HNHacker News
TopNewBestAskShowJobs

pzb

700 karma · joined January 18, 2011

Peter Bowen

I'm a engineer working at General Motors on a variety of software and hardware projects.

I used to a security engineer at Apple working on iCloud and Apple Cloud Services.

I used to be a Principal Security Engineer at Amazon Web Services.

I used to work in AWS Cryptography and was primarily responsible for Amazon Trust Services, their public CA. My old group also owns AWS CloudHSM, AWS Key Management Service, and some new things. Previously I worked on EC2 and have dabbled in various other parts of AWS.

See http://www.peterbowen.org/ Contact me at pzbowen@gmail.com or peter.z.bowen@gm.com

[ my public key: https://keybase.io/pzb; my proof: https://keybase.io/pzb/sigs/ncn-SquIIOKO-pD9o-CvE96l2zUzrvskCwZ-vo8q8lU ]

submissionscomments
pzb··on Amazon has sold no more than 35,000 Fire phones, data suggests
Principal is a job level. It is above Senior. A single product frequently has multiple Product Managers, some of whom are Senior PMs, some are Principal PMs, and some are "just" PMs. You could even have a Senior Principal PM.
pzb··on EMV and Chip cards
This is a great move to help reduce fraud for their US merchants, but even more important is it expands their potential market. Adding a chip reader opens up the rest of the world.

However, I'm still not sure how they will handle the PIN part of Chip and PIN, as the usual requirement is that the PIN is entered on a dedicated Pin Entry Device which then only presents the unlocked smart card to the merchant register.

pzb··on Amazon’s Cloud Is Growing So Fast It’s Scaring Shareholders
If I total the numbers you present, they had a net $2.2b of positive income (i.e. profit) since 1997. Small profit as a percent of revenue since 1997, but overall profit. The first quarter of this year had an operating income of $108M and the second a loss of $126M. Are you suggesting that the remaining two quarters will have approximately $2.1b of loss?
pzb··on Ask HN: First Contract Job, what to do?
If the company is working to ensure that you are seen as an independent contractor, then they may require you to provide your own tools, such as computer and cell phone. You should also expect that expenses incurred independent of specific performance of the contract will not be reimbursed.

So take your target salary, add the costs of cell phone, computer, laptop, etc plus all your routine costs (internet access, cell phone, business phone, etc) plus all benefits (time off, sick pay, life insurance, health insurance, disability insurance, retirement plan contributions, etc) plus your downtime costs (it is highly unlikely you will contract 40 hours a week every week for the whole year, so you will have unbillable time while you search out your next gig).

You will have to do the math for yourself, but it probably comes to an additional 50-100% of your current salary rate. This calculator is a good start: http://www.rakkar.org/ContractPayCalculator.html

pzb··on Amazon Dash
It can run in AP mode and serves a webpage that asks for the key at which point it switches back to client mode.
pzb··on Officially, the Special Collection Service doesn't exist (2012)
The Google map view clearly tells you that it is the Secret Service training center. Lots has been written about it; it is where they do training for protection details. http://www.secretservice.gov/about_rtc.shtml

The truck in the picture is a vacuum truck. Nothing odd about it, I see them in pretty much every city. They unclog pipes and remove material from dig sites.

pzb··on NSA Rejecting FOIA Requests by US Citizens
You can request the FOIA log via a FOIA request. However the names of the individuals making requests are generally redacted as per privacy laws.
pzb··on Two Senators Say the NSA Is Still Feeding Us False Information
It helps to turns the language around and split it up:

"They shall be privileged from Arrest during their Attendance at the Session of their respective Houses in all Cases, except Treason, Felony and Breach of the Peace.

[They shall be privileged from Arrest] in going to and returning from the [the Session of their respective Houses in all Cases, except Treason, Felony and Breach of the Peace].

For any Speech or Debate in either House, they shall not be questioned in any other Place."

Any Senator disclosing classified details would be violating Senate rules which would then place him or her subject to action by the Senate itself.

pzb··on SSL And The Future Of Authenticity
In what way is a StartSSL certificate any different from a Comodo certificate? What makes StartSSL only usable for "playing"?
pzb··on Ask Joel Spolsky: Pricing – what changed?
I think this is probably a large reason. If your competitor is an order of magnitude cheaper, and not significantly worse, then it gets very hard to compete.
pzb··on Announcing AMI Copy for Amazon EC2
It is a blast! Come join us and help increase the rate we deliver :)
pzb··on Root Domain Website Hosting for Amazon S3
Route53 now supports at least S3 buckets and EC2 Elastic Load Balancers as alias targets. So it does more than just another RR.
pzb··on Inside Team Romney’s whale of an IT meltdown
I would point at the campaign manager as the person who should be responsible. The Campaign Manager is the CEO, the candidate is actually the product being sold. Granted, the candidate is being sold with promise that he or she will be a good CEO, but, during the campaign the CM is the CEO.
pzb··on Heroku Sandy Situation Room
Actually, AWS has more than 10 data centers that make up US-East-1. This was mentioned in the post-mortem published last week.

