jdsalaro

> build higher altitude solution that could leverage git/MD/whatever but with free/opensource/selfhosted/alternative tools

Not that I disagree with this, but that goes almost directly against "Mak[ing] that source public via GitHub or another favorite long-lived, erosion-resistant host. Git’s portable, so copy or move repositories as you go."

Any self-hosted service or solution is going to not be erosion-resistant by virtue of not being for-profit.

The only middle-way sort of solution I found a long time ago, even before joining the company, while looking where to host https://jdsalaro.com was to use GitLab, they being open-source and quite public about their, now our, values.

Nowadays I'm planning on writing again and have tried a setup that seems to be alright:

- migrate from Pelican to Hugo since the community is more vibrant, responsive and the themes much more mature and well maintained.

- Use a mature, well-maintained documentation-oriented template as base (I based https://jdsalaro.com off Pelican's bootstrap3)

- Create an Obsidian vault out of the posts/ directory to improve note-taking and editing capabilities.

- Host same as before on GitLab

- Deploy via CI/CD copying the posts/ directory to a public repository

- Probably mirroring to GitHub

I'll be able to report back once I've gotten the above fleshed-out :)

> They fill a similar role to prosecutors that field drug tests serve to cops[1]: they aren't meant to be accurate, they exist to give the the cops legitimacy as they proceed to do whatever it is they wanted to do to you. In the cops' case, they need legitimacy to search and arrest you, and in the prosecutors' case, they need legitimacy to charge and convict you.

In case any of you are interested, or completely flabbergasted as I was, by the idea that law enforcement's purpose and raison d'etre could ever become as distorted and contorted as this comment mentions, you should definitely read more on Walter "Johnny D." Macmillan [1] or watch the movie based on his story: Just Mercy[2].

Absolutely mind-blowing stuff.

[1] https://en.wikipedia.org/wiki/Just_Mercy

[2] https://en.wikipedia.org/wiki/Walter_McMillian

> This is very painful part of our work

GitLabSec team-member here, ^ this 100%.

Our Trust and Safety team works really hard to keep up with spam. For those interested in how they do so, you can read more here[1]. We are also working on making our spam detection engine more effective at mitigating high-volume spam incidents such as this.

For current, working product improvements to detect and mitigate spam you and others can check out MRs labeled "spam fighting"[2]. We've had quite a few internal conversations about strategies and best-practices. For more information on how to contact our Trust & Safety Team, including tips on how to deal with abuse in your own instance or steps to suggest spam/abuse related features, see our handbook[3]

[1] https://about.gitlab.com/blog/2020/10/29/how-we-work-to-dete...

[2] https://gitlab.com/gitlab-org/gitlab/-/merge_requests?scope=...

[3] https://about.gitlab.com/handbook/engineering/security/secur....

It varies: generating inconvenience(for fun or hate towards a particular service), spreading scam URLs(leveraging existing trust relationships), SEO and improving discoverability of their projects (porn, streaming of pirated content, etc) and many more.

Strictly speaking the former. You could, however, say it's both since submitted issues trigger an e-mail being sent to people following the project.

How can anyone possibly think this is a good idea? This is such a bad decision that it almost disappoints me more than Ubuntu's relentless push of the badly broken and poorly designed Snap ecosystem.

> Capability based security, for example was something that allowed you to run any program, with no danger to your system. It's not part of any common OS. They had it at Xerox PARC, but Steve Jobs chose not to take that part.

For FreeBSD there's Capsicum(1) and for Linux, although the implementation is not strictly capabily-based, there's SE-Linux which depending on the usecase resembles capability-based restrictions.

Also, although not based around capabilities, Linux has supported them for awhile https://linux.die.net/man/7/capabilities

(1) https://www.cl.cam.ac.uk/research/security/capsicum/

I'm sorry but this saddens me to no end, even I did better science during my BSc and MSc; it's not just disheartening, it's frightening. Reading this almost made me feel ill to my stomach. I don't know what else to say at the blatant disregard for scientific ethics and sense of duty.

And we complain that the public at large doesn't trust us "educated" folk, well I can't see why...

