HNHacker News
TopNewBestAskShowJobs

skyzyx

93 karma · joined February 25, 2011

[ my public key: https://keybase.io/skyzyx; my proof: https://keybase.io/skyzyx/sigs/PRD3BCqkvHryUgieQgNqg1rMuaw4eaVkUQ9pZcn81OI ]

Engineering manager with 20+ years in Software/DevOps/Security. Created SimplePie and AWS SDK for PHP. Patented MFA-as-a-service. The godfather of Serverless. Ambivert. Curious. Not a coffee drinker.

submissionscomments
skyzyx··on Mold linker: targeting macOS/iOS now requires a commercial license
@sacnoradhq: what did you the person building the build system in the first place? Or the one that actually builds the runner instances themselves that everybody else leverages?

What you’re suggesting is certainly the ideal case, but there are lots of things that can happen between where you are and where you want to end up. Saying that somebody isn’t a professional developer just because they haven’t reached the ideal state yet is bullshit.

It’s also easy to go around telling other people what they are or aren’t when you haven’t had the responsibility of building these building blocks yourself. You’re the user of them, not the creator of them. Have some respect for the giants whose shoulders you’re standing upon.

skyzyx··on Mold linker: targeting macOS/iOS now requires a commercial license
Utterly false. I build locally all the time to make sure that the thing works before I commit the code.
skyzyx··on What it feels like to be bullied out of a job you love
It’s called working at AWS and being bullied by a Sr. Director.
skyzyx··on Banks are not repaying victims of Zelle scams
For as bad as education is (talking mostly about the US), cybersecurity education is so much worse.

Also, since our lawmakers are so far behind the curve on technology which impacts daily life (also talking mostly about the US), if you are not proactively learning about and defending yourself against cyber threats, absolutely nobody else is going to do that for you.

Cybersecurity experts have failed to educate at least three solid generations of human life on earth. We can bitch and moan about this post all day long, but the root problem is the societal education problem.

skyzyx··on Ask HN: Should I inform investors that my startup employer is a scam?
Yes
skyzyx··on 1Password delisting forum posts critical of their new Electron based 1Password 8
Like it or not (I don’t), but the Electron apps are here to stay. It’s the direction they’ve decided on. Arguing about it does nothing to move the needle forward. It’s a done deal. I imagine that posts about it are simply unproductive. I’ve posted about it, and my posts are still there.

This past year was the first time since 2009 that I’ve actively looked at alternatives, and there are none. 1Password is in a class entirely its own.

Are there things I wish that were different? Yes. Do I wish they’d bring back features that they’ve dropped? Absolutely. But it’s still the single best product in its category. Nothing else comes remotely close. And they are years ahead of #2.

What’re you gonna do?

skyzyx··on Ask HN: Should I checkmate my employer?
I started building websites in 1997, started my first post-college job in 2004, and and have worked my way across the spectrum from user experience backwards through the stack to operations and architecture over the last 25 years.

What do I do? What value do I bring to an organization?

“Reliability and cybersecurity are critical features of any project, but these things require a deep understanding that most software engineers don’t have. I build platforms and tools which empower teams to ship highly-reliable, highly-secure software by default, enabling low-friction when it’s time to ship to production.”

PHP and JavaScript were my bread-and-butter for 15 years. But I took the time to learn how to write highly effective, modern PHP with types, and linting, and static analysis to point out poor choices in my code.

Besides teaching me to be a better developer, it also made it really easy to pick up Ruby, then Bash, then Python, then Go, and even some dabbling in Swift along the way. With each new language I learned, I was able to bring new ideas back to my day job.

I have both Dev + Ops skills, so I also do a lot of work in AWS (beyond the “Big 4” of EC2, S3, RDS, and CloudFront), Terraform/Terragrunt (with modules), building AWS base images with Packer and AWS ImageBuilder, Monitoring-as-Code with Terraform + New Relic, built custom cybersecurity scanning tools that identified vulnerabilities and poor configurations across our suite of AWS accounts, and more.

Stay humble, and stay hungry, because there is always somebody coming to eat you. As long as you’re respected, feel free to stay. If you’re not being treated the way you believe you should be treated, then go someplace else. Never let your ego get in the way. Never allow yourself to become too proud to make the right call.

Lastly, but probably most importantly, is that very few things are done by individuals. Most things are done by teams. I teach, I share knowledge, and I work hard to build up the people around me, so that we can work collaboratively together to solve the big problems. I try very hard to magnify the talents of the people around me, rather than preventing them from growing beyond my own limitations. Even though I elected not to become a “manager“, I am still a “leader“.

Find the thing you do which drives value, and market yourself that way. You are not a “PHP developer“. You are a “developer who uses PHP as one tool in the toolbox“.

