lpapez

Slowly but surely turning into 4chan /pol/, now with country flags too!

Less headcount usually means faster pace - less lines of comminication, less red tape etc.

Or at least that's what many C-level people believe to be true. "We need to move like a startup" is a common mantra repeated by executives, even megacorps like Amazon.

I guess it's true to some degree though, anecdotally as an IC at a tech company, I feel like I could move a lot faster if some people around me removed and replaced by an automation instead.

Don't share your code publicly then?

> I think politically, everyone would want airlines to have working IT-systems and they would probably want to pay $100 (rationally, closer to $1000) amortized over 50 years to pay for that, but apparently humanity is just too stupid to make it work.

Not stupid, just corrupt :)

If we did this, the money would get misappropriated or stolen - most likely completely legally through overpaid consulting fees.

So clearly we should pay someone to prevent that from happening.

Wait a minute...

> Are there really people out there who still reach for Meta-scale by default? Who start with microservices?

Anecdotally, the last three greenfield projects I was a part of, the Architects (distinct people in every case) began the project along the lines of "let us define the microservices to handle our domains".

Every one of those projects failed, in my opinion not primarily owing to bad technical decisions - but they surely didn't help either by making things harder to pivot, extend and change.

Clean Code ruined a generation of engineers IMO.

This article goes completely against my experience so far.

I teach at an internship program and the main problem with interns since 2023 has been their over reliance on AI tools. I feel like I have to teach them to stop using AI for everything and think through the problem so that they don't get stuck.

Meanwhile many of the seniors around me are stuck in their ways, refusing to adopt interactive debuggers to replace their printf() debug habits, let alone AI tooling...

IMO the author of the article should lawyer up.

They should not have done any of this in the first place, let alone disclose it publicly in this manner.

I too did similar things when I was younger, riding high on that feeling of power, and learned the hard way that even attempting to hack something can be considered computer fraud in EU.

I was lucky to not suffer any consequences in the long run.

You can brag all you want about being an "ethical hacker", the law is probablycnot on your side - especially if you publish incriminating evidence in the form of an immature post like this.

What is the overall severity distribution, including human code?

Based on the churn I have fixing security vulnerabilities reported by Snyk and Trivy, I have a feeling that issues have a tendency to be labeled mostly as HIGH or CRITICAL when they are assigned a CVE, for better or worse.

This same argument you laid out here also works if you replace "Chinese" with "US".

For much of the globe, the US is the bad guy/bully, and not the "world policeman" - epecially in countries they bombed (like my country).

With recent US administration changes, this attitude is also becoming more prominent in countries which used to consider the US to be an ally!

Why not test the OLAP reports?

Surely there is a way to run a raw query in Rails/ActiveRecord and use it in a smoke test?

You can have parts of the web app rendered on the client, and still keep the rest of the app the same. Rewrite the diffs and previews, keep the rest as-is.

There is no excuse for possibly the most used feature of Github to suck so badly.

Being concerned about page sizes is 100% wasted effort.

Calculate how much electricity you personally consume in total browsing the Internet for a year. Multiply that by 10 to be safe.

Then compare that number to how much energy it takes to produce a single hamburger.

Do the calculation yourself if you do not believe me.

On average, we developers can make a bigger difference by choosing to eat salad one day instead of optimizing our websites for a week.

At my first job, the senior guy on my team used to say:

"Software is just like lasagna. It has many layers, and it tastes best after you let it sit for a while".

I still follow this principle years down the line and avoid introducing shiny new things on my projects.

Using such tricks might seem like a cute way for malware to make analysis difficult, but often times calling these obscure system APIs can be detected statically, and you bet that it will flagged as suspicious by AV software. If the malware binary is not obfuscated to hide such calls, I'd even call them "counterproductive" for the malware authors!

The legit programs interested in these APIs are almost always binaries signed by well known (and trusted) CAs - making it sensible for the analysis to report sus behavior.

I worked as a junior in this field, and one of my tasks was to implement regex pattern matching to detect usages of similar APIs. Surprisingly effective at catching low hanging fruit distributed en masse.

