1,174 karma · joined April 11, 2018
(Naively, not knowing much about apt-get or yum or other OS package managers, I have always assumed that 1. only a handful of trusted people can publish to the default repos for system package managers and 2. that since I have to run `apt-get install` as root anyway, package installers can completely pwn my system if they want to and I am protected purely by trust. Is some of that wrong? If it's right, isn't it nonsensical to be any more worried about installing new packages in light of these vulns?)
In my experience (of primarily web dev), this is not true, and the reasons it is not true are not limited to software architecture conflicts like you describe (although they happen too). Instead the problems I usually encounter are that:
* once you have shipped something and users are relying on it, it limits the decisions you are allowed to make about what features the system should have. You may regret implementing feature X because it precludes more valuable features Y and Z, but now that X is there, the cost of ripping it out is very high due to the backlash it will cause.
* once you have shipped an application, most of the time when you add new features you are probably slightly changing at least some UI, and so you need to think about how that's going to confuse experienced users and how to address that in a way you wouldn't have to when implementing something de novo. For an internal LOB app, that might mean creating announcements and demos and internal trainings that wouldn't be necessary for greenfield work.
* the majority of professional web dev involves systems with databases, and adding features frequently involves database migrations, and sometimes figuring out how to implement those database migrations without losing data or causing downtime is difficult and complicated.
* as web applications grow their userbase, the scale of the business often introduces new problems with software performance, with viability of analysing business-relevant data from the system, or with moderation or customer support tasks associated with the system, and these problems often demand new features to keep the broader business surrounding the software afloat that weren't needed at launch.
* software that has actually launched and become embedded in existing business processes inherently tends to have many more stakeholders in the business that care about it than pre-launch software, and those stakeholders naturally want to get involved in decision-making about their tools, and that creates meeting and communication overhead - sometimes to such a degree that stakeholder management and negotiating buy-in ends up being an order of magnitude more work than actually implementing the damn feature being argued about.
To the extent that the amount of work involved in implementing a new feature is inflated by these kind of factors relative to what would have been involved in doing it de novo, I personally conceive of that as "maintenance" work; and in my experience my work on big teams at successful businesses has on average been inflated severalfold by those factors. (I also count work mandated by legal/compliance considerations that arise only after a successful launch as "maintenance". My rough conception of "software maintenance" is that the delta between "the work involved in building a product de novo with the same customer-pleasing features that ours has" and "the work we actually had to do to incrementally build the product in parallel to it being used" as "maintenance".)
Would most people agree with my broad notion of maintenance? I reckon they roughly would, but it's hard to say since people who talk about maintenance rarely attempt to define it with any precision. You give a precise but extremely narrow definition above. Wikipedia likewise gives a precise but extremely broad definition - that maintenance is "modification of software after delivery", under which definition surely over 99.999% of professional software development labour is expended on maintenance! I guess my definition puts me somewhere in the middle.
This feels ludicrously backwards to me, and also contrary to what I've always seen as established wisdom - that most programming is maintenance. (Type `most programming is maintenance` into Google to find page after page of people advancing this thesis.) I suspect we have different ideas of what constitutes "maintenance".
Otherwise, the risk is investors put in $1m for 10% of the company, only for the founder-CEO to decide a month later - perhaps totally genuinely and honestly after initial R&D - that the entire business plan wasn't viable after all and the best thing for stockholders is to liquidate the company... and then walk away, personally, with $900k while returning only $100k to the investors. And obviously because this scenario is possible, there would be great temptation among dishonest founders to "realise" their companies "aren't viable" in order to walk away with all the cash. Something has to protect investors from this outcome, and remove the perverse incentive on founders to promptly liquidate after getting investment. A liquidation preference where the investor gets repaid before any distributions go to other stockholders is one way of achieving that protection; what alternative would you prefer?
As for liquidation preferences with a multiplier (i.e. we get paid back X times our investment before anyone else gets anything), eh, I wouldn't outright make them illegal, but it's less clear to me they are always serving a legitimate purpose, and they may grossly mislead the public about the actual valuation of the company implied by a given funding round AND mislead naive common stockholders and options holders about how much of the company they really own and what they can really expect to make in an exit.
(I don't really understand how the fourth power of axel weight thing can possibly be true, though. Why would joining two vehicles together into a mega vehicle with double the weight and double the wheel count suddenly cause the combined vehicle to inflict 16x more wear than before you joined the two together? It makes no sense.)
No doubt in a world of 8 billion people, there exists someone, somewhere, who has for some reason voiced the belief described - i.e. that if institutions really heavily based their selection of applicants on skin color rather than merit, that would be good, but that because in reality institutions have only been convinced to somewhat compromise on merit-based selection in favour of skin-color-based selection, it's bad, and should thus be abandoned completely in favour of total meritocracy. But that belief would really be rather odd, and I have never seen it expressed even once in my entire life.
Nor am I convinced, despite its oddness, that it is properly considered to contain a fallacy! After all, sometimes it really is the case, for various reasons, that some endeavour is only worth doing if total success can be achieved, and not worth the downsides if you can only succeed partially. No doubt if someone really held the allegedly fallacious view described, they would believe affirmative action is exactly such an endeavour and be able to explain why!
