Better than those on Richese.
1,117 karma · joined January 21, 2013
There are plenty of too-big-to-fail companies that at the end of the day don't care if the project succeeds, just that if somethings goes wrong you have some definition of legal recourse. You buy IBM because you write in your contract "we agree to buy the necessary computers systems and software as require per our vender (IBM) and the vender will be responsible for ensuring compliance."
Sounds great to both parties, except the loophole doesn't say that the requirements need to be correct. If things go great, fine. If things go wrong, customer gets to argue with IBM. Good luck with that. IBM isn't known for their hardware and software in the computer world, they're known for their lawyers.
I think you make a good point: the only way to be secure in this method is to A) work on an uncompromised machine and B) write each layer in series and C) never change it again.
The problem with deniable encryption is: if the attacker can watch the file changes, one can determine the rough size of the data in the volume. The attacker makes note of where in the file changes occur. Once you get them to unlock the file you see if the data is shorter than the size of file changes. If so, you know there is more data.
Once an attacker can see your encrypted volume, you can no longer make changes to the hidden data.
I once interviewed for a COBOL position. It was a typical large financial institution. It was a lead position that wanted a migration plan out and then would lead to a team for me. I have a lot of systems integration and information management knowledge. I have worked on planning multi-year projects and migrating out of large systems like this before. The interview went well, and afterwards they showed me around the place and what they were doing.
I sat down again in the office with the hiring director, and I enquired about how long he has been with the company and what he has been working on. Turns out he had been hired in five years ago and had already attempted this once before without success. I knew without a doubt why they didn't have success, and it had nothing to do with COBOL.
Financial companies are highly risk adverse. COBOL developers know this. COBOL developers know that if the shop isn't COBOL their job is at risk. So, COBOL developers will constantly introduce "what about this risk" issues, which then must be considered in committee; thus, the company is eternally paralyzed. The fact that the director couldn't make it anywhere in five years meant nothing was going to change.
As I recall, I checked in a few years later and they were still in the same place. I suspect it might have been a decent place if all I wanted in life was a paycheck. They were nice people.
I have the advantage that I am a programmer, so I can deal with a bit of reading install guides and arcane configuration. I was surprised to learn just how reliable things can be. Open Source tends to move forwards, so I don't have features taken from me. In recent memory, both 1Password and Fantastical have taken my features in the name of subscriptions. I installed ZigBee home automation with a Hubitat. It has never failed me. Internet and Wi-Fi can be down and things still work. The unreliable part is Google Nest (invalidates tokens every now and then) and Apple Siri (randomly can't do things at times). In short, I can automatically scan and OCR documents, have file services, movie and music, and more, and it all just works.
/rant mode enabled
It has become obvious to me that the law is quickly becoming snitch based. With so much information being hosted online, it's just too tempting a target to not use it for other purposes. Google and Facebook are just the leaders in where this is going. There is just no reason for law enforcement to not scan for dissonant behavior at some point, just as they roam the roads looking for violators. As more jobs become remote, the argument will be "the roads of the 21st century are on the Internet." Difference before is if you get pulled over on the road, you can log it. You know when and where it happened. You have evidence of the encounter. You can see what was used against you and who.
The new system you requires you to try to prove your innocence. You won't know when or where you were targeted. You are not allowed to inspect the software or see the matching hash information. You must open your phone to prove the file is innocent, at which is is legal for the police to capture data. Finally, it is NOT against the law for law enforcement to lie to you [1]. This utterly stacks the deck against you.
All of this could be avoided if at the time of the event you could record what happened and challenge it, because ultimately law enforcement is a money making scheme. Cops are the largest thieving group in America, so treat them like it[2]: a car alarm doesn't stop them, it's just means most thieves will choose an easier target. So, private services doesn't stop a cop, but following cloud events is a lot easier than trying to get into my house.
My sincere hope is that the cloud keeps them busy enough to stay far away from me.
[1] https://www.youtube.com/watch?v=_IZlrf8CiM4 [2] https://www.washingtonpost.com/news/wonk/wp/2015/11/23/cops-...
Use ZigBee. ZigBee devices create their own mesh network, so Wi-Fi can be down and things still work. ZigBee does use 2.4 GHz, so you may need to move your router to use a different frequency.
Use a Hubitat Elevation or other dedicated server with ZigBee and a UPS power backup. Again, this means the automation logic is independent of the network. Wi-Fi and/or Internet can go down and home automation continues to work. The Hubitat has community driven package management. Once set up, it's a breeze to perform updates.
If you still want to use Alexa, Google and Siri, use bridge software to the services. I use Home Bridge to give access to my Hubitat to HomeKit. Home Bridge in docker means upgrading is letting Watchtower do its thing. Home Bridge rebuilds it's plugins every start, so restarting the docker container brings everything up-to-date.
The most unreliable part has been Google. I have Nest thermostats, and Google cancels the Home Bridge login token now and then. HomeKit integration is excellent, but I wish Siri wasn't so daft at times recognizing speech.
