gsoltis

This is cool. I wonder if your VM could work in conjunction with an LLM? Have you tried making this optimizer available as an MCP, or maybe some of the calculated invariants could be exposed as well?

This matches my experience with AI agents. Wiring up the correct feedback and paying attention to ensure they use it is important. Tests and linters are great, but there's usually much more that human devs look at for feedback, including perceived speed and efficiency.

I agree, it is absolutely a matter of judgment and is heavily dependent on the stage and specific threats a particular organization faces. It is difficult to balance product velocity with the need to protect a growing "something to lose" that the company is accumulating.

I think one of the best things we can do as security professionals is to identify or work to create security measures that have outsized ROI and advocate for those. Using battle-tested software is one, as are, I believe, measures like MFA.

Good suggestion! The underlying tech actually does support diffing resources over time, so it would be very possibly to generate a delta report.

Hey all, we wrote rpCheckup after seeing the Endgame (https://news.ycombinator.com/item?id=26154038) post the other day. A lot of the issues it surfaces are things we routinely check for with our customers, but we are unaware of any open source tools that help AWS customers check on their own.

We would love to get your feedback and we hope you find it useful.

Hmm, maybe. Can you provide more details about what specifically you are trying to accomplish?

My company, Gold Fig(https://goldfiglabs.com), is working on something just adjacent to annotating webpages: we enable you to annotate changes you make on the web. Since so much of our work is powered by online platforms, we wanted a way to keep track of changes we were making in the tools we were using. Similar to how you would annotate a code change with a commit message, you should be able to annotate a CMS change, a platform settings change, or anything else you might be tweaking as you go about your work.

We'd love feedback from anyone who is interested in adding annotations, and especially those working on teams who could benefit from being able to share annotations.

We definitely understand that a lot of data is currently siloed, so to that end we're also interested in the annotation formats that we should be looking at. We currently export our own json format, but we would love to work well with existing tools.

To be clear, at Firebase, we held these kinds of discussions in addition to the technical assessment. A portion of my section of the interview process was usually to do a deep dive on a recent interesting project that the candidate had worked on, either sourced from their resume or just by asking. You're right that you can often tell their level of involvement by seeing how quickly the well of details dries up.

There are tradeoffs, but I found it to be an overall net positive in addition to the technical assessment. Doing this effectively requires that the interviewer have a pretty broad exposure to lots of different technology, otherwise you can't distinguish between someone BSing their role vs something you just don't know a lot about / can't ask intelligent questions about. It's also incredibly subjective, which would make me hesitant to rely on it without more objective criteria.

That is what we're aiming at. We're starting by capturing deltas, but we'll eventually be able to backfill the entire existing configuration, whether it has changed or not. That can then live alongside the configuration for your other services. This is where you get a lot of power: you'll be able to write tests or constraints across different services, for instance requiring DNS settings include ownership markers for your GSuite domain.

Currently, any changes made without the extension won't be tracked. For some services, we will eventually be able to capture the delta anyways, if they have API access to their own configuration. This, however, is still sub-optimal because you lose out on the commit message and the opportunity to capture the intent behind the change at the time that it's being made.

Our hope is that much like policies around code review, where often you can commit to master, but by policy you don't and request a review first, your coworkers will see the value in everyone contributing so that everyone is kept aware and the log is maintained.

Yup, that is definitely on the roadmap! You're right that it won't always be possible, but for many of the more popular tools, it can be done.

Thanks, and good suggestion!

I put together a gist with the currently supported services: https://gist.github.com/gsoltis/302b3e60d385854a9a5158d0c071...

For sure! Infrastructure as Code is great. However, there are plenty of instances where services you depend on cannot be configured with Terraform. Additionally, we have found that there are lots of companies who have a wide variety of setups across all of their teams (internal dashboards, engineering teams that are not focused on infrastructure, etc.). Some teams may be fully automated, while others are not. For some, it just isn't a priority. We hope that Gold Fig will work for them. We think that being able to represent the changes in the way that they are already used to making them will provide a stepping stone towards automating more of their setup.

Interesting. What are you using for object marshalling on iOS? And which json processor are you using on your android benchmark? The referenced library?

Surely the size of the JSON payload matters for this benchmark. Just saying you can parse json in under 1 ms is somewhat meaningless unless you're comparing similar sized json documents, as well as marshalling into a user-supplied class.

One data point, but sonic.net is great. Friendly service and consistently given top marks by the EFF on privacy concerns. Also, it's reasonably cheap and you can get a static ip with your service.

Edit: I'm not affiliated in any way.

I've been prototyping some bindings to make Firebase work with RxJava / RxJS, since the model seems like a good fit.

If anyone has the time and inclination, I'd love some feedback.

RxJava: https://gist.github.com/gsoltis/86210e3259dcc6998801 RxJS: https://gist.github.com/gsoltis/ee20138502a4764650f2

Also, is ReactiveCocoa what most people would use to do this in ObjC? https://github.com/Reactive-Extensions/Rx.ObjC doesn't seem particularly active.

