tldr; The number "512" when talked about in the context of RAM is assumed to be measured in MB, but 512 GB is also a less-commonly-encountered amount of RAM. :)
2,010 karma · joined December 27, 2015
tldr; The number "512" when talked about in the context of RAM is assumed to be measured in MB, but 512 GB is also a less-commonly-encountered amount of RAM. :)
The moment a product mentions "From developer to CEO" (ie. includes the word "CEO"), this is bad news. As soon as you introduce any metrics involving "participation awards" (whether based on lines of code, commits, reviews/pull-requests, etc.), the company is doomed to fail at understanding how productivity/worth is measured in the development world.
The fact they even mention "CEO" in their tagline is all one needs to know. There is not a single CEO in the world who should give a goddamn shit about actions taken at the source control or release level. It's all marketing drivel intended to promise management that the product being sold can somehow deliver insight into a world they will never understand. The fact is developers will just waste time inflating their metrics to satisfy productivity algorithms, while costing the business time–and therefore money–developers could have spent actually improving the product.
I don't see much of a solution other than making it a matter of policy, eg. Microsoft's "P3P" header. Otherwise authentication credentials need to be supplied with every request. Not a session id or token as a cookie, but the actual username and password being supplied with every request. Basically the old http basic auth, but with a more modern system to replace it.
I understand the core idea behind the EU's desire, but the fact is that cookies are absolutely required for login sessions, and it's impossible to allow users to opt out. The EU doesn't understand the tech behind the laws they are trying to enforce, and this is where it leads to. Absurdity.
That depends on the difference between ground vs. air delivery. I usually pay expedited shipping if I expect it to convert a 2-3 week ground delivery into a 1-3 day delivery by air.
Yes, some companies offer "normal" vs. "expedited", with either choice being shipped by ground. In that case, I agree that shipping expedited ground–especially if it's within state–is designed to rip off those who don't known any better.
100% this. IRC chat has no right to privacy as far as I'm concerned. If anyone can join without an explicit invite that has an expectation of privacy, those rights don't exist.
> In VR people will stick their heads everywhere.
Particularly when players have any level of knowledge about what kind of complexities or edge cases are likely involved (eg. any software developer or QA, even if not part of the gaming industry). Or... hell, maybe it's even worse when you have ignorant players who expect the VR environment to mimic real life so perfectly that they get frustrated and can't understand why certain actions aren't supported/working.
The first VR game I got to experience was one of the haunted house horror games, and you're damn right I bent down and tried to shoved my head into an open cupboard just to see if the collision detection stopped at the outer box of the model, or whether my head would be allowed to enter the space. Then repeatedly leaned/shoved my head against VR walls at various angles to see if I could get the camera to clip or bounce/reposition jarringly. Poor, poor developers who have to try and nail all that logic perfectly. It must be so rewarding to see final results when everything works out well, though. :P
Many people assume Google, as an upper-level business decision, purposely makes products work better on Chrome in order to vendor-lock users to the browser. Maybe that's true; or maybe it's developers being lazy and using User-Agent detection. Removing their ability to do so might actually improve cross-browser compatibility of Google products.
Note that this is incorrect. This is a common misconception about POSIX/UNIX. Not every process exits with an exit code; that's right, a process can exit without an integer exit code! A process exits with either a) an exit code, _OR_ b) the signal which terminated the program (as a separate status in the underlying struct, rather than as an exit code).
Many shells–including bash–provide an abstraction that translates process exits caused by signals into 128+signo, but this is only to fake an exit code for processes as seen when executed within the shell; this is a nonstandard and shell-specific abstraction.
Look at the man page for waitpid() for details. There are macros to test for the difference between an exit status with a code vs. an exit due to a signal; eg. WIFEXITED() and WIFSIGNALED(). WEXITSTATUS() will return the exit status... if one exists because WIFEXITED() tests truthful. Hint: if you're used to seeing your shell report 128+signo, that's because your particular shell happens to check waitpid() for WIFSIGNALED() and sets $? to 128+signo for you… as an abstracted convenience.
tldr; An exit code, vs. an exit caused by a signal, are mutually exclusive statuses. Processes terminated directly by a signal do not have an integer exit code; your shell may provide a fabricated exit code to make things appear simpler, but that is shell-specific and NOT a standard convention provided by POSIX or UNIX.
Half of this article is not "How do Unix pipes work", but "how to fix broken SIGPIPE handling in Python".
1. If whichever identifier is used for login (eg. email address) is exposed/leaked, it cannot be used by the attacker to lookup accounts in other leak dumps.
