3,526 karma · joined May 14, 2012
Socials: - github.com/rdegges - linkedin.com/in/rdegges - reddit.com/user/rdegges - instagram.com/randalldegges - https://bsky.app/profile/rdegges.com
---
I'm just a happy programmer that likes to hack stuff.
You can contact me via my site: https://www.rdegges.com/ or via email r@rdegges.com
The rate at which constitutional protections are being undermined, attacked, and rule of law is being thrown to the wayside is crushing and astounding. For the first time in my life, it appears that there are no longer any protections in place to help prevent an authoritarian regime from fully taking over our government, and it feels surreal to be living through this in real-time.
The TL;DR is that our security research team routinely hunts for various vulnerabilities in tools developers use. In this particular case, we looked at a potential dependency confusion attack in Cursor, but found no vulnerabilities.
There's no malicious intent or action here, but I can certainly understand how it appears when there's not a ton of information and things like this occur! As a sidenote, I use Cursor all the time and love it <3
The only thing I have to add is that this same concept applies to just about everything -- it isn't just a cybersecurity industry problem.
- Bad writing keeps Grammarly in business - Developers doing a bad job at confirming to a codebase's style guidelines causes code linters and formatters to stick around pervasively - Bad authentication and authorization practices keeps Okta/Auth0 in business - ... <the list goes on and on>
- Generative AI uses the context you provide to help generate additional tokens
- If the context you provide is bad (low-quality code, riddled with security issues), you'll similarly get low-quality code generated
- If the context you provide is good (high-quality code), you'll get better-quality code out
The thing we wanted to highlight with this research is that security is meaningfully impacted when you're generating code, particularly with low-quality codebases.
Now that I’m older, I’ve noticed that I just can’t do it. If I don’t sleep 7+ hours a night I feel TERRIBLE: my mood is worse, my focus is worse, and my overall productivity drops off a cliff.
Last year I was put on a medication with the unfortunate side effect of causing insomnia which made sleeping a full night extremely difficult and it was a struggle. Thankfully, after changing medications a few months ago to an alternative I’m sleeping great and no longer struggling.
My advice is to look into sleep hygiene and follow all recommendations. If you’re still not sleeping well look into medications and do whatever you can to treat your body right — it’s worth it.
My thoughts around code quality are generally that if you're writing code for yourself (as a hobby, for open source, whatever) -- then write code however you want, as it's for fun. Obviously, others can contribute fixes and help make things better, but there's no professional "responsibility" in these cases.
On the other hand, if you're writing software meant to be used by others (including companies you work for), it's your responsibility as a developer to ensure the code you're pushing is:
- In compliance with style conventions
- Properly reviewed for security issues (tools like Snyk and other SAST/SCA tools work well for this)
- Makes architectural sense given the rest of your codebase
- Is documented so others can easily contribute/review without a lot of handholding
The rules above are true regardless of how the code is being generated.
Just as a note -- that's a good amount of exercise, even if once a week. Burning 1,000 calories is a lot of physical movement.
While some people prefer to keep a separate personal and professional identity, I chose to do the opposite and refused to create separate personas. I'm 34 atm, and have been working in industry full-time since I was 20.
Here's a few observations from my own experiences here:
1. If you're willing to bring your personality to work with you, it'll help you make friends. Some of my best friends are people I've met through work while just "being myself". 2. It opens opportunities you may not be aware of. Years ago I ended up switching from being a founder/CTO-type to working in Developer Relations where I would spend ~50% of my time building software and ~50% of my time doing marketing-related work (writing articles, giving presentations, etc.). I fully attribute this shift to my personality, and it's been a great fit. I really enjoy the work I do and feel like I can be my authentic self at work. 3. I've also been in situations (similar to what you describe) where I don't fit in with the corporate culture. For example, I worked at Okta for ~4.5 years or so and didn't blend in with the corporate culture AT ALL. I still feel like I enjoyed myself and made a large impact, but I certainly wasn't expecting to become a VP there or anything like that.
My advice: just be yourself and optimize your work so it's something you can fully enjoy without putting on an act.
