pfooti

i like hover.

That is more or less what I landed on myself. (Not quite, but similar reactive configs based on traffic thresholds).

For a while, we had to just set off pagers when global traffic exceeded a threshold and manually toggle the extra hardening, but eventually it became a lot more reactive.

Yeah, "recaptcha" in this case is shorthand for a lot of stuff we did to harden the endpoint that ultimately represents a minor shift in balance from no friction to some friction for otherwise legitimate users, but a pretty significant drop in illegitimate traffic.

The main idea here is that at some point just leaving the scrape running in a way that didn't overwhelm my backend would have resulted in me not caring enough to do that. But now they get nothing. Even if you're borrowing bandwidth and not paying, you should be a good neighbor is all.

Mostly works, but there do exist a couple of botnets that contain 1 million compromised machines. If each makes one request before hitting backoff, spread evenly throughout the day, that's about 10 QPS alone before they use an IP number twice. But they tend to not actually level out their usage (which is a bummer - if they did they could have kept using it). Instead they hit with a lot of parallel queries all at once.

There's only so much you can really do when your underlying resource is so limited. Luckily the value of the query is lower than the cost of a recaptcha solve, so the attackers moved on to some other target.

Ironically I could now turn off the endpoint protection (or have it responsive to traffic load), until the attackers return. I shall not go into too many details, no need to give people a map.

See sibling, but the endpoint was part of a signup funnel, so short of rearchitecting it completely to put that check after customer creation, there's no real persistent key to rate limit on. Any one IP ended up getting rate limited to 5 requests per hour on that API, but the attack was incoming from what looked like a botnet, so it was tricky.

Endpoint was invoked in our signup funnel, so there was a bootstrapping problem for quota enforcement, the attackers weren't making a whole signup, just getting to the point where the domain search ran.

I run a system at my employer that occasionally gets scraped by malicious users. It can be used to infer the purchasability of a specific domain, which is a moderately-interesting API endpoint, since that requires talking to domain registries. For a while, nobody cared enough about it to abuse the endpoint. But then we started getting about 40 QPS of traffic. We normally get less than 1.

I was keeping an eye on it, because we are hard-capped at 100 QPS to our provider, beyond that and they start dropping our traffic (and it is an outside provider, bundling domain registries like verisign and stuff), which makes regular users break if their traffic gets unlucky.

Anyway, after a week of 40qps, they start spiking to 200+, and we pull the plug on the whole thing: now each request to our endpoint requires a recaptcha token. This is not great (more friction for legit users = more churn) but it is successful. IF they had only kept their QPS low, nobody would have cared. I wanted to send some kind of response code like, "nearing quota".

FTR before people ask: it was quite difficult to stop this particular attack, since it worked like a DDOS, smeared across a _large_ number of ipv4 and ipv6 requesters. 50 QPS just isn't enough quota to do stuff like reactively banning IP numbers if the attacker has millions of IPs available.

> But the point is, unless you are technically skilled, you probably can't tell whether you're about to go to a trusted file or download something random.

Under what circumstances would a link you click on a website or an email _ever_ be a trusted file?

Or maybe layoffs.

The threshold for "obese" and all such labels has changed over the years, in such a way that makes it seem like people are fatter, when in fact the labels have changed.

Some history. https://elemental.medium.com/the-bizarre-and-racist-history-...

Curious about the tradeoff between index builds on insert and general hotspotting if you have sequentially increasing primary keys. I had always thought the latter was a bigger problem (to the point where I would need to reverse the bits of some uuid pkey before writing it). I guess scale matters?

FWIW, if you're the administrator of the organization, you can disable 2FA from the admin console for that user's next login. I've done this a few times for similar reasons.

That's the neat part, you don't.

The problem, ultimately, cannot be solved without disassembling neoliberal capitalism. It is more or less endemic to the system. To a large extent that short termist, get returns and move on before the cost is due, mode of being is how we managed to run an economy that requires constant growth (rather than stability) to function. It's also why we won't solve any of our climate or many social issues.

There's no way to change this without drastically restructuring the utility function people apply to decisions, and that just won't happen until the aftermath of whatever collapse is inevitably going to happen when the planet floods.