This is a very strong narrative in the U.S. media to excuse the fact that we had a chance to do the right thing but didn't. When the political leadership realized that we were utterly unprepared and the Trump presidency would refuse to act in a meaningful way and Republicans would never accept blame for being in power without a solution, it had to turn into "it wasn't a solution and it just hurt economy." This is despite the in-your-face fact that many countries successfully used lockdowns to stop COVID in its tracks.
You have to realize that there is tremendous amount of censorship going on in the U.S. by a lack of reporting in general media. COVID is the ultimate in confirmation bias porn and is making the media companies lots of clicks. Many Americans are now addicted to various narratives on all sides; and, if they see something that contradicts their position they immediately throw the narrative out and/or straw man you that you're on the other side.
I can say that many of us Americans lament that freedom once meant "the ability to work together as we each see fit for the good ourselves and the common of good of the next generation" and now freedom equates to narcissistic goals at any justification and cost.
I knew that hospitals charge ridiculous prices at first and then insurance jumps in. At the time, the insurance that I was on seemed to have a policy of "first let the hospital bill the patient and see if he/she pays then we'll get in involved." My procedure was $3,000+. That was a joke, but it also wasn't wholly inexpensive. I figured I'd end up for my deductible at about $800 or so. Hospital sent me the bill for $3,500. I expected insurance to chime in, but didn't. A month went by, I got an other bill, only lower. I call the hospital why this wasn't being resolved, and they said "looks like we didn't mark the procedure correctly. Ignore the bill, we'll fix this." Another month goes by, another bill, still lower. The bills still come and they kept changing. Eventually, it gets coded correctly and insurance did their part, and I owed $600. I forget it about, though. I get a call on the phone with the hospital saying, "we're going to send you to collections unless we can get some level of payment on this." I ask what the bill is if I pay in full. She says, "Pay in full and it's $380." I said, "I can make that happen."
The U.S. is quite corrupt like any other "third-world" country. Just in different places. Our places are acceptable, though because "deregulation" or "gun rights" or "free speech".
[1] https://en.wikipedia.org/wiki/List_of_community_currencies_i...
Generally, there are two solutions. One is to track absolute time by increasing the clock as necessary to realign the day to the year. There are Earth days with where the last minute of the day is 61 seconds long. Daylight Saving Time makes days with 23 hours or 25 hours. And, of course, leap years add a day. Unfortunately, a lot of software/hardware is built by people with misconceptions about time, like a minute can have only 60 seconds or a day can have only 24 hours.
So, the second solution is to update the system periodically. Computers often poll internet time to update the clock and will jump to the new time. Alternatively, some systems skew the system clock with additional milliseconds per second until it catches up with the time change. As long as the values are valid typical ranges, most software doesn't care about sudden changes.
Many things can be "fixed" if you choose to go to another system. Good developer environments limit the supported tools, languages and packages. This comes from several issues:
* When something goes wrong at 2 a.m., is the developer available going to be able make a reasoned decision how to fix the program?
* Can you hire people with a mix of Python and Go experience?
* If you want performance, why not choose a faster variant of Python so you stay in the same skill set?
* You successfully built a Go program, but did you document your development? Did you set up a standard environment? What about CI/CD and automated testing?
When you leave your position (and you will someday), who is really able to take over managing that software?
> My coworkers who don't know Go understood the code just fine.
Understanding and groking are two different things. I'm sure they looked at the code, nodded their heads that it makes sense; however, I suspect that if you asked one to modify the program with a new feature that they suddenly will see all the things that they don't know, from getting their environments working to subties in the language's mechanics.
Environments are standardized to prevent having these types of issues between workers. Software development is ultimately about supporting the people and business goals in the company.
I agree completely. I was trying to comment on the Western narrative about capitalism: "Capitalism is all fine and dandy unless it impacts me negatively."
You can argue with price or the peculiarities of a service or that AWS is taking over the world, but I have never seen them use contracts to force effectively companies to comply.
I remember in business school how it drilled into us that there are only two important numbers in a company. The price of your product, and the cost of your product. "You can only dictate your cost of your product because your market dictates what you can sell it for." Every time I hear things like "we can't find enough people" or "yeah, but then we'll just pass it along in our cost to customers," I know how much we don't have capitalism.
Think of it this way: A balloon is space and the speed of sound is the limit at which waves can travel across it. This normal for sound waves. If every bit of the balloon expanded at 1 inch per second, a small balloon would be getting bigger, but wouldn't exceed the speed of sound. A sound wave will outrace the expansion.
Once the balloon as expanded to about 2500 feet in diameter, the expansion along the balloon will be greater than the speed of sound. A sound wave will never make to the other side. That said, no one place is expanding more than 1 inch per second. Nothing in part violates the speed of sound.
Google stack ranks employees regularly. Lowest of a group is always fired. Doesn't matter how good you are or how much satisfaction you give to your customers, you're basically asked, "what have you built that could be the next billion customer thing?" If you're not answering how you're part of the next big thing, you're going to lose. So, once something is acquired or released, consider it deprecated.
The TSA is a lot more likely to steal your stuff than some random person with a printed key. Plus, if you use a real lock, they have the right to clip it off, which is trivial. Don't put stuff of value into checked luggage. Keep it on your person or ship it via a carrier who has insurance.