munchbunny

Am a manager at Microsoft so I can see where the policy-based midpoints are once regional adjustments are made. The base numbers look low by a rough 20% compared to what a Redmond HQ dev would get paid at the given level number. Bonuses are based on a level-dependent target percentage which you can find if you search for it.

And yeah, the Levels.fyi base pay distributions are closer to the truth.

The intuitive explanation is that the effect of a single sample on the average diminishes as you take more samples. So, hand-waving a bit, let's assume it's true that over a large number of trials you would expect the average to converge to 0. You just tossed a coin and got heads, so you're at +1. The average of (1 + 0*n)/(n+1) still goes to 0 as n grows bigger and bigger.

That skips over the distinction between "average" and "probability distribution", but those are nuances are probably better left for a proof of the central limit theorem.

I'd probably categorize it as edutainment. Like a History Channel show, where any credible historian you know would likely have a lot of issues with the accuracy of the content, but it's still entertaining.

I could name several "loud laborers" who I work with off the top of my head, but the root causes are quite nuanced. As many commenters have pointed out it's an adaptation behavior to an a work culture that values loudness.

> It also paradigms shifts from imperative to (more) functional. So if you are not comfortable with closures and side effects (like the author), you will get lost.

I don’t think it’s that simple. I write in a functional language for my day job, yet React hooks style components still give me headaches because they are leaky abstractions where you have to know what they’re doing under the hood anyway.

This argument feels a lot like 15 years ago when C++ developers were saying C++ is bad if you’re bad. Some are probably still saying it, but its pitfalls and crippling complexity are pretty widely acknowledged at this point.

It also has useful automation for dealing with things like OAuth which would be annoying to handle manually (or to script) with curl.

In general I like Postman because of the ergonomics, not because it does something that more primordial tools can't. Makes debugging easier.

Programming is much, much easier to learn to a professional level than biochemistry, and open source is much, much cheaper and easier to enter and navigate than medical academia/pharma industry, and adding a software feature is (generally) much easier than discovering or developing a drug.

I think it’s a valid question but expectations have to be tempered by the question of how many people have the means to follow through. Not many are in a position to go (back) to school for a doctorate just to start working on the problem 5-10 years later.

I wouldn't be surprised if the actual story underneath was that they got to a "works well enough" implementation and then forgot about the inefficiencies until someone looked at costs, connected the dots, and went "ok yeah we need to optimize this architecture."

I've seen some staggering cost savings realized because someone happened to notice that an inefficient implementation that wasn't a problem two years ago at the scale it was running at back then did not age well to the 10x volume it was handling two years later. The reason it hadn't fallen over was that horizontal scaling features built into the cloud products were able to keep it running with minimal attention from the SRE's.

Maybe? It’s like blooming coffee, it makes a difference, but how much does that matter to the specific drinker? The same goes for water temp.

I found that I could tell the difference but for tea I regularly drink I couldn’t be bothered to break out a thermometer. But if it’s the good stuff I totally would be doing more of the ritual.

Interesting that Yubico is choosing to go public via SPAC. It’s lower scrutiny, it became more popular over the last few years, and then lost some popularity because of high profile duds. Why go with a SPAC in that environment if the business is healthy and profitable?

Google is a bit notorious for taking extremely long from the candidate's perspective, even among the tech giants.

I’ve encountered both, significantly more of the “build a mini project for us” variety.

I also dislike those because I’ve already got a full time engineering job and a family and don’t have time to put 4-5 hours each into every 3-hour project the interviewers ask for. But 5 years ago I did.

I’ve concluded there really isn’t a single way to interview that checks all the boxes, and if you’re running the interview process you have to pay the costs somewhere, unfortunately.

How so? By “hard problem” do you mean defining what consciousness is?

That saying is often used in the context of non-practitioners throwing ideas at practitioners.

The flip side of the coin is practitioners who are too focused on what’s immediately in front of them to the exclusion of creativity.

For trained programmers it might be more harm than help, but, for many laypeople, it absolutely is an advantage because it means Excel is automatically allowing them to handle date-like text as actual dates. Most of the time that's helpful.

> When I press button on yubikey, it pastes some jibberish - way more than 6 chars, but can't THAT token be re-used?

Just to be clear, that's not related to FIDO which I was originally talking about. That's one of the extra OTP features that most Yubikeys come with, but it's unrelated to the Yubikey's FIDO capability.

> How? I mean how can keylogger get the secret from which TOTPs are being generated?

Since it’s time based with a 30 second window, you don’t need to know the secret, you just need to be able to repeat the code as it is typed. It takes more effort because it has to be done in real time, but 30-ish seconds is pretty doable.

> And why wouldn't some other malware won't be able to read whatever data hardware token inputs? I'm myself yubikey user and would like to know in what ways it is more secure than TOTP, even in the scenario when my workstation gets compromised.