That sounds even worse honestly.

One of the criticisms of microservices is that factoring a system correctly is already a hard problem, and introducing a network call between them makes it even harder.

Enforcing service LoC limits is equivalent to forcing further factoring of a system, which might not be necessary, especially not into a microservice arch.

Sometimes code is tightly coupled because it needs to be tightly coupled.

You don't even need to ask AI to get an answer to the first question, the first hit on both Google and Bing will tell you how to do it - it takes 2 seconds!

This is true in the same way that Dropbox is just a wrapper around rsync.

Cash is not really relevant to this particular discussion.

When the power is out one cannot pay with cash either - because the cash register is offline.

Counterpoint: show me a human who can reliably produce 100% accurate notes.

Seriously, I wish to hire this person.

Soon to be announced "Quake PAK files identified carrying malware, critical 10/10 vulnerability"

I had hoped that this kind of "Trump is actually playing 4d chess, you just don't understand" argument would be dismissed after seeing him through the first term, but apparently not.

I was once contracted to work on a project where the monthly GCP bill for Postgres was $60k per month - this was basically my YEARLY rate at that time, just for managed Postgres.

After some time I was quite familiar with their stack and had gathered considerable domain experience. This led to an idea how to halve the database load (and the cost would presumably fall by a similar percentage), which I wanted to use as leverage during contract renegotiation.

I boldly offered to work for free to halve their database load, in exchange for being paid half the money this optimization would save over the course of one year. This would basically triple my pay, and they would still save money.

They declined, and I moved to a better opportunity.

Last I heard they had to pay a team of 4 new consultants for a year to implement the same idea I had. Without the domain knowledge, consultants couldn't progress as fast as I suspect I could have done (my estimated was 2 months of work).

I know it's very petty, but I regret revealing too many implementation details of the idea during the pitch and allowing the company to contract other consultants to see it done.

I've come to the similar conclusion - just write the damn logic inline, and only decouple the parts which would make the whole thing difficult to test. Test decoupled parts thoroughly but in isolation.

Bonus architecture points if those functions behind an interface are never mocked in tests.

"The useful addition might become deprecated in a few years" is a poor excuse considering that all the time niche language features are being added which either take forever to implement, or end up getting banned in real codebases.

How is it okay that newly added language features end up unused/deprecated/discouraged, but it's a problem for libraries?

I never got to try exceptions and modules in C++.

Exceptions because every place I worked at banned them, and modules because they were not implemented by the time I left the language.

I'm 100% sure that people got (and will keep getting) much more value out of unfortunate std::regex and std::fstream than they will ever get from reflection (in the few places that will even allow using it at all).

Sure, I get that.

But my point is that niche (in my opinion) features seem to be getting into the standard much more often than things that are broadly useful (in my opinion).

Thankfully I no longer work with C++, but such proposals were my main problem with the language.

I had the impression that the vast majority of us regular users just wanted quality of life improvements: better error messages, networking library, a standard package manager etc. Literally most of what C++ code styles are concerned with is about picking what features are banned in that particular style.

But instead of doing something pratical, the commitee always went with the route of adding increasingly niche features citing that useful things are "out of scope" or "implementation defined" or "userspace".

So what you get is incompatible ecosystems and cultures for an extremely complicated language.

Very happy working with Go presently, where exactly the opposite approach is being taken by maintainers. Eg: There was huge pushback regarding generics introduction (a genuinely useful language feature IMO), but they introduced very good vulnerability scanning (govulncheck) without me even hearing about it being under development.

You come across as pretty opinionated and eager to comment for someone who states they don't care.

I work with spaghetti PHP every day. It pays the bills. There are far worse jobs out there.

The expert wishes to fix the tedious tasks. But a true master understands that all tasks are equally tedious.

Relax and enjoy the ride.

In my experience, most CVEs are reports about ice cream trucks lacking nuclear-proof bank vault doors.

This looks lovely, it's so readable!