Availability zones in US-East-1 are at least one data center, but may be multiple facilities in geographic proximity.

pzb··on Multi-Region Latency Based Routing now Available for AWS
Yes, we sleep.

Come join us and be part of the fun that is AWS: http://aws.amazon.com/careers/

If you can name it, we are probably hiring for it.

pzb··on SICP is Under Attack
This is really the root of the problem. Computer science/programming is immature as a profession. There are not clear, broadly accepted rules for what roles exist and what requirements there are for one to fill the role.

Looking at building houses (just the construction side, not the mechanical systems), we have: - Architect - Structural Engineer - Architectural Technologist - Carpenter plus construction employees not officially certified. Each of these has a specific test, both written and practical (apprenticeship), and specific roles in the building process.

In software, we have no standardized tests, so companies substitute "BSCS" for "Software Engineer" in the requirements. And there is only ever one role officially defined; there is no separate "Software Programmer". Internally every companies has "Software Engineer I", "Software Engineer II", etc however this is rarely exposed in job postings and requirements and is never standard between companies.

The software industry could solve all this hand-wringing by creating a set of standardized roles, testing to create Certificates of Qualification for each, and getting HR departments to require these. And it would be possible, even with an established industry. Canada has added several new Professionals over the last decade, working with the existing industry to define the job, requirements, and build a phase-in plan that allowed the industry to continue operating.

pzb··on Student Loans and DOE S.W.A.T. Teams
Every federal department has an Inspector General and the employees are federal agents authorized to carry firearms and conduct raids. However contrary to the article, the OIG agents, like all other officers, have to get a judge to sign the warrant and approve it for no-knock service.

A few examples: NASA OIG: http://oig.nasa.gov/ USPS Postal Inspectors: https://postalinspectors.uspis.gov/ National Endowment for the Arts: http://www.nea.gov/about/OIG/Contents.html

All Inspectors General: http://www.ignet.gov/igs/homepage1.html

pzb··on Inside Google's Secretive Data Centers
Look just south of that point, to the massive unlabeled building with the large gate and power substation.
pzb··on Show HN: Amazon EC2 instance comparison table
The raw CPU performance of the SUSE and regular Linux instances is identical. The difference is purely the Operating System. On the SUSE instances, SUSE Linux Enterprise Server is preinstalled and all updates are automatically available. You do not need a separate subscription from Novell. With the base instances you need to provide your own OS license/subscription as applicable.

(Disclaimer: I'm responsible for the AMIs for SUSE)

pzb··on Amazon Web Services are down
Compared to PaaS provides, Amazon is easy to migrate off of because they are simply giving you virtual hardware.

The basics of their setup are well known: Xen and Linux. EBS is some sort of block-based network storage. True, we do not know the backend storage setup, but it does not really matter. The Xen VM simply sees a disk device. NetApp, EMC, Dell, HP and many others all have products that offer similar functionality, including snapshots.

The only part that is potentially hard to migrate off is the security groups, and then only if you are using named groups. If you are just using IP based rules, most any firewall would work.

pzb··on Dudes, this is so not REST
Many APIs simply specify that the encoding is constant (always UTF-8) so this is not an issue. And many HTTP libraries simply handle the content encoding transparently.

The challenge is some HTTP library APIs commonly used for developing clients offer the following interface: - GET $URL

If you are lucky, then it might also support POST and offer a second parameter for the request body. If are really lucky, there is a way to specify arbitrary methods, but this is fairly rare.

pzb··on Can you use PHP without frameworks nowadays?
You shouldn't need to chroot apache to avoid serving /etc/passwd. I have never worked on a site with chroot'd Apache, and have never run into these kind of issues.

Are you setting your Apache configuration to only allow reading certain directories?

pzb··on How Facebook Ships Code
Product managers are very useful when you are not your own customer. Good product managers are a proxy for your customers, providing you information on the customer wants and needs. Good product managers work with the engineers to prioritize projects; it is not a dictator position, but does help ensure that the less sexy projects get done as well as the uber-cool sexy projects.
← PreviousPage 2 of 2