> How is the current "notion of IP for software" not sustainable?

https://www.eff.org/deeplinks/2016/06/stupid-patent-month-st...

It's absolutely surreal.

Thanks for the heads-up!

Edit: too late to delete and re-submit D:

> QAnon is just more fun.

As a counter-example, to me being right or approaching truth consistently and in a repeatable manner is much more fun than believing whatever I want to believe.

I know which beliefs I'd like to be true, but self-deception isn't as fun as being right; right as in claims made within an independently validated methodological framework that makes my claims reproducible.

That's isn't inherent, I assume, but learned.

> Teaching will not solve the problem with incentives -

Citation desperately needed!

The, arguably, oldest human system of hierarchical organization called Church would like to have a word with you: a system based purely on psychological and social incentives, nothing else, giving relevance to itself and propagating certain world-views, beliefs and thought-systems.

"Makes broad, meaningless and demeaning generalizations about language and its creators by alluding to their inability to capture the world's complex nature while doing that very same thing by means of rigid categorizations and stark remarks all in the interest of sounding edgy" - Wendell Johnson

Nice, albeit terribly useless, soundbite.

> If things ever got extremely horrible, I used to have a friend that worked at google but she no longer works there. The other person I knew that works at google stopped responding to my tinder messages, so I'm pretty much doomed the next time they do something ultra crazy and I need emergency support.

Doing good for the sake of the web, even while dating, that's some next level dedication. :)

That's a very good point. Actually, I just thought about something in the context of this conversation: one's absolute top priority, both in life and tech, should be to stop the bleeding[1] that emerges from problematic circumstances.

Whether those problematic circumstances, harm, arise due to happenstance, ignorance, negligence, malice, mischievousness, ill intentions or any other possible reason is ancillary to the initial objective and top priority of stopping the bleeding. Intent should be of no interest to first respondents, rather customers or decision makers in our case, when harm has materialized.

Establishing intent might be useful or even crucial for the purposes of attribution, negotiation, legislation, punishment, etc. All those, however, are only of interest, in this context, when the company in question hasn't completely damaged their brand and the public, us, hasn't become unable to trust them.

All this to say, yes, this is a terrible situation to be in, how are we going to solve it?

Do I care if Google is doing harm to the web due to being wilfully ignorant, negligent, ill-intentioned, etc? no, not an iota, I care about solving the problem. Whether they do harm deliberately or for other reasons should be of no interest to me in the interest of stopping the bleeding.

[1] https://isc.sans.edu/diary/Making+Intelligence+Actionable/41...

> Thanks, I totally agree. Just to be clear I'm not saying it's malice as I don't believe that. I'm just saying the end result is the same so one should consider them a hostile actor for purposes of threat modeling.

No worries at all! I interpreted your post the way you intended; and I agree fully being also in InfoSec.

Going by how you phrased your original post, you're probably more patient and/or well-intentioned than me as I'm farther along the path of attributing mistakes by big, powerful corporations to malice right away.

"never attribute to malice that which is adequately explained by stupidity" and all that, but after the events and the almost perfectly orchestrated behavior we've seen in the past and last couple of weeks it's becoming increasingly difficult, at least to me, to not attribute this to malice. Probably deliberate negligence is a better term. They know their systems can make mistakes, of course they do, and yet they build many of their ban-hammers and enforce them as if hat wasn't the case.

This approach to system's engineering is the technological equivalent of the personality trait I most abhor: the tendency to jump quickly to conclusions and not be skeptical of one's own world-view.

[1] https://en.m.wikipedia.org/wiki/Hanlon%27s_razor#cite_note-m...

> I think another take away from this article is “don’t allow users to upload malicious files to your domain”

I disagree, at which point did we all accept Google's role as defacto regulator and arbiter of the Internet? Why should we tacitly accept the constraints they deem as appropriate and modify the way we build the web?

In other words, those are our domains, our apps, our systems and we'll do as we please; that includes worrying about content moderation, or not.

When and why did we accept google as the Internet's babysitter?

Apologies if this sounds aggressive, but your takeaway reflects an appalling and quite fatalistic mindset; one which I sadly believe is increasingly common: big corporations knows best, big corporations say and we do, big corporations lead the way.

