devonkim

FWIW, more debugging information in an IAM failure is another round of information available to me as an attacker. If such a service existed available to the customer this also becomes potentially available to an attacker. In fact, it may wind up violating a few companies’ security and compliance policies.

However, I think that customers should have the option once they sign some stuff acknowledging that they may be really, really screwed similar to Bad Things done as a root user in AWS.

Given the distributed nature of so many requests in AWS I’d imagine that a GraphQL-like setup would be conceptually compatible with such a system. It’s not terribly far from tracing systems like OTEL

And that’s part of the problem IME from the customer side. Many of the largest pockets come from those with the worst technical debt and cultural issues of past mistakes and trends all done precisely while trying to avoid said mistakes. While part of the point of many different vendors is for resiliency as an enterprise much of the complexity is frankly various forms of proprietary vendor lock-in tactics trying to entrench themselves in some way to these high value, low churn accounts which starts to become more of a politicking or spear phishing exercise to the C-suite than anything about the solution itself. Essentially, every other bad technology decision in hindsight comes from many of the underlying problems that cause people to develop rather poorly thought out, shallow opinions unrelated to technology - confirmation bias.

As such, sales to me is one of the ultimately lucrative forms of social engineering attacks that oftentimes leaves the victim feeling like they got something when they really are just paying to feel like someone’s solving something for them.

I’m a big proponent of leveraging Amdahl’s Law in social policies and that freedom of movement should be promoted culturally given the nature of markets to solve a lot of problems although we have serious gaming and regulatory capture issues in the US that make this pretty naïve. If command economies oftentimes fail to attain resilience and markets have horrific social side effects detrimental to civil society / collective problem solving, as a society we should probably accommodate people to relocate given it’s probably cheaper than encouraging specific groups to relocate geographically. There’s no clear social contract at a point given so many holes and inconsistencies over many decades of back and forth bad faith approaches along with institutionalists myopic to the individual scopes of their well intentioned policies.

Much like the original architecture and UX of welfare in the US had assumptions like a family with a cook at home I don’t think education as an institution is really meeting the needs of the public to be better informed and critical thinking citizens invested in communities and society as a whole.

There’s a big cultural issue currently where people are resistant to move for better opportunities when much of the US immigrant population has thrived over generations specifically by migrating to opportunity areas. Now, many that try to leave impoverished areas are shamed and become pariahs for leaving basically job deserts and the social costs are horrific as people find less and less connection to others.

I'm not disagreeing that throwing money at bad schools won't really help is the thing although it might seem like that's where my line of thinking may lead. Heck, usually more money at schools from what I've seen ranges from more administrators (lol if anyone thinks that helps) to equipment for students (as if an iPad will help a disengaged kid that much?). Add in the reality that lower socioeconomic status folks tend to move a LOT (think migrant workers' children) and that has pretty bad outcomes on education regardless of potential of the child.

In fact, in impoverished areas probably the most important thing to do to improve educational outcomes after establishing a school at all isn't better schools but simply money at home - teachers are only responsible for 35% or so of the educational outcome of an aggregate population while something as simple as ensuring a child has reliable sources of meals and that the meals are with family is _way_ more important it turns out (insert correlation / causation caveats).

As such, my suggestion isn't to spend more money on schools in low performing areas but to direct funding toward better home lives for students in the districts essentially. What good is spending $100k on better teachers and equipment when the students are living in trailer parks with abusive parents that don't feed them properly? This is a problem _many_ teachers in low-opportunity areas have talked about as one of the top problems for them.

I used to support charter schools conceptually until I understood that the funding mechanisms cause a zero-sum game problem which takes funding away from schools that could use funding that would do better. At this time I'm convinced that almost any policy in education or health will fail without addressing the massive harms of large scale poverty in a capitalist system.

One of the key problems in the US funding system is that population clustering effects will cause exacerbating effects where people of increasingly similar socioeconomic and cultural strata all stick together - of course this will cause rising inequality and unequal outcomes. The people living in the gated communities fund their local school primarily, not the poor one on the other end of the street that can't get or retain teachers there besides from ideologically driven sources like Teach for America because students are absolutely horrible when coming from poverty-stricken homes that use public education as a meal program while the working poor parents do 12+ hour shifts frequently.

