nstart

I agree with the idea that solutions can lie in more than just negotiations. But I will also say that I’m at the point in my life[1] where I believe the vast majority of solutions do lie almost purely in some form of negotiation.

Take your own example:

> After all, if you plead for some time to address technical debt and do platform improvements, you might just get told "no" to, given that in certain cultures people won't view these things as something that generates value directly and convincing them otherwise will be an uphill battle.

This right here is a negotiation between business and engineering. The business unit cares about technical debt only if it affects successful delivery of business goals. As such it needs to be negotiated along those lines. In fact, I’d say you make a wonderful negotiation right after:

> So why not just announce that X% of the following sprint or month will be spent on these things, to ensure successful continued operations?

That is an excellent negotiation right there. The business cares about successful continued operations. Stopping everything to focus entirely on technical debt is not successful to the business. Allocating x% time to a mutually beneficial goal where x can be continuously tweaked is an acceptable point.

> After all, you don't ask business about using a version control system, do you? You just go ahead and do what's necessary to version your project.

The thing about this point is that it is:

A) easy to get setup.

B) well understood enough now to know the benefits to the organization

I’d argue that ci/cd is coming closer to that point now. Definitely is on the right trajectory and for the same reasons. Easy to setup and the benefits are well known and easily understood.

More nebulous topics like testing and tech debt will for the foreseeable future be topics requiring decent negotiation.

[1] I may change my mind on this in the future. Definitely been around on topics where I believe one thing, believe an alternate point of view, and later have a softer or accepting view of the original idea :).

While this example feels pretty obvious, I think in practice, these conversations conflict with the third caveat mentioned:

"Your team is always working on the next most important thing (as prioritised by the business)"

When the business functionality and marketing needs compete with technical advances, there's a decent amount of negotiation that needs to be done and that negotiation varies wildly from company to company.

Early on in my career I felt angry at these kinds of negotiations. As I've become more mild and open to business needs across the board I realise that most people will agree with the goodness of the idea but it becomes the duty of the proposer to sell it in terms that the business unit can agree to.

Overall, this is a great thought provoking article. Concise. Yet nuanced.

Didn’t have time to read other comments, but based on anecdotal experience I’d say the interpersonal connections have migrated into the private corners of chat via WhatsApp, Meta apps’ chat, or snap (highly dependent on age and location).

I’d add on to the idea of social media is over by saying the age of social networking in public is going through a rethink (or is just over for a while).

And as much as one wants to take it as a turn towards the networks becoming an ad machine and blame it on networks themselves, I’d also say it’s a human thing. The moment a platform gains escape velocity and starts growing, we immediately see the influencers, hustlers, and businesses approach it with a “grow your brand and audience” mentality. This eventually skews the network towards serving them because they actually bring money and shortly after, tadaaaa. It’s an ad machine laid on top of a content network rather than a social network.

Chats don’t suffer from this so in my experience, that’s where “social” networks are going for now. I’ll hold my breath on federated networks being the next step.

Been playing since day 9 I think (someone shared it on Twitter). Thanks for making this. Wife and I have added it our list of puzzle a day games.

This is a brilliant idea. Feel like it should work since this is already done for YouTube. The same mechanism is used to A/B test thumbnails and automatically choose one to be the winning candidate.

Congrats on making this.

If you know basic vim movements (j/k for down/up kind of basic stuff), you can pipe the output into less to read it in a more convenient way. Nothing major, just found it nicer to not have to scroll back up when the article loads

Example:

curl https://mahdi.blog/raw/self-hosted/ | less

If it helps, I use it on iOS and I have a shortcut to my “inbox” file where I capture quick ideas and todos

It’s open url where the url in my case is -> obsidian://open?vault=GTD&file=Inbox

The shortcut lives on my Home Screen.

Not sure what the android equivalent is but given androids capabilities I assume it’s even more straightforward.

Hope that helps.

If you are truly interested in sustainable methodologies, I think one area that requires acceptance is that the volume one consumes needs to be second to the volume one can take meaningful notes on. There is no sustainable notes strategy that can support randomly opening HN and skimming a random article on the front page during a break at a bus halt.

