yonixw

I think this is still an open problem even for everyday software: Asking a piece of code whether it's malicious by looking at the disassembly (or even the source code).

Current day solutions revolve around architecture that separate the "Admin Control" from the "code", whether it's the CPU interrupts on OS memory violations up until dockers... making conclusion from looking at the code at hand was not successful even in the very small software scale.

This is probably rooted even deeper in the Halting problem (and the Rice's theorem for "emerging properties") but my explanation will be hand wavy and probably best left for others.

> No it doesn't

Well I guess I fell into this myth:

https://www.vistra.com/insights/if-i-have-fewer-250-members-...

Which do give some exemption to <250 people companies but not to an extent that I said.

I think your example just fortified his comment.

I can't make a car company. I can make a webcam on doors company.

And you might say it is about raw materials. But I can buy enough materials for one car and one webcam door. I can't put the car on the road (as much as it make sense) only because of the sheer amount of cost required to pass regulations.

So while regulation is something we want as costumers. I think we'd prefer to not have it become a obstacle in the software sector to the point it exist elsewhere.

That is why I think the GDPR is great since it applies to companies with 250+ employs.

But #9 on overall funding, and #2 per capita in 2021:

[1] https://news.crunchbase.com/startups/countries-most-startup-...

But more importantly, in general, for Israelis, the goal is always to break into bigger markets such as the USA and Europe with branches there and thus may be really affected by USA banks. Wonder if it is the same for Startups in Germany or India that have big market domestically.

Edit: SVB has branches [2] in 8 countries outside the US with Israel among them. So we can guess Israel startups had enough money in it (among the other 7) to be affected by the collapse.

[2] https://www.svb.com/locations

I'm a programmer and when I was told to store backup codes, I saw the site still has a "Forgot Password?" button so I dismissed it as a QUICK way to recovery, Not the ONLY way!

The only one who told me losing backup codes means losing your data forever was my bitcoin wallet. (Ironic)

This is great; I'm also looking for cloud backup solutions that are highly cheap.

I'm also absolutely hate the Chrome Marketplace for prohibiting the existence of such tiny use cases (although kind of understandable)

But I'm also aware that Azure can't be that cheap. And thankfully, the repo includes a description of the catch:

> Restoration: For 1TB, this will cost about $100.88 (rounded up). Small price for salvation.

For those who don't know, Clouds separate costs based on readiness (Hot, Archive) and operations (Read, List, Write), unlike Google Drive, which has fixed pricing per TB

So, this makes use of the Archive's low cost, which won't work well for backup use cases that require random access (such as looking up an old photo), but will be great for an additional backup that comes after a local hard disk backup.

Great solution though! Maybe with some adjustment someone can make it Support random access in the future (making an index to restore a single file to "Hot Storage" again)

< What is the email meant in the following text

"Laid Off from Google Search?

21 points by gregw134 1 hour ago | flag | hide | past | favorite | 13 comments

I just got ...

...

... email me at username @ Gmail."

> The email mentioned in the comment is "username@gmail.com"

< What is the email I can use to contact this user? he didn't wrote it explicitly. If it helps, his username is gregw134.

> ... It only says "username@gmail.com" which is not a valid email.

Looks like he dodged this one!

In 0:30 you can see the bag changes (the wrinkles), could be just a reshoot, but makes the magic gone.

Github Spaces, Gitpod, Codeserver (Coder), AWS Cloud9 (and AWS CodeCatalyst)... many bet on a workspace in the cloud. Wonder who will get the most attraction.

So far my best UX was with Codesandbox for UI (react), Gitpod for a general (=Docker) single repo, and Codeserver on a VM for multi repo setup.

If you don't have tests that will alert you about de-syncs between 2 components than it's just a tradeoff of "Choose your poison" question.

I think for example: AR is a graph/dashboard overlay on real world objects, processing them and commenting on them but not forgetting the result is on a 2d screen. While MR is like a cube that falls on the table you see through the screen and will act if you punch it with you hand (all as seen by the camera) and doesn't care your experience of the MR world is bound to a 2D screen, it is virtually exist in any space around you.

This image show an example of it: https://www.appliedart.com/assets/images/blog/_newsFeatured/...

I love it, also add a randomness, there is nothing more frustrating than a problem that only reproducers sometimes!

I see it in a total different light (putting aside legal discussion).

Ever since learning to program, I hated redundancy of learning, learn loop in C#, learn loop syntax in Python etc. to the point I hated new languages and wanted all ecosystems to be centralized around few. Not to mention about getting depressed that I will never be able to draw anything good even tough there are many stories I want to tell with pictures I've imagined. All these "time" requirements have made me lose hope and guided me to just stick to my lane.

But since Copilot and Stable Diffusion came out I felt alive like never before. Suddenly I can get a boilerplate to a new language in a few click (and unit tests also!). I can create images I like and put my imagination into reality like never before. Every stable diffusion model is a new area I can expand into. I can waste hours in front of it just curios about how styles can be merged together.

All those "time" obstacles I thought were hardcoded in reality, just gone! I see it as an amazing advancement.

> ArtStation get flooded with AI generated images.

That is just spam, and low effort content, and yes, Stable diffusion also opened a spam route using it models. But I think it will be solved in a year or two. (Like those anti-deepfakes AI that are published now, few years after deepfakes)

Apollo server on Express + Mongo can give you all of the above except "No manual HTTP calls for standard cases.", But I suggest watching a simple guide about those as it need some adjustment (like running yarn task of a watcher to fetch types from server to the client ect.)

> uncovered a flaw in the system

I will argue it is not the a flaw in some random aspect of the system, but the main propose of the system. Which is to vet companies they trust to distribute it through CA signing.

