d_watt

Yeah, they seem to even admit in the article they're dealing with machines the original owners expected to be destroyed.

Admittedly, I don't love the idea of that massive scale waste, but some people or corps have legitimate opsec concerns.

I don't think this is normal. It may be common, but I don't think it is normal. I find this deeply creepy for an OS vendor to think it's okay to push an update that collects data passively from machines. This isn't even collecting telemetry on active users. This is collecting telemetry on installed software.

I get that the Overton window in this shifted a long time ago, and in the tech community I'm in the minority, and especially on hacker news where so many people work for tech companies that track their users every way they can, but I am saying I find it deeply concerning that this sort of thing is a "run of the mill" telemetry update.

How do you think that a windows update checks for out of date office packages in a way that you would not define as scanning?

Also, please don't do ad hominem. I have no motivation outside of the personal one not wanting to be worried that every piece of tech I own is phoning home what I do.

> This update is intended to help Microsoft identify the number of users running out-of-support (or soon to be out-of-support) versions of Office, including Office 2013, Office 2010, and Office 2007. This update will run one time silently without installing anything on the user's device.

Sorry, how can this be interpreted in any way other than Microsoft pushing an update who's only purpose is to scan my computer to collect data for them?

And Microsoft has 0 goodwill in this department after pushing updates that made ads start appearing in start menus. These aren't "fears as facts," it's pattern recognition.

The idea that the OS vendor can push telemetry that scans my computer, not even analyzing activity, but rummaging through my old files, is crazy.

They've taken what was originally a sort of okay idea, automated updates for security, and turned it into something absolutely nuts. I have a windows PC for the occasional game, and these days I feel like I have to treat it as defacto malware.

> GPT-3.5 series is a series of models that was trained on a blend of text and code from before Q4 2021. The following models are in the GPT-3.5 series:

code-davinci-002 is a base model, so good for pure code-completion tasks

text-davinci-002 is an InstructGPT model based on code-davinci-002

text-davinci-003 is an improvement on text-davinci-002

https://twitter.com/OpenAI/status/1615160228366147585?s=20&t...

Asana as a subscription product makes sense as they provide hosting. The same for paying for backups for something like Obsidian.

However a single player game I play locally should not be a subscription.

Creative Cloud is interesting because they don't really offer ongoing value, but the price for purchasing it used to be so high the cost of "renting" it for a month feels better.

So, are you actually providing an ongoing service that justifies ongoing payment from your customers? On the flip side, are you pricing lifetime access at the true value of the software?

However, in the mean time, it's always worth coming at these things with the generosity of mind to assume that smart people made tradeoffs for real reasons, and for your "day job" work in the frameworks adopted until you understand the problemspace well enough to give truly informed feedback on why to do something differently.

I would suggest that the onus of learning this isn't on other people though. You can start with a baseline assumption that there is a reason these decisions are made. Assume other people are smart, rational actors, and that certain pressures and tradeoffs lead to the belief that the current strategies are the best we have for the state of things overall.

The reason I say this, in particular, is that you questions and answers in this topic have felt close minded and defensive. I say this not as an insult, but highlighting that this is often how I approached things when I was early on in my career. I felt overwhelmed by all the things I needed to know, and wasn't even close to having a mental model of how all the things in a fully working piece of production software fit together. That imposter syndrome led to me discounting things I didn't understand because it was emotionally safer to feel like I knew better than to accept I was barely floating along. Was this thread about a good faith effort to understand why terraform is needed, or is it a rant for why you're mad you have to learn it?

An engineers job is to get stuff done and not fight an ideological battleground. The world is impure, and requires impure solutions. Terraform is a tool to get things done, and given the realities of managing stateful infrastructure it does a pretty good job of addressing the failure states of it.

I'm a little confused by this, microservices or monoliths can both be distributed systems. A monolithic architecture (eg a Rails app) still usually has a separate database. You can even deploy that monoloth in different configurations (Web vs Worker).

You can then deploy many nodes of that same monolith, pointed at many different shards of a database to handle huge scaling needs. This is especially easy to do if the problem domain lends itself to horizontal scaling, like B2B saas.

