finaliteration

> if the org-admins have approved the OAuth application and are able to send mail from within the organisation - then it's probably game over anyway

In my case the email came through due to a “bad” DMARC configuration so they were able to spoof our domain from an external server and the OAuth app in question had our company’s name on it.

And on a personal front, I was busy that morning and didn’t pay enough attention to the permissions being requested by the app before I clicked “allow”. So it was a failure of both systems and people controls.

My new rule is that if I get an email asking me to do any sort of action, automated or not, I’m going to sit on it for 1-24 hours before doing anything about it. If it’s actually urgent then someone will get ahold of me through some other method than email.

Agreed. However some service providers (like GitHub) allow a user with admin access to approve any OAuth app the first time it’s “launched” if they are the ones initiating the request, rather than using a pre-defined allowlist approach which I believe is what Office 365 does.

My wish would be for some sort of multi-person approval process rather than allowing anyone who is an admin to authorize an app. Even admins can be susceptible to a targeted and advanced attack.

Also, many people (like myself before my own “failure”) simply aren’t aware of OAuth apps as a serious attack vector. Most remedial training around phishing campaigns covers things like fake login pages but not “An attacker has spoofed an internal domain and an OAuth app with your company’s name in it”.

I was the target of one of these during a recent internal pen test and got caught in it, despite being very technically savvy and aware of “normal” phishing techniques.

The attack that was simulated in my case utilized convincing social engineering, spear phishing, domain spoofing, and malicious OAuth apps meant to look like an internal resource/service to gain access to sensitive material.

It was very sophisticated and I’m glad I fell for it during a simulation rather than in a “real life” situation. It was a learning experience and a situation I’m way more paranoid about now. I could easily see admins and developers anywhere falling for it if they were specifically targeted.

> more likely to be carrying it anyway due to misbehavior

I’m not sure about that. I’ve been pretty strict about physical distancing, mask wearing, and all of the other things necessary to help combat the spread of the virus. I’m also someone who gets a flu shot every year and I make sure my child is vaccinated.

That being said - I am majorly skeptical about a vaccine being rushed through the approval process for political reasons and how safe it will be for me and my family. I may refuse it if it seems like it will do more harm than good and/or the process isn’t transparent and the safety data aren’t made available.

> Maybe just have sex instead?

Having grown up with two addict parents I can tell you that “Just try doing something else” isn’t typically a useful strategy.

> His retirement had not brought the contentment it had promised, and no number of visits from his children could dispel his loneliness. He had little in the way of a social circle

This is actually a concern of mine regarding retirement and part of the reason I tell people that I will likely never retire. A large number of my social interactions are through work, and I feel if I didn’t have something “productive” to do I would be pretty listless and depressed.

I get wanting to enjoy leisure time and hobbies, etc, but there is something rewarding about doing work that you enjoy that is different for me.

Too true. Intellectual bullying can be insidious and is often overlooked because it doesn’t come with physical scars and bruises. Some of the worst bosses and coworkers I’ve encountered were those whose mentally abusive and toxic behavior was enabled or ignored simply because they were “intelligent” or technically indispensable.

Can you elaborate a bit more on what bothers you about Go? “It’s not Python” could encompass a lot of things.

Personally, I use both languages (as well as Java and C#) and find they do really well for different tasks. If I need a binary command-line tool that I can ship off fairly easily I turn to Go. If I need to quickly parse some text files, bang out a quick HTTP client script, or automate some AWS tasks, I’ll go with Python.

This is my concern, as well. We have some people at my place of work saying, “Working from home has been great! I’ve never been more effective and happy at my job.”, and then we have a smaller but more vocal group that says, “I hate working from home and it’s incredibly stressful. I want to go back ASAP.” I worry that the second group will “win” and the pendulum will swing the other way because of the latter group’s experience.

What we should really be aiming for is flexibility. Some people can be in the office, some can stay remote.

Personally, I dislike being in an office every day, but even more than that I hate the commute. If my manager forces me back, I’ll probably quit and look for a job/company that plans to allow remote work permanently. I’m trying to remain hopeful, however.

Portland State is actually on a quarter system, so you'd need to multiple those values by 3 or 4 (depending on if you include the Summer quarter or not).

Source: I'm a Portland State alumnus.

While I think this project and the data are interesting, one thing that becomes problematic is that you actually DO have to invest time in whatever courses you register for at most colleges and universities (or at least the ones that I've seen).

Generally, if you aren't making adequate progress in a course, you can be dropped by the instructor mid-semester/quarter or placed on academic probation, both of which can cause you to fall below the minimum number of credits needed to be eligible for healthcare coverage.

So while you may save some money on health insurance, you lose a potentially large amount of time due to having to keep up with coursework to maintain eligibility.

That being said, this may not be a problem if they are courses you are actually interested in and can dedicate time to completing.

I love asking for help in channels because I feel like it socializes the answer and process for finding it much better than a DM does. It also helps build trust within the team because someone can see a “stupid” question get asked and then answered and then also feel comfortable asking questions like that.

That being said, I have worked for some shitty bosses who have told me not to post questions and information in channels directly because they want them “vetted” first. I’ll never work for someone like that ever again.

As a parent myself who is guilty of this from time to time, I think it’s easy to judge those moments without seeing the full picture. Nowadays parents are expected to attend to kids basically 24/7 and keep them engaged, etc,. Just because you saw that happen at breakfast doesn’t mean it was happening all day, every day. Maybe they were out visiting museums or nature parks for the rest of the day.

