1,058 karma · joined May 19, 2015
I was expecting to see at least one repo that shouldn't be there depending on when the dataset was put together. In 2015 I changed a repo from public to private, which I think might suggest that the dataset was built after 2015 since my now private repo isn't in the dataset?
See, the beauty in what we're now calling the joke, is that it's both a joke for those who know, and it's actual valid commentary that meets your expectations of this forum.
Is the GP commenter suggesting that they'd like to have people in remote locations each load a copy of their DVD into a player at the same time so they can comment on it together? If so, then yeah, you need a capture card I guess, but the notion of doing that seems a bit bonkers.
That feels like such an obvious thing to say that I hesitated even saying it, but then I started thinking about how funny it is. A solution to HDMI being so locked down is to buy a $20-ish computer, that does all the things a computer can do, so that we can feed the TV the video stream we want. Over HDMI.
Given that it's so easy to circumvent now, I wonder why anyone even bothers with HDMI any more, aside from inertia.
But a bus? Yeah, that's just weird.
> iirc it's generated from a script in asterisk, with the delay and tone durations set "short" (I think it was the minimum EIA/TIA DTMF mark/space numbers, not sure.)
> My phone system was Google Voice, through an SIP bridge with Obihai (now defunct/discontinued). Asterisk then made the SIP connection and rang my other phones, a Lucent Partner ACS for my landlines, cellphones, ATAs and forwarding numbers, also over SIP.
> Most of the hardware was lost in the housefire last year. This recording was from early-mid 2020 or so.
https://cohost.org/sirocyl/post/2891449-i-broke-ikea#comment...
What looks "normal" depends on the org, but 23&Me knows what it is (or should, since it's a fundamental of running their business).
Just as a made up example, they may know that 85% of users don't use VPNs, and typically have an IP address that geolocates within 100 miles of their mailing address (which 23&Me has on file). Users might also typically log in very infrequently between 12-4am (localized to their IP/mailing address). And when they do log in, 90% of the time it's to see the new content you just sent a marketing email about, with short session lengths as well.
A user who logs in through an IP that geolocates well outside of their mailing address and methodically steps through every possibly thing you can click on at 3:15AM, is probably a bad actor who gained access through credential stuffing attacks.
Off the shelf tools can automatically detect all of that kind of behavior, and more. They can look at the collective traffic patterns and see a bunch of users logging in from the same pool of IPs, or the same VPN, or around the same time, or using the site in the same way as others bearing similar attributes. They can stop wide spread coordinated attacks from botnets.
The same tools can automatically detect and alert when credential stuffing attacks are happening, locking down accounts and requiring their passwords to be reset.
Given the scale at which 23&Me operated, it's impossible that they weren't aware of these tools.
Investing in the right tools is just one of many things they could have done. Even with those kinds of tools, you need to assume they're not enough (even if they are), so you encrypt everything at rest. Every decryption gets audited, and audit logs get fed into the same monitoring tools used to alert and stop abnormal behavior.
It all sounds overkill, but remember: they lost 91% of their valuation. All it took was the wrong people getting in, and it tanked their entire business.
This is not what happened here. 23&Me exercised poor security. I deal with financial data for my job, (like, transactional data, for most Americans), and I would consider that less sensitive than DNA data. We lock that transactional data up so tight it'd make your head spin. If it's data about an individual, in the wrong hands, it can do harm. If you're in the business of people's data, you cannot be stupid about protecting that data. 23&Me is (was) very much in the business of people's data, and could afford and attract the best talent to ensure the data was encrypted and protected.
They're reaping what they sowed.
That's why this data breach is so dangerous. It helps fill in nearly every stepping stone for bad actors, all the way to the baddest of them, to cause harm or exploit someone.
I work with someone who has said "if the Quest 2 was a 0 on the usability scale, the Quest 3 is an easy 8 - it's that much better." I've not tried it myself, but I don't think my coworker is exaggerating.
