vinay_ys

> Experts Recognize, Beginners Reason

> System 1 is fast and driven by recognition, relying upon pattern recognition in long-term memory, while system 2 is slower and focused on reasoning, requiring more processing in working memory.

Interestingly, today, LLMs are augmentation for someone's weak system 1, and allowing them to focus solely on strengthening their system 2. LLMs and popular/cheap/generalizable AI today suck at system 2. So, if you are really good at system 2 and suck at system 1, the next decade is going to be amazing for you.

Don't use that then. Tell that vendor their security posture is bad.

this doesn't scale – what happens when you want to add another piece of information? how do you change the schema for all the names?

heh. no, don't use IPs either. You use well-known service names and use a dedicated service discovery mechanism to reach your service nodes in a resilient and scalable manner.

Yes, it is much easier to build and scale a general config service that can serve keys (like names in dns) and associated config snippets with versioning and expiry/go-live timestamps etc. Such a service enables us to build on top of it things like service discovery, failover, draining, cutover, weighted load-balancing etc. It is much easier to also control/orchestrate/audit changes to key-configs in globally consistent transactional manner and guarantee these changes will be instantly visible to every client or will be deterministically spread-out/staggered etc. It is also much easier to do interpolation of config variables arranged in a hierarchical class namespace. All this makes it a lot more powerful building block for large scale infra services than dns ever could and it has none of the drawbacks of dns.

DNS is for friendly names; friendly to humans using web browsers. Using DNS for machine to machine communication is not essential complexity. Every chance I get I eliminate DNS from internal infrastructure and a whole lot of things get a lot better. If you naively keep forward/reverse DNS resolutions on in different parts of the stack, you end up with a shitstorm of DNS lookup requests at even a moderate scale infrastructure. Then bad things tend to happen.

Even if only genuine hotspot apps got the entitlement, it is not a user-friendly privacy-first design. Such API use should trigger a user-visible permission dialog before apps get background-notified and user should be able to select the one of "allow-once, allow while using, allow-in-background, never" and the app activity should show up in app privacy reports.

I get the warning "your contact key has changed.." all the time with various contacts on WhatsApp. What am I supposed to do? there's no clear next steps to debug / report of suspicious activity. In such cases, users get trained to become complacent of such warnings.

Why does Apple couple iMessage with rest of iCloud? Why is iCloud and iCloud Keychain being on a requirement for secure iMessage to function? That seems like a poor design choice to me.

For someone who cares about their communication security deeply enough to do contact public key verification, they would likely want to turn off iCloud syncing iMessage across multiple devices. They are likely to not have same iCloud account on multiple devices. In such cases, what's the value of having iCloud Keychain being turned on?

In the past with Java 8 JFR wasn't free for use in commercial production environments. So we built our own profilers. It's nice that with NFTC, Oracle allows you to use JFR in production from Java 11 onwards. But they can revoke NFTC anytime. So, it is still wise to develop and use open-source or private alternatives to JFR. Besides JFR still doesn't profile everything well and you still need to build infrastructure for integrated distributed profiling and tracing.

Just a couple of decades ago, I started with 64kbps ISDN uplink on copper twisted pair and 2Mbps sat downlink, serving 100 computers in a college campus browsing center. That was clearly web 1.0.

And a decade ago, I was doing pairs of redundant 10Gig links to a datacenter. That was web2.0.

For the past 5 years, I have a GPON network to my home (incidentally with a Nokia ONT). Today, this is the only way Internet is delivered to homes around me. But I'm on a 300Mbps plan and don't think I utilize anything close to it. There are 1Gbps plans available. Btw, my mobile already clocks 400Mbps+ in speed tests on 5G network. This is the post-covid WFH plus multiple 4K streaming services era.

I wonder what new use-case (like video streaming) will emerge that will push utilization beyond 1Gbps. Is it AR/VR? Is it streaming updates to big fat AI models running inside your home? Or is it streaming lots of data from your home to AI models in the cloud and getting responses back?

You can deal with this problem only if you are very disciplined about it, like GenX and prior generations were with their physical photo albums and paper financial records.

At some regular cadence (say weekly or monthly, whatever is your balance for loss tolerance vs discipline is), you will have to organize (tag) and archive your digital assets (photos, finance/health records etc), compress and encrypt it, and then do an offline disk backup as well as upload it to a cloud storage like S3. You will have to keep your encryption keys, S3 credentials etc safe and secure. And you will have to do it serious discipline, at the cadence you decided or at least upon completion of major life milestones, to save your digital life.