Just like how McDonald’s is not in the restaurant business; they’re in the real estate business. Google is not a search engine company; they’re an advertising company. Facebook is not a social networking company; they’re an advertising company.

skyzyx··on GoDaddy Statement on Eth.link Domain Registration
What should we learn from this?

Don’t make yourself a single point of failure. Always have at least two people who have admin access on things. Have emails go to a distribution list of at least 2, not to a single individual.

The only news here is not actually news. It’s the same way that organizations have been shooting themselves in the foot for decades.

We have learned nothing.

skyzyx··on Zuckerberg says FBI warning prompted Biden laptop story censorship
I think I take issue with the word “censorship”. Is it really censorship if free speech was never guaranteed in the first place?

I mean less the denotative definition and more the connotative definition.

skyzyx··on Gravity Payments CEO Dan Price resigns
This. Exactly fucking this.
skyzyx··on Google’s video chat merger begins: Now there are two “Google Meet” apps
I’ve been watching Google for a long time. And with all of the smart people they have working there, they sure are stupid.

Who the hell is steering the ship?

skyzyx··on US library defunded after refusing to censor authors
Republicans, for all of their bravado, don’t understand the first fucking thing about Constitution.

You can’t have liberty for some without liberty for all. Either you believe in liberty and free speech, or you don’t.

skyzyx··on Ask HN: How to say no to a GitHub issue feature request?
The requester is wrong.

You are the project leader. You are the decider when it comes to the project. Do you think this makes your project better? If so, cool. If not, say so.

If someone is badgering you, then feel free to charge them money for your time. They can choose to sponsor the development of a feature that can be used by everybody. Or they can choose to pay you for custom development that they would own after the transaction.

One thing that I do (in the US) is I have very specific guidelines about the transfer of copyright and licensing. I own the copyright to the code, full stop. I don’t offer copyright for purchase. What I do offer is a long-term, royalty-free license to use that copyrighted software that I give them once payment is made in full.

If they use my code or my designs without a license, then I have the ability to file a copyright infringement case. Thanks to the Recording Industry of America (RIAA), copyright infringement cases can be upwards of $150,000 USD per infringed copy, which can be translated into a download, which can be translated into a website visitor. Very quickly, companies realize that it’s in their best interests to pay what they owe me.

Having said all of that, if you don’t want to do it, then just don’t do it. But you have to have the backbone to say no. Set boundaries for yourself, and then enforce them. But backbone is what makes the world go round.

skyzyx··on What I'm Frustrated by in Crypto
Oh. Talking about crypto-currency as opposed to cryptography.
skyzyx··on Stop saying “They shouldn't have invested more than they could afford to lose”
TLDR:

1. Scammers exist. Fuck those guys.

2. Dumb people are dumb.

Both things are true. You can’t call-out one without calling-out the other.

skyzyx··on Netflix Homes
My wife and I live in the US. My kids spend the school year with their mom in Canada, and spend summers, vacations, and many weekends here in the US. We’re only about 100 miles away from each other, but it crosses an international border. For more than a decade, my kids have been on my account. All of their history and recommendations are attached to their profile in my account. If they want to move their profiles over to their mother’s account for the nine months of the year that they are in Canada, they can’t. They just use their existing profiles in my account at both homes.

In my case, nobody is “stealing” anything. My immediate family has had to deal with these international issues for about eight years, where the kids spend about three months in the US and nine months in Canada every year, crossing the border every 3-4 weeks.

I have no idea how Netflix’s changes are going to affect my family.

Taking another example: Disney+ and Hulu. Hulu is majority (but not entirely) owned by Disney (post-20th Century Fox acquisition). In the US, we have Disney+ and Hulu as separate services. In Canada there is no Hulu, but Disney+ offers something called “Star” which is more-or-less non-US Hulu. In other words, Disney is already getting 2 subscriptions out of me in the US for content that only requires one subscription in other countries.

But I don’t mind. Why? Because Disney has high quality content. Even if I don’t want to watch it, none of it is necessarily “bad”. Netflix, OTOH, churns out so much garbage. And most of their original shows get canceled far too early. I now avoid most new Netflix shows until it has a few seasons under its belt, because I’m tired of getting invested into shows that are canceled after a cliff-hanger.

Ted Sarandos: I’m looking at you.

skyzyx··on Netflix Homes
If you mean geographical location within the same country, sure.

If you mean across multiple countries, it gets dramatically more complex. Copyright holders sell streaming rights based on countries and all kinds of other continent negotiation details.

skyzyx··on AWS open sourced the AWS console design system
I was working to solve this exact same problem while I was at AWS on the design team from 2012 to 2014. I had spent the previous two years working on the SDK team (2010-2012). I’m a software engineer, who got his start in user experience, so I was able to work on the visual and interaction design with the designers, and then turn around and write the code for it as CSS classes, JavaScript, and components. It was called Plutonium.