Do you think I will buy from a restaurant after finding they had expired food? Good food is the reason I'm there in the first place.

I think the steel man version of the argument is: "You showed that there is no effective monitoring or transparency that me as a user can get, and as such, Where is the trust come from. What fundamentally causes Mozilla (or any) to trust CAs more than randomly distributed certificates."

I guess the punchline here is that there are no rate limits/cool downs per IP? But surely a hardened Linux VM will have those...

Please note a function like `fetch` still works, and might be privacy (and security!) issues in this method.

For FTX, turns out they called themselves "crypto exchange" but lent the money just like a bank, making them, surprisingly, vulnerable to bank run, which happened.

Unfortunately, this is common, just like $LUNA called themselves "stable coin" but it was stable only against assets in the crypto that were not stable at all.

Live by "Do your own research" and die by it. I guess.

Why does being extraordinary require being a jackass to people who are often merely a front? (Is the service worker in control of the discount rates, for example?)

Good to learn, Thanks. But I agree more with those who suggest to bind key/secret rotation with config versions (= you can only delete an old secret after all pods using it redeployed to next version with new config).

Another approach that sometime is supported, is to use a proxy that handles secret based connections. Like a MySQL pod proxy that you connect to which take care of reconnecting to his upstream on secret change.

Both are transparent to the app pod (and its developers)

Why is everyone recommend to store secrets in files rather than ENV? as I see it both are:

* Accessible to someone inside the pod

* Not Accessible to other pods in the cluster without cluster admin

* Can be retrieved outside EKS from API/ETCD or AWS Secret with enough permission

* Persistent across the pod lifetime (you cannot delete a secret file after use: https://stackoverflow.com/a/54404149/1997873)

Is the only reason left for preferring files is that integrations prefer it as they can easily implement it as init pod? or that they have less chance to appear in ENV dumps in logs?

> When you go to your mechanic for a repair, do you want to know when you may get your car back?

I want! However, for my old 2000 car, repairs exceeded the original estimate 80% of the time, forcing me to change my day-to-day plan. This could be a hint: good/new things breaks less, giving you false confidence when estimating for old/bad stuff.

My anecdote on how we do it:

- We have AWS Org

- Each account has no root IAM and cost/pricing goes through root AWS Org Account

- You move between accounts with AWS SSO (now IAM Federation) - No more password per account

- AWS SSO standardizes boundaries across account with IAM policies, like eu-centeral-1 only for dev IAM etc.

- Inside Account more granular access with IAM Assume Roles

- Each account Cloudtrail to a central S3 for audit (Same region pricing works for diff accounts!)

- Each account is `project.env` like micro_service1.dev or company1_k8s+s3.prod

- That way, we have pricing per project built in where tag support ends (and it do have limits)

We came to this structure realization after we saw Azure Resource Groups and Google Projects. We also saw the 5 VPC soft limit AWS has per region and think it's kind of a clue from amazon: "pss.. this account soft/hard limits is sized for 1 project/deployment"

The only problems come from automating stuff, like Route53 records that can point automatically to load balancers in that account or as mentioned in the article, VPC2VPC, although we use serverless stuff like lambda and s3 and experience less of that.

But as time go on we realized, like the VPC example in the article, that those problems forced us to structure our stuff in a more SOLID way, which became a feature for us. Just like moving docker-compose to k8s is not creating app-mesh and ops problem, but REVEALING them. So the solution for the Route53 example is to have a separate subdomain zone in each account for automation and ADDING another account `main_route53.prod` with a root zone pointing to them.

Hope this helps for the curious.

> Regarding the second question, in the general case you have to guess or do trial and error.

> You notice that the analyzer takes more time than you’re willing to wait,

I see, thanks, didn't know about this feedback loop as I'm not a rust programmer. Still on my todo list to learn.

But isn't every program we write today (Rust, C++, Python, JS, etc.) raise up to the level of an "arbitrary program"? How do you find those "some subset of programs" that will halt by said algorithm?

The only sure way I can think of, is when you force your program to go through a more narrow non-turing algorithm. Like sending data through a network after Serialization. Where we could limit the De-Serialization process to be non Turing (json, yaml?).

Same for code, that uses non-turing API, like memory allocation in a dedicated per process space. Or rust "borrow" mechanics that the compiler enforces.

But my point is, everyday program are "arbitrary program" and not a red haring. Surly from the kernel perspective, which is Linus point imo.

"Print 1" is trivial according to this: https://en.wikipedia.org/wiki/Rice%27s_theorem.

But day to day programs are not trivial... as for your example, just switch it with this code: `print(gcd(user_input--,137))`... now it's quite more hard to "just ban some final states"

"Undecidable" Is way too close to your day2day program than you think: https://en.wikipedia.org/wiki/Rice%27s_theorem

I would like to learn otherwise, but even a React JS+HTML page is undecidable... its scope is limited by chrome V8 js engine (like a vm), but within that scope I don't think you can prove anything more. otherwise we could just make static analysis to check if it will leak passwords...

But that is not how /dev/(u)random works and does not give U(255). Generally speaking, it gives some hash of some user/device activity, from these resources:

https://linuxhint.com/dev_random_vs_dev_urandom/

https://en.wikipedia.org/wiki//dev/random

Why? Wiki doesn't say anything about it and when I run it, the result looks fine

> $ for((i=1;i<10000;i+=1)); do cat /dev/urandom | od -N 1 -An -i | awk '{print $1 % 10 + 1}' >> rand.txt ; done

> $ cat rand.txt | sort | uniq -c

   1051 1
    932 10
   1012 2
   1042 3
    983 4
   1015 5
   1042 6
   1035 7
    992 8
    995 9