Then, every once in a while, at least once a year, you will have to download your entire archive, decrypt and decompress and verify that your system of tools and processes still work.

If you skip any of these steps, you are likely to find that you have screwed up and lost your digital life irrevocably.

Btw, just like your GenX parent/grandparents kept physical photo albums and file folders, you can keep digital equivalent in BD-Rs.

The author's framing can be misunderstood in so many ways that it is not a useful shorthand at all. There can be no absolute rank order of these tokens.

Firstly, in this framing, the "dev" is not one person but it is a collective for lots of people with varied expertise and seniority levels in different orgs – product, engineering and design orgs.

Then, "ops" is again not one thing and not just engineering ops. It could be bizops, customer support etc. too.

Then, "biz" isn't one thing either. There's branding/marketing/sales/legal etc. and execteam/board/regulators/lenders/investors etc.

All of these people affect what code is written and how it is written and how and when it is shipped to users. Everyone should be solving the same "problem".

A lot of the times, a lot of people within the org are just there to make sure that everyone understands/sees the same "problem" and is working towards the same goals.

But that understanding is continuously evolving. And there is lag in propagation of it throughout the org. And hence, there is lag in everyone working towards the same goal – while goal itself is being evolved.

Finally, "user" is not one thing either nor any one cohort of users are static. There are many different cohorts of users and these cohorts don't necessarily have long-term stable behaviors.

So, it helps to understand and acknowledge how all the variables are changing around you and make sense of the imperfect broken world around you with that context. Otherwise it is very easy to say everyone else sucks and everything is broken and you want to restart building everything from scratch and fall into that and other well-known pitfalls.

Do you work for the company?

This!

..much better in what way?

G.657B standard cables have a pulling (stress) bend radius of 5mm. So, you can abuse it quite a bit and it's fine. Also, while it is abused during installation, at rest, it is not under so much stress and usually have a sturdy casing to make sure it stays above its min bend radius.

Most irritating thing the Amex did recently to me is to call me from a random number and then proceeded to ask me for my personal details like date of birth etc for "verification purposes". I promptly refused to provide any details as I have no way to authenticate them and cut the call. They are basically educating their customers to become vulnerable to fraudsters and I told them as much. But the call center person is the wrong person to hear that from me.

hmm, WhatsApp rings my phone more than regular phone network and like me billions of people pick-up WhatsApp calls everyday.

A bank that never calls or messages via traditional phone/mobile network and never uses email is the best. Always use secure in-app communication. And use secure device binding + password/pin + biometric authentication for access. Use a pre-registered and securely couriered FIDO2 token (Yubikey) + in-app video-KYC for initial setup and credential resets. Don't depend on another channel for resetting any of the credentials. Educate the user that you will never contact them via any other means. Establish these secure expectations with the user from day-0. Within the app, always do additional factor authentication for any monetary transaction. On the server-side, have per-transaction, per-day limits for fund transfers. For large value transfers, require payees to be added to the account and have a 1-2 days cooling off period. Notify the user during this cooling-off period and give them ample opportunity to intervene if they think it is a mistake or fraud. Have low-friction instant payments only to pre-verified and registered merchant addresses. For person to person instant transfers, have velocity limits and legal framework to clawback and prosecute in case of fraud. For out-of-network (say international) instant transfers, definitely require payees to be verified and added to payer's account and have fraud protection funds to enable swift clawback and legal frameworks for prosecution across international borders. Without these types of protection, any increasing in banking velocity is bound to result in more fraud harm than traditionally accepted.

We have FTTH everywhere in India and seeing how fiber is installed in all kinds of nooks and crannies, I can tell you that fiber is more resilient than you think. And frankly, I have experienced far less Internet outages with FTTH than I used to with twisted copper pairs (ADSL2+).

What happened over the weekend is a death and rebirth, of the board and the leaderships structure which will definitely ripple throughout the company in the coming days. It just doesn't align perfectly with how you want it to happen.

There's a whole new generation of engineers for whom this is new news. Enjoy!

Ugh. A quintessential engineering mind is always curious, critiquing and questioning everything and will always want to know the why of the what and ask why not an alternate what. Such a mind be motivated by a higher purpose – finding meaning in larger impact of their work. Only such minds can be creative and persistent to solve the hardest problems to create outstanding product experiences. All it takes to destroy such a mindset is to tell them to shut-up, not to ask so many questions, and to do as they are told.