On the other hand, probably I'm just biased and tired considering how tiresome it's been to explain to my friends and family why Signal is the better alternative after the WhatsApp/Facebook fiasco.

/EndRant

> I am actively evangelising my family members to start using alternatives.

Which specifically? I've finally succeeded in showing them the light regarding Signal.

The only usable alternatives that come to mind is Gab for Twitter (or Mastodon but that'd be a stretch for most of them). With respect to Facebook and Instagram, I don't see a clear path to a seamless switch as with Whatsapp and Signal.

> Rather than having nothing positive, I think it's having negatives that they can't otherwise control.

Not OP, but this critique revolves mostly around semantics and I don't find it useful or accurate. If, big if, they had something positive to look up to outside of work, they'd be less inclined to put all their energy into work. That'd be the case even with multiple negatives they couldn't control. In other words, it's the total lack of any and all upside outside of work rather than the existence of downsides that makes people feel powerless and depressed.

I agree. I say that a someone who doesn't tend to support popularity contests as a solution to everything. For example, privacy, buying local, supporting SMBs, thinking critically, and many more are hard, in different ways but those albeit important are not easy to do. Many people would say "make privacy easy!", OK we've got Signal, Tails, Tor, etc. "Make supporting SMBs more appealing!", OK we've got Shopify, Stripe Etsy, Gumroad etc. "Make thinking critically easier!!!" ... Wait a second, thinking critically is and will be hard, perhaps not hard but at least not easy.

GNU Social was called StatusNet and Laconica before that, but no, they still chose a deliberately uncool name in one of the most extreme popularity-driven markets. Not that we ought to drop our standards, but why choose such a petty hill to die on?

> I don't belive there's any other kind of unmoderated site.

Moderation of a public space after consensus has been reached long it's members is fine, moderation before dissenting opinions have had their opportunity to be voiced, discussed and their merits disproved through consensus is not. The former is democratic, the latter dystopian.

> There are plenty of bad arguments one could make on this very site which would get your post hidden or removed or even your account banned

Popularity doesn't imply correctness or legitimacy.

Your Twitter and Github links in your footer are going to https://pipecontent.com/#

> It's hard to learn math, history, science, and literature running around playing

Citation, desperately, needed.

The anecdotal evidence available to me from my experiences and my social circle strongly contradicts that.

Not OP, but I assume they mean your lambda-specific components and configurations such as IAM roles, accounts, the function itself and it's parameters are considerably long-lived in comparison to the actual code executed on top. You wouldn't be modifying your lambda-specific setup everyday. That, however, doesn't apply to the actual code, which might be modified several times a week or a day to incorporate MRs coming from different people.

This might be uncalled for, but from your comment it seems like you could really use some input.

IMHO it isn't qualifications you're lacking, but a method for "working smart" and proving you can adapt to the industry on top of being able to work hard; as you've surely noticed, the latter is seldom enough. You "don't get this market" probably because you haven't understood what the companies you're applying to are looking for, and you haven't understood what they're looking for likely because you need to recalibrate your understanding of value delivery and expectations in the industry as opposed to academia.

You can contact me (info in bio) in case you want me to look at your CV, want to do a mock job interview or want other sort of feedback.

In any case, stay strong! Also, https://www.reddit.com/r/cscareerquestions and https://www.reddit.com/r/cscareerquestionsEU might come in handy.

> Not to mention that this whole discussion brings us back to the question: Who's fault is it that people die? The arms researchers or manufacturers? The army? The people who are mean to us and own resources we want (I mean they could just surrender)?

Everyone's at fault, according of course to the degree to which they themselves are able to shape the object, in this case mostly culture and incentives, responsible for the decline.

> Are the people building Facebook responsible for the social decline? Or is it the government, not applying proper regulation/laws? Or is it the people using Facebook (nobody is forcing you)? Or are humans just like this and Facebook shows us their true color?

I repeat, everyone's responsible.

https://en.m.wikipedia.org/wiki/Diffusion_of_responsibility

What, specifically, are you lacking wrt text to speech?