There are mornings when you just want a quiet breakfast while you’re on vacation without an embarrassing meltdown happening and, for better or worse, the most effective way to accomplish that is by giving your kid a movie or show to watch on the iPad for 30 minutes while you eat.

Not sure if this is true in all states, but in mine getting fired for cause disqualifies you from receiving unemployment. You have to be laid off/terminated by no fault of your own.

My wife’s business had to shut down due to COVID-19 in early April. We filed for unemployment through PUA at that time and have yet to hear ANYTHING other than “your claim was accepted and we are processing it”. On top of that, the phone lines are totally backed up.

We’re extremely fortunate because my income covers our monthly expenses, but it was a huge financial blow for us and we are conserving cash like crazy. I can’t even imagine someone who lost all their family income going through the same thing.

So, yes, there absolutely is need to worry.

In a some tangential way this makes me think of Derek Parfit’s “repugnant conclusion”:

https://plato.stanford.edu/entries/repugnant-conclusion/

A couple of examples:

- I bought an Apple Watch through them that was the cellular version. There was some activation error with the carrier when we tried to set it up, and rather than the employee I was working with shrugging it off and saying, “Sorry, you have to call the carrier”, they handled it all for me and got it fixed before I left the store.

- I bought a Logitech mouse. It was having issues with the cursor stuttering. I went to return it, they went though the process in store of updating the firmware to make sure it was a hardware issue, and then they gave me a full refund and recommended another mouse (which I still have and love).

I've commented here a few times that Best Buy really has turned itself around and now offers a great shopping experience. I have a location nearby and every time I go in to buy something the employees are super helpful and knowledgeable. They also have a decent selection and can usually have a pickup item ready in less than an hour. Additionally, they will price match with Amazon on most things.

I'll choose them over Amazon any time if they have the item that I need (which they typically do).

I also have some eczema/dry skin problems and one thing that I've found helps is not showering every single day. I used to shower once (or sometimes twice) a day, and it made the skin on my elbows and knees extremely tight, dry, and itchy. I now shower every other day (I still use deodorant and change my clothes) and haven't had nearly as many issues. That being said, I am fortunate because I don't have a lot of body odor and I don't sweat very much, so I can reasonably get away with not having a daily shower.

I'm in the same boat as you. I don't totally get the push to retire early. In fact, I don't think I'll ever retire if I can continue working and doing something that I enjoy. I have colleagues who dream of spending their days on a golf course or doing projects around the house. That sounds like a horribly boring life, to me. I'd love to be able to keep working at and solving technical problems until I die. That, and I think my spouse and I would hate each other if we had to spend every moment together. We love each other dearly but also appreciate our time away from each other.

The challenge is that even having a strategy fails when you’re in a vulnerable place and someone comes along and says and does all of the “right” things.

Many people are deeply lonely and will do and believe anything someone says if that someone is offering love and affection.

My bank does allow setting a per transaction limit, but nothing on a daily or weekly basis from what I can see. I agree it would be a great feature for controlling spending, or for setting reasonable limits for kids and teens.

My bank has a feature where I can get an email for every transaction at or over a certain amount. I set it to $0.01 awhile back so that I could see transactions come in without having to constantly log in to my account online.

As a parent myself this story makes me really glad I did.

I'm not entirely sure what you're saying, here. Are you saying that, if someone is acting like an asshole, those around them should just accept it? What if everyone they work with judges their behavior to be that of an asshole? Does that make others wrong and the asshole right?

Having worked with (and for) a few assholes in my day, I can say that most of the time they aren't as smart, helpful, or clever as they believe themselves to be. Most of the time they add friction to a work environment and make other people around them miserable, and eventually those other people quit.

> I'd rather be with Grumpy people who are factual, realistic and capable

It's possible to be positive and also be factual, realistic, and capable. Being positive doesn't mean ignoring reality and glossing over everything negative. I'm a fairly positive person, but I definitely still have conversations where I say, "Yeah, this totally sucks, I'm not happy with it, and I think it needs to be fixed".

Approaching things in a positive, friendly, and collaborative manner has always served me and my teams far better than being grumpy and pessimistic about everything.

> Portland has had nightly riots for over a month.

I live near Portland and have many friends and coworkers who live in the city and this isn’t true. There have been mostly peaceful protests, yes, but not nightly riots.

I’m also not clear on how that would make this acceptable or justified even if it were true.

I’m a full time software engineer and it depends for me. Some weeks I’ll work 30-35 and others I’ll work 45-50, depending upon what projects are in flight and at what stage we are at in the project. I don’t mind the weeks where I’m working a little longer as my job is well-paid and flexible where I’m able to “leave” (I work from home) early for the day fairly often when I feel I’m at a good stopping point.

As someone with a mild form of ADHD and a kid who likes to chat my ear off, I can’t count the number of times I’ve placed something in a cart on my phone, went to check out, and then got distracted or pulled into something else, only to return because I got the “abandonment” email that reminded me of what I was doing.

I’ve been using a Wacom Intuos S combined with Microsoft Whiteboard. The Intuos wasn’t outrageously expensive and has been working really well for my needs (mostly just process and class diagrams during online architecture discussions).

That’s a fair question. I do think some people may buy and take the test if they’ve been in an area where the potential for exposure is high and they worry they are an asymptomatic or presymptomatic carrier.