lq9AJ8yrfs

Broker or dealer. Per the interwebs, a broker acts on behalf of another party, vs a dealer trades for themselves.

As distinguished from an exchange, where the exchange intermediates and becomes a middle party "simultaneously" to both sides.

The market dynamics are pretty different between broker dealers and exchanges. For instance a /ticker/ as a concept makes sense only with an exchange.

The exchanges basically pick up only the contracts or goods with the most volume and standardized & predictable goods.

To trade more exotic or niche things basically you have to find your own counterparty, versus the exchange acts as an "typical" buyer and seller to each side (assuming there is anyone there at all to participate on each side... giving rise to the concept of market makers who undertake to do just that, i.e., to be ready to trade either side at any time in a certain good).

Not a lawyer but as a citizen I generally understand that the courts expect demands from court parties to be met.

If meeting the court's (or court parties') demands costs you something you are generally entitled to charge them for it, within reason and with justification.

As a hobbyist therefore putting a service offering page together with your preferred rate probably helps establish the nature and parameters of any such service.

Bill rates / piece rates, especially, and setting up bounds of what is reasonable to expect, in proportion to your gig and your intended effort level.

Quantity and price tiers, turnaround times, what will be included in the deliverable, how it will be delivered, SLAs, etc.

Whatever defines your service, esp as it relates to the types of requests you end up getting.

"Kidney transplantation is a surgery to eliminate a sound, working kidney from a living or cerebrum dead giver and embed it into a patient with non-working kidneys. Kidney transplantation is performed on patients with persistent kidney disappointment, or end-stage renal illness (ESRD). ESRD happens when a sickness or confusion harms the kidneys with the goal that they are presently not able to do satisfactorily eliminating liquids and squanders from the body or of keeping up with the legitimate level of specific kidney-directed synthetics in the circulatory system. Without long haul dialysis or a kidney relocate, ESRD is deadly."

https://blackwells.co.uk/bookshop/product/Handbook-of-Kidney...

https://books.google.com/ngrams/graph?content=kidney+disappo...

Wolters Kluwer seems to be a real multinational company?

For a long time fixed income trading took place over AOL Instant Messenger and later Yahoo chat rooms.

I am not making this up.

There were custom frontends that would enrich things like cusips.

There are lots of small insurers at least.

Multiple resources on the internet put the startup costs at $500K or less. That's not much more than fast food or other high touch retail startups by comparison.

There are certainly a few steps on the learning curve but it's mostly high school and undergraduate math that is needed. That puts it out of reach for some but the field is pretty flat once you get there, is my perspective having considered and opted against getting into it.

In other words, there's no moat in insurance.

You need a capital base in proportion to the policies you sell in order to pay them out without going bust, to a certain confidence level. The time sequence of premium payments vs when the risk is expected to come due for a payout is factored in.

The 50 states regulate insurance in the US and issue rules about how to do this, some of which affect competition and pricing in heavy handed ways, sometimes it's overtly political.

In general though insurance is an extremely competitive field. Margins for the most part are similar or lower than other industries.

Not sure where the popular impression that it is not competitive comes from. If anything I think the sword cuts both ways, the friction in the process is probably more a symptom of competitiveness more than its absence.

that's nearly a requirement for anti-bot things. turnstile etc.

LLMs, including open ones, are really good at this it turns out. It stands to reason, there is tons of training material out there no doubt they have consumed and are ready to regurgitate.

Yesterday I one-shotted several interactive pages, that Qwen built out of straight HTML and Javascript. I handed it my API (source code, not even a swagger, via an MCP that Qwen wrote for me), asked for a frontend, and it delivered. One page at a time to keep context down, and mightve gotten lucky on the first draw but after the first one I told it to make the next ones like the first.

Can't say I've had that experience with backend languages & frameworks, incl writing that same API, but perhaps I'm off the beaten path with those, or perhaps there's greater breadth of things to do vs a narrower set of acceptance criteria? IDK.

Here I was sweating that I'd have to research and learn a current-day frontend framework. It felt like a magic wand using consumer-grade AI. HTML and plain old Javascript was plenty.

Tangent but apropos of other contemporary threads on HN, it puts a spin on supply chain threats. There's no NPM or anything, except perhaps whatever mysteries are baked into the model.

It happens in the private sector too. I was involved in procurement at a megacorp for several years.

At one point one of my colleagues asked for assistance in getting an order of 500 iphones approved. As "spares".

Fortunately the corp had a policy that phone purchases needed to have a named individual declared.

I declined politely to assist.

It was common to see certain mid level execs churning through 2x - 5x the equipment of IC's (who would never get out-of-lifecycle approvals anyeay) and some quid pro quo stuff. As a fraction of their total comp it was modest ultimately, and for this reason my boss advised me to keep my mouth shut.

CNC milling is typically included in the bans being considered in various states.

