HNHacker News
TopNewBestAskShowJobs

genmud

1,784 karma · joined September 18, 2017

Security nerd. Father.
submissionscomments
genmud··on Ask HN: Reputable SWE Resume Review?
I'll give you honest feedback, been a hiring manager for like 10+ years, what's a good email?
genmud··on Musk sues law firm because he’s mad that Twitter paid $90M bill
So they are saying it is related to a success fee of about 72m, plus fees for services rendered, totaling 18m. Musk accuses them of unjust enrichment, but it sounds like a pretty clear cut case of the old management doing what was right for the shareholders.

Musk tried to back out of the deal and even paying your law firm a bonus for winning the case, it was a wise move by the shareholders, board and employees. By spending the money, they ensured Musk complied with his contractual obligations when it was very clear he wouldn't have closed the deal otherwise. By taking him to court vs renegotiating, they likely kept billions of dollars of value for twitters shareholders.

genmud··on Ask HN: Is is possible to cut down on OCD phone use?
I made the decision a few years back to not allow notifications on my phone and it has improved my quality of life quite a bit.

There are simply too many things in my life that need doing that having one more thing competing for attention just isn't worth it.

genmud··on Ask HN: Favorite Mac Apps for Productivity?
I use Rectangle [1] for window resizing, I have an ultra wide and it allows me to resize/move windows in thirds with a simple keystroke command, which I really like.

I also use it frequently to maximize the window to screen view without having it go full screen.

[1] - https://github.com/rxhanson/Rectangle

genmud··on US spies are buying Americans’ data – Congress has a new chance to stop it
You read too many spy novels my dude.

There are lots of former LE and intel people in any company that deals with analysis of massive amounts of data, because that is specifically what some of these skillsets are trained for. Leaving the IC absolutely is a thing and I can tell you without a doubt that giving up your FAANG job which pays 5-10x what an equivalent government job to break company policy is not something that most of those folks are willing to do.

Ironically I find those ex-LE folks to be more protective of the data, because if they ever went back into government or needed a clearance, those questions are not only asked, but if someone has violated the trust of their employer, it's very frowned upon.

genmud··on US spies are buying Americans’ data – Congress has a new chance to stop it
I mean, most of the mobile carriers and a number of ISPs straight up monitor your web traffic and sell it to advertisers, just as bad. Some will even inject headers that you can use to track and associate mobile devices with desktops.
genmud··on US spies are buying Americans’ data – Congress has a new chance to stop it
Get this... there are former military people in those organizations too. What kind of things are they trying to hide from us?

This goes deep.

genmud··on ServiceNow Insecure Access Control to Full Admin Takeover
In any other software I would say no, but it's ServiceNow, so yes.
genmud··on ServiceNow Insecure Access Control to Full Admin Takeover
You could be wrong... I worked at a place where we had like 20-30 different ERPs and they got SAP as a way to centralize the entire thing on one platform. However, during the migration they managed to recreate interfaces that resembled the old workflows people were used to, effectively having 20-30 customized SAP UIs with a common backend.

It became such a clusterfuck the vendor (SAP) who we paid MASSIVE amounts of money to, wouldn't support their own software.

Thanks for coming to my TED talk, try to run as vanilla as possible.

genmud··on Understanding Cybersecurity Frameworks: NIST, ISO, and More
Can you provide some examples?
genmud··on Understanding Cybersecurity Frameworks: NIST, ISO, and More
Having worked with a number of different companies, and these frameworks are the floor of best practices, these frameworks are far above the subterranean caverns many companies operate their security postures from.
genmud··on Meta releases Intermediate Graphics Library
Not trying to shit on anyone, but that screenshot reminds me of 1990s/early 2000's games. I'm sure there has been a ton of work that went into it, but having some better textures or highlighting the usability would go a long way.

Just based on the screenshot, I am not sure that I would even bother to dig too deeply into the library.

genmud··on Understanding Cybersecurity Frameworks: NIST, ISO, and More
You know these are the floor of what you should do, not the ceiling.

If a big company can’t explain why they aren’t doing the bare minimum defined in a framework, that’s a red flag.

There are open source solutions for the majority of controls in these frameworks. It isn’t 1995.

genmud··on Grumpy Locals Are Sabotaging Cruise and Waymo Robotaxis with Traffic Cones
Me and my wife constantly have this debate... she worked in insurance and insists that self driving cars will be safer than human drivers. One example she brings up is the time a car in an airport hit a parked plane.