The funding structure of every other thing in the US is totally backwards and so unless we solve cultural problems like xenophobia and tribalism we will be unable to solve socioeconomic ones. As such, I have basically zero faith that the US will last another 20 years in any recognizable form as a liberal democracy.

You'd be better using South Korea as an example rather than France these days. To add more context, South Korea is an incredibly, incredibly corrupt country that sends its exiting president to prison to the extent that I joke that we need a special prison just for presidents. Yet there are basically no nuclear accidents at the kind of scale that we saw from Japan. 100% speculating but it's almost as if the nuclear power plants are used as a deterrent and part of the national security apparatus perhaps similar to the logic that Ukraine may have had in the past.

The anti-nuclear crusade in the West is a bit worrisome given that if we had been better at dealing with nuclear as a whole there would be less coal and gas power plants all over the West now. As much as I can sympathize with the concerns about nuclear power related supply chain issues and risks of meltdowns + radiation almost all the problems I've seen in nuclear across countries and cultures don't come down to technical issues as much as structural ones due 90%+ to politics causing massive over-regulation of nuclear to become unviable both financially and politically. This seems silly because I strongly believe such efforts should be directed at the much greater, immediate, far more supportable threat to humanity's IMO of fossil fuels. Of course we kind of depend upon them now but given the problems we had from the 1980s into the 2000s with fossil fuels all the way to now the kind of resources we could have spent on renewables may have had better results simply stepping away from lobbying constantly against nuclear power and letting engineers do their best work in all areas of energy research.

Seriously, almost all the "but nuclear costs too much" arguments are a self-fulfilling prophecy of bad faith where people pile on more and more requirements like it's a really bad DoD project when it's much more complicated honestly. US DoD has operated tons and tons of nuclear reactors, for example, quite successfully with a pretty darn good safety record last I saw despite all sorts of other failures within the US Jobs Program - they're used in submarines!

We’re looking at a stagflation situation now where prices go up and wages and even underlying assets are supposed to be going down (cars and technically houses given they both depreciate as durable goods go).

I studied and played classical into college during my engineering degree and have some insight into the realities of the profession - it's much harder than that and the pay for those stable gigs are oftentimes less than $300 / month. You're looking at one of the classic professional survivorship bias that I thought even the layman understood very well. Firstly, orchestras are in dire straights currently where programs are oftentimes supported by movie and pop media performances (see: National Symphony Orchestra playing Fantasia, Danny Elfman scores, and even freakin' Super Mario Brothers). This is a similar situation to ballet and theatre - legacy performance media I guess I'd call them. These orchestras don't pay much at all and most of the money classical musicians make are from lessons, typically the children of fairly affluent professionals, including from tech, finance, real estate, and other usual suspects of said caste. I saw grad students have to skip meals and beg and plead students to continue lessons to eat while I went off to recruiting events sponsored by tech companies where I ate food constantly and I never stopped feeling guilty even after inviting some friends to avoid pizza waste.

Some very lucky others that do well are from multiple generations of musicians that were essentially born, bred, and raised to be among the world's best and live and breathe music. There was no way I could ever compete with these kinds of folks and the hard life I saw so many talented people including professors that _are_ established after decades to live a very modest life made it clear to me that it wasn't something I should do for a living despite how much I love and respect it all. My role I feel is to support these folks now, so I go to shows, buy merch at the show, etc. and try not to take up space or attention too much and let people do what they do while trying to show appreciation for the work I was too chickenshit to ever do.

The arts and now entertainment fields are very much "tournament" style careers where given very limited public attention the winners take basically all and the remainder struggle quite a lot. It's nothing like professional fields like tech, accounting, medicine, law, or trades like construction, hospitality. In fact, any field that becomes more mass market-driven seems to become substantially more "tournament" style which has greatly impacted sex work - a top n% take an increasingly higher percentage away from an elastic but fundamentally highly dynamic demand.