If you want to take notes of what you are reading, no matter what method you choose you need to synthesize your ideas. You need to make them your own. That takes time. Personally, I found that for the time I was taking notes* I had to first discipline myself in how I consumed material. This lessened how much I read and made me focus on quality which in turn made me focus more on what I was reading which then turned into a positive feedback loop.

This answer may feel like a cop out, but I add it only because too many people try to find a note taking methodology to support an unsustainable consumption habit and then they think the note taking method was the issue when it really wasn’t.

* - I ultimately stopped taking notes on most things when I decided one day that I didn’t want to do it anymore. I narrowed my areas of interest to ones where mostly practical experience mattered much than theoretical knowledge (eg: illustrating). The only areas I take notes in still is security research and even that is far more practical

I think the reason to be interested in this is because it’s deno specific. I’m not up to date with the deno landscape but I believe this is pretty novel for deno.

In some ways I think this “meta” conversation style is part of the early stage of nearly every social network. Especially the ones that are public messaging by default (as opposed to something like FB or IG which was in theory at least, friends and family first). Twitter was a lot of talking about Twitter. Mastodon was and sometimes still is the same. Reddit had lots of meta chats.

Even the early stages of fb had discussion of how it compared to hi5 or whatever network we migrated from. Same with google plus.

I think one mark of success of the network is the moment it escapes that conversation. In my opinion it means that the usage of the network is no longer a novelty and is now part of a routine.

For anyone who’s interested in a quick and dirty way to do it, I just post the sha256 to Twitter/some public forum and reveal when I feel like it

Quick thoughts I’ve had for years on this article and about the book Getting Things Done by David Allen.

Not trying to put this article down btw, since this was the article that introduced me to gtd in the first place. That said, if you do feel like trying gtd based off this article, I have a possibly helpful heads up for you.

Try out the whole dumping things into an inbox and processing it bit for a short while. Just the bit of building a habit of unloading anything on your mind into the inbox. Don’t worry too much about projects and ticklers and whatnot. Once you’ve done that for a few weeks, you should pick up the book by David Allen and read it. And then implement the rest of gtd.

As someone who tried gtd but didn’t get it for many years, the book has so much context behind the thinking of each concept (next actions, projects, tickler, weekly review, etc). Every single summary of the gtd method feels pale in comparison to that.

Now, everyone’s journey might be different. But just know that if GTD doesn’t work for you after trying it based on a post like this, it’s completely natural. It’s a rare case where the source material is really where all the gold is at.

Sorry. I saw this a little late. Hope this reaches you. I just make use of normal files and backlinks. No fancy whizzbangs except for a script to run the tickler for me. I need to convert this into an Obsidian plugin at some point.

The folder structure is simple

root folder -> Inbox.md (everything goes there first. I have shortcuts on mobile to open inbox directly)

Sub folders for Projects, Tickler, Attachments, Next Actions, Tickler, Someday Maybe Lists, and References

Attachments is just the folder that Obsidian automatically attaches stuff into when I paste/drag'n'drop something in.

I have about 9 Next Action lists inside the Next Actions folder (broken down by type of work [personal, work communication, work tasks, self education, etc])

Every project gets its own file inside the project folder. This will have links to sub projects and will also have its own notes and updates about the project so that it becomes a one stop location to check on a project and its history. When I finish/halt a project I move it into the Completed or Discontinued sub folder in the Projects folder.

When I need a next action on a project, I open one of the next action lists and use and add a task in there with a backlink to the relevant project. This way when I am reviewing my projects I can use the backlinks panel to see what next actions I have pending.

References are additional things like mails/announcement I am writing up. I insert references to these inside the project document (I'll use ![[project X status update announcement]] to embed)

The tickler is exactly like it's described in the book. Each day and each month gets its own file. I came up with an alphabetical arrangement method so that it displays exactly as the book specifies it — days coming up, next month, the days of the month that are done, the months that are coming up, the months that have completed (in that order). Re arranging this requires a bit of precise naming of files which is why I have a script to do that for me. I run `tickle` when I turn on my computer and the tickled tasks go into my Inbox.md file and everything is arranged automatically.

When I need to pick a next action to work on, I have several workspaces I have saved (eg: Work tasks to choose from). I open the workspace, review a next action to work off of and get into it.

