HNHacker News
TopNewBestAskShowJobs

kkirsche

576 karma · joined November 3, 2014

Hey!

My name is Kevin, and I am a cybersecurity developer and penetration tester for an ISP, developing tools such as DDoS Mitigation solutions, security evaluation tooling, vulnerability management tools, and much more. I enjoy building complex projects comprised of front end, back end, and various integrations, as it pushes me to stretch my design, programming, and architecture skills.

The thoughts and opinions I express on Hacker News are my own, and I look forward to having great discussions with the community.

submissionscomments
kkirsche··on Tell HN: Gitlab Premium pricing increases incoming $19 to $29
The pricing of Gitlab already got pretty insane on the upper tiers for a large business. I regret ever advocating for them with how expensive they are becoming.
kkirsche··on I Will Fucking Dropkick You If You Use That Spreadsheet
I wish this didn’t resonate as strongly as it does. Thanks for sharing this
kkirsche··on Ask HN: Best practices for self-healing apps?
I think it’s important to review well established frameworks for fault tolerance. Things like Erlang’s OTP come to mind which demonstrates concepts like supervision trees.

I don’t have a great resource of these frameworks or patterns but my approach has been to learn from the characteristics of historically successful systems that I want similar capabilities to (if I can’t use the framework directly)

kkirsche··on Serving Files in Python: How FastAPI Failed Us
You’re correct, sort of. But you’re not testing JUST FastAPI’s performance, you’re also testing Uvicorn’s. For them to be equivalent tests, both need the same run patterns. It’s closer to comparing Flask running as a script with flask running behind gunicorn as written and as I read it.

And no, I’m not going to fix your benchmarks for you. This does not provide any value to me but does come at a time cost.

I appreciate you raising the issue and performing research on it, that’s valuable and I applaud you for that. I simply don’t believe that this is a valid benchmark from a technical soundness perspective.

kkirsche··on Serving Files in Python: How FastAPI Failed Us
These don’t seem to be equivalent comparisons when you start using different ways of running the applications and whatnot. On one hand this compares uvicorn running an ASGI FastAPI app and another tests a raw script running a server it seems. I need to do some research on aiohttp’s server to speak definitively but as written, I don’t trust these results.
kkirsche··on Git archive checksums may change
This. You have to draw the line somewhere. Was this specific choice that line? Maybe not, but sometimes users aren’t right and changes just need to occur to ensure other asks from the same users can be delivered.
kkirsche··on Ask HN: What are some excellent pieces of software written by a single person?
You had me until the anecdote. I understand the sentiment and intent of what’s being said, but as a security professional it just paints themselves, their applications, and their user base as targets. Knowing it’s a won’t fix means it’s also easier to sell exploits if not disclosing as it’s clear he doesn’t intend to upgrade to a maintained and supported version of Python, so it should work for longer than most exploits.
kkirsche··on Apple says iPhones will switch to USB-C chargers to comply with new EU law
I have to wonder, when will a company just say, No. Your citizens like our products more than they trust you, we can force their hand by immediately pulling products specifically to spite them while being “compliant”
kkirsche··on Python 3.11.0 Released
I believe you may be thinking about a different language? Python only releases a feature release yearly. Features which don’t make it into a release like 3.9, 3.10, and 3.11 are usually agreed upon before the feature freeze window to avoid specifically this.
kkirsche··on Ask HN: What programming language do you think is the best for Web Applications?
It depends on a lot of factors. Building a highly concurrent application such as chat? You may find node or elixir to be good fits. Building a reports service with lots of data crunching? Maybe checkout Python for it’s data libraries like Pandas / numpy. The choice of language stems from the domain you’re solving and what your team knows. Finding a happy middle ground is best, but sometimes you need to prefer either what the team already knows for the sake of time to market and other times you need to prioritize the problem space if the team’s knowledge has a limitation that will prevent it from being a maintainable solution.
kkirsche··on Castopod – Open-source podcast hosting platform
This may cause some issue with Castro Podcasts app on iOS which may feel the name is too similar. I know I was confused and was wondering why they would have open-sourced this.