The way (most) hardware tokens work, including the Yubikey, the private key is generated on the key and it never leaves the key. When the FIDO challenge/response happens, you relay the server’s challenge to the Yubikeu, it does the private key operation with the onboard chip, and sends back the response for you to relay back to the server. Done this way, your computer never needs to know the private key, but you can still prove you physically own it, which is what the server is trying to verify.

That said, just because they can’t steal your Yubikey’s private key, doesn’t mean they can’t take the bearer token from your computer. In general if your device is compromised it’s game over anyway.

Yes, with a keylogger watching you you’re typically pretty f-ed. Though that’s also one of the reasons using a physical FIDO token as a second factor is a good idea, since the keylogger isn’t going to be able to steal your private key off the hardware token, unlike for TOTP.

Though that also begs the question, if I can get a keylogger onto your device, why wouldn’t I try to implant something slightly more capable?

These statements can definitely be simultaneously true:

* ChatGPT is revolutionary - honestly, it's genuinely impressive how much of a leap ChatGPT is compared to the attempts that came before it.

* Programmers write a lot of simple code that has been written before - there are genuinely tons of cases of "write a web endpoint that takes an ID, looks it up in a database table, pulls an object through an ORM, and returns a JSON serialization of it." Most programmers? Doubt it. But tons of programmers write CRUD stuff and tons of IT admins do light scripting, and a lot of it is repeated code.

Could ChatGPT do my job? Not even close. But it's still really impressive to me.

Indeed, we’ve seen this movie before. If the CEO really wants some AI product to exist, an AI or even normal ethics team will end up getting steamrolled by any number of product teams in order to make an AI product happen sooner, actual ethics be damned. I’m actually really grateful that GDPR landed a few years before ChatGPT did because at least there’s a regulatory fear of god keeping product teams honest on the privacy aspect of AI ethics.

Perhaps so, but I’ve seen from the inside what people looking for their next promotion try to build when there isn’t the specter of the evil mad scientist label (why is it always a panopticon or an easily abused tool?) and it makes me grateful that there are people whose jobs are to think about frameworks for reasoning about what is and isn’t at least approximately ethically neutral.

Through self improvement literature! The problem is there’s a lot of bad self improvement literature out there.

You are also right that a lot of it can only be approximately taught, because the process of internalizing the skills has a lot to do with figuring out how to work with your own personality.

This was more explicit when implementing class based components than functional components because the class based API had explicit overridable methods for those aspects of the component lifecycle.

That issue probably wouldn’t exist except that React has to make some concessions to performance, therefore component reuse, therefore component state working in sometimes unintuitive ways.

Do you mean that you don’t agree with the criticism, or that you don’t understand why someone would dislike the story? I feel like the former is the more understandable sentiment, since the latter is just a matter of personal taste.

After a quick read of critic and user reviews through metacritic, the complaints seem pretty consistent regardless of how I personally feel about them. A ton of them say the plot was barebones and predictable. Even the glowing reviews from critics seem to mention that the plot only gets the job done.

Soft skills are also teachable to a coachable person. I've seen it in action. However, far fewer people are receptive to coaching on soft skills because fewer people understand what "soft skills" are and why they matter.

I've met plenty of engineers (anecdotally, not a majority, but enough that it's a clear pattern, and strongly correlated with how junior they are) who lump soft skills into a single category represented by broad labels like "charisma" or "schmoozing" or "eloquence". But it's really a very big category of practicable skills.

What “octernship” means: https://education.github.com/students/octernships

Basically a GitHub built a platform for students to get paid to do contract projects with mentorship attached. I think it’s interesting.

I read most of the way down the post waiting for any sort of explanation of what an “octernship” is, but the post mostly just says the word a lot and sings praises. In fairness it links to the explanation page, but I would hope a launch post has even the barest of short introductions of the platform.

Chinese doesn’t have a writing system that mixes different sets of pictographs. It has traditional and simplified versions of the writing system but they’re not intermixed the way Japanese does it.

> How does this work for ideographic scripts like Japanese Kanji or Chinese?

For Chinese, it’s usually not difficult. If a stroke or two is off, or if it’s the wrong radical, you can usually figure out pretty quickly with a similar effort to a misspelled word what they meant from context. If they incorrectly used a homonym, you likewise can tell pretty quickly, like “queue” vs. “cue”.

In Chinese this partly happens because you don’t just memorize individual characters, you also memorize pairs/clusters of characters as the actual semantic units.

It’s legible, but it takes a bit of active effort which makes it tiring to read more than a few sentences in a single sitting.

Not sure he was trying to start a dialogue or make some broader commentary, so much as a classic hacker’s report of “here’s what I’ve discovered” with a helping of snark added. I personally enjoyed the quick read.

> Wouldn't a fresh look at things, essentially a "clean room" implementation offer the possibility of a novel approach to a thing or two, as opposed to making the same tool, just different?

Yes, sometimes, but if that’s what you’re going for it’s still important that you’re solving a problem that you understand well. So maybe I would be okay with someone with limited photoshop experience making an image editor, but I hope they still have a designer/artist/etc. background.