And that's all there is to it. It's a lot of words to describe a process that doesn't require any mental overhead to maintain. The only mental overhead is in following the process required by GTD and that's a given :D .

Happy to answer more (feel free to mail as well)

GTD. Been using the gtd system with obsidian for almost 2 years now. I sometimes fall out of sync with it, particularly during high stress times where I lose the motivation to work in a disciplined way, but it’s never too hard to get things back under control.

Most days I go through my next action lists when I’m thinking of stuff to do and review it each week to do any re org.

It's easy to trade on crypto platforms with stable coins. A lot of people will typically buy tether and then use tether to buy other coins using the exchange of their choice. It works the other way around too when you want to store your value in a predictable form if a currency like bitcoin is doing a dip. Just convert your bitcoin to usdt and hold it there till btc starts going back up.

It’s not. Increase the duration to 20,000 and you see a classic gaming bug of the momentum going haywire eventually. Unsure if it’s anything to do with the environment or the coding. On mobile so can’t really analyze it.

Fabulous addition. For anyone looking to see what a master harmonica player looks like, highly recommend looking up blues traveller / John Popper.

In particular, there’s a live performance of no woman no cry that has John Popper alongside Ziggy Marley. Mind blowing. Watch it. You won’t regret it.

https://youtu.be/9zk0HFG5mDw

Couple of questions I can’t find answers to:

1) What companies are the first batch of 11? Or put another way, will we learn who is in each batch at some “graduation” point? Whether the founders grow or not, I would love to see the program practicing transparency from the start.

2) After so much interest in crypto, I can’t really seem to see visible crypto investments in their fintech area. Is crypto supported at all by this program?

Pinterest is one of the most recommended tools when it comes to building collections for most things art related. I’ve taken a few courses on concept art/concept development and Pinterest has been in 90% of it.

It’s used to collect references and build mood boards.

So, while self hosted Pinterest is a nice idea, it does miss the powerful part of Pinterest which is its search and community. When I want to find roman armour or steampunk vibe architecture, I don’t even have to leave Pinterest most of the time because the collections I need to find are right there.

That is a valid and excellent point. Nuance is often discarded in favour of stirring trouble and it is very frustrating.

I don't know if this has been tested, but I'd venture a guess that this has something to do with how one flip flops.

Exhibit A:

"This fact X is correct and we as institution C Org have institutional knowledge that makes us right and anything otherwise wrong".

Changing this later to "This fact Y (that people were asking about, shh) is true. We won't mention that it contradicts X that much. We won't say we were wrong. We will say that as institution C Org, we have institutional knowledge that makes us right and anything otherwise is wrong"

VS

Exhibit B:

"We as A Org, have reason to believe that X is the most true thing we know given current knowledge. We acknowledge fact Y exists and are actively investigating it and its implications. For people searching for guidance, A Org recommends actions S,T, and U. We will continue to research and revise information where necessary"

---

I feel like Exhibit A, which is something I see a lot from government entities (confirmation bias makes me want to add "in the US") makes a changing of mind a thing of pride since you've staked a bet on it. A bet which usually is condescending and says "I'm right, you're wrong"

Exhibit B leaves the hatches open while still getting a firm message down based on today's knowledge.

Sadly there's no A/B testing we can turn to to know which approach would be better. But just out of sensibility, I wish more entities engaged in the latter approach

There's definitely a tasteful way to do this model. Dota 2, Fortnite, and Brawlhalla are examples of good ways to do this. To me, it comes down to two things:

1. Should not be able to purchase a competitive advantage

2. Should be able to purchase the item you want.

Re the second point, if you want the rare items and that involves gambling random item opaque loot boxes, that's an abusive relationship. If it involves purchasing the item directly, or buying a box where you can see all the items inside of it, that's a respectful relationship. Purchasing the item directly is the most preferred.

Games that do this entire model badly involve Hearthstone and any number of mobile games made by Supercell.

Some people might balk at the idea of purchasing any further items, but personally, I don't see anything particularly wrong with allowing cosmetics to be purchased and applied as a model that enables people to have a great free experience.

The entire message has a tone of being entirely true but not representative of the entire truth. And that just leaves us all hanging with more questions because it doesn't tell us what we really need to know.

