munchbunny

> That’s the cynical approach, but most companies don’t actually want to lose valuable employees.

While an abstract rational actor like a company might come to this conclusion, day to day line managers often do not come to the same conclusions. A low performing employee affected by personal issues is dead weight on said line manager's budget and headcount, and therefore their metrics and their own performance and promotion. The trickle-down performance model often doesn't incentivize long-term-focused management practices.

Suspicious as in they might have left Microsoft knowing about these issues, or that they're a plant by Microsoft?

It's quite likely they had insider knowledge and therefore had a better idea of where to look. But I'm not sure that makes it "suspicious", as opposed to... well, what else would you expect in those circumstances? Or are you saying that the unfair advantage of insider knowledge is what makes it suspicious?

For programming projects, I personally find that the ritual of setting up all of the infrastructure is very likely to distract me from actually building the thing.

I can be obsessive about doing things the right way, but my most successful projects have always been the ones where the code looks like I dragged it kicking and screaming over the finish line and the infrastructure is basically nonexistent. And sometimes I clean it up afterwards, once I am motivated by the success of the project.

By infrastructure I mean things like CICD or even tests. If I have to choose between thorough testing and being able to finish the project at all, testing can wait.

As someone who worked on/with the ad serving stack, I agree with FireEye's stance on this one.

The problem is this: ads are basically browser-injection-as-a-service, as in injecting code into websites of your choice, targeting audiences of your choice. Browsers mitigate this problem somewhat by sandboxing cross-site stuff in the webpage, and ad networks theoretically scan the payloads for malware like miners, but those tests aren't hard to work around. So ads can basically run whatever they want within the little aperture of an iframe that they get.

If there's a zero-day like the Internet Explorer JPEG renderer zero-day (https://www.kb.cert.org/vuls/id/965206), then the ad networks are basically broadly targeted zero-day-as-a-service.

Ad blockers aren't a bad first line of defense for this.

I used to be in ad tech, and I did the same thing. I didn't use an ad blocker so that I could understand what the users were seeing.

A few years in though, it started to get bad enough that I enabled the ad blocker on my personal stuff and kept a browser session for work where the ad blocker was off.

It definitely happened to me with steak. After a year where I unintentionally climbed that hedonistic ladder, I ended up in a place where steak I would have formerly been fine with is now unpleasant to eat. So I just don’t eat steak much any more. I don’t think anything was really lost there - well prepared steak still tastes amazing, but the environment and my body could benefit from me eating fewer slabs of cow anyway.

It definitely also happened to me with coffee. I used to be able to drink almost any coffee straight, but over time my taste drifted towards more expensive stuff and I started adding cream and sugar to hide the taste of cheap coffee. That’s mostly thanks to all of the trendy coffee shops in San Francisco where I did meetings. So one of my small projects during covid was actually finding the cheapest bulk coffee I could drink straight. As proof that my tastes had drifted, what I settled on turned out to be a step above the cheapest cohort, but thankfully still several times cheaper than making a daily habit of single origin coffee.

Thankfully, it never happened to me with restaurants. Despite having paid hundreds of dollars for a meal on a few occasions, I haven’t lost the ability to enjoy stuff across the whole price spectrum.

I think a small adjustment to this formula could make a big difference: instead of group prompts, is there a way to prompt a single person at a time to respond to something deeper, and then to use that to start a conversation?

When I think about the most genuine connections I have with friends, the bonds are not formed from little things like talking about what we’re doing this weekend. They’re formed from moments when we are focused on each other as complex people with hopes, struggles, ideas, perspectives, messy families and careers, insecurities, successes, all wrapped up in a bundle. They come from being around for each other’s journeys as we individually sort out our lives, even if the venue might be something insubstantial like talking while playing the same video game.

I think short prompt responses would make me focus too much on myself, not enough on others.

