twunde

One thing that's been interesting is that there's been a noticeable dichotomy in how people and companies have been affected. Those who are lower-class and potentially worked in retail or restaurants have been slammed economically with the stimulus checks and the rent forbearance being one of the few things keeping them afloat. Yet if you talk to those who are middle class or upper-class many have done incredibly well since the stock market has gone up and their cost of living has decreased. From an industry perspective, there's been a shift in spending and some industries like ecommerce, groceries, video games etc have done extremely well.

To add on to this, this results in an odd job market where demand for COBOL programmers is pretty low most of the time since there isn't a ton of work, but when a company does need to hire COBOL programmers its much more difficult to find them and hire them. Which leads to these common stories about COBOL programmers being in demand, when the reality is that most have a hard time finding new COBOL jobs, especially without needing to move.

Off-topic but do you work for Eversource? An ex-coworker of mine found a bug that he immediately recognized as a COBOL bug while working with Eversource CT's EDI

This may have been true in the past, however per https://www.shopify.com/security they are SOC2-certified (SOC2 is significantly more common in North America), they are certainly PCI Level 1, and have GDPR/CCPA compliance requirements. You can also see their 2019 Transparency Report: https://www.shopify.com/security/transparency-report/report-.... It is still possible that their SOC2 and PCI reports could have a number of exceptions, but I would be surprised at this point in their maturity cycle.

This is a common requirement for security-conscious organizations, especially those with HIPAA or PCI requirements. For shopify, this likely was originally created as a customer requirement, so that clients could monitor their staff. The typical setup is to generate internal user logs and feed it into a SIEM of some type, potentially with custom rules to do some checking. Alternatively, this may very well have been caught by a type of DLP (data loss protection) or network monitoring product

From what I've heard from ex-FB employees, they are told repeatedly during onboarding that snooping for personal reasons is a first-offensive firable offense, to the point that engineers often won't try to look up information even when debugging prod issues.

TX is __slightly__ different in that its fully deregulated and there's simply more knowledge about REPs/ESCOs and their pricing (because they customers HAVE to choose a REP). Also in what other state do you see billboard ads for REPs?

What is genuinely sad is that Griddy has a "price-lock" (ie a fixed rate) for the summer, which is exactly what you're talking about regarding tail risk. They just don't have it for the winter, which is normally the cheapest time in TX and clearly couldn't set up a decent fixed rate quickly after they understood the implications of the polar vortex. What they should have done is sent an email to their customers offering a fixed rate for the month even if it was expensive.

Small quibble here. I'm pretty sure that most regulated companies do NOT own their own generating plants, since for a long time they were legally not allowed to be in both the distribution business and the generator business. I _think_ this was from the Public Utility Holding Company Act (https://en.wikipedia.org/wiki/Public_Utility_Holding_Company...) but it was ~ 15 years ago when I toured an Entergy power plant and heard the explanation so I may be wrong. I suspect that this still holds true for regulated utilities since the conflict of interest is pretty high.

What has been a recent trend is generator companies purchasing supplier companies (for example Calpine purchased Champion Energy and Noble Solutions)

Regulated suppliers operate somewhat differently than deregulated suppliers. 1. Regulated suppliers have rules around how much a rate can change, and those rate changes have to be approved by their respective PUC. This limits the sticker shock. 2. Regulated suppliers do this in exchange for a guaranteed profit for their distribution side (they have a government approved local monopoly). They also tend to be the biggest supplier since they are usually the default supplier. Because of this, these companies have both more cash on hand and more ability to borrow in case of a cash crunch caused by issues like this. They also have a tendency to be better about hedging for circumstances like this.

Basically the regulated suppliers will probably see some rate increases but they will be more gradual and certainly won't be as wild as rate increases by deregulated suppliers.

PS deregulated supplier is a bit of a misnomer. They are still regulated by the state Public Utility Commission, but they are less regulated than the utilities that also do distribution.

Not directly.

In Texas and other deregulated markets, you can be on either a fixed rate for n months or on a variable rate. If you're on a variable rate, the rate will be much higher than normal for the next few months. If you're on a fixed rate you're fine for now, but keep an eye on when your fixed rate expires. This assumes that your supplier is still in business after the next few months (many suppliers will go bankrupt because of this). For the suppliers, they're going to be hit hard by people who either decide not to pay their supplier next month, or have people who switch to budget billing. They're going to suffer a cash crunch for a bit.

