avg_dev

Imagine my surprise when I clicked your profile and saw the first word. That, combined with the quotes found in the post’s URL and the fact that it was posted in the first place lead me to believe the issue likely lies with the Wikimedia Foundation. I will continue to use Wikipedia as before and due to you taking the time to reply to me I will hold it in the same high regard.

1. Intuit owns Credit Karma

> Intuit has lobbied extensively against the IRS providing taxpayers with free pre-filled forms, as is the norm in developed countries.[108][11][109]

- https://en.wikipedia.org/wiki/Intuit

2. Intuit owns Mailchimp. Mailchump was hacked earlier this year.

> In a scant blog post dated August 12, just two days after the company’s co-founder and long-time CEO Ben Chestnut stepped down, Mailchimp said a recent but undated attack saw threat actors targeting data and information from “crypto-related companies” using phishing and social engineering tactics. A company spokesperson told TechCrunch that 214 Mailchimp accounts were affected by the incident, which comes just months after hackers compromised an internal Mailchimp tool to access information on 300 accounts.

- https://techcrunch.com/2022/08/16/digitalocean-emails-mailch...

I don't know for sure but I believe this could have been prevented by the use of hardware U2F tokens, the cost of which is pretty small compared to the consequences of this breach, which affected DO and others.

On a personal note, I used to have bad credit, and I grew in the habit of regularly checking my credit score on Credit Karma. They used to send me emails telling me to check my credit score, that my score had fallen, or it had risen, and so on. The emails were unnecessary - it was ingrained in me to check the app on a ~weekly basis. Eventually, I realized that my score had been at an acceptable level for years, and I unsubscribed from the mails, deleted the app off of my phone, and stopped checking. In my opinion, this was predatory behavior, preying on the vulnerabilities and insecurities of people like me or people who had it much worse.

To sum up: Intuit is not a good company. They care about making a buck and don't care about the consumer; in fact they actively work against the consumer. I don't understand why the connection between Mailchimp, Credit Karma, and Intuit is not front and center in all of these articles.

Fucks sakes. I just made a very sizable donation to them based on the huge banner ad that popped up and the fact that I use Wikipedia on a pretty much daily basis. Fuck me for trying to do the right thing. I’m sorry for the language. Honestly I’m really pissed off about it. I work for a living and where I live there’s no taxable donation for this so it was just me trying to do something good. Well I guess when I calm down a bit I’ll try to learn my lesson.

This is a tangent and I’m sure others will see me as being oversensitive but I’ve always found it distasteful that the subreddit has master race in its name. I mean there are real people who have suffered serious consequence because of racism. Just my thoughts.

What utterly valuable work. I did not know of his existence til now, but I remember when I first used LetsEncrypt to get a cert for my website. It was so much easier than it had been before, and it was free.

And as I have thought of so much lately, developing compassionate, sound policy for the technology we create is so often lacking in our work. https://pde.is/posts/docs/Report-on-Algorithmic-Risk-Assessm...

I am sorry not to have known of him while he was here, and I am grateful for his work.

I guess what I'm trying to get at is that I wish to see learning to code, per se, easily accessible for all. I'm not talking about cheap or even free boot camps that promise entry into a lucrative job market. I'm talking about a kid, or a parent, or an auntie or uncle or cousin or sister or brother, about whoever, who just sees something they want to make happen and they literally do because they can. I read through the comments and I re-read the wonderful article by Robin Sloan linked below ("An app can be a home-cooked meal" -- look through this comment thread, and you'll see it, alongside my first observation of the term "OA", one that took me some time to decipher -- another thing that will stick with me).

I believe that programming is and always will be for the masses. I believe in development best practices when they are called for. But for learning, for discovering the beauty of computing and the joy of software, of writing one's first programs, I wish the barriers were less!

That link was very interesting, I read it all.

The footnote made me laugh, which is good, because apparently I make poor life choices, and am an embarrassment to us all. ;)

How did GitHub ever get so big when this exists? Is it because GH predates SourceHut? I'm not clear on when SH came into existence, but they have entries on their blog from 2019.