I disagree - humor is really useful as a communication tool. If you are naturally inclined towards humor, don't suppress it entirely. I've found it useful once in a blue moon to indirectly make the point everyone is thinking but nobody wants to acknowledge. But more generally I've found it useful to put people at ease at the start of a meeting where I need people sharing ideas and feedback.

In my experience, there are two types of humor that should be avoided, which I learned the hard way:

* Punching down (including joking about doing harm from a position of power)

* Sarcasm/cynicism in public channels, especially when it's directed at specific people/teams.

Personally, I've found that Jupyter notebooks occupy that niche pretty well.

When authoring, you have something that shows intermediate results just like Excel, making troubleshooting without dedicated debugging still pretty doable. And then you can still run them headless, and you can check them into version control, and diffs are readable enough.

> In all, how to eliminate accumulated cruft like is a fascinating problem to me in that I can't see how it ever gets done. And it's not a Google thing. Even the newer cooler startup I now work at has similar "work around old Safari bug, not sure if it's safe to remove" codepaths that I can imagine will stick around forever, for similar reasons.

I think this is because it's not purely a technology problem. Especially if you have enterprise customers, the real question you are asking is: by removing support for these specific browsers, are you breaking someone's important workflow in a way that lacks viable IT workarounds? Because if you are, the backpressure via business channels will be what forces you to keep the old cruft in the code.

In a previous job, I had to explicitly keep tabs on certain customers' IT policies w.r.t. browsers because that would ultimately inform our browser support matrix, and because it's enterprise, the actual browser versions could lag by 5 years or more. And when a single enterprise user is stuck on IE9 but the account is worth tens of thousands of dollars to your nascent startup, starting a fight with their IT department is one of the last things you want to risk customer goodwill on.

That's why I was goddamn ecstatic about Microsoft's move to Edge, because it meant historically stuck-on-Trident businesses now had a path to supporting more up-to-date browser tech on a much faster cadence.

I suppose we'll never know if the Tesla was going to follow through on that right turn.

But if you were an observer on the corner and could not see whether it was a human or an AI was driving the car, you would almost certainly consider whatever the car did (starting the turn) while pedestrians were actively crossing dangerous.

They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.

I think it's perfectly possible for one person to be on their org's good side and another to walk into every single branch of a hostile bureaucracy. Especially in large companies, which Atlassian certainly is now. I've seen that in action, side by side, even within the same team.

Neither invalidates the other, because a large company is perfectly capable of both at the same time.

Did that at an earlier point in my career, and it absolutely was, but calculators pretty quickly reach a point where "less is more", and at that point it's just better to leave it alone.

Absolutely agree. It's probably the biggest disconnect I feel between how ideas are structured in my head and how to best communicate them in written format.

Parentheticals in English sit in this sort of midpoint between a modifying clause for necessary elaboration and a footnote/end-note for optional detail, and lots of people including me use parentheses where "inlining" the parentheses or moving them to a footnote would be more appropriate. That's in addition to conventional uses of parentheses, like to expand abbreviations.

Also most languages already support nested clause structures without the use of parentheses.

As someone in their 30s, married and preparing for kids, what has surprised me is how much all of the little things add up. Not the sheer dollar amount, but rather just how many bills you can get in a single month and how many little bits of infrastructure are required for a stable baseline day to day living.

The answer for me was “enough that I have to actively dedicate time to managing them.”

Just to give a different perspective, I am budgeting for a not-ascetic but also not-extravagant lifestyle (cook at home, buy nicer clothes less often, buy cars new but stick to low maintenance budget models, etc.), dual-income family, kid(s), one or two trips a year (one to travel, another to visit family), some hobbies with equipment costs, a chronic medical condition I was diagnosed with at 25 that is minimal impact right now but will almost certainly get expensive when I'm retirement age, some ongoing memberships like for state parks, etc.

Factoring in taxes, it adds up to more than I'd like but less than I would intuitively assume.