If you are in a regulated market or are using the regulated utilities like ConEd in NYC, you'll see limited rate increases to deal with the increased cost to supply. These rate increases need to be approved by the state's Public Utility Commission.

As a former PHPer myself, I agree with you on all counts. Python's tooling, especially around package management is _terrible_, hand's down the worst of any major dynamic language, even comparing where they were 5 years ago to where Python is today. Virtual environments are Python's "solution" for local installs, where everyone else supports local installs by default. There's no standard way to specify dev dependencies, they're just all dependencies. Thankfully now most things are pip installable without problems unlike 5-10 years ago, but you'll still occasionally run into weird easy_install/setup/wheel issues.

I'll note that my other complaint is the quality of many open source libraries are a significant step below their counterparts in PHP, Ruby or JS. Django, boto and presumably the data science libraries are top notch, but after that even heavily used projects like celery lack the level of polish that major projects in other languages have.

1. There's a good chance that the malware has updated your browsers preferences, especially if you're using Chrome (which syncs preferences/profiles). To test this, you can try using a different browser and see if they have the same problems.

2. If you're a Google/Gmail/GSuite user I'd suggest that you log out of all sessions by following the instructions in https://support.google.com/mail/answer/8154?co=GENIE.Platfor...

3. I wouldn't count out Best Buy/micro center/whatever. Many of the computer support calls they encounter are around removing malware

For those interested in understanding the security of Chrome extensions, duo introduced CRXcavator (https://crxcavator.io/) a while back, which does some risk scoring around permissions. It is chrome-only, and it doesn't protect against this type of attack specifically, although you can look at the Potential External Communication section for possible issues.

Neverware's original business/idea was in enabling massive reuse of older, slower computers in the education space by making them thin client devices if I remember correctly (back when it was 5 guys working out of General Assembly). Anyway congrats Jonathan and crew. It's been a long journey

It was almost certainly the state public utilities commission PUC, which depending on the state may have a different acronym (PSC is also common). These regulate telecom, water, and energy companies including ESCOs (companies that in theory reduce your energy bill by charging you a different rate than the local monopoly). For companies regulated this way, PSC complaints are extremely effective.

While most mid to large size enterprizes are likely running Active Directory, it makes sense to set up SAML as GSuite, LDAP and Active Directory all support SAML workflows including Just In Time (JIT) provisioning.

Sorry, I should have edited. This is why the article is NOT a HIPAA violation. Damn you slack distractions

Why is this not a HIPAA violation?

HIPAA is a US law that's focused on protecting the privacy of a person's medical history. In SQL terms you can't JOIN a person's identity with their medical history (unless explicitly authorized). However aggregated data is allowed, as long as it can't be easily reverse-engineered.

It's more akin to making and then running a CDN but only charging 10% of customers. I'm sure Docker the company was writing it off as a marketing expense, but if they were running this in one of the public clouds that charge for egress, they were paying out a boatload of money just in egress charges (plus more in storage costs)

RDS takes care of 1/3 to 1/2 of the configurations, particularly around hardware related options. However, since postgres uses MVCC, it has a lot of tuning options around autovacuum and replication that impact performance. This is even more true if you have access patterns that don't take into account postgres' MVCC (are you updating 10%+ of large tables daily, triggering autovacuums?) but which would be fine with mysql

who doesn't love x12, especially with its loops and segments?

John Yoo is somewhat an unusual case, and he was held to account to some degree. If you read the Office of Professional Responsibility Report section in that wikipage https://en.wikipedia.org/wiki/John_Yoo#Office_of_Professiona... you'll see that he had to go through debarment hearings and was almost disbarred.

A better example of these legal standards holding lawyers to account is Prenda Law: https://en.wikipedia.org/wiki/Prenda_Law

It depends on your speed requirements and whether calls are being sent async or not. Also keep in mind that even with internal apis, an api call is usually multiple network boundaries (service1 --> service2 (potential DNS lookup) --> WAF/security proxy --> Firewall --> Load balancer --> SSL handshake --> server/container firewall --> server/container). Then you get into whether the service you're calling calls other apis etc. You can quickly burn 50ms or more with multiple hops. If you're trying to return responses within 200ms you now have very little margin.

