int0x2e

Why hasn't anyone made that crypto currency yet?

We also used to write code in low-level languages, and system designs were simpler compared to our current approach of writing a lot of stuff in JS and using Electron everywhere, having a huge dependency tree and in general - optimizing for fast development rather than efficient runtime.

Having said that, optimizing for perf is rarely worth it because people don't usually care, and when it is - you can often make the biggest difference by figuring out why some step requires O(n^3) instead of O(n) like it should and fixing that, rather than rewriting the entire stack to get some 10-20% improvement...

Having worked in a Solaris shop for a while, I still wonder what could have been if Solaris made the decision to open-source about 5-10 years earlier than they did. I think Solaris would have been such a better base for the Linux ecosystem than Linux ever was. Though the licensing issues had to have been resolved for this to work out, and knowing Sun/Oracle - that would never have really worked out...

That's insightful, but I still think the assumption that the CISO has to go when the company gets compromised is a bit issue. Instead of security being a team effort, with the goal being making the hard choices together, finding the correct compromises to let the business thrive while being secure - it usually makes the CISO take an adversarial position to anything in their company - since it's always their head if something bad happens....

Amazing CISOs lead security by enabling others to make secure choices that still let them move quickly and deliver value. To do that - they shouldn't always be one hack away from losing their job.

This is a very common case, sadly. But this is due to people failing to use MVPs correctly. Instead of being a tool for the sole purpose of rapid learning and iteration, it is used to falsely accelerate delivery. When done well, you build a series of prototypes/MVPs with the sole purpose of learning faster what customers really need. You should then put all your effort into building that really, really, well, and kill off anything that didn't work out. Ideally, you should always have new, minimalist code for new features you are exploring, and lots of old, extremely well designed, implemented and well-tested code for all the areas you already know are critical for your users - and nothing in between (no "nice to have" features, no failed experiments that linger on and contribute to your tech debt...)

This takes a ton of discipline, but in my experience the only alternatives are to either build up a ton of tech debt, or build things extremely well from day 1, only to end up dying due to low velocity (even if you get some critical decisions spot on in the beginning, no PM or engineering team that I've ever seen has been able to make only good decisions over several years...).

As the old quote goes - "if you are typing "AES" into your code at any point, and you are not a world-renowned crypto expert - you will get this wrong, guaranteed". There are so few cases of people who are not seasoned crypto engineers getting everything 100% correct that it's basically a myth, and in crypto, getting things "almost right" is the same as getting them wrong...

I too loved playing with crypto - read a ton of books, attended some crypto classes in University, implemented some crypto systems which I thought were secure, etc. - but nowadays I wouldn't dare use anything that isn't considered secure by a large audience unless I had extremely good reason to do so.

I strongly urge people to try something like Application Insights. It's not dirt cheap, but not that expensive, and lets you collect anything you'd want and query your telemetry/logs retroactively extremely flexibly. It's just great.

You're totally right, but we both know someone is going to build this into some tool tomorrow, and it will mostly work. I think we might actually need legislators to step in to say that any use of ML would require review prior to use in life-critical applications...

I think this is a neat idea in theory, but for any long term value to be gained, a military power would need to practice generating at least medium-scale sorties many times to know if this strategy was really viable, and specifically, since this strategy is so reliant on scale and weather - you would need to also test launching at some scale at your actual target (even with dummy payloads) prior to the real attack (i.e.: what if once you get to a wave that's 10k/100k strong, they start to mess with your weather projections?)

Basically, I think this is a strategy that's effective at scaring the US citizenry, but it is such a bad idea in practice no good adversary would choose this instead of the usual nuclear deterrent.

Specifically, this could be amazing to map out non-public comms, radar and AA systems. This could provide the sort of information you'd want for a future military conflict. I hope I'm completely wrong about this.

One story that stuck with me - at FB (at least in the past), there was no travel budget, and no list of sanctioned hotel chains. Any employee could travel as often and as expensively as needed with only their immediate manager's sign-off (unless their job requires weekly travel, in which case - no need for any approval). The only control they put in place was that every week, the top 10 bills would be reviewed by Mark, and you didn't want to be on that list if you didn't have a good business reason. Trust encourages people to do the right thing, and people flock to positions where they are trusted with the tools for the success of their mission...