The misattributed quote "find what you love and let it kill you" is the typical path of the career musician like most arts. I prefer to at least have some money to have more options to make it more fun on the way without resorting to the trap that is recreational substances.

There is a huge difference between the arguments I'm seeing for large groups of people disagreeing completely upon what people have control over, which very quickly devolves into what control and rules we should exert upon others. There seem to be thankfully some general ideas about consent that seem pretty obvious like for the most part people don't want to be murdered and dismembered, but the hardest part of the human species IMO is basically cat herding - how do we get collective action performed when both its strengths for evolution (ability to splinter off and form separate groups) is precisely the evolutionary biases that keeps it from achieving higher aggregate functions as a species.

It seems kind of unfathomable to me how people do not understand that privatized tyranny is still tyranny by a system that is socially reinforced - it doesn't have to be a government that does it whatsoever and the general rules of power kind of matters more for first principles than some arbitrary definition of "capitalism" or "socialism" or whatnot that may be irrelevant in another thousand years. It's always been about how to organize collective actions compatible with the context of human social development.

The customer is the shareholders, silly

Wait a second, tech stocks are down like crazy for most of us. Fat good that did for us all as employees. Clearly raising interest rates isn't the kind of silver bullet that economists hoped it'd be.

Part of the problem is that most human beings are fairly wired through various selection criteria and conditioning to accept even maladaptive behaviors through mimetics. The people that seem to quickly go against societal rules for whatever reasons they may be tend to be viewed as "anti-social" and quickly judged harshly by at least roughly 40% of the population at large. After all, "criminal" behavior and "protest" is mostly distinguished in terms of defining the current social contract as not valid or inconsistent and how many people overall agree, not whether something is simply written down and codified.

A lot of people talk about the inefficiencies of government with lots of cushy career bureaucrats that are lazy. In truth, US government federal employees get substantially worse benefits and protections than private sector EU companies while much of the ire is directed at “lazy” public sector employees.

The kinds of experimentation and wild re-orgs constantly in private sector have substantial costs and so many of them are not so much product driven as they are investor fad driven it’s a ton of capital waste. Yet somehow market proponents see that as healthy and by design. Like uh, then by design public sector is supposed to be more stable and they have different kinds of capital inefficiencies systemically and we are spreading out risk as a society similar to a long term financial portfolio.

The $100k is one figure I saw for the whole district but looks like they got it for $20k list each for a stationary one according to this article https://www.nbc12.com/2021/09/16/manassas-public-schools-use...

Either of the models are more sophisticated than just extra fans and filters though

Not necessarily high confidence but certainly worth exploring given the minuscule costs compared to many, many other expenses, a local school district bought classroom air filters for about $100k each and had dramatically lower COVID related absences than nearby county and city school districts that didn't have them.

It’s usually political in nature I’ve noticed when being that specific and that would be Reagan’s first time. I go much further back than that to even prior to the Southern Strategy. It’s a tad of a red herring to look at a presidential term when it’s usually a lagging indicator.

The test has a number of fairly loose factors that are explained to the candidate as more about approach and communication than a “correct” answer (although don’t keep sitting and wallowing about a particular problem like the Python GIL for what is meant to be about exploration together). 1. Many outages are due to systems not even known to us to even exist for a team, so being able to determine when one knows something v. does not is a skill in the sense of knowing when to stop wasting time and to escalate and when to keep trying to troubleshoot their responsible areas - response time isn’t the KPI in an interview and never should be. Part of why I ask this is to determine if a candidate will give up really, really easily and just escalate saying “this isn’t my problem” - this isn’t acceptable, has happened to us all at previous companies, and is basically one criteria for failure / dismissal. A more constructive attitude and approach is “I have done a lot of evaluation including A, B, C, D and do not have anything else in mind, I would appreciate another set of eyes” - that is basically all we can reasonably expect in an interview situation and of course nobody knows anything about a company’s systems as a new hire. There is usually no expected canonical answer as well which would bias interviewers for a “correct” solution or even approach.

