d_watt

Part of taking on SOC 2 is also choosing whether you want your attitude to be "Let's do the minimum to get past the audit" and "Let's take this framework, and figure out where we can learn from it."

The post mentions background checks. On the one hand, I understand there's a real issue with these. On the other, if my PAAS isn't ensuring repeat offender fraudsters don't have access to sensitive data, that's possibly an area of concern. Hopefully the things they took from the other mentioned company do increase due diligence in vetting employees who have access to sensitive/regulated information.

Use it as a framework to actually think about BCP, DRP, etc, etc, and it won't be a total waste of time.

Edit: Also adding I bring up background checks as an example of learning from vetted practices, rather than trying to attack the decisions of fly. I respect this article, especially where it's easy for people on the internet to criticize decisions, when the reality is security is a series of tradeoffs, and to function as a business means having imperfect processes.

I've never met a company that gave SOC 2 out without an NDA. In fact, I'd consider it a negative indicator of maturity to not require it.

I'll agree that there are many situations where blockchain is being misapplied.

I think it's very unfair to say there aren't any applications though.

Blockchain solves the problem of "everyone has an agreed upon history of the entries in a ledger, and that ledger can't be edited by a bad actor, and there's a consensus algorithm to ensure new entries to that ledger are maintained."

That's exciting for situations where trusting a central actor to be well intentioned forever is not wise. Publishing "news" on a blockchain, so you don't have to worry about a future actor trying to whitewash what history is, as an example.

Interesting. When you say that's the problem they're intended to solve, do you have a link to that as their intended use case.

IE is that "a" usecase or "the" usecase? I've never seen submodules used for that, only for internal dep management, so if there's content about "what they're really for," I'd love to read more.

Relatively few people are against the blockchain as an interesting technology for creating distributed truth in areas that can actually benefit from that.

I think if we're extending your age of sail metaphor, I think people are against it being used for the modern version of tulip mania.

Personally, I'm now more excited now about blockchain than I have been in the past. I think the the rush to extract money from people via btc, nfts, etc. is what has overshadowed it's ability for interesting/novel use cases.

Git submodules aren't bad in that they're buggy, they do what the documentation suggests.

I think they're difficult to use, because it breaks my mental model of how I expect a repository to work. It creates a new level of abstraction for figuring out how everything is related, and what commands you need to be able to keep things in sync (as opposed to just a normal pull/branch/push flow). It creates a whole new layer to the way your VCS works the consumer needs to understand.

The two alternatives are

1. Have a bunch of repositories with an understanding of what an expected file structure is, ala ./projects/repo_1, ./projects/repo_2. You have a master repo with a readme instructing people on how to set it up. In theory, there's a disadvantage here in that it puts more work on the end user to manually set that up, but the advantage is there's a simpler understanding of how everything works together.

2. A mono repo. If you absolutely want all of the files to be linked together in a large repo, why not just put them in the same repo, rather than forking everything out across many repos. You lose a little flexibility in being able to mix and match branches, but nothing a good cherry-pick when needed can't fix.

Either of these strategies solve the same problem sub-modules are usually used to solve, without creating a more burdensome mental model, in my opinion. So the question becomes why use them and add more to understand, if there are simpler patterns to use instead.

Interesting. What would you say the use case is for this, rather than setting up read replicas? Not having to maintain routing to the replicas on the application side?

1. While that’s true there’s no reason to think that extreme case is normal for these.

2. Even if it was, it’s sort of irrelevant. When considering the safety of the feature, the whole process, including allowing the driver to become distracted, must be considered. This isn’t a clean room where you can just focus on the performance of the models, this is a real life car interacting with other unpredictable cars, being driven by an imperfect human. If the nature of these systems is that it makes the drivers complacent, that’s absolutely something that needs to be taken into account when thinking about the overall experience of a self driving system.

I know this is the discussion as old as JWTs, but the tradeoff here is how do deauthenticate the user. If you delete/disable the user, or change their role, there's still a stateful JWT out there claiming they have certain grants.

You either need to accept a certain TTL on the JWT, or be able to revalidate the JWT on every request with some authoritative service to ensure the grants are good (which sort of invalidates the value of the grants encoded in the JWT itself).

Every B2B app I've ever worked on eventually needs some type of calendar view / integration.

My even dumber reason 5 years go was sublime's extension system at the time didn't allow styling of the file explorer, so git status wasn't available.

The entire editor being easily tweakble is the killer feature of web-tech based editors.

Sublime may have opened up more customizability since then...

It's amazing how much a minor annoyance can drive someone to a completely different solution.

You having a legal right to discuss pay means your companies can't prevent it, and you could sue for wrongful termination if they fired you for it. This is as opposed to the government having no opinion, and a company could fire you for discussing it, with that act still being legal.

As a small anecdote as someone who switched from atom, the killer feature for VS Code is being extendable AND performant. I used to use atom for a flexible text editor, and then still have to use sublime text if I wanted to open a large file (atom choked on multi MB json files).