I went to cardiologists for a mild burning sensation in my chest area, post recovery of my first & only covid infection, in early 2022. They dismissed my concerns. A year after recovery, I resumed my routine strenuous exercises, and I noticed I had elevated resting and walking heart-rate and my apple watch would alert me of abnormal heart rates. I went to cardiologists again and they dismissed my concerns again. Both times, they did all the usual battery of tests (Echo, TMT/EKG, cholesterol, blood markers etc) and they all came "normal". They basically told me stop googling things and to throw away my smart watch. Anyway, another thing my watch was telling was that I wasn't getting enough sleep and I focused on fixing that. A few months after that, my resting heart rate started to trend down and has come back to pre-covid levels. I don't know what to make of it all. One expensive doctor explained it to me this way – historically medical community don't have enough data about how post-infection recovery has been in large populations w.r.t heart rates. Only recently, with smart watches etc such data is available. Until that smart wearable data is scientifically studied, analyzed and concluded, the doctors won't change their diagnostics and treatment protocols, for good reason. While I understand that, I felt that their current protocols are for suited for well-advanced and well-presenting cardiac diseases that occur in old people.

Rack level disaggregated compute-memory-storage-accelerator architectures allow for dynamic partitioning/aggregation of hardware to suite concurrent workloads and their evolution over time and make it easier to achieve both cost efficiency as well as incremental, continuous and non-disruptive hardware upgrades.

The personal traits required to find a job are different from that to perform well at a particular company & role. That's the sad truth. So, people voluntarily leaving won't be correlated with performance low or high. Also, people who were selected for layoff by management will also not be correlated to low performance well. In fact, in most layoffs, they are planned in closed rooms with only VP+ people who have little context of who does what work well or not, and with flawed performance calibration data. So, you will always be shocked to find that the people /you/ thought were high-performers were let go.

I have cleaned contacts everywhere with electronics alcohol wipes. I see that the pins inside the left holster are not as protruded as they are on the right holster of the case. I have tried to pull it gently with a tweezer but it has not helped. Its 1 year warranty period just expired as well.

This is indeed a cautionary tale. But soon enough, this taking out electronics at airports will be a thing of the past as more and more airports deploy luggage scanners like the ones at Dubai airport where you don't have to take anything out of the bag.

In general, here's my operational security to prevent scenarios like this:

1. All my luggage has uniquely identifiable tags and stickers on them. This includes my laptop, mobile phone, chargers and cables. This largely avoids myself or someone else mistakenly picking up wrong things. When I'm asked to take out electronics at airport security, I use 4 trays in sequence – carry-on luggage, all my electronics in the tray, and my backpack, my shoes. This way, my electronics tray is sandwiched between my luggages. I also put my laptop in a thin cushion sleeve and I have not been asked to remove the sleeve. I also put all my smaller electronics and cables in a clear plastic zip bag and put it in the tray. Then, I try to cross the human x-ray at the same time as my luggage (most airports do a good job of ensuring this if you stay in the lane next to the luggage line). When I pickup my luggage I'm super focused to make sure I verify I got back my stuff correctly.

2. My corporate MacBook and iPhone does not allow iCloud account on it. Hence, there is no Find My. But it is tied to corp MDM. If anyone were to find it and try to wipe and install, the MDM will force a profile on it. When I report my laptop is lost, they will put it in lost mode (via MDM) and also remote wipe it. Also, they have loss/theft insurance to cover the cost of the laptop.

3. On my personal MacBook and iPhone, I have had firmware lock (on Intel ones), and always had FileVault (for M1/M2 silicon, this is same as firmware lock) on with recovery key (not iCloud recovery). Recently I have turned on lockdown mode as well. I do have an apple account for Activation Lock, App Store and TV. And I have advanced data protection mode on for this iCloud account and I have disabled iCloud Web. I have recovery key and recovery contact for this iCloud account. I don't want my data on iCloud servers without end to end encryption nor do I want Apple to be able to unlock/wipe my devices without a cryptographic consent from another iDevice I possess. With File Vault on, nobody else who gets my laptop can unlock it or wipe it or reinstall it. On some of my devices, location service is off, so Find My can't show the location but it can still activate lost mode or remote wipe the device.

4. I have both physical sim which is locked and eSIM on my iPhone. And my iPhone is locked with a password. I disable Face ID while traveling.

5. Similarly, I have advanced data protection on my Google accounts.

6. I use physical Yubikeys with pin locks for 2FA.

My one year old AirPods Pro has a problem charging the left ear pod. And, this is my 3rd AirPods in as many years. I have promised myself that I won't buy another one once its battery dies like the previous two AirPods.