(I find it extremely sketchy from a competition law perspective that Microsoft, as the owner of npm, has implemented a policy banning npm publishers from publishing via competitors to GitHub Actions - a product that Microsoft also owns. But they have; that is the reality right now, whether it's legal or not.)
Per this narrative, a significant antisocial tranche of the public has responded to the effective suspension of traffic law in the way that you would expect them to, and that is why road deaths are up.
Here in the UK, it is pretty much universally the case that if there are buildings, there are street lights. (Maybe there are occasional exceptions where there's a single building in the middle of nowhere on a rural road; I'm not sure. And I suppose there must be occasional outages of street lighting even in e.g. dense city centres. But such things are rare.) Having high beams on in almost any context where there are buildings around is therefore unnecessary, against the Highway Code, and quite possibly criminal under RVLR reg 27.
It's not and I didn't suggest it was. It gives the NSF itself the ability to litigate discrimination by grantees (in order to claw back its funds) instead of only the people discriminated against and the EEOC being able to do that. That's a real effect! But it doesn't impose any new obligations whatsoever on PSF - just changes the recourse mechanism if PSF violates legal obligations they already had.
> When the federal government cancels your grant and claws back money you've already spent because they claim something innocuous is illegal
As far as I know this has not happened in any of the cases you mention and _could_ not happen. Yes, grants have been cancelled for dumb reasons, but nothing has been clawed back. Right? What would the mechanism for clawing back the money without a lawsuit even be?
Of course it has an effect, but that effect is giving the NSF the ability to sue over a grantee's alleged breaches of discrimination law, instead of that being limited to parties discriminated against and the EEOCs.
> NSF reserves the right to terminate financial assistance awards and recover all funds if recipients, during the term of this award, operate any program in violation of Federal antidiscriminatory laws or engage in a prohibited boycott.
So there's no plausible way that agreeing to these terms would have contractually bound PSF in any way that they were not already bound by statute. Completely silly ideological posturing to turn down the money.
There's no contradiction, or even tension, between these three positions:
1. "DEI is about taking jobs from white people and giving them to undeserving others"
2. "the deserving are spread across different races and genders etc. and we should capture that better"
3. "so the government just doesn't want people to discriminate and that's a problem???"
so what exactly are you trying to say?
Probably not - but when I say that we should not deemphasise their agency, I don't think I imply otherwise. The opposite, in fact: to even ask or try to answer the question you ask here - to consider how I would act if put in the circumstances of another person - is to view their suicide as agentic.
(Observe that you could not meaningfully ask, of someone who got lung cancer and died due to asbestos exposure, whether I could be certain I would not "react the same way" to asbestos exposure! That is the difference between the "disease" framing and the "act by an agent" framing.)
I agree with your final paragraph, disagree in part with your second, and disagree with your first.
To the second: I don't doubt there's an implication of wrongdoing baked into the etymology of "committed suicide" - after all, suicide is a sin in Christianity and was historically a crime in England, and I imagine when the term first arose there was an intent for it to be condemnatory. But I think modern usage of the term is generally not understood to inherently carry that implication. IMO sometimes, as here, terms become established as first-class citizens in the language, speakers and listeners consequently don't even think about their etymology any more, and consequently the connotations logically implied by their etymology just cease to be salient to the vast majority of people.
(I also don't think the -cide suffix implies wrongdoing. Homicide is not necessarily illegal or wrong, and then of course there are words like "fungicide".)
But in any case if the term is to be eschewed, there are alternatives that avoid the implication of wrongdoing in the word "commit", are already well-established in the language (thus avoiding confusion about meaning) and avoid the new set of distasteful/offensive connotations that "died by suicide has". "Took his/her own life" is one; simply "killed himself/herself" is another. That is - we agree on your third paragraph, even if we disagree on details along the way.
To your first paragraph - I am perplexed. Did you (or anyone else) really just read this term for the first time (whenever you first came across it) and intuitively understand it was simply a new term for "killed themselves"? I struggle to imagine anyone grasping what the term was meant to mean without going to Google to figure out how it was meant to differ from the usual "committed suicide" (or either of the other less common but still well-established terms above); certainly I did not.
Obviously it's impossible to block all ways of "bypassing" the policy. If you are a developer who has already been entrusted with the ability to make your GitHub Actions workflows run arbitrary code, then OF COURSE you can make it run the code of some published action, even if it's just by manual copy and paste. This fact doesn't need documenting because it's trivially obvious that it could not possibly be any other way.
Nor does it follow from this that the existence of the policy and the limited automatic enforcement mechanism is pointless and harmful. Instead of thinking of the enforcement mechanism as a security control designed to outright prevent a malicious dev from including code from a malicious action, instead think of it more like a linting rule: its purpose is to help the developer by bringing the organisation's policy on third party actions to the dev's attention and pointing out that what they are trying to do breaks it.
If they decide to find a workaround at that point (which of course they CAN do, because there's no feasible way to constrain them from doing so), that's an insubordination issue, just like breaking any other policy. Unless his employer has planted a chip in his brain, an employee can also "bypass" the sexual harassment policy "in the dumbest way possible" - just walk up to Wendy from HR and squeeze her tits! There is literally no technical measure in place to make it physically impossible for him do so. Is the sexual harassment policy therefore also worse than nothing, and is it a problem that the lack of employee brain chips isn't documented?
* (though not necessarily, since the Internet is its own country with its own culture, and much training data comes from the Internet)