Time to share one of my favorite talks (and speakers) ever -

"Debugging Under Fire: Keep your Head when Systems have Lost their Mind" (Bryan Cantrill, GOTO 2017)

https://www.youtube.com/watch?v=30jNsCVLpAE

Extremely well put. Any time a business decides on a metric / decision criteria, they introduce a strong incentive for their employees and managers to act accordingly. For some reason, leaders rarely seem to think hard enough about the possible outcomes.

My anecdote - at a former big tech company, we had a long hiring freeze, and they even decided that when someone leaves or gets fired, their headcount goes back up to senior leadership who decide where that headcount should be (so as a manager, if you fire someone - you might lose the position entirely).

So, naturally, even since then there have been zero people fired, even if they are low performers, since managers want to keep their headcount. But talented people obviously still get offers and leave, and when they leave, their headcount disappears.

So after a year or so of this great policy, the average level of talent across the company is steadily dropping, which also means it'll be much harder to recruit top talent even after this policy is over - because most talented people want to join a team where they can still learn and evolve, collaborate with other smart folks, etc.

I get your point, and I do think it's great for many people that we don't lose this outright, but I will offer an alternative view - Where I live, there always were a lot of people who don't report their income fully, which means they mostly transact in cash. We have fairly high and progressive taxes, which means that by transacting in cash, some medium to high earners can lower their tax payments significantly. After trying basically everything over many decades, the clear plan by to government is to make cash transactions obsolete as soon as possible. They've been slowly reducing the maximum legal cash transaction size for a while now, but the goal is clearly to get rid of cash.

While I worry about people without access to banking (mostly people without documentation, but also the poor), I think they're on a course to resolve that too, and I for one would be very happy to not have to pay that much in taxes while seeing others cheat the system and reap the benefits...

It's interesting, because I took a pay cut to join this startup. I had grown tired of not being challenged and not learning as much anymore, and I definitely got tired of the corporate politics and endless bureaucracy. Don't get me wrong - I did cool stuff, and I did have impact, but nearly as much as I thought I could.

At the startup, I was really impressed by the caliber of folks I met, and over the past 2 months I've been here, I've only grown more happy with my decision. It's so thrilling to see what a team of A players can get done when you set clear goals... I think it's worth the pay cut (to me at least), and I am very hopeful for a further exit to make me more than happy financially as well...

I love your thinking, but sadly most large corporates seem to suffer from very slow and very bad deciding making processes.

Some examples from the tech giant I called home for 5+ years until I recently quit: 1. When the pandemic hit, mangement froze all hiring and emphatically urged us to optimize costs so we wouldn't have to lose anyone. 2. When the pandemic concerned turned into the hype of 2021, we tried to hire at a crazy rate, often competing with insane offers. 3. When the war started, we again went into a hiring freeze, and now a round of layoffs.

In my experience - our management basically did what everyone else did, which meant we couldn't leverage any of our unique advantages and beat the market in some way.

The reason I joined the company I did after the megacorp is that they had a very simple strategy for hiring - hire top talent in strategic areas when you can find it, but ignore anything else, don't lower the quality bars, don't make insane offers, etc. It's almost as if having common sense is such a rare thing now, that it's become a winning strategy...

Microsoft is surprisingly hard to kill. They do a little of everything, and internally act much less like one company and more like a conglomerate. This means there is more politics than needed, but also that the company can survive some pretty massive changes. Microsoft isn't perfect, but it can probably survive even if they lost their top 3 revenue generators, which I'm not sure would be true for Google or Amazon...

I'm far from a Tesla fan myself, but one thing I found really cool are claims by friends who worked with Tesla is that they have a huge lead on mainstream car makers thanks to the fact they design and make a huge part of the cars and "stack" in-house. Rather than 80% of the car (and code) being built by 1st tier makers, packaged by 2nd tier and integrated by your 3rd tier provider, leading to very very slow iteration cycles. One friend even claimed they do continuous delivery on many parts of the hardware on a daily basis (meaning revisions are a frequent thing across the entire stack). I am not sure how much of this is true though.

I love tinkering with hardware, but I always make a mental note to myself and say that building it will often cost 2-3 times what I thought it would, and that I'm actually paying for learning and having fun along the way, not the final product (I often end up using many of my projects only a handful of times, but still enjoy making them).