On the one hand, I absolutely love working with rxjs on a fairly large angular app as a side project. It affords me the chance to be clever with code, to reason about coordinating multiple asychronous streams, and so on. Firestore gives me observables of the queries I run where the data update themselves, and the user generates events that turn into data mutations. It is all just super great.

On the other hand, I recognize that doing this well and correctly (understanding how to pipe together operators instead of creating lots of intermediate subscriptions manually, which I see a lot in example / stack overflow code) requires a high level of understanding.

It is a whole change in how you think about event pipelines and code structure. I don't think I would want to migrate my day job systems to it, because then you need everyone on the team to develop that understanding. I'm sure they _could_, but working with promises and trad event handlers is a lot simpler, as long as you keep the rest of the data / eventing pipelines simple.

I think there's a pretty clear difference between chatting about interesting puzzles between friends and asking annoying puzzle questions in a job interview. The power dynamic is very different, although honestly I don't often like those socially either. They can be deployed to trip other people up, make them feel small, etc. Can cause social anxiety.

As with most things, it depends a lot on the history you have with those people and the psychological safety you feel, so it depends? Definitely not with someone I just met and is interviewing me for a job.

And FWIW I also don't interview anywhere there are questions like this.

dell xps laptops are (a) pretty nice and (b) do ship in some models with ubuntu as the main OS.

personally, i use an xps15/windows/WSL, mainly because i also use the laptop for video games and so on.

If the viewport meta tag includes user-scalable=no, then it won't scale on mobile. Personally I don't like that setting much, since it is bad for a11y.

It does also prevent accidental zooms when users intend to scroll, so maybe that's a use? Often times the meta viewport tag (which is quite arcane) is just copy-pasted without deep knowledge of what it does.

It's just a mobile thing due to pixel scaling. In the overflow menu, of the browser bar, check the "desktop site" box and you can zoom in.

there's also banks.

Most companies do both. If just asking users questions was strictly better than passive tracking, that's probably all they'd do - analytics have a real cost to use, that cost wouldn't be paid if the information gathered was useless.

But, people are pretty remarkably bad at asking for things. It's mostly the "better horse" problem. People ask for fixes to proximal issues (make this faster, cheaper, better) and not the big things.

In my own product, we use gtm to understand where in our sign up funnel people fall off. It is a complicated product and a complicated sign up flow. Since people who fall out of the funnel are unreachable, we can't just ask them why. But we can observe that (say) 40% of users bounce off of step X, so let's make that step easier.

The problem at hand, though, is that the only reason I can see people working on crypto is precisely for the money. I mean sure, there's some small number of purists out there, but I get DeFi recruiter emails all the time. The only thing they have going for them is compensation.

I would suspect that a large number of engineers working in crypto are heavily motivated by money above all.

Roll back prod?

I mean, I don't know if you can do this with modern c++, but I would occasionally do this when I was being aggressive in my c++ tweaks:

    #define private public
    #import <something.h>

then you can interact with your class private fields all you want.

Just use SWALE, it hasn't done me wrong yet.

Matsutake are delicious. You can get them online in october-november usually if you look around. I've gotten them from www.oregonmushrooms.com. Not cheap online; the dried version are also pretty good, but not as much.

I personally wouldn't pay ridiculous prices for them, but as I live in the SF bay area I keep an eye out when they're in season and you can usually buy them for $20 a pound or so (and a pound is a lot of mushrooms). trim off the dirt, slice them, sautee them in a little fat with onion and garlic, add in some soy sauce, white wine, maybe chicken stock, maybe strips of chicken.

The main thing with matsutake is, like truffles, they have not really been domesticated. You have to forage for them.

There's all sorts of interesting things about mushrooms- the mycelium ends up connecting multiple trees together, and they act in symbiotic relationship to each other, in terms of exchanging minerals and nutrients (which is apparently why they haven't been domesticated yet).

Best hope you don't end up releasing 2.100 then

Can't tell from your UI screenshot, but quite often loading a page with devtools open will disable the cache. I forget if this is the default behavior or not.

One thing you should consider (not an infra eng myself, but I know a lot at the FAANG where I work) is that the infra team gets a lot of requests for stuff like that.