Myself and my manager were constantly at odds with the Director in that area of AWS. He had no respect for designers or design, and kept pushing GWT, because he didn’t think web developers even needed to be working at AWS in the first place. We were actively and regularly working with the core Console team, as well as individual engineering teams who were building their specific sub-consoles (EC2, SQS, etc.).

I left in 2014. My manager left in 2015. Even though this doesn’t appear to be a direct extension of our work, this is absolutely a spiritual successor to the project we kick started all those years ago. Congratulations to the people at AWS who continued the good fight, and did what was best for customers against the whims of middle-management.

skyzyx··on Ask HN: Why isn't GWT or Vaadin more popular among Java developers?
GWT can fuck right the fuck off.
skyzyx··on Rust Editors to Replace TextMate 2 – The Agony of Despair
After TextMate 1.x stopped being updated in 2010-ish, I moved to Sublime Text which felt very TextMate-y, but was a much better piece of software.

Then, in 2020 as the pandemic began, I decided to give Visual Studio Code a try. For this experiment, I chose to use it exclusively for one full week doing real work, and finding solutions for the things that bugged me.

I think it’s been more than a week at this point because I’m still using it full-time. It has a full development team (instead of 1–2 developers who go back-and-forth and how active they are in maintaining the project), and the community who builds things for it is gigantic.

Yes, technically it’s slower than either TextMate or Sublime Text. When I run Linux virtual machines or other lower-performance systems, I use Sublime Text. But after Ogden failed to update TextMate for 4–5 years, I decided it was time to move on. I haven’t used it in over a decade.

skyzyx··on Texas Freedom Caucus Warns of Illegality for Companies Funding Employee Abortion
American conservatives are utterly hypocritical and self-inconsistent. The things they believe don’t even pass the sniff test with their own rhetoric.

It’s not based on logic. It’s based on emotion. America was founded by the Puritans.

It’s not about life, it’s about control.

skyzyx··on Congratulations: We now have opinions on your open source contributions
To me this sounds like “I don’t want to do the thing that is obvious and sensible because I just don’t wanna.”

Personal liberty? Sure. But not when your personal liberty negatively impacts the rest of society. Just like how you’re not allowed to shout “fire“ in a movie theater because of the harm it could potentially cause. Your personal liberty ends where danger to others begins. If you don’t want to use 2FA on your Google account, knock yourself out. The context of Pypi is different.

Yes, everybody should be using 2FA. And we should also be looking into how to perform package signing and verification. Of course we should. This isn’t your grandfather’s Internet. These are table stakes in 2022.

I hope that there is a future where Pypi mandates those things because they’re good for everyone. They improve things for the entire ecosystem. I’m sick and tired of discovering that Python packages I depend on are being hacked or typo-squatted by malicious packages.

Oh, and get vaccinated — because it’s exactly the same premise. Stop being selfish.

skyzyx··on Ask HN: First-time dad-to-be. What do you wish you'd known back then?
There are a lot of these that I would agree with as well. These days, my daughter is 21, and my son is 17. Here are some things that I’ve learned that I haven’t seen mentioned yet.

1. Don’t make a habit of being quiet because the baby is asleep. Go about your day, do the things you normally do, and talk at your normal voice. This will allow the child to become accustomed to having noise around when they’re trying to sleep. Otherwise, as they get older they’ll tend to be lighter sleepers, and not sleep as well. If the kid gets tired enough, they’ll fall asleep.

2. I never really talked “baby talk“ to my kids. I never really treated them as “less than“ because they were young. I will talk to them with the same attention as I would talk to anybody else — although when they were younger, I would definitely adjust how I explained whatever it is. About two years ago my son and I were driving somewhere, and he mentioned that this was something that he had always appreciated.

3. Find ways to connect with them. Spend some time in their world with them. Yes, your parent, and your job is to raise them. But meeting them on their level, sitting down on the floor next to your child, fluffy bear, fuzzy bunny, and a bunch of tea cups is a great way to build deep connections with your child from a very young age. As my daughter got older, she loved reading and‘s I would ask her about her favorite books and the characters in them. She’s now a “dungeon master “at D&D parties. My son got really into Minecraft and building these worlds with blocks, that’s why I spend time with him talking about things that could be built. Now, he has his sights set on becoming an indie game developer.

4. Don’t try to make them a copycat of yourself. You are the only you that exists. Instead, help them become the best possible versions of _themselves_. Who _they_ are.