Great work though, don’t mean to detract from any of the hard work on the platform, and naming things is hard.

kkirsche··on Metaprogramming in Python
Thanks for sharing! Instead of using meta classes for subclass registration though, please just use __subclass_init__ instead. It’ll often be simpler unless you have a complex use case.

https://docs.python.org/3/reference/datamodel.html#object.__...

kkirsche··on Adobe to acquire Figma for $20B
That’s too bad. Good for the individuals and groups benefiting from it, I am happy for you, but I expect Adobe will ruin this product for users. Especially since this is an anti-competitive acquisition.
kkirsche··on What makes a senior engineer? Writing software vs. building systems
Or, you built a poorly architected piece of software that replicates your organizational structure.
kkirsche··on New AirPods Pro Do Not Support Lossless Apple Music
I’d much rather them focus on LE Audio over lossless. The battery impact will be more valuable to most consumers than the quality difference, I expect.
kkirsche··on Ask HN: What subscription services are worth paying for IT professional
I wouldn’t say any are worth it inherently. There are a lot of good subscription services but what matters most is your tech stack, habits and needs.

For example, I haven’t found the per-language focused IDE approach of JetBrains to fit well with the multi-language architectures I commonly work on, and while I’ll watch Pluralsight courses I find I don’t read as much O’Reilly content even though it’s often something I get more out of.

End of the day, identify what you want to take away from things and focus on optimizing for your own mannerisms.

kkirsche··on Apple overtakes Android to pass 50% share of smartphones used in US
For me, I think that’s actually part of why I stay away from Android. I tinker and whatnot with my open systems and it often leads to various forms of slight incompatibilities or instability. I rely on my phone to work consistently, and for me that’s meant staying with a more closed off ecosystem to protect me from myself.
kkirsche··on Fuzzing Go APIs for SQL Injection
The problem I run into at work is developers learn ORMs in many situations before they learn SQL itself. As a result, many are used to ORMs which can do this for them via parameterization or they simply were never exposed to them. Whether it’s good or bad, right or wrong, we’ve found that ensuring certain concepts are shared across all developers via a team onboarding training trumps the inconvenience when they already know these.
kkirsche··on Auto giants like BMW, GM and Toyota make drivers ‘subscribe’ for basic features
This bothers me because those raw materials and byproducts of manufacturing still get either used or produced. So this seems like a net negative for the planet when there have been pushes to reform the impact this industry in particular has on the environment.
kkirsche··on Ask HN: Anyone using Swift on the server-side?
I don’t work for them but Omnigroup does for Omnifocus for web, last I had read in their blog posts while they were developing it.

https://www.omnigroup.com/blog/under-the-hood-with-omnifocus...

kkirsche··on Former judges who sent kids to jail for kickbacks must pay more than 200M
He didn’t ask if it was legal. He asked what was worse
kkirsche··on Former judges who sent kids to jail for kickbacks must pay more than 200M
Of course, life in prison in solitude confinement. And if you went to other parts of the world, well, best not say what can happen
kkirsche··on Python F-Strings Number Formatting Cheat Sheet
The issue tracker though includes https://fstring.help if it helps :)
kkirsche··on Ask HN: How to say no to a GitHub issue feature request?
As someone who makes lots of merge requests, please don’t add the further statement. In my experience while it’s well intentioned, it (understandably) frustrates contributors because it’s making an assumption that they aren’t valuing your time, which you don’t know.

Just my 2¢, at the end of the day do what feels best for you, but you may drive away some contributors.

kkirsche··on What's New in Python 3.11?
Ini files aren’t a standard though, so every language can handle them differently. As a result they often bite people using them in multiple languages in the foot
kkirsche··on Ask HN: What are some mentally healthy apps to have?
Calm / Headspace or other meditation apps with settings tweaked to turn off things like streaks and only show notifications for your goals.
kkirsche··on PEP-690: Lazy Imports
Corrected link is https://peps.python.org/pep-0690/

Looks like this had a .html added to it accidentally

kkirsche··on The balance has shifted away from SPAs
Define what quick means to you. They can be extremely good at responsiveness and background updates once the bundle has been loaded
kkirsche··on Impacket – collection of Python classes for working with network protocols
Not OP, but if you work for a big company the goal of penetration testing runs counter to the goals of the other departments. The more bugs you find, the more that means someone else looks “bad”, so it can become hard to move up in seniority if you don’t have a good leader above you to properly align the interests of both parties so it’s collaborative rather than antagonistic
kkirsche··on A full Python interpreter written in Rust
Interesting, I had heard of PyOxidizer to produce binaries but hadn’t heard of an interpreter. Always interesting to see how different implementations approach a problem space. Thanks for sharing!
← PreviousPage 2 of 10Next →