I feel like the definition of microservices has gotten a bit murky here.

Whenever I think Sed or Awk would be correct for a problem, I find myself with a clever 1 liner an hour later I look at and think "I should have just used python," as it's untestable / unmaintainable, and I'll come back the next day and not be able to read it.

Are there people out there for whom these tools are daily drivers that are actually part of their core toolset, or are these mostly just hobbiest things where it feels neat to know. Like HAM radio operation.

Navigating the balance between self improvement, and being okay with the idea you may never improve to the point you want is hard. I know as much as I wish I could run a 5 minute mile, I was incredibly sedentary in my teens and 20's. It bothers me that I may never become "elite" in fitness because of my past, and that's just a fundamental barrier for me now.

My current thought is trying to find my personal worth in the journey of attempting self improvement, and not having an absolute goal of "I must be this smart" or "I must be this fit" to consider myself valuable. That mindset is easier said than done, though.

This advice can feel trite, or it can feel overwhelming. Changing physical habits when you're already depressed is a huge undertaking, and I don't want to minimize it. However, my revelation has been the mind truly is not separate from the body, and taking care of myself by running, lifting weights, falling asleep at the same time has had largely outsized benefits vs any medication or therapy I've tried in the past.

I think there's proven to constantly be a huge market for companies that do the dirty work that everyone knows they could do, but don't have the time or expertise to do.

If they can stay ahead of the curve on having best in class api-ification of the underlying tech, even if they develop competitors with similar quality, they have the momentum of being the brand name now.

I unhooked it and planned to drive 20 miles to the nearest charger, but after 1 mile of travel, it had dropped to 40 miles left. I turned around and drove back, now with ~20 miles left.

I parked the car in an unheated garage and plugged it back in, praying that the car would heat the garage to the point it could start charging. Maybe 2-3 hours later it started to take a charge, and 3 days later it was up to 150 miles, and I drove it to a super charger.

I realized after that, if I ever moved back to Maine and wanted a tesla I

- would need a heated garage

- I could never expect to leave my car overnight at a friends / trip during the winter.

I'm curious about the tradeoffs. The article mentions increased latency of 10's of milliseconds. If you have a complex access (many joins or index hits), is that exacerbated from many round trips to load different files? From a cost perspective, I image that you now have to think about IOPS. If you have a very high usage database, would it make sense to have a more traditional file system where you aren't paying per operation?

Edit: On reread, I missed that this is only available for the hypertable concept, and is more of a "cold storage" for older metrics, presumably accessed infrequently. I am curious about a general "PG backed by S3"'s ramifications.

Doubling that to 1/1000 accounts for downtime, unpaid pto, paying for facilities, paying for your own insurance, etc.

My main point is you can either treat the SOC 2 as an adversary to overcome, or actually try and leverage it to be better. No matter what it's going to suck and be annoying, though Vanta/Drata can help. But one can leverage it to be a better company.

A less controversial example than background checks is infra cost monitoring. Where a lot of SOC 2 is focused on business continuity, in addition to security, one of the things required is that you're actually paying attention to your costs. A lot of cash flushed VC backed startups don't. So, once SOC 2 hits, the company that's treating it adversarially will just rubber stamp some quarterly meeting where they "look" at infra costs. Or, you can actually take that moment to level up the company to have macro review of the cost of goods sold, an ensure the business is on a healthy path.

Again, not a comment on your article, one of the big takeaways for me in running a security program for years was a general anxiety around being transparent on the program externally, because there's a certain type of "security" person who gets off on picking apart policies, without understanding tradeoffs that we were careful to make sure kept the company safe, while letting it function smoothly.

Coming out with an article like this is a great thing to do, where a lot of content out there is just "we got our SOC 2, and now we're prefect."

I won't comment on the background check thing again, not the least because I don't want to argue more for something I don't like, just think may be a needed evil.

Again, they're not ideal, and there's a large social concern of a permanent record like that, but you have a duty of care if your customers are trusting you.

Also, it can help get you out of repeat security assessment questionnaires, so it can actually give you time back, depending on how many of those you have to field.