A lot of FAANG programmers are people who "work to live". Even with the financial means, the freedom to do what they want isn't necessarily something they value very heavily. Instead, it's a steady 9 to 5 and they have time for family, friends, and hobbies, and they're content with that.

Also important to note though: while FAANG pays well, it doesn't pay so well that you can consistently retire at 35 unless you pay very close attention to your wealth management.

If I had financial independence, I'd try to become a teacher. Unfortunately, even fully vested, I'm a good ways out from financial independence.

I think what you're saying is you don't know whether future versions of the code are safe?

That's fair, but also I don't know any companies in the industry that pay for a fine-toothed-comb audit like this one for every major/minor release because it's simply not practical. I don't think this report pretends or is intended to pretend that a one-time audit is representative of future code any more than a negative COVID test is representative of whether you have COVID two weeks later. But that's not an argument against disclosing that you came up negative on your last test a few days ago, because disclosure is still better than the opposite.

The way Mozilla is handling this is a textbook implementation of typical pretty-good transparency/disclosure practices. A post discussing the big issues, and the full report available publicly. I think it's a cynical take specifically because it's the least charitable take on someone following best practices.

That's an overly cynical way of looking at this. Security audits of your code are a matter of course best practice and are unrelated to "does the VPN live up to its marketing claims?"

It's like publishing that you passed health and safety inspection for a factory that makes safes. I don't think anyone would reasonably confuse a company publishing that its factory passed inspection for a claim that its safes are hard to break into.

They released the full report here and it's pretty clear on what they did and didn't audit: https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...

> This hasn't turned me off of monadic error handling, but it has made me think of it as FP's version of exceptions, rather than an upgrade.

This reminds me a lot of Java's checked exceptions just with different window dressing. You move the failure mode type information from the exceptions list ("throws" clause) into the return type.

Typed error return values is definitely an improvement in ergonomics over C-style error code returns, and pattern matching is definitely a big improvement on ergonomics too, but I think error handling has a problem of fundamentally irreducible complexity. For example, if you make network calls, you have to be prepared for network calls to fail, and you have to design your system to recover from it somehow, whether that happens in a try/catch or a match on Either[Throwable, Result].

That depends on why they're hesitant about mRNA vaccines. The "anti-vax" label isn't just about not taking some subset of the standard vaccinations. There's a tribal element and a conspiracy/disinformation element.

What makes them not vaccines?

Discord hasn't gotten bloated yet the way Slack has, which makes it much more pleasant when all you actually want to do is chat and maybe hang out on voice and sometimes with a screen broadcast.

Once you're in an enterprise space, Slack's features become actually useful.

Does that mean you have to temporarily install Windows or plug it into a PC with Windows, turn off the lights, and then go about your day with Linux?

My experience with dermatologists has been the opposite. Over the last 2 decades, the dermatologists I've seen mostly just recommended pretty basic stuff like gentler unscented soaps, moisturizers in general, or Vaseline/Aquaphor. That's not including actual prescription drugs of course.

> Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.)

For the client side of things WebAuthn contains a standard option to block/allow "platform" authenticators, which I empirically know includes Windows Hello, and I'm not sure about Apple's or other equivalents. Of course you'd still want to verify the attestation on the server side.

I think removing the self-managed data store feature makes sense even if not everyone likes it. It removes a source of architectural complexity, and most users aren't looking for local storage anyway.

Personally, the problem of managing reliable persistence of my password database just isn't something I want to spend time on, and the incremental difference in security posture is uninteresting to me given that it's encrypted at rest anyway. In terms of waking hours spent worrying about the security of my household IT, the security and persistence of sensitive documents (mainly vs. ransomware) is a bigger problem and I like that my passwords aren't tied up in that mess.

I think it comes down to this: as a developer, part of your job is tuning your sensor for moments of "there has to be an easier way to do this, let me look it up".

I wouldn't criticize a developer for being unfamiliar with bit shifts because I've never had to use it for work either. The part I'm incredulous about is that there wasn't a step in the middle where the developer looked up bit manipulations.