While poetically consistent, it enlarges the crater around these bad laws if they are passed and enforced. Basically all new manufacturing setups will need to stop and reprogram to stop and start according to fluctuating rules designed by committee, and will need to be made brittle to prevent circumvention.

It is a debacle.

I don't think I've met an llm that is adversary resistant, and here are counterparties that are actively playing the field, to put it mildly.

The bug bounty service providers did an adequate job of filtering out junk reports. There was a survivorship bias, some of the bogus ones that got through had an uncanny ability to twist words.

As a sometimes peripheral and sometimes primary program manager for vulnerability disclosure, for companies you nearly can't avoid, $0.02 follows.

It's a signal vs noise thing. Most of the grief is caused by bottom feeders shoveling anything they can squint at and call a vulnerability and asking for money. Maybe once a month someone would run a free tool and blindly send snippets of the output promising the rest in exchange for payment. Or emailing the CFO and the General Counsel after being politely reminded to come back with high quality information, and then ignored until they do.

Your report on the other hand was high quality. I read all the reports that came my way, and good ones were fast tracked for fixes. I'd fix or mitigate them immediately if I had a way to do so without stopping business, and I'd go to the CISO, CTO, and the corresponding engineering manager if it mattered enough for immediate response.

It doesn't help that a lot of security software is pretty niche. It's unreasonable to expect most candidates to know it or have experience.

In one case I was one of exactly two people out of 500 that had used the product as a paying customer. Neither of us was in management.

After a year or two the CISO drifted over and asked me to show him how to use the product, but he was more interested in soundbytes than actually using the system.

It became a powerpoint exercise and I collected my attaboy.

From having worked at and consulted with security software producing companies as well as security software consuming ones, I would say the security companies are worse than average at security.

And their security teams more cynical.

Sometimes they deliberately hire lower aptitude candidates to run internal security to prevent them from getting distracted by the product.

In other cases they are getting high on their own supply, more or less.

Jack Welch style management seems to take a deeper toll in this sector.

It seems hard to donate a trademark application to someone.

Trademarks seem like a sore spot for successful OSS but probably useful for solving this problem.

Or perhaps a license change? Might be tricky to do what the author means and still meet the definition of /open/. Maybe that's ok?

Getting your cloud 'wiz wit' in Philadelphia would mean having melted cheese on it.

there are a lot of "do what I mean" type papercuts in openscad. BOSL2 is a library that, for me at least, takes away enough of them to make a rewarding experience. still find myself brute forcing which axis to translate or rotate things the way i want.

concur otherwise that openscad is parameter friendly. the lightbulb moment for me was when i finally grasped its functional grammar and leaned into it, esp recursion instead of algebraic solutions. that should probably be the subject of a tutorial or several.

i like the way prusaslicer has a conspicuous setting to enable intermediate and advanced settings so that users can start with a less intimidating setup and opt in to the bells and whistles if and when they are ready.

this pattern could probably benefit a lot of apps

Real world CSRF attacks into hxxp://192.168.0.1 home routers and polluting DNS and DHCP settings you could argue is caused or at least facilitated by NAT, or NAT misconceptions especially.

Though IPv6 has a similar situation with well defined unicast and multicast addresses.

True story, popular browsers won't let you load a webpage via various IPv6 local address literals for this reason. Hxxp://[ff02::] addresses won't work.

/ You can have your cake by "tying a knot" with yourself and port forwarding from 127.0.0.1 to the IPv6 literal. An ssh port forward will do this with aplomb. Then load hxxp://localhost:port and it works again.

// Browser logic

NAT causes security issues too. Reflection attacks are much harder to stop if the endpoint and its network address are decoupled.

You can provoke loops and tangles of many sorts, some at the same protocol level and others going up and down.

My memory is fading but I vaguely recall a time when all of AOL shared something like a dozen egress addresses for certain traffic -- might have been proxies as opposed to NAT/"PAT" as we know it today. Iow, you couldn't block one without blocking 1/12 of AOL users.

Stronger memories of a time when your IP address (some were nat, some were not, varied by ISP) depended on which modem bank you dialed into, which was strongly influenced by what phone number you dialed. Which diluted the identity value of a given IP for a computer or user.

As an outsider to this industry, is there any real moat against what an enthusiast or several could pull off with a few iterations?

Feels like a well placed post to a model sharing site could affect the landscape.

If we can do ghost guns shouldn't hand tools follow?

If your schedule allows, try to time your visit around any of the science fairs that they sponsor and/or host. Top notch all around.

My espresso machine is semi-automated and lots of folks seem to go for fully automatic coffee experiences. Mr Coffee all the way to K-cups etc.

There are some crazy things [1] going on in the oven world, though Miele seems to have blown the marketing. My wife and kids all furrowed their brows when I told them about the fish in the ice block. They don't understand or care about physics, they just like tasty food they know how to prepare. "Why would you cook a fish in an ice block in the first place?"

[1] https://www.mieleusa.com/m/in-dialog-with-food-miele-to-unve...