My response is there is a non zero chance that guy got fired from the airport and picked up developing software for self driving cars.

We still disagree on that topic.

genmud··on SerialEM: Control Electron Microscopes
That's really neat. I have always kept an eye out for SEMs since they sometimes get sold for scrap prices, but have always been weary of the software. This might actually make me pull the trigger.
genmud··on Ida Free
Yep, I had similar stuff about a decade back, probably around the time there was someone who developed python bindings for ida and holy fuck was it painful to do in their official SDK, which IIRC was C++.

Radare2 has some really nice, easily scriptable stuff, you should check it out if you haven't before.

genmud··on Ida Free
Too little, too late.

When I wanted to buy a personal copy of pro after having purchased IDA Pro + decompiler like 5 or 7 different times with different employers over the last 15 years, they wanted full retail prices. No discounts, wouldn't give me info for my old license to do an "upgrade" license, even though they are named licenses.

For the home version they want you to buy a copy per processor type, like, why... I want to be able to disassemble pic16, arm or riscv stuff for embedded stuff, and I'm not going to pay 600 or whatever a pop.

This is a move born out of desperation and a great example of how a niche company killed a golden goose. It was fine for them to be... difficult to deal with, when they were the only game in town, but with binary ninja and ghidra picking up all the net new people, I suspect hexrays will be in difficult times over the next decade.

genmud··on Twitter refuses to pay arbitration costs for 891 laid-off workers, lawsuit says
Just because they have been evicted doesn’t mean they aren’t responsible for the remainder of the lease.

Like when he tried to not close the twitter deal, just because you don’t wanna pay doesn’t mean you can arbitrarily back out of a contract.

genmud··on U.S. Navy says Iran tried to seize two oil tankers, fired on one
Well, it might be better for the US, but I'm not sure that having China as a replacement trade partner is going to be any better for the people in middle east. Just looking at the places where they have gotten involved in Africa, it might seem like a good deal at first, but there are definitely strings.

But, regardless, it definitely is a much more hands off approach. Its kind of like Arrakis in Dune, as long as the spice (oil) flows, nobody cares about the inhabitants.

genmud··on Ask HN: Any hardware startups here?
Agreed, my only thought on the $1000 price tag was that I already have a seat that is well rated and don’t want to throw away or donate a perfectly good $800 car seat/stroller system.

Like cheap end car seats when we looked were in the 200-400 and nicer ones were in the 600-1200 range.

genmud··on Twitter refuses to pay arbitration costs for 891 laid-off workers, lawsuit says
Not when you have leases that are 5 or 10 years for 7500 or 8000 employees, which is what they had before musk took over.

Commercial offices and real estate in big cities is fucking expensive. Like $100/year per square foot for nice office space at the peak. Each employee probably requires a minimum of 100sqft average to account for offices, conference rooms, etc. 10k x 1000 = 10m/year per 1k employees.

Figure like 1m or 2m a month per 1000 employees after you factor in all the other maintenance and required stuff for an office that size.

I would be surprised if they are not sitting anywhere from 70-100m/year of real estate costs.

Maybe 30-60m/year if they didn’t build out office space for their employees hired during the pandemic or got fantastic lease terms (which if they did, they would probably be subletting at a profit).

If you want to break your lease, in this commercial real estate market, guess what? Tough shit. You can pay the lease in its entirety or sublet the space.

genmud··on Financiers bought up anesthesia practices, then raised prices
> How does a hospital not have in-house anesthesiologists? Are they really cutting costs by scheduling medical technicians like they're picking up shifts at Taco Bell?

Don’t work in healthcare, but if I were to venture a guess it’s around liability. If the patient is in a surgery and dies the anesthesiologist is probably one of the first to get blamed.

genmud··on Ask HN: Any hardware startups here?
Let me know if you need someone to test in a high heat environment and give you product feedback.

I am on the UAS committee for a large city (1.6m+ people with 13k+ employees) and its amazing how many us-based companies don't take into account how hot it can be in the desert. I recently saw a vendor who needed to redesign/change their batteries and motors because of it.