I suspect there's a hidden trap here due to survivorship bias - those of us who were lucky enough to see hugely successful products/services that got some of these decisions spot-on in the beginning, see how wonderful it can be when you are able to make these investments early on and build things once. The risk is that you fail to count the number of teams that did the same sort of analysis process and still made the wrong decision because they ended up pivoting, or just straight-up made the wrong call...

Replacing a managed solution in a small-scale product really isn't required, because it likely doesn't cost you enough. Replacing it in a high-scale product does matter, but that also mean you should be making enough money to make the replacement pay for itself. If you make the decision to use the managed solution and it's wrong, that's something you can usually fix. If you go DIY when you should have paid for it - you rarely get to correct it in time, and it might just be another nail in your coffin due to lower velocity, focus, etc...

At a past company, we (incorrectly) assumed we'd always have to support an on-prem deployment capability, so we decided to build our own virtual appliance (assuming we'll do actual hardware one day). That appliance cluster had to do a bunch of heavy lifting to provide a bunch of services, and we had to do it all ourselves. We even had a Cassandra-like DB cluster, which we stupidly tried to do using Scylla-DB (Scylla is amazing now, but it was just getting started at the time, and while it was super fast even then, it was not stable or reliable enough at the time). To add insult to injury, we only did a single on-prem deployment ever, and that customer never actually converted to a paying one...

If I could do it all again, I would have gone cloud-native (or at least leveraged K8s), and I'd use as many managed cloud services as humanly possible. At a later gig - we did just that, and we very very rarely had even 1% of the infra struggles we had with the solution I described above.

Nowadays, my basic advice is to always buy the best possible service when you start out, and only start to think about replacing it with DIY services when you have enough scale to pay talented engineers a salary to build AND support replacing it - and even then, the potential loss of focus and velocity might still make this a bad idea. There's a reason Netflix is still on AWS.

A former boss used to use the term OFE - Opportunity For Excellence :-)

Hosting something yourself does not make it magically more secure. Even if you hire a small team of really smart people, they'd have to work pretty hard to do as good of a job as the many 100s working on security at GitHub...

When your product basically is security, that's not really a compromise you get to make...

Most people are constantly dehydrated. The fact lots of people drink sugary drinks makes it even worse. As someone dealing with a 3rd round of kidney stones - please stay hydrated! You don't want this pain, trust me...

Please, please, please stay hidrated! As a person on their 3rd round of kidney stones - please drink more water!

There's a major difference between the data-plane (the lanes where frames go from the signal source to the display) and the control-plane (the command and control channel that is bidirectional and used to discover a peer and negotiate settings).

The former is indeed very high speed, in the order of gigabits per second (up to 48gbps in later iterations), whereas the latter can seem ancient in comparison - 500bps to 115.2kbps - several orders of magnitude slower. The reason is that while the high data rate bus is handled by powerful, dedicated hardware (GPUs and ASICs/FPGAs), the control plane is usually done by micro-controllers (or otherwise lower-power devices) that are responsible for general management of the display. Sure, it would be nice if they had more powerful hardware and a faster bus, but those changes usually aren't what people are shopping for and so the standards committees aren't pushing makers to make these changes...

This is almost accurate. You can slightly increase your chances if you say "I will defect, but will take care of your family and give you half my income forever. If you also defect, we will both go to prison and you will be worse off", then don't actually defect - which means you both cooperate! It won't always work, but it did work flawlessly in a show called "Split or Steal", which basically made the prisoner's dilemma a TV show: https://www.youtube.com/watch?v=S0qjK3TWZE8

It seems like there are plenty of people essentially thinking something along the lines of: "I know this is a useless asset that only an idiot would think has real value, but I will get in and unload it on a bigger idiot before the crash...".

The issue with investing using the "bigger idiot hypothesis, is that sometimes, you are the biggest idiot and are left holding the bag of sh$#.

Sadly, it seems that often the biggest idiots somehow end up in governments and financial institutions.

I am very far from being a billionaire, but as soon as I made it to upper-middle-class, I realized that the hedonistic treadmill would never end, even if I was a billionaire. It's a never ending fantasy world where everyone looks up and wants to be as rich as the next tier, even though that's rarely possible, and just like the scene in WarGames, "the only winning move is not to play".