> * Absolutely no tracking or advertising

> * All features work without JavaScript

> * Many features work without an account

> * The fastest & lightest software forge [links to https://forgeperf.org/ - which is very impressive]

> * 100% free and open source software

Edit: here's the actual "forge" site: https://sr.ht/

Wow.

I would argue that it really doesn't matter if Twitter is worse than most other companies, the problem is that none of these companies should be operating with such poor (non-existent) standards. Especially when they have as much data as Twitter. I personally "protect" my tweets so that others, like my employer, cannot see them. There are many more people with so much more sensitive information that are trusting in this system.

Please note that I am not claiming that updates are a silver bullet. I am sure if someone managed to obtain credentials that allowed them to release an update for MS Windows, say, and that update installed a keylogger, it would be bad news.

But regular updates at the source code dependency, OS, firmware, networking hardware, device layers, mandatory code review, hardware FIDO/U2F tokens, training on best practices for handling data and for writing and reviewing secure code, use of modern encryption algorithms, encryption of sensitive data at rest, requirements to not store PII without a proven need, requirements to change default passwords (or even better yet - laws mandating non-default passwords at ship time), ongoing anti-phishing training, and the like will all help us stay safer. There are bad actors out there. We all make mistakes. Our industry is maturing at an altogether unacceptably slow rate, IMO - a lot of these techniques are well known in the industry, but they cost money and time to implement, and nobody seems to want to expend that effort until it's too damn late.

I am not a security expert. Just a developer who tries my best to pay attention.

One of the beautiful things about code and about tech is (used to be?) the leveling of the playing field down to simply ability. In my opinion, it should not matter whether a person is ugly, fat, skinny, fit, short, tall, old, young, gay, straight, nonbinary, trans, cis, what color their skin is from, etc., if they can get the work done and get along with their teammates.

I feel that we have lost something valuable in the remote working world when we demand that everyone turn on their video cameras at all time; we have lost the ability to appreciate people for solely for their ideas and their accomplishments and their aptitudes. We make it about the way they look, which has so many negative ramifications associated with it.

I'm not disabled beyond needing to wear glasses, but for more than a decade I had low self esteem and was unhappy with my appearance. I was ashamed of how I looked. I felt really bad about it. Today, I am quite happy to get on camera and as a tangent to whatever activity I'm doing show off my fitness. But I will never forget that I used to hate it, and it made me feel very uncomfortable. I believe that appearance and bias can reduce opportunity for those with the requisite ability.

But there still is the matter of that one hour. If I am applying to a job that has a hard limit on the amount of time that I can spend on that task, and I really want that job, you can bet that if I can figure out how to arrange my schedule so that I can spend more than an hour, and if I can figure out how to make it look like I spent no more than one hour, I will. And I believe there are those candidates who may not have the time to spend on unpaid work. It may be harder than it appears on the surface: There are quite likely other commitments in the candidate's life. There may be other interviews that the candidate is facing, each with its own technical requirements, some of which may requiring learning, study, or refreshing (as may your own). There may be other job application processes that the candidate is dealing with that also have one-hour pre-interview coding tasks.

There is also the fact that the candidate has to trust that you will evaluate them fairly. I believe that a published rubric can go a long way to alleviate this particular concern.

I'm not saying I have all the answers, as I know that I do not. But I believe that asking a candidate to take "one hour" of their lives for a simple coding task, unpaid, can sometimes cost more than is obvious.

If I can ask someone to solve a question (fizzbuzz, the find method in a binary search tree, ...) in real-time, I feel it is sometimes more respectful of the candidate's time. If the candidate has the time and the inclination to code a pre-interview task, by all means, it is a great method of assessment.

Live-coding in an interview be it in a text editor (shitty or otherwise - those web based platforms can be really painful and slow to use when sharing a screen with zoom, e.g.) or on a whiteboard is a skill, and I’m not sure it is one that is worth optimizing for because I’m not sure that this particular skill really has much to do with day-to-day software development. I am sure it doesn’t hurt to be able to perform in a foreign environment with someone judging you over your shoulder but I hope dev work in general possesses as little of this type of work as possible.