Just a head's up, while you can proxy websockets via cloudflare workers, you cannot have them act as the endpoint (https://support.cloudflare.com/hc/en-us/articles/200169466-U...).

It's much rarer to see $_SESSION or $_COOKIE nowadays. Most frameworks have session libraries that have some validation checks built in, handle csrf/flash messages and easily plug into backends (being able to have sessions use redis, etc in 2-3 lines of config makes session handling soooo much easier. And you're less likely to run out of disk space :P).

The main issue with $_SESSION was that it is very easy to create a giant multidimensional array and have inconsistent logic creating fields. Another advantage is to bring the session variable in line with that of other languages so that devs switching languages won't be WTF as often

`The market decided to take away the power of a real programming language DSL as an interface. People are now forced to deal with terraform (HCL), YAML or JSON. It's a lobotomy` I feel this so much. Granted HCL is taking steps to become closer to a real language but its frustrating that some of the features that I used to take for granted are missing (why do we have ternary if statements in HCL but not real if-else blocks. I used to enforce a rule that you should not have nested ternaries, but now that's the only way to do if else if statements)

So if you look at the copyright, it was from 2005-2007: [https://github.com/opencats/OpenCATS/blob/develop/constants....]. Maintaining and upgrading PHP from that long ago is a real challenge and typically involves several major rewrites of the core. For anyone reading through the code, this is where a significant portion of the code smell comes from especially since some of the updates were never finished (an example is that namespaces are setup to allow autoloading, but the files I looked at also had include_once in the files). The global $_SESSION['CATS'] is almost certainly from the 2005-2007 era. Then there is the faux security fixes (sprintf'd sql instead of parameterized queries.). FYI, the age of the codebase also explains why they're using MyISAM instead of InnoDB.

This gives me flashbacks of early career codebases. I've seen so many of the mistakes here (including the HTML in the db. God, I remember the original dev being so proud of that mistake. 2 devs working on the same page? Who's going to overwrite the other's html?)

Thanks for adding the sources. I'm 80% sure that The Grid [https://www.amazon.com/Grid-Fraying-Between-Americans-Energy...] had discussed electric cars helping solve some of the distribution/transmission problems, but that was from the view of the large power companies, not the smaller local munis (and maybe paired with smart meters? It's been a while since I read it). However, after reading the two articles you cited, it's actually just moving the bottleneck and in the wrong direction to a point where it's harder to manage changes.

I was actually thinking about the long-distance transmission lines, but that's a good point about potentially needing to upgrade local lines. As a non-EV owner, I can't discuss much but I was under the impression that you could just plug in to a normal wall socket for a slow charge. I suspect that you're referring to the Level 2 quick charging station. If that's the case, that would certainly impact you depending on how old your house is and whether you're running your own solar panels

FYI, if you have a source, I'd be interested in reading about it.

Tesla is actually a good example assuming that you believe that lithium mining is better than coal mining or at least an equivalent problem.

Tesla's utility-level batteries (MegaPack) make wind and solar projects more economically feasible since any excess wind can be stored instead of being sold at negative rates when its not being used. These batteries will allow the replacement of many coal-powered generator plants since those are typically used for peak times when we need more energy. They're responsible for pushing the electric car revolution forward (making it fashionable), which is forecasted to lead to less peak energy usage and a more balanced usage during non-peak hours (since people will be charging their cars at home after hours). In theory, this reduces the need to make upgrades to the US electricity distribution network and we should lose less energy transporting it. This also reduces the need for oil, and could prevent more wars in the middle east (since their major resource is less valuable)

Stripe may expand "up market" at some point, but at the moment they're pretty enterprise unfriendly and don't seem interested in becoming enterprise friendly. You can't pay for phone support, their PCI compliance can cause some enterprise customers to blink and even if you're funneling millions through them they won't negotiate on price like other payment gateways. Also many of their more advanced features, just aren't that well implemented or documented (think connected accounts, etc) and since those cases aren't as heavily used we've had to side-channel to a C-level to get an issue expedited after bouncing around support for a show-stopper bug.

Additionally as a sidenote, that market is quite crowded with a LOT of choices. This is certainly not a winner take all industry, there are literally 20+ choices that will be reliable. Typically most large enterprises will end up with a vendor that will give them a good deal on rates, which isn't Stripe.