5. No two children are alike. Once you get everything dialed in for the first kid, if you decide to have a second kid, that kid will be completely different. This means that the way you teach things, the way you discipline, the way you do pretty much everything will be different for each kid that you have.

6. Be consistent. You and your spouse should always have a “united front”. You can debate, argue, complain, whatever to each other in private. But in public, in front of the kids, you need to be united. If you say bedtime is 8 o’clock, then bedtime is 8 o’clock. The kids will always try to weasel their way into getting more, or less, so set a few ground rules and keep them. You could always reassess and adjust them as they get older. But kids thrive in structure, so give them the reliability of things they can depend on.

7. One thing that I did when the kids were growing up was to count to 3. There were no halves, no three-quarters. Simply 1, 2, 3. I would tell them that they needed to do something, and if they ignored me, pretended not to hear me, or something else, I would begin the count. I would count one, then repeat the instruction that I had given them before. Then I would count two, and repeat the instruction again. But if I got to three, then it was the end of their little child world. My daughter, who is now 21 years old, has only gotten to three maybe five times her entire life. Two of them were before the age of three.

8. I have a zero tolerance rule for disrespect. I have told them they are free to disagree with me, they are free to feel angry if they don’t like something, they’re free to present their side of the argument if they want. But it will be done respectfully, and with a respectful tone. And I will always show them the same respect. If they start to mu or something under the breath, or back talk, or something else, I will fire warning shot by asking them if they have forgotten who they’re talking to. That’s usually enough and they bring it back down. They know that dad doesn’t fuck around like that.

9. Perspective matters. Your job is not to tell them what to do. Your job is to teach them how to become well-adjusted, fully functional adults. Part of that job it may include telling them what to do, but when they get older they need to be able to make decisions for themselves, and they can’t do that if they spent their entire life being told what to do. When they’re younger and up through the preteen ages, it’s mostly telling them what to do, with some amount of “why“ being part of the answer. As they become teenagers, the amount of telling them what to do lessons, but should be replaced with teaching them how to reason about a situation. You’re not always going to be with them, and if they don’t know how to reason about the situation because you’ve always told them what to do, they’re not gonna be very good at making good decisions for themselves. So you have to teach them how to do that. And that will continue shifting until they become young adults who are moving out and starting their own lives on their own. you never stop being a parent, but the way that you parent changes over time.

10. I’m going to end on this. Make sure that your child knows definitely, unambiguously, and confidently how much you love them, proud of them, and will always be there for them. “I know, dad“ with an Iroll will prove that you’re doing this well. They know it so much that they’re sick of hearing it. But that’s OK, because there are a lot of kids out there who don’t know how their parents feel about them, and that sticks with them for the rest of their lives. And don’t just say it, but show it. Go to their performances, go to their sports games, go to their place. Even if you think it’s boring hearing your kid play their instrument out of tune in an auditorium with a lot of echo, you do whatever you need to do to make sure that they feel like they absolutely killed it. The next school performance will be even better.

I hope this helps!

skyzyx··on Papers on GitHub Copilot, copyright law, and ownership for AI-generated code
I think this is an interesting discussion to have, and I’m interested to see where the lawyers end up on this.

But please don’t start with an organization as utterly biased as the FSF.

skyzyx··on Ask HN: Does anybody still use bookmarking services?
Since 2006, I’ve gone from:

Delicious → Ma.gnol.ia → Delicious → Pinboard/Instapaper → Raindrop.io

skyzyx··on Show HN: Terragen.dev – Automagically Generate Terraform for AWS
I think that too much simplification without empowering people to understand how the pieces work is ultimately a detriment.

It’s important that there is a human understands how the stuff works that’s getting shipped to production. You can’t skip that step, or who knows what kinds of vulnerabilities and miss configurations will end up going live.

In my opinion, rather than building a tool for people who don’t understand the stuff, your target audience should change to instead be those who DO understand this stuff. This is not something that can be solved with automation-only if nobody understands how the pieces work.

skyzyx··on Show HN: Terragen.dev – Automagically Generate Terraform for AWS
I disagree that it’s complex for the sake of vendor lock-in. Having spent four years working at AWS I can tell you that it’s complex for two reasons:

1. Some of the stuff is genuinely complex.

2. The software engineers and development managers regularly ignore the user experience teams and their feedback.

skyzyx··on Show HN: Terragen.dev – Automagically Generate Terraform for AWS
This.
skyzyx··on Show HN: Terragen.dev – Automagically Generate Terraform for AWS
Sounds like you should find a new job with a better company. Your company culture sounds like shit.
skyzyx··on Show HN: Terragen.dev – Automagically Generate Terraform for AWS
Even Google hasn’t really solved this problem very well. A lot of Terraformer resources are incomplete.
← PreviousPage 2 of 4Next →