Git integration is on our roadmap. However, you can also set this up yourself now by adding your own git hook that calls 'firebase deploy' on push. For more information, see the documentation for the commandline tool here: https://www.firebase.com/docs/command-line-tool.html

Ruby is on the list. In the meantime, you can use the REST API from any language. If you need the realtime aspects on your server, we have a node client as well.

Correct. There's a quickstart guide for using the Node SDK here: https://www.firebase.com/docs/nodejs-quickstart.html

You can also use the REST API (https://www.firebase.com/docs/rest-api-quickstart.html) to interact with Firebase from any platform.

Firebase engineer here. For things like chron jobs / emails / any logging you want to do, you can run a node server that uses the javascript SDK. That lets you do things like, "any time a user writes to this location, send an email with the contents of the data".

You can also observe arbitrary data changes and log any info that is relevant to you.

As for passwords, we have a few details here at the bottom of the page here: https://www.firebase.com/docs/security-quickstart.html

The short answer is that we use bcrypt for password storage.

Hope that helps!

Leading up to my current job, virtually none. However, at my current job (Firebase), it now makes up a significant percentage of what I do. The way I've described it to friends is: "You know how most companies ask you tree traversal/sorting/search questions in an interview, then when you show up for work the first day, your job turns out to be 'add this button to this web form'? We actually work on those algorithm problems." It helps that we are an infrastructure company and that our user interface is an API.

If this is something you're looking for, my recommendation is to look at either large companies that have large infrastructure needs (Google, Facebook, Twitter, Amazon, LinkedIn, etc.) or small infrastructure-related startups, depending on your preferred working environment. If the hard parts of your job are offloaded to the database/language runtime/middleware, look for companies that work on databases, language runtimes or middleware. And in the interview, ask them for examples of hard problems that they have solved.

Also, I have absolutely nothing against the companies that don't do this kind of work. In fact, Firebase exists so others don't have to do this kind of work. This is just an observation that occasionally, the skillset tested in these interviews is not in line with the responsibilities a successful candidate will end up having, so make sure you ask.

Hi, I'm one of the Firebase engineers working on keeping clients connected.

We use a mix of different methods to maintain a connection. We normally start with our custom long polling implementation and move to websockets when they are available. We do not currently make use of any flash sockets.

This doesn't seem to have much to do with MVC. Assuming that the beginning of the requested page can be returned while more processing is ongoing, it seems like a controller method would be a good place to do this.

It might be interesting to try something like this with a generator, so that "for response in process_request(request): send_response_to_client(response)" would work.

I find it a little worrying that "Must run every line of code to find all the errors" made the list. More worrying was the fact that the author thought having compiler-enforced type safety would relax that requirement. Giving the benefit of the doubt, maybe by find all errors, he meant "find all type errors except for anytime anyone does something dynamic or a cast".

I would hope we all recognize by now that even running all lines of code (100% test coverage) is insufficient to find all errors (especially semantic ones). In any language.

I would consider the law unjust once it crosses the line into being a burden on society. That's obviously not a black and white transition, although I gave part of what I consider to be over that line in my last response. From my perspective, SOPA, as proposed, was (is?) an unjust law, in that it meets the criteria I specified for what I consider a burden.

It's worth making the distinction between legal rights and natural rights. Obviously, if a particular draconian and unjust law were passed that guaranteed the right to secure your 3kb of data, then you have the legal right to do so. That fact has mostly no bearing on your natural right to do so.

It's also worth noting that sharing between friends and someone making a large profit off of sharing are not the only options. It is not hard to envision a situation with a large amount of sharing and no one profiting directly the way kim dotcom did. It has the scale of the profiteers, but the intent and profitability of the between-friends sharing. I think it is a lot harder to find someone worthy of being called a criminal in such a situation.

Speaking for myself (I am also a developer), I am concerned with the circumvention of due process and presumption of guilt that is built into these bills. If I am operating a service that someone files a complaint against, especially if I am a startup, I have very little recourse before my business is trashed. This is independent of whether or not I am guilty of anything, or my users have submitted infringing content to my service. Content owners and federal agencies have a historical lack of concern about the accuracy of their claims, so I would like to ensure that they have to be rigorous before they can take down my service. They should have to prove to a judge that I am in fact in violation of the law before they can cut off my source of income.

Speaking to the philosophical issue that pg raised, I believe people have a right to attempt to make money from their efforts. I also believe that they most definitely do not have a right to be successful in that attempt, regardless of how much effort they have put in. They also do not have a right to continued success if the world around them changes. What works on Monday may not work on Friday, and the fact that it worked Monday should not serve as a guarantee that Friday's endeavor has a right to success. If the effort it takes to secure a number of the size required to represent a 3 minute song becomes a burden on society, then I do not think they have a right to be successful in doing so. The same