, to stop inflation

But not that far fetched in 2024, Bitcoin limits the total amount of coins. I'd think at a certain amount of money, probably a significant part is likely idleling (and not adding to economy) or not in full control of the owner.

I like seeing qmail as blueprint how a secure app that needs elevates permissions should be designed, in fact it has 7 users.

Yeah but elevated permissions may be needed from time to time anyway. Either on the client, the baremetal server or the container. Running everything as root is even for containers not recommended. Considering how popular these have become, it's a bit of an irony that systemd isn't available on the container without considerable detours.

Probably worth a book though

I think this is one of the biggest misunderstandings about security that there's one linear scale and that every solution can be assigned a generic positive/negative delta on that.