But you can simplify the problem considerably and ask someone to solve a fairly easy problem in just about any live coding fashion. To wit: I learned Java in school, spent some time at a job using other languages, then interviewed for an intermediate software developer position. The hiring manager asked me to write fizzbuzz in Java. I had never heard of the fizz buzz problem and I hadn’t written Java in some time. Still, I was able to successfully solve the problem with a minimum of difficulty (though admittedly a maximum of nerves). He asked me a few questions about how to improve the solution, and I mumbled some stuff about combining string concatenation statements instead of simply appending to the string, something which made him nod his head sagely and that I still consider to be a largely useless micro-optimization, but the main thing, the important part, is that I demonstrated some coding ability in a matter of minutes, right in front of his eyes.

It’s something that sticks with me and I think it’s a valuable type of interview question.

I got the job.

https://en.wikipedia.org/wiki/Fizz_buzz

1. Providing useful context up-front

2. No "hello" message sent while waiting for further input to be typed in

3. More emphasis on written communication

4. Less of a need to jump on a video conference

5. Use of headsets for video conferences

In some of the latter cases, the "office-first teams" still had management working out of the office and I believe that remote employees are kind of second-class citizens in these cases, and I found it less enjoyable and less productive to be a remote dev in that sort of situation.

I believe also that headsets for video conferences allows for full-duplex conversations where one or more people can talk at once and be heard, but I've not seen anybody else talk about this and may be wrong.

Edit: IANAL but here’s a resource:

> You're under no obligation to choose a license. However, without a license, the default copyright laws apply, meaning that you retain all rights to your source code and no one may reproduce, distribute, or create derivative works from your work. If you're creating an open source project, we strongly encourage you to include an open source license. The Open Source Guide provides additional guidance on choosing the correct license for your project.

From https://docs.github.com/en/repositories/managing-your-reposi...

I laughed at this. I am a Go programmer, FWIW :)

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

Edit: some reading: https://en.m.wikipedia.org/wiki/Universal_2nd_Factor I have the advantages and disadvantages section a read and I believe I got it right. The one major disadvantage I’ve read about is that there is no backup. At a place I worked, we registered two keys and kept one as a backup. It seemed to work okay.

Also this: https://www.yubico.com/blog/otp-vs-u2f-strong-to-stronger/

On OTP:

> The remaining issues, however, are phishing and man-in-the-middle attacks, the most infamous assaults that defeat OTP technology. The theory is quite simple: the hacker sets up a fake website designed to trick visitors into submitting their credentials. When a user falls into the trap and enters his information (user name, password, and even his one-time password), it is immediately intercepted by the hacker and used to access the victim’s account.

Later, on FIDO U2F:

> Real-time challenge-response schemes like U2F address OTP vulnerabilities such as phishing and various forms of man-in-the-middle attacks. As the legitimate server is issuing the challenge, if a rogue site or middle-man manipulates the flow, the server will detect an abnormality in the response and deny the transaction.

A couple of tangents:

1. I have ordered things from the Costco website; one time it was a large TV that was cheaper there than anywhere else I could find it, most recently a couple of office chairs. Their web purchasing experience is similar to others I have used.

2. There seems to be some evidence that Costco may be perpetrating animal cruelty on a pretty big scale: https://www.washingtonpost.com/food/2022/06/23/costco-chicke...

The line chart was great as well showing the huge number of listings for that one kitchen.

I don’t live in India and I wondered what FSSAI is, so I looked that up as well. It’s the Food Safety and Standards Authority of India: https://www.fssai.gov.in/

The author is performing a public service that I feel ought to be done by the authority in question in the first place. I hope the article gets lots of traction and serves as an example for food safety authorities worldwide to prevent this kind of trickery.

I’m leaning towards subscribing to the author’s newsletter; at the end of the article they mention that they were the ones who posted that recent fake IMDB credit article which I also saw on HN, and I’m looking forward to reading the article on the early Indian internet (https://peabee.substack.com/p/15-mafatlal-and-the-early-indi...). (I once had a chance to see Vint Cerf give a talk and while it was a while ago I remember enjoying it.)

Last note: I thought it was kind of funny how the author resorted to using Google maps photos of the kitchens. I thought it would be worth an excursion outside to get more recent photos and see them first hand, but maybe the author has mobility issues or something. I feel it would add a personal touch though.

From the article