2.5% of all customers were accessed by all Sintel employees for the period in question. How many customers did the particular affected Sintel employee access?

They assessed all the actions that took place by the Sintel employees. Were any of them sensitive?

The tool doesn't allow them to create or delete users. Does it allow them to modify users so that an attacker can take over an account?

The attacker had access to "Jira, Slack, Splunk, RingCentral, and support tickets through Salesforce". Doesn't sound bad on its own but have those tools been evaluated to ensure they don't have sensitive information? Do we know what the Sintel employee in question accessed from each of those tools for the time period?

The employee's machine was logged into using an RDP session. Was the employee's machine assessed to ensure they weren't storing other sensitive information? While not allowed, a lot of support engineers will quickly drop in "temporary" sensitive stuff into random notepads and what not. Was this assessed? Also, why does a support engineer have a machine that has the ability to enable an inward bound RDP session at all?? How was that not the first trigger since this is a known attack vector for support agents.

Given the possibly small blast radius of this issue, Okta had all the opportunity to turn this into a communications win for them and just build a multiple of trust really quickly. All these half communications have utterly botched it and that's just really disappointing. We'll still continue to use them because the switching costs just don't justify moving off Okta. But Okta has really taken a hit in their "trust bank".

Okta's CEO just released a statement. And it's very tiny. Unsure what to make of this. Waiting to see LAPSUS$ response

> In late January 2022, Okta detected an attempt to compromise the account of a third party customer support engineer working for one of our subprocessors. The matter was investigated and contained by the subprocessor. (1 of 2)

> We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2)

https://twitter.com/toddmckinnon/status/1506184721922859010

For people wondering about how they get access to these systems, it feels like they use the weakest human link in the chain.

I checked their telegram group and I can see that they specifically recruit people with access to VPNs/internal support systems. This okta breach seems to have happened through similar means. The group has made specific calls for access to gaming companies, hosting providers, telcos, call centers, and bpm providers. They offer payment.

It doesn’t feel difficult to see how some overworked, underpaid support agent (or even a well paid disgruntled one) might decide to go with this. Just takes 1 well placed agent to give creds and this group has access to a huge attack surface instantly. This might sound like an overreaction, but corporations in the future might need to make least privilege access and access logging everything a priority from day 1.

https://t.me/minsaudebr/162 (Link to the recruitment message)

Just a quick one in case it's helpful to others: On the topic of redirect attacks, this works only if the oauth flow does not have a third leg. This is where the the token granted at the end of the redirect must be sent to the server of the legitimate company. The token is combined with a secret to then retrieve a final access token with the actual permission to access the API on the user's behalf. That final token is retrieved entirely on the server side and is never sent to the user's device and in that way you are protected from an open redirect attack.

Happy to be corrected on any of the above. My knowledge here is very much a WIP.

It’s worth noting that the setup mentioned:

> Using VSCode as a desktop connected to a remote code server, or using JetBrains Projector, is the true sweet spot

is a zero lag approach when it comes to code editing.

The only time a brief lag show up in the IDE are when you need to open a folder/workspace in an uncached directory which is easily ignored.

I’ve been banging the drum on this setup for well over 2 years. Happy to share more info if interested

For some who might wonder how Uber attracts riders to the platform, it’s done through “bonus” payments. They give riders “goals” to achieve in terms of numbers of orders completed. Achieve these numbers each month and you get a bonus. The bonus is usually comparable to an expected monthly wage. Over time though, the goals go higher (Uber says the demand is more but fails to say the supply is more as well) and then the bonus goes down. Over time it just becomes an abusive relationship. But like a person trapped in a Ponzi scheme, many drivers believe they can do it if they work hard enough (they shoulder the blame) and they stick on.

I’ll riff on that (pun intended). The api allows the ability to see the position and change of position of the crank. Moving the crank to the correct position and doing. A rhythm game could very well show moves like rotate forwards twice. Half rotate back. Etc. And you have to perform moves within a certain range of that. That could be a fun one indeed :D

Oh that is very very cool. I think something with the kind of quirky rotoscoped animation like they had in the original prince of Persia games would fit so well on this.

Now that I think about it. A remake of the original prince of Persia would be such a joyful experience with the mechanic you thought of.