I've been journaling with it for two years now nearly every day and it's 100% wonderful. At the end of each year I order a physical copy of the journal for my personal archive. Highly recommend.
This past week I couldn't stand the thought of giving Elon any more money and canceled all those purchases -- I'd be SHOCKED if Tesla and his other companies don't end up suffering based on his complete 180 flip over the last few years.
I've got one of those legacy Google Drive unlimited storage plans, and for years I've been using it to store all my code, video projects I work on, etc.
The way I normally use it is inefficient: if I was importing videos for a project, I'd use the Google Drive web UI to upload them into Drive, where I'd later organize them, etc.
Over the years I tried a variety of Goole Drive syncing tools, but all eventually stopped working, or were so unbearably slow that I couldn't justify it.
Last night I spent some time and set up rclone for Drive, along with a persistent mount so that Google Drive is always accessible via ~/Drive. So far it seems like everything is working well -- really amazing software! <3
I bought the full featured version and was soo happy... Until they killed it off. Now I'm on an iPhone and Apple Watch and it's ridiculous to pay to subscribe just to be able to control it from my watch. Feels ridiculous.
If they brought back even an expensive, $80 one-time purchase fee I'd be more than happy to support.
Why do governments (or any groups of people, for that matter) feel the need to impose their moral values on others? What does it matter how someone looks, dresses, or acts so long as it isn't causing harm?
I remember meeting @craigkerstiens through Heroku -- I started using it back when they first released a beta Python buildpack. I also made friends with a ton of amazing people over the years through Heroku. It was a magical company with amazing engineers.
Over the years I've written a lot about Heroku on my blog (https://www.rdegges.com/), and even wrote a book on Heroku many years ago (https://www.theherokuhackersguide.com/), which really helped improve my technical writing chops, and got me into the public eye.
RIP Heroku
They should absolutely remove these, totally insane these fees exist in 2022.
The important things I’ve done to make myself feel more satisfied in my life are:
- Be grateful for the things you have. Write about them in a journal, talk about them with your spouse, etc. - Give back. Donate money to a cause you care about, get your hands dirty volunteering, do something to make the world a little better. - Recognize that you’ll never be 100% satisfied and that’s OK. Continue moving up in your career, invest in keeping your relationships strong, etc. Don’t get lazy.
Talking to a lot of peers over the years, I've realized that most people carry around insanely high levels of debt and grow accustomed to spending multiple thousands of dollars per month on debt servicing. It's crazy how much of a difference it can make to get rid of those and free up all that cashflow.
Obviously, this isn't doable without an income buffer, but if you are able to cut down expenses for a while and aggressively pay down debt: it was one of the best decisions I made early in life.
When I took a few months off, however, my perspective changed. After the 2nd month of doing nothing, I started to really miss the intellectual stimulation of hanging out with other engineers, working on shared goals, etc., so I decided to go back to work at a new company.
I'm now happily employed full-time, working with a larger team, and still building things in my free time. Life is busy, but I enjoy it.
I still think this may be my eventual destiny, but for now I'm happily working with other people and just trying to enjoy life as much as possible.
If you treat blog posts as ephemeral, it means you'll write them once, ensure they're accurate, then leave them there forever. Unfortunately, with technology stuff, that rarely works. Technologies change, libraries break, facts now might be different in two years, etc.
One of the things we're currently working on is tagging all of our technical content so that once a year it pops up in a review board somewhere and someone reviews it for accuracy, updates it if necessary, etc.
This way, technical stuff will still be useful to readers (hopefully) a couple of years from now.
I discovered that I love writing software when I was a kid (maybe 12 years old?) by writing automation bots for video games: it was so incredibly fun to write a bot that would play the game, level up your characters, and do things that would otherwise take thousands of hours of human grinding to achieve. This passion never left me, and now, more than 20 years later, I still spend a good chunk of time building little scripts/tools/utilities/apps that help me in various ways.
The writing was something that I also got started on early. I discovered my love of writing through IRC where I'd routinely answer people's programming questions and eventually write blog posts explaining answers in more depth than I could fit into a short IRC conversation.
I don't blog as much today (life gets busy), but I do spend a lot of time writing at work, working on the occasional long-form blog post, and ... journaling.