2. I usually ask candidates questions and scenarios based upon their submitted code samples and will presume an OS or cloud provider they’ve listed as something they’re familiar with on their resume. If you have lied for any reason it will be very obvious very fast as I keep adapting the question to a narrower and narrower scope to being a purely toy problem that is now useless for measuring anything beyond whether they’ve seen the problem before. Usually we can spot some errors in code samples submitted and make it clear to candidates that we do not expect perfect or necessarily even working code! The test isn’t about necessarily being bug free but about the attitude one has about their work output and how they’ve thought about various failure modes. I’ve had candidates surprisingly often say “that can’t happen, I made sure of it in my test cases” and then I show with a quick test run I think of that their submitted code does indeed have some flaws that would have had issues in production causing, say, OOM issues, segfaults, etc. A successful candidate’s attitude is accepting / welcoming of criticism as a team effort, has strong but loosely held opinions when encountering data contradicting their position appropriately, and is able to accept a challenge from junior engineer with respect and sincerity. Red flags = arguing with the interviewer for asking an admittedly irrelevant question, getting very defensive about a technical decision, and saying adamantly “this should have been caught in a code review so it’s not relevant” and being dismissive about the question. Yes, I’ve seen all these responses before. Nowhere in this process does “is expert at X” enter the picture, and we are usually evaluating the quality of the questions asked by the candidate as well. Many of us on the team have respectfully asked the relevance and presumptions of a question and that’s a big plus IMO - they have courage, respect, and critical thinking skills under pressure. I make sure to tell them that during the interview because people are so used to taking orders and shutting up that it’s bad for the organization.

Another set of red flags I’ve seen is “I’ve never had to do X, it’s taken care of by Y” and being unable to reason or even conjecture about how Y could be designed and reassured it’s not about correctness when it’s on their resume. Like I had someone that was pretty clearly a competent, skilled programmer but was applying to be an SRE and didn’t know how to work on a system below the container level with any tools proprietary or OSS - they were recommended to a different team but not for the applied position.

I assure you that everyone I’ve interviewed for years now has said they’ve had a great experience in all the follow-ups with recruiters, felt that the interview was a technical conversation rather than a hazing / torture test, and that nobody felt the questions were not relevant to the job once hired. I’m not an asshole as an interviewer trying to push people to some limit or something that seems to be the result of most technical interviews in our industry.

I came up with the term myself which is why you can't find it but I also half expected someone to have named it as well. Because "manners" or "nice" is a mostly culturally-loaded or very subjective term I wanted to say "be considerate to others above how even one would want to be treated." And it's a word not used daily except among the religious in the West, and that works well for those groups because "act how you would in church / template / mosque / synagogue" as a reminder of what civility can look like. Granted, some churches in the US are truly frightening to me and maybe I should refrain from calling on such emotions.

There are certainly unfamiliar people judging me and my coworkers when there’s an outage involving customers of various levels, yes. And in a previous company sadly yes we have had people let go for poorly handling incidents that resulted in lost business. It’s a lot of SRE in the ugly side

I've said before to other technical folks that the interview process in tech is more a measure of ability to handle anxiety and stress than whether one can solve problems competently and gracefully. Granted, in my current role I make it clear to candidates that they may have to perform under pressure at 2 am when there's an outage possibly due to their code or even others' and many people are relying upon you in particular for guidance. I also make it clear that we do a LOT of things to keep such a skill from being required but no process is perfect so being able to handle such a situation without panicking is an important factor in the hiring criteria because each of those situations I can count have been very important and high impact (it's part of why they're so stressful, right?).

Every other practice we have in our interview process is justified based upon historical precedent as well as a team decision for where the team wants to go next.

