alecbenzer

> It's a shame how our industry is the only highly-paid professional industry where this kind of sophomoric "intellectual hazing" is not only accepted, but also encouraged. I mean, hell, I have like three books on my bookshelf not about how to write good code, or scalable code, or performant code, but merely about how to pass interviews. Yuck.

I don't think it's hazing so much as it is a test, and we're definitely not the only profession that has tests. I'm sure medical professionals and lawyers might have books on their shelves on how to pass the MCAT, LSAT, or Bar exam.

If anything, we've maybe not matured as a field enough to have an actual standardized test for this kind of stuff, which would maybe make things better. But that's doubling-down on the "test-y" nature of coding interviews.

Uh, I dunno? Is the implication that I'll have less patience for taking tests each time I change a job when it's the Nth time?

Maybe? At 5-6 years out of school, I personally don't mind tests. Sometimes I actually really like tests (e.g., I've started watching youtube vids of Putnam problems, like doing daily problems on brilliant). I can imagine time to study becoming more scarce if I had a family, but I was under the impression that changing jobs was something that's gonna take a healthy amount of time regardless.

To be clear: I think you can have bad tests, and I imagine I'd find it frustrating if I was boxed out of a lot of jobs I thought I'd do really well at because the unrelated test keeps me out. But I don't think needing to study inherently makes a test bad.

I think of interviewing like I think of other "tests" like the SATs. They're a thing you've got to study for. Just because they don't mirror what your day to day at a job will be like doesn't automatically mean they're of no value.

I think some coding interview questions are bad, some are better, but I don't think the idea that you must take what amounts to a test to get a job is inherently bad.

> I mean, firstly, no. What you're describing is what we call "Textbook RSA" and that's a classroom exercise rather than a technology you should use in practice - it's unsafe.

? I'm not talking about encrypting data with RSA, but how else do you perform signing with RSA except by using the private key to transform some message that can then be verified with the public key?

I see now the article's trying to describe elliptic curve Diffie-Hellman, which makes much more sense (but makes the comparison to RSA in the article confusing...)

Oh, I see, we're just doing Diffie-Hellman but with elliptic curves? Ok, that makes much more sense... it was confusing for the article to compare it with RSA instead of vanilla Diffie-Hellman.

Right, but while most people understand multiplication, it doesn't seem clear how to efficiently perform repeated application of the dot operation. I'm guessing the operation is associative, which lets you do it fast.

Ah ok, so the dot operation is associative I guess?

---

I mean, once you have the keys, how do you actually use them to transform data?

Right, but the point is that doing the transformation in one direction needs to be fast in order of the scheme to be viable. So there must be some faster way of doing n iterations, which the post doesn't mention.

Sure, fine, but even in RSA signing there's some message you transform with one of the keys and then undo the transformation with the other key (the transformation is encryption when the first key is the public key, and signing when the first key is the private key). I just mean, given these EC keys, how do you actually apply them to data?

I'm assuming that given a starting point A and a number of operations n, there's a much faster way of computing the end point than just iterating n times?

Otherwise, determining n given A and an end point would just be a matter of iterating from A until you hit the end point and counting, right?

Also, how do you actually use the keys to encrypt/decrypt?

A feature that's available for free on public repos isn't necessarily free for private repos, it seems. The wording on the pricing page isn't very clear about this, though.

If they mean that they're now removing required reviewers for public repos in the free plan, that's definitely a big step backward I think.

When has GOOG made something expensive once the competition died?

I guess for that matter... also when has MSFT? I buy they have, but not aware of any examples of the top of my head.

Looks like it's one of these:

  .alt-mono-font {
      font-family: SFMono-Regular,Consolas,Liberation Mono,Menlo,Courier,monospace;
  }

If you find yourself wondering this a lot, https://chrome.google.com/webstore/detail/whatfont/jabopobgc... is a fun extnesion.

> A better way is to self-host...

Even ignoring the higher cost to set up, are you sure your self-hosted solution will have better uptime? Are you sure you'll be able to get things up and running faster when it does go down than GitHub will when GitHub goes down?

> Do you not have those with Free private repos?

Correct.

The whole world sometimes feels like it's held together with duck tape. I think people invest in things until they're just barely not falling apart.

My therapist recently told me that often it's working on something that sparks (or fuels) the passion for it, not the other way around.

Sometimes you just need to decide to do something and make progress on it, not worrying about the fact that it's not what you're most interested in at this instant.

> you basically just derived a logical consequence that touching the website yields a result?

The suggestion was pretty implicit in the original comment but I think making it explicit makes the tone of the comment friendlier. It shifts the focus away from just pointing out the bad to also focusing on how to be better.

> Also, what does 'expanding' even mean in this context? At no point did you give any constructive feedback (what should be improved, why is it low, why is it 'really low' etc).