There's also little value to the answer. You either learn that someone is a delusional liar who has no weaknesses, or, you get people describing how they "care too much" or "tend to be a perfectionist," - both of which are basically worthless answers as well.
If I were to ask that question, I'd consider it valuable to hear about how the candidate realized they had a weakness. What was its impact? Did they do anything to try to fix it?
If you're asked "what's your greatest weakness," I don't think you can go wrong by reframing the question in your mind to "describe a problem/event that was significant in your career growth, either because of the hard truth it taught you, or because of the consequences it made you face." It may not be a strict answer to the question, but it serves as a way of telling the interviewer that you get it.
For example, I might ask a software engineer to describe one of their most challenging bugs - I'd want them to tell me what made it challenging. How'd they discover the bug? When did they realize they knew what was wrong? Why'd it make it to production in the first place? What did they learn when solving it?
I think if you can tell a good story that answers those questions, your "weaknesses" can become the reasons why you get hired.
I don't recall the question that brought out this story, but the candidate was describing why the startup he'd cofounded failed. One of the reasons, he shared, was "because of the day I went to jail."
You hear that from a candidate and your next few minutes just got way more interesting.
Candidate said he and his family woke up to a SWAT team raiding his house and seizing all his electronics early one morning. He immediately assumed his cofounder had been doing something shady, and decided on the spot to end the venture. His instincts ended up being accurate. Instead of paying taxes to the IRS, his cofounder had been paying that money into his own pocket, according to the candidate.
That's not so much a mistake, but the candidate shared what was the mistake: he never got a lawyer. He just accepted the consequences as cofounder, presuming that "equal partner meant equal responsibility."
He got hired, and has been rock solid for the four years we've worked at the same place.
It does remind me of a candidate who did though, for the exact opposite sort of behavior. One of the people on my panel wasn't very creative, and asked the cliche "what's your greatest weakness?"
The candidate thought about it for a moment, then apologized, saying "I'm just trying to pick an interesting one to talk about, because I'm sure I have them." That got me listening, as it was perfectly honest. Eventually the candidate said something like "one thing keeps coming to mind, and it may not be a great answer, but I can't let it go - I think my greatest weakness, at least when thinking of this role, is how challenging it will likely be for me for the first month as I get to know the people and company and process."
That's how you answer that question should you ever get it. With honesty. If someone asks about your mistakes, think of a big one, one where you learned a lot. Humility sends out a strong signal about how well you'll work with others, which is easily 50% of what's important to thrive at most orgs.
I once asked a candidate how DNS worked. It's something that even junior candidates for this role should have known, but this candidate tried to insist that "DNS worked because of the DOM" (as in, the browser DOM). When asked to clarify, and given plenty of chances to save themselves, they continued to insist, claiming that "Javascript and React handled all that." That stopped their candidacy immediately - less because of the lack of technical skills, and more because of their unwillingness to even explore the possibility that they were wrong. You can teach someone how the DOM and DNS work, but not someone who's unwilling to admit when they're wrong.
I'll admit that I'm not as "plugged in" to what pop culture is pushing these days, so can't speak to that, but my own experience with cannabis puts it in a different light for me (which, given your experience, I bet you're not that eager to hear, but maybe others might be).
For me, cannabis fits between opioids and over the counter pain killers - neither of which I can take for pain that I get from nerve damage from a pretty severe injury from a few years ago. Cannabis is very effective at taking the edge off that pain so I can sleep. It doesn't make it go away, it just makes it less intense. Cannabis is by no means benign - anything that can do what it does to my pain isn't "safe". I treat it with the same respect and responsibility I would with other medications. It's not perfect, and has its own risks, but in my case, it's beneficial.
Again, I really am sorry for you. Not so much because you can't enjoy cannabis, but because of what you have to deal with now.
I was simply offering examples of "normal" deductions that can easily change what you owe, and how those deductions aren't as uncommon as the person I was commenting to would have you believe.