I rather disagree on the difficulty of pulling it off. The problem space is well-defined and there aren't that many degrees of freedom in functional design.

I'll concede there is some complexity in integrating with everything and putting up with the associated confusion. And granted the stakes are a little raised due to the nature of identity and access, and like you point out what could go wrong. Implementation is annoying, both writing the identity solution and then deploying and operating it. But the deployment & operation part is still there if you go with Okta or 1Login or Cognito or whomever.

The implementation is a capital type thing that is substantially solved already with the various F/OSS solutions people are mentioning - it's just a docker pull and some config work to get it going into a POC.

There are much harder problems in tech IMO, anything ill-defined for starters.

The C-level folks seem to think they are buying some kind of indemnity with these "enterprise" grade solutions, but there is no such thing. They'll even turn it around and take Okta's limitations as existential--"if even Okta doesn't get it right, there is no way we could pull it off". Out of touch, or less politely, delusional.

Among the reasons to leave my last job was a CISO and his minion who insisted spending $50k+ on Okta for their b2b customer and employee authentication was a bulletproof move.

When I brought it up, they said they didn't have anyone smart enough to host an identity solution.

They didn't have anyone smart enough to use Okta either. I had caught multiple dealbreakers-for-me such dubious / conflicting config settings resulting in exposures, actual outages caused by forced upgrades, not to mention their lackluster responses to bona fide incidents over the years.

I use Authentik for SSO in my homelab, fwiw.

Those all seem like easy problems to solve.

Draw straws and one person dials in from their desk or a phone closet. Take advantage of multiple locations, which are frequently if not always part of the landscape. I had a similar experience, there was a lady on the same floor who was sensitive to light, versus I had a plant that was dying, so I bought a timer and a desk lamp and set it directly under the lamp to run after hours, and we kept the lights dim during the day.

At some point the rigidity is just another type of enshittification, there to subtract. Ingrained in their culture and part of their prerogative. Denying them the privilege is an insult that earns greater retribution. Pour encourager les autres.

It would literally cost them nothing to be flexible. Solzhenitsyn level material.

Suggests a new unit of measure, the Solz, which characterizes how occult and byzantine the rules are and how vindictive and arbitrary the application. Bonus points for tail-eating and Lysenkoist aspects. Stalin era normalized to 1.

I had "exceeds" ratings the whole time at this job, btw. I am told my contributions live on 10 years later, I can't say that about most of my work experience.

Something I am not quite able to compute is why they are so rigid. I paid for a house with enough rooms that I turned one into a generous office. My peers tell me my hobby productivity is off the charts. There is / was no price at which I could solve for an acceptable office environment at this company. At any company I have worked with or heard of.

I get that there is back biting and intensive score-keeping, resentment etc, but the act of putting everything on a synchronized linear scale (with sub linear progression) seems cruel. Some people like tchotchkies, some people don't like those esoteric office snacks, some people like mouthwash and shoe polish and fancy towels in the restroom. Why gatekeep it all and shove the same exact bundle of goods down everyone's throats?

If they were really minimaxing your next unit of work, this is not an optimal strategy. It's just lazy, a children's tale of how an office might be.

I tried this -- I am undiagnosed, but my kids are diagnosed. On one hand I thought parts over-dramatized, on the other hand I thought parts were watered down.

Misophonia for me does not give me any choice. Either the noise stops or I am leaving. If necessary I will explain later. If the noise stops I am possibly leaving anyway in case it starts again. Fortunately in my case the trigger is pretty obscure, like nails on a chalkboard type of rarity -- people don't actually do that so often.

The explanations I thought were dramatized. One of the challenges I think people with autism have is trying to explain their reactions and coming up with things that neurotypical people cannot relate to. It is more like reflexes. I'd be slack-jawed if my co-worker asked me to explain why my leg moved when the doctor hits my knee, "it just does that when you hit it that way", "probably something to do with ligaments, or tendons? IDK". Could you make an "undiagnosed" mode where your scores just go up and down?

And the options -- when the people team came through at $bigcorp and announced tiny hotdesking, I filed all the necessary paperwork, gave constructive feedback, worked with my manager etc, but started looking for new work immediately and noped out at the first opportunity. The people team was happy to close the file which was growing fat with demerits like not hanging my coat the right way, but my peers and reports were upset. well done people team! This was at a company that professed to be supportive of neurodivergence.

I think you're on to something, though it's optimistic to count on app devs to specify a novel platform-specific flag. "Don't break user-space" seems like it's in contest here.

Maybe if you could taint a process (or perhaps the inode and/or path instead) so that its and its children's opens get the new o_atime flag by default, so that systemd or whatever could set it for legacy processes (or files/paths) that need it.

Then distros or SRE's could put up with it without nagging all the SWEs about linuxisms. Some of whom may not know or care their code runs on linux.

What if we helped everybody look better and smell better and it turned out it was all for nothing?