eugenekolo

Awesome news.

Sentiment might hold some merit, but this article is 80% copy pasting from an RCA report and 2 sentences saying nothing more than "This shouldn't happen" while offering no alternative or deep thought into improvement...

Schlopp. Beautiful schlopp. Beautiful schlopp with a cherry on top.

I run it in a production environment (side project). I also use it locally when developing when necessary.

It really does speed up loops by 5x or so.

So when you're trying to say... test 100 million+ iterations of something, pypy will run that in something like 2 minutes versus cpython can take me 15 minutes.

Honestly it's an amazing performance gain for 0 effort, and I have yet to run into a limitation with it.

That's a bit of my point. At any time your business model can get interrupted when you're doing things "that the big company isn't, but holds the gate to".

Big company might get more aggressive and make your life harder developing. Big company might get less gatekeeper and open up the gates so now you have more competition. Big company might do it themselves and add interoperability and now your product is almost useless.

It's a business model that works to get to some point, and then exit as soon as possible, IMO.

Smart of Beeper to accept an acquisition/exit as soon as possible before their product gets further eroded by non-public APIs they're reliant on. Tough to build a business where at any time your product can get wiped out by Apple/Meta.

There's some logic to hiding the identity... don't know who/who's family to hack/threaten? But, you can just target the 2nd, or 3rd in command it'll be just as effective really.... so I'm not sure what the point is, besides some sort of security theater coolness.

The love for Aldi must be very regional or personal. Because I walk into them and just see knock off snacks such as chips/poptarts, an aisle of rice and pasta, and an aisle of canned food items, and pretty much nothing else in them.

I don't know which users integrity checking the executable would be hostile against. But, I see your point that perhaps their reason for cert pinning is to defend against compromised CAs. It does fit the narrative better with their lack of obfuscation and other layers of defense on their app.

Perhaps I'm a bit harsh... but my suggestion to fortune 500 tech company remains. Implement integrity validation as well, otherwise all it takes is editing 2 bytes to bypass your ssl pinning.

There's no point in implementing cert pinning if you don't also have integrity checking... Being able to alter bytes in the physical file and running it should not be possible (without another bypass).

`int(a/b)` instead of `a//b` (for trunc to zero behavior. especially important when working with c or disassembled code)

Doesn't seem that difficulty to get $50/yr when Xbox Live itself is around that price. Add in selling games... Add in microtransactions... And I'd wager it's close to $200/yr they get from every single Xbox owner.

Haven't heard of htmx before, but I might use it on a future project if I remember.

As somebody who is not a frontend engineer, but still likes to make a website every now and then. I haven't found a full framework (vue, react, etc.) that I've been able to go full into and still use jquery and writing plain css/html.

Htmx looks like a slight feature upgrade to jquery that I enjoy.

Always surprised when some of these sites shut down. The operating cost seems low and putting on a few ads (ethical, non-intrusive, etc.) can net you passive $100+/mo.

A build step is fine. I think the point misses the real issue: that build step changing every 6 months in the web world.

Played it for a few minutes, quite enjoyable, very well done.

I think it could be good for games you have a continuous account in, but sometimes want to play on PC, and sometimes on your phone.

The better games have some account login and online synchronization... but also requires sometimes buying two copies.

[BROUGHT TO YOU BY WINDOWS] Subsystem for X.

I had this happen to me about a year ago when this first rolled out in the US on Pixel Devices. My phone's power button was broken and kept toggling (still is). So, one day after this update, it ended up calling 911 on me and I had to explain no there's no problem, just my phone is garbage and called automatically. Did it a few times after that as well where I would have to scramble to cancel it.

I managed to make it to the menu described to turn off this feature. And gave up on fixing that device.

Really don't know what went on in the product owners minds to release this... There's plenty of people with finicky power buttons, children pressing things, general people pressing things hoping to make something work, accidental button presses, and so on...

I can't believe that. There's still so many personal blogs by real people. They just don't show up in the first 3 pages unless you query for them very specifically.

Seems most queries result in something like 30% SEO spam sites, 30% quora, 30% reddit, 10% other.

Edit: I don't disagree that Discord/Youtube/Other closed gardens have taken open searchable data away, but it's not like there's now no authentic searchable data at all. Perhaps Google also needs to learn to search those closed gardens better.

The gaming of the system is the reason they rescores themselves and do not take a vendors statement as fact. There's a long history of vendors underreporting and underscoring their security issues.

It's a social and economic problem.

The NVD and CVE teams are very low staffed, with people who get a large amount of reports every day. There is no way they can process each report as thoroughly as people want them to while reporting the security issues as fast as possible. I can understand the frustration, but there should be some consideration for these facts.

The social issue continues in that people want some quick and easy to understand number, because they and their company also cannot process in a short time if these security vulns are substantial or not.

Then there's gaming of the system where products with bugs do not want to be exposed as insecure, so they will try to lower the scores assigned to them. Then there's pentesters who want to get high scoring bugs for bounties and clout, and they will try to raise the scores...

All this ends up where the scores mean very little, but it's the best we have. I've seen vulns with a 9+ that are clearly not exploitable, and ones that are 6-7 which are powerful easily exploitable primitives.

Dealing with people running automated scanners that do nothing but spam you about nonsense.

*Has delivered. This is since 2014.

What a strange title to mask the actual first line: " 2022 tax collection dipped from 2021."

I feel like I'm on crazy pills when I complain about these things and all the other intrusions Windows pops up at me every time I use the operating system... Yet, the people who use it (mostly gamers), seem to think it's all fine and the operating system is great.

I'd say exact value versus % can be more meaningful in many non-billion+ companies.

Understanding you saved $1M/yr means you're closer to profitability (I understand in the VC world all you really care about is % growth, but that's up for debate if that's how everything should be) or able to hire more engineers.

I found those definitions to be a weird line. But, I believe the overall premise is you use types for large projects that many people will be interfacing with and making small changes to. You go cowboy when it's some fun scripts.

Layoffs typically go like 7%... then you get another 1-2% of people who jump from the sinking ship. Then you get another round of 5%.. and another 1-2% who jump from the sinking ship and end up at a nice round number like 15%. Looks better than laying off 15% at once (although Zoom is doing great?)

I'm honestly surprised they're not profitable. The cloud tax and cost to acquire new customers is just too high I guess.