As some unsolicited advice, if you aren't working to get on the DIU Blue list [1], I highly recommend it. Many if not most public safety agencies are using that to make purchasing decisions.

I have been sounding the alarm on how DJI is likely going to get banned at some point with all the trade shenanigans going on, but many of the US based companies just aren't as operator friendly.

[1] - https://www.diu.mil/blue-uas

genmud··on Heat Pumps – The Well-Tempered Future of A/Cs
There is actually efficiency issues with the high heat... but they do help offset the AC requirements, so overall even if the efficiency is down 20-40% because of heat, you require potentially 20-50% less A/C because it shades the roof.
genmud··on Heat Pumps – The Well-Tempered Future of A/Cs
Luckily, the local grid here in AZ is fairly robust, probably one of the best in the US. During the 3 years I lived in DC area, I probably had 3 or 4 power outages due to weather (ranging from a couple hours to multiple days).

In the 30+ years I have lived in Arizona, I have experienced probably 2 outages, lasting a total of a few hours (one was when a car hit a transformer, the other was when a microburst knocked a bunch of aging poles down).

The last outage I had was like 6-8 years ago.

genmud··on Ask HN: Would you mind sharing any hobbies or activities you enjoy?
Diving, electronics, photography, CAD, milling, welding, shooting and bbq.
genmud··on China Travel Advisory
> The US also doesn't show evidence for PRC nationals prosecuted for photographing sensitive infra. They're not releasing said photos, only allegations/prosecutions because of course not.

That's provably false.

> And in Michaels case, involve literal people with acknowledged intelligence backgrounds. which is close to smoking gun threshold.

Smoking gun in what way? When you look at the geopolitical issues at the time, it's obvious they were arrested with the intent to put leverage on Canada, whether they are spies or not is irrelevant. In fact them not being spies, but related to connected people is actually even better.

genmud··on China Travel Advisory
One was followed by police while he was in country, then detained by customs officials (I assume it was MSS) on exit, and was told in no uncertain terms not to come back. This is a regular cybersecurity person who was there to speak at a conference. He was given no records and when his company tried to dig into why he was detained, they unsurprisingly had no records of him being detained or questioned.

I also done incident response for a number of companies targeted by Chinese state sponsored actors going after industrial and financial IP.

You keep calling them spies, but in both cases it's not as clear as you make it out to be and there is no evidence they were spying. The US provides quite a bit of information when they charge someone with espionage. Kicking someone out of your country for taking photos of sensitive sites (US) and keeping quiet about sources/methods is different than arresting someone while refusing to show evidence of their crime(PRC).

You act like someone with a regional interest will always be a spy if they have done intelligence work... there are tens of thousands of people who work for intelligence agencies in Canada and many more former employees.

I'm not even denying they might have been spying or providing trip reports afterwards, but without evidence I have a choice between believing the Canadian government or the Chinese government... I'll choose to believe the Canadian government.

genmud··on China Travel Advisory
> Statistically, a westerner (not ex Chinese national) has less chance of being thoroughly fucked with in PRC than an ethnically Chinese scientist in the US via China Initiative.

That has not been what I have observed with people I am friends with, nor the experience of other people I have worked with who go to China regularly.

You call them useful idiots, but then call them spies. Which are they? Unknowingly assisting intelligence agencies or illegal spies?

Where is the evidence, the PRC refused to provide any... and I'm sorry, but CSIS celebrating the release of a Canadian citizen isn't evidence they are a spy. Look at their feed, it's full of Canada related stuff all the time.

genmud··on China Travel Advisory
Just speaking from experience, often times offshoring isn't actually that much cheaper. The total cost of ownership often times is not calculated correctly, or because of the way financials are done, give incentives to move costs around to make stock numbers look better. For example, if a company said they reduced the cost per unit to offshore production by 50%, but don't mention shipping has tripled and quality has gone down, in addition to costing a ton of money to transition, only netting 10-20% savings, the market often only cares about the unit costs.

I would say the number one thing people do is they don't allocate overhead or things like shipping/logistics/lead times into the total costs.

Like for example, if it takes 3 months to have a product, you should store more inventory than if you were doing it in the US. You also shouldn't just look at just the raw unit price, you factor in shipping, quality assurance checks, inefficiency of engineering changes, etc. which many people don't actually do.

← PreviousPage 7 of 19Next →