2. It allows to detect which site/service/entity is selling or leaking email addresses to third parties which send spam. I no longer need or have a spam folder. The moment I receive a spam email from someone I don't recognize, I can lookup which site/service that email was for, and choose how to act; eg. update that site/service's to use a new email address and blackhole the old one; maybe unsubscribe/close the offending account if it happens again. Of course since setting up my unique-email-per-site setup, I haven't been victim to third-party spam yet; likely because I no longer have a personal email in public Github commits.
https://en.wikipedia.org/wiki/Serenity_Prayer#Use_by_twelve-...
Personally, I'm ecstatic that there is no recovery process to reset or recover a Bitwarden master password. No security questions. No email reset. No one-time use login codes (which would need to be stored somewhere not encrypted by a user's secret key in order to verify). Again, I can understand why an IT department would want that, but all that does is open up attack vectors that are very easy for an attacker to abuse.
The whole point of the master password is it's the ONE AND ONLY password you cannot forget or lose. One... lousy... password.
Of course, Bitwarden also has the "Families" paid version, which costs... $1/month for up to 5 users (that's $1/month flat for all 5 users, not $1 per user). $1/month for a whole family is beyond reasonable, and precisely why I love Bitwarden – it's great software with prices designed to support a single developer's open source software rather than the exorbitant prices required to support an entire company and their proprietary software.
Search for "Organization Accounts" on https://bitwarden.com/ – either a) $5/month for first 5 users in a team + $2/user/month thereafter, or b) $3/month per user for enterprise (teams + premium for TOTP + user groups). If I understand correctly, the teams version allows users to manually share what they want, while the enterprise version allows finer-grained permissions based on predefined groups of users (including optional integration with LDAP).
I haven't used teams/enterprise, but based on the feature list ("User Groups: Use groups for easier user management and greater control across departments and teams", and "Access Control: Implement fine-grained access control policies and organize your vault with collections"), I assume it's possible to setup permissions to the shared collections however you want. I would hope it's possible to have read/write owner(s) to manage credentials, with an option to allow other users to be readonly if desired.
Based on my experience with the personal edition of Bitwarden, and how well the developer handles his community and GitHub issues, I expect it's now as mature and flexible as anyone needs. You likely need the enterprise ($3/mo/user) for the most flexible use cases. Don't quote me on that though. :)
Passwordstate pisses me off so much I can't even be bothered to go into details as to WHY it's so bad.
Unless you're talking about mass-replacing a single password across a bunch of different entries? Which is certainly not a limitation of any password manager; reusing a password is just horrible.
Personal use is free, with an optional $10 per YEAR (not per month) addon that adds a built-in TOTP client (ie. Google Authenticator compatible two-factor auth). There are also "Organization" accounts at extra cost for more enterprise-level usage, including sharing credentials among teams.
Note: I believe that even if you host on-premise using the open source code, it expects a paid license for the extra features (TOTP and Organization accounts), at $3-5/month per user.
The credentials (certificates) being exposed via http://169.254.169.254/metadata/v1/user-data – from within any pod/container, not just from a physical node – was the final straw. I'd forgotten that the DO token wasn't directly listed there, but can be extracted from the etcd instance where it is stored (explained under "DigitalOcean Account Takeover" of that article).
Again, all of this may have been (and hopefully has been) mitigated since the original release. For me, it's too late to reevaluate; the fact that was considered releasable in the first place destroyed any credibility in my eyes.
Not only are your cluster's administration ports exposed on public addresses with no ability to firewall them, but each node pulls an Admin-level auth token to manage the DigitalOcean account behind the scenes. A single http request made to an internal IP, from within any Docker container running within the cluster, grants the attacker full read/write access and control to the underlying DigitalOcean account. This includes any developer who does so from code deployed into the cluster, giving the developer full access to the business's DigitalOcean account.
This is why I'm an Apple user. Hate regarding Apple's policies like "use a platform that lets the app function correctly" (ie. drain battery running in background just to do more tracking, or because every developer assumes THEIR app is so special that it must never be unloaded from memory, in order to open instantly when being swapped back to... weeks after user's last interaction). With hilarious frequency, the complaints people have about Apple are precisely the reasons I prefer their products.
It's impossible to satisfy everyone, regardless of the content rules, and no mater how curated. YouTube could spend a billion dollars curating content, along with surveys where 90% of parents have to approve a video before it is included, and the remaining 10% would still be the vocal minority ruining it for everyone.
Sure, YouTube probably doesn't do quite enough. But when you have parents looking to let YouTube babysit their 2-8 year old children without supervision, whose fault is that? YouTube's, I'm sure. /s
Swift came out at a time where UTF-8 was already the standard. They talked a lot of talk about grapheme clusters being the most accurate representation, and then failed to deliver a coherent API to back it up. Any chance that has changed?
Personally, if I switched away from PHP for web development these days I would do the backend in Go. But thank you for teaching me something new today. SCGI is not a protocol I'd heard of before, what with FastCGI being the (horribly legacy) standard. I have something new to research. :)