There's a general dislike of special-casing all build deploy run pipelines for some team's snowflake needs, since once you put a feature in, you have to support it forever. So one suggestion is that you look really closely at your own service and ask: can you change that to fit the framework? The majority of times an infra eng gets a request that amounts to "we can't use the framework until it does X", the answer is actually, "you should not want to do X, for reasons Y".

This might not be your specific issue, but if you want the thing soon, work on the parts of the codebase you do have control over.

And in general, yes. This is how big companies tend to work. Teams plan out effort far in advance. I have an ask to a sister team right now for 2022 planning, and I would be delighted if they came back and said "Q1". There's a million things all going on at once.

> Cancel culture at its best. Von Braun was a Nazi. Haber was a Nazi-sympathizer (putting himself in a difficult spot, since he was Jewish) and an horrible person in general. And?

Not sure if you read the linked science article, but there is plenty of evidence that Asperger did some terrible stuff. Not surprising, given the interest in eugenics that was wide-spread at the time, but still terrible enough that yeah, we should probably stop naming things after him.

Parenthetically, if you are interested in making an argument where other people presume good faith on your behalf, avoid the term "cancel culture". Like "virtue signaling" it is a turn of phrase that strongly correlates with bad faith argumentation.

Instead of arguing around the point, go straight for it - don't say "cancel culture is bad therefore we cannot ever question the actions of people who did questionable stuff", instead face the actions directly and say "Yes. Asperger sent kids to be killed because he didn't want their parents to spend time caring for humans he saw as a drain on society, but he did all this other great stuff trying to highlight how 'autistic psychopaths' (his words) would strengthen German society, so we clearly should continue respecting him". Or whatever it is you respect about Hans, you should be able to say, "Despite all the heinous stuff he did, I respect him because of XYZ". Personally, I am all for canceling Asperger (op. cit).

When you just complain about "cancel culture" and don't address the core issue, it is intellectually lazy.

As to the central thesis here- I'm sure that there are different between neurotypical and autistic people. I'm even sure that those differences cluster. That's not the point of the linked article (or its sole source, which others have pointed out is also unsourced) and it is bad faith to argue otherwise.

The linked article claims single causes for most of the claimed observations, almost always rooted in a supposed (and incorrect) universal lack of empathy. Some autistic people behave in a way that implies a lack of empathy, but (a) not all and (b) that only means neurotypicals think they lack empathy, whether or not they do is another thing entirely.

Presenting an unsourced laundry list encourages people to presume that all autistic people are alike, and that the phenomenon is well-understood. It is reductive, and no more useful that any other "scientific" stereotype about race or gender (or zodiac sign for that matter).

On "aspie", I've seen the word used as a dismissive insult too often to consider it a label I'd appreciate applied to me. But that is kind of why I hedged it. If you want to call yourself that, go for it. I mainly wanted to highlight that it is a fraught term and that it is not universally applicable.

As an autistic person myself, but by no means an expert, I can say a few things. Adding here because there are at least two replies to parent that are the same "well, it seems like a useful list" at time of reply composition.

First: Asperger's syndrome is not actually a recognized diagnosis anymore. It's all just autism and autism spectrum disorder. That's in part because we've recognized that it is all part of the same spectrum, and probably at least in part because Asperger was a Nazi. More about both points here: https://www.nature.com/articles/d41586-018-05112-1

Second, while some of the notes in the gist align with my own personal, lived experience, the vibe of lacking empathy absolutely does not. The Leader article cited in the parent comment aligns better with my own experience at least.

Third, that list is absolutely just a random box of facile observations. Note a particular thing about one particular autistic person, and try to coerce it into aligning with a mental model that you think must be true of all autistic people, with no particular actual supporting evidence.

If you're interested in what it is like to be autistic in an informal way, I recommend trying to get your hands on a copy of "Sensory: Life on the Spectrum" https://www.kickstarter.com/projects/schnumn/sensory-life-on... as it is a good, crowd sourced book about all the different ways autism works. If you want a deeper, more scientific analysis of autism, there's plenty of peer reviewed literature out there. But the linked gist in OP is neither (a) peer reviewed literature nor (b) reflective of autistic experience in general at least.

Finally, while some folks self-identity as "aspie", I would find it _extremely_ offensive if anyone used that word to refer to me or anyone else without express permission. Just say "autistic person".