Darkstryder

I think you’re talking about Brian Krebs while the person you’re replying to is talking about Chris Krebs.

Both of them are well known in cybersecurity but are very different people with very different reputations.

Recently I’ve often wondered if LLM productivity gains (for coding) could end up mirroring the productivity gains of a good monitor setup.

That is, table stake on the one hand (nobody likes to work for a company stingy enough to refuse to buy one or two more screens per worker), but also not obviously more productive either (it is not easy to measure the productivity gain of a monitor setup and most developers who are productive with it will also be productive without).

If LLMs do not bring a lot more value to the company than providing a good monitor setup to every tech employee, this is a clue that once the bubble pops AI expenses should not be priced very differently than a bunch of screens (~700$ per worker per three years?)

I’m posting this comment 8 hours after the post so I can be in the better half of the distribution.

Damn. I never knew that way to search things. I used to do « Share / Search on this page » which was already obnoxious, which has now become « … » / « Share » / « Search on this page ».

Either I’m dumb or there is a discoverability problem with all these features. Probably a bit of both.

As a daily Safari on iOS user, I don’t care about any of this, but since iOS 26 basic Safari features such as bookmarks and text search have become so buried deep underneath, they are basically unusable at this point.

It infuriates me a lot more than all the liquid glass stuff (on which I’m neutral overall).

As a father of an 8 years old, this is very moving.

While Terence is -without a doubt- born with prodigious abilities, I think credit should also be given to his parents Billy and Grace who seem to have managed to simultaneously nurture these special abilities while still letting Terence have a happy (?) childhood. This is not easy to do.

A dream of mine was that in order to get a PhD, you would not have to publish original research, but instead you would have to _reproduce existing research_. This would bring the PhD student to the state of the art in a different way, and it would create a natural replication process for current research. Your thesis would be about your replication efforts, what was reproducible and what was not, etc.

And then, once you got your PhD, only then you would be expected to publish new, original research.

I am not very familiar with Triplebyte but I really appreciated this (seemingly) candid yet lucid writeup about how it was all went down from the inside.

These kind of insider perspectives, even if they come with their own biases, are very interesting nevertheless.

I wish I would see these types of articles more often.

To avoid something called the thundering herd problem: https://en.m.wikipedia.org/wiki/Thundering_herd_problem

For instance, a bunch of clients all make a request to a server at the same time, briefly saturating the server. If all the clients have the same timeout without jitter, they will all try again together at the same time once the timeout expires, saturating the server again and again. Jitter helps by « spreading » those clients in time, thus « diluting » the server load. The server can then process these requests without saturating.

LIFO queues with a timeout, and a retry after an exponential backoff with jitter is/was kind of standard for implementing queues at Google. More info in the Google SRE book: https://sre.google/sre-book/addressing-cascading-failures/#x...

> Say you add a new source file. Wouldn’t it be great if your build system just picked it up?

> Alas, it cannot; the list of stuff to build is passed from the meta build system to the build system, usually by fiat.

It can, actually. At least for make. Just use a wildcard in uour rules: https://www.gnu.org/software/make/manual/make.html#Wildcards

I highly recommend going through the make documentation at least once in your career. Per the lindy effect, as it has been around for 40 years, it has a decent chance of sticking around for another 40.

To me, a good cover letter is about being actually motivated to apply to a specific job and then simply explaining why.

AI doesn’t help because if you can articulate your genuine motivation as a prompt for an AI, you should just use the prompt as the cover letter which will be a lot more effective than using the AI-generated letter, as the AI will muddy your authentic motivation and diminish its impact.

> I’ve never heard of a family being divided because its members dance different styles, but I am in one divided by political and religious opinions.

Being a dancer (lindy hop) with a large number of dancers in my social circle, dancing is actually a frequent source of tension among many couples around me.

Couples splitting up because one is heavily more invested in dancing than the other is a common occurence.

And don’t get me started on lindy hop vs west coast swing.

To me, Internet's permanentness should be treated according to Murphy's law: you should plan for everything you wish would go down to stay up indefinitely and everything you wish would stay up to go down at some point.

Vim is available on a lot of Windows machines through WSL. I agree this would not be my go-to editor on Windows though.

Vim is basically the only editor you can safely assume to be available on any machine you’ll ever interact with. In my opinion, this fact makes it a requirement for virtually any developer to be able to confidently use vim during a production incident to, say, fix a broken config file while being connected to the machine through (multiple hops of) SSH, without any ability to use your editor of choice.