I look back at myself and the kind of cringe responses (and questions!) I had earlier in my career and for the most part the interviewers were right to reject me but not necessarily on the basis of technical merit (or lack thereof). On a lot of teams being able to communicate effectively and develop a strong rapport quickly is a bigger factor for an individual's effectiveness than how much quality code and designs can be produced. Ironically, this is an even bigger requirement for smaller organizations. For example, see a pathological case a start-up of two people where they must both be _very_ good at working together or the entire company will fall apart quite quickly. Also in a lot of interviews I was unable to demonstrate that I'm competent partly because I had already burned way out from months of being on-call and losing a great deal of sleep, so I was walking into interviews at basically my worst possible performance. It took me quitting for a while, working on my own terms, and recovering slowly to be able to demonstrate what everyone saw when I was actually operating at my general level of competence in various dimensions. Additionally, got some professional help and with some clinical diagnoses under my belt with solid medications everything got substantially better after that. Going through basically an entire career with severe handicaps has made everything seem much, much easier to handle.

It's ironic that the dynamics of targeting higher quality candidates are not that different from personal dating. While for larger organizations they seem to stress how much more damage a bad hire can be they have the capacity to absorb losses better than substantially smaller organizations on a purely mathematical basis. Likewise, individuals that have higher resources, emotional intelligence, capacity for grace, etc. can much better tolerate "bad" relationships yet are among the most stringent at avoiding "bad" relationships in the first place.

Not exactly on brand for him to be modest though, so I don’t imagine it would be suggested except maybe as an April Fool’s Day joke

The founders of the US didn’t want it to become like England. England gave special tax breaks for churches and churches became very, very influential parts of the State due to tax policy alone. As such, the idea was that if churches are tax exempt they would stay out of politics mostly given they don’t pay taxes in the first place.

As it stands any persistent form of power (corporate, religious, perhaps even academic) that seeks to further entrench itself will seek out forms of power such as a government or large multinational to ingratiate itself to.

Separation of state and anything else at all would probably have been the better doctrine to establish and follow, but oh well we’re screwed now

Know of someone that paid money to have his seatbelt systems become non-functional basically. Basically yes - they hate being told what to do and will rebel harder. So maybe for these folks we should have a campaign to use even more fossil fuels because there’s so many of them and they disproportionately cause social issues to begin with (the man is directly responsible for many, many ruined lives with his toxic personality, including his own children).

I’m guessing PassKeys / WebAuthn rolling out everywhere but at the same time not every site will get it I know. After all, there’s still sites in 2023 that ask users to limit their password length to 16 and only use certain characters.

Using the wrong register is a form of humor as well just like in English and other languages but with different impact due to the politeness level being so important to the syntactic structure just like in Japanese. Being overly polite or using too low of a register works much better than sarcasm for comedic purposes for reasons I can’t quite explain. In English sarcasm is commonly how I joke around and involves an intonation cue but it doesn’t really work in Korean even with intonation (possibly because intonation and vowel lengthening is used for a lot of word distinction perhaps although homonyms exist in basically all languages) and if you try it native speakers will oftentimes have trouble telling if you’re serious or not. Although these days due to Western influences IMO most Koreans understand sarcasm as a style of humor and can apply it for all languages although for older generations it’s going to be less natural. The country’s had massive, massive social and economic changes in the past 100 years, it’s kind of wild

IME most sushi places in the US in particular are operated by Koreans, not Japanese.

It’s for both reasons. If you have a separate refrigerator you might as well optimize it for the stuff you’re trying to store. Think wine refrigerators in the West.

I believe the 고추가루 was derived from a Portuguese chili plant which explains the timing. Why Japan didn’t go for more spiciness is not clear. Lots of Korean recipes seem to have parallels with Szechuan cooking methods and approaches (read: lots of bold, spicy flavors) but I’m not sure if it’s merely coincidence.

There’s various macro extensions and plugins available including .NET but these options tend to have a long history of horrible security problems because they are general purpose languages. While possible to crash spreadsheets with simple formulas they’re not going to steal your local credentials off disk probably.

A long time ago I remember people saying that JavaScript is the most popular language that programmers don’t learn. A language with a sufficiently low bar for mass adoption by non-programmers in theory should be useful without needing to know the ins and outs. Yet, I would argue still that the world’s most popular programming language isn’t even either JS or Python or PHP - it’s Excel. When we constrain a programming operating environment and language elegantly it’s quite impressive what is accomplished. We as programmers tend to forget oftentimes that computers and all that stuff is just a means to an end.