Well sure, if I was the one actually giving the feedback, expanding even more would be even better. Even just the gestural focus on how to be better still does help the tone I think, though.

> on the note of 'really'. i find 'dreadfully' much more useful than 'really'. much stronger, gives a clearer indication of how bad it really is.

"dreadfully" is stronger than "really" but that doesn't make it clearer or more useful. "This is 5.6 bad points" is stronger than "this is 3.2 bad points", but without having any standard for what a "bad point" is, it doesn't really communicate any meaningful information. I think "dreadfully" similarly shifts the tone of the comment to being more negative without adding any real content.

> let alone be less pretentious

The pretentious-ness isn't as strong, but I think there's a hint of it that comes from using a "fancier" word without adding much actual content.

Whether this is true or not, there's much better ways to phrase this.

> Your online presence is dreadfully low for a web developer.

Just dropping "Sorry to say" makes it sound less condescending.

> Your online presence is really low for a web developer.

Dreadfully -> really. Could argue that this changes the meaning somewhat, but I think the change is more in tone (again, less pretentious/condescending sounding) than in actual meaning.

> Your online presence is really low for a web developer, you should consider expanding it to increase your exposure/get more interviews

Explicitly making a suggestion is more constructive and makes the tone more friendly.

Eh, it's sort of the same? You can imagine each pixel as its own message: the point is that repeatedly transforming things in a consistent but "random" way isn't actually random. The ciphertext of each pixel is "random", but the pattern when looking at all the pixels is clear.

I'm reaching the limits of my stats knowledge, but you may be able to figure out, even from just those two ciphertexts, something about the input plaintexts. It's obviously harder with shorter inputs.

I guess one thing to note is that, if what you were transmitting was just random noise to begin with, OTP re-use may not matter/be evident. But essentially all data that people care about transmitting isn't random noise, it has some structure, and that structure comes through with OTP re-use (more and more the more you re-use and the more data you re-use with).

AIUI, the Enigma machine (not quite an OTP but I think similar) was broken in part because of just a few key re-uses https://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma#Op...

> The output is always random, regardless how often the key has been used.

The output of any _one_ use of the pad is, yes, but the point is to consider all of the data that an attacker may have. If you re-use the key multiple times, then the entirety of the cipher texts an attacker has is not random. (See also: https://xkcd.com/221/)

> But how do you know they're using the same one? Or how are you sure, they're not?

You'll be able to tell because you'll see patterns in the data: https://upload.wikimedia.org/wikipedia/commons/f/f0/Tux_ecb....

Not sure what you're asking? If you use the same key over and over again, then you're using the same key much more than just twice.

The idea of a one-time-pad is that you're basically just randomly flipping the bits of your input, which means the output of an OTP cipher is indistinguishable from random data.

If you're using the same key multiple times though, then the output of the cipher (considered over time) won't be random, and you'll be able to detect patterns from the original input in the cipher output (e.g., the shape of an image, frequency of certain letters).

> I would much rather buy $30k of preferred at fair market value.

Sure, but VCs aren't getting shares at FMV either.

Yes but the context here is liquid investment, which is what preferred stock are meant to be a defense for (at least according to what I've heard).

(The opportunity cost is also paid slowly over years; I think VCs get better terms in part for front-loading all the money.)

> It absolutely is an inferior product.

I don't think they were disputing that? But it's not dollar-for-dollar equivalent -- VCs are paying more (a lot more, I think usually) liquid cash per preferred share than employees are paying liquid cash per option of common stock.

In common language when discussing comp, yeah definitely, I think so. "Legally" idk.

I think startups are a bit of a crapshoot even in this regard. You'll learn a lot at a good one, but could potentially learn a lot of bad habits at a bad one.

> don't deserve to be "preferred" instead of "common" because the VCs put in actual money

I agree with most of what you said, but a nit: one perspective I've heard on the motivation for preferred stock is this:

Suppose I give you $10M to start a company in exchange for 10% of it. You then easily sell the company for $9M, keeping 90% * $9M = $8.1M for yourself and returning $900k to me. Preferred (non-participating, 1x) shares prevent this problem by making sure you can't just run away with the money: you have to actually use it to build the business.

People investing in the company in non-liquid ways (e.g., the founders or engineers, via opportunity costs) aren't in the same boat, because their opportunity cost can't be immediately liquidated.

0.02: I really didn't mind the change, I assumed it was meant to allow users to more easily identify "well-known" sites in the results: noticing a familiar icon is a lot easier than noticing a familiar URL. This seems potentially good for both users and sites? I guess it's bad for sites that are currently trying to build up their credibility and aren't yet "well-known"?

In retrospect, I'm sure blurring the lines between ads and search results was probably part of the motivation. But if they modified ads a bit more to further distinguish them and kept the favicons, I don't think I'd mind.