I don't know if it's possible to get the performance you need to make an IDE/text editor feel snappy in most situations with a pure DOM solution.

It's in the article, the section being discussed in this thread: https://www.citusdata.com/blog/2022/05/19/speeding-up-sort-p...

Not for OLAP, but this seems to be about OLTP. If you're trying to sort 10GB of data for a traditional OLTP query, I would consider that "too large" and need of some data structure optimization.

Also it's specifically about queries where the sorted data is too big for memory:

> The final change is aimed at larger scale sorts that exceed the size of work_mem significantly. The algorithm which merges individual tapes was changed to use a k-way merge. When the number of tapes is large, less I/O is required than the original polyphase merge algorithm.

Thanks for the link.

Now I need to dig deeper on all the concerns brought up there around non-atomicity and table level locking!

Seems like it could be useful specifically for bulk uploads.

Does this fill the same role as "Insert - On Conflict Do Update," but it doesn't require unique indexes?

I'll +1 firebase as the easiest managed solution for this work. There are competitors like supabase that can do the same thing. Alternatively, where both your examples are about showing things to the user, maybe product walkthrough software like appcues is more approptiate.

I'd caution against Airtable, last time I used them in this capacity, the API rate limiting / response time made it a no go. I'd err more on something like hasura if you want a flexible CRM like that.

Just to throw in another anecdote, I realized a bias I was having interviewing. Talking with candidates who used airpods was such bad audio, that I was less engaged and generally had to devote more energy to understanding them, leaving me with an impression of them that wasn't so much to do with the content than the medium.

A good reminder to myself when I'm on an important call just to set up a yeti, out of respect to the people who have to listen to me.

For some reason, it's stuck in my head that CSVs can't be streamed, as they cannot be parsed until you have the whole thing, due to the nuance of quotes, excaping, and newlines.

IE

1,2,3

a,b,c

d,e",

"

g,h,i

Or is there a reliable way to know when you have a complete line chunk without the whole file?

Probably one of the questions here is how your company defines Senior. I’ll assume we actually mean “senior” and not “We give out senior to anyone with more than 3 years of experience because the title make it easier to hire.”

I don’t think those requirements are very much for senior. The first four bullets are “can you own your code through into production,” and the last one is critical to build a healthy organization that can build up new people.

Honestly, if anything I feel like there’s a trend to expect less from developers because the market is so tight, you can’t push people to grow for fear they’ll jump ship. Many developers are allowed to become “advanced beginners” where they’re just getting really good at one small part of the stack.

And if that’s all you want, to be a badass (React Dev | Golang Dev | SRE) etc, that’s fine, but unless you’re truly at a company massive enough to support deep specialization, that’s not being senior.

Can't you also value a thing for the history they represent? The tomb of the unknown soldier isn't sacred because it's human remains, they're sacred because of their story.

I've been curious, if this is true, why hasn't intel moved the goalpost for 7nm and declared victory, rather than the constant black eye of not having achieved that "marketing" number for years?

It depends on the implementation and definition of “datetime” in whatever you’re working with. Taking Postgres as an example:

date: the concept of a calendar date (Your birthday)

timestamp: the concept of of a calendar datetime (You should get a new years kiss at 2022-01-01 00:00)

timestamptz: the concept of a precise moment in history (This comment was written at xxx time utc)

You can design a system where timestamps/datetimes are considered to be precise moments in time, utc, but that’s a matter of the impmentation you’re dealing with. Again, postgres does not assume timestamps as being in UTC (which has messed me up on more than one occasion).

Ultimately, this is the same problem as “is ‘04’ > 3”? That is to say, you can only properly compare two things of the same types, and you can either implicitly or explicitly cast.

The easiest option is that comparators should only work on the same data type, to avoid any ambiguity, leaving it up to the user to do explicit casting, and throwing errors if they don’t.

Of course, like integers and decimals, maybe it makes sense to have implicit casting, but it’s unintuitive to me if “‘2020-01-01’ > ‘2020-01-01 12:000’” should be cast to two dates, two timestamps, or two timestamptzs. Even if a language allows implicit casting, it’s probably an area where not doing it as a author is a smell.

Am I right in reading this as the parent comment envisioning a “post” table and a “tag” table, and you’re suggest the “post” table just have a “tag” column?

And likely a working professional adult who can afford an iPhone is worth at least a deviation or two above that.

Competent Authority is a legal term referring to the agency/group that has authority in the given area.

Those aren't really equivalent, are they? Hadoop is for analytics, spanner is transactional.

In terms of popular nosql vs google sql products, it's more Hadoop : BigQuery :: Mongo? : Spanner

You're pretty explicitly not supposed to run OLAP queries on spanner.

It's not as common in the US, since most states are at will, either side always can give notice at any time for any/no reason (other than targeting protected groups / whistleblowing, etc), there's not as much point to a probationary period.