Once this basic-but-crucial skill level is mastered, using vim more proficientely as a daily driver is entirely a matter of taste. Personally I prefer using a fully-fledged IDE for anything that goes beyond a simple script.

Back in 2014 I was doing music production semi-professionaly for almost a decade. I tried out a brand new pair of headphones, and after an evening of listening to loud music with them, I put them down and heard a continuous blip.

I got (probably lifelong) tinnitus and hyperacusis that day and it never went fully away.

I basically stopped a passion I had since being a teenager because of this injury.

Be careful with your ears, folks.

One last comment though: I didn’t realize you were the author of the post (great work!!). This let me think you know your stuff, and you know something that I don’t and I need to think of all of that more carefully. So it is very probable you are right and I am wrong. Thanks for the discussion!

Again, the idea is not to find a specific hash value, but any $hash for which the property md5($manifest_content, $hash, $random_bytes) = $hash is true. You don’t need to match a specific hash value.

And you never answered how this manifest is somehow different than the self-referential png.

It seems we do not understand each other (unfortunately HN comments are not the best avenue for deep discussions) so this will be my last post on this thread as we both have better things to do than talking past each other.

This is indeed a preimage attack if the manifest content (besides its own self-referenced hash) is fixed. However this is not the case in practice: to pull off this trick you could just append some random bytes at the end of the manifest, disguised as ASCII art or something like that. The manifest would still be human readable and correct, but this would become a collision attack.

Again, to me this is the exact same problem as this self-referential PNG file, which is a very cool trick but which can be (demonstrably) computed with limited compute resources.

You do want to change the MD5 of the manifest. This is what makes it a collision attack instead of a preimage attack.

I don’t understand how this is a pre-image attack, as the manifest file only references itself (and not the zip file) and you can fiddle with the manifest file to your liking. To me this is the same theoretical problem as this self-referencing PNG file.

To me this can be done with a simple collision attack (assuming you can fiddle with some bytes inside the manifet file while freezing everything else in advance), which can be found under a second for MD5 with a laptop, and a few hundred thousands dollars of cloud resources for SHA1.

I think our disagreement is that I vehemently consider global warming to be against my long-term financial interest, making it perfectly rational to invest in anything that has a serious shot at limiting it, while you consider this to be « activism ».

It does make sense if you accept two hypotheses:

1/ cryptocurrencies are here to stay, like it or not

2/ The environmental harm done by PoW is a much greater risk to oneself than losing some money on staking.

Then staking becomes a « vote with your wallet » situation to nudge the entire cryptocurrency ecosystem towards non-polluting algorithms.

If you prove switching to PoS can be done at Ethereum’s scale, the case to ban PoW altogether becomes much stronger.

Withdrawals haven’t been enabled _yet_. Per your own link it will be enabled in an upcoming upgrade.

Of course you can argue this upcoming upgrade will never happen. But you could argue the same about the merge upgrade, and this one did happen in the end.

Slite is a SaaS company providing tooling for remote work and is a fully remote company itself, all of that since well before the pandemic. So I think calling the article a "hit piece against remote" is unwarranted in this case.

Disclaimer: I have an acquaintance who works there.

For the specific topic of cryptography: every professional cryptographer I know not only started with a master in mathematics, but completed it with a PhD in cryptography afterwards. Trying to do it professionally with neither diplomas feels like a non-starter to me.

Of course, that doesn't mean you can't study the field on your own for the sake of knowledge. And it will certainly make you a better infosec professionnal, whatever subfield you want to specialize in.

Also, keep in mind there are maybe 1000 people working in information security for 1 person working as a professional cryptographer. Cryptography is a bit tricky, but information security is a broad field with many interesting things to do.

I did that for a side-project a few years back. This was very elegant to implement: I was happy not having to store any password hashes (which is a dangerous thing to store as password reuse is prevalent) while still ensuring that my users had a secure way to interact with my service.

Still, this confused the heck out of some users. Some people kept forgetting the email address they used to sign up and were asking me why their account had been 'duplicated'. I had deliberately blurred the line between signing in and signing up and in practice it backfired a bit. I would not try that for a mainstream service nowadays.

September 24th, 2014.

To know the date of publication of a given xkcd comic, go to https://xkcd.com/archive/, search for the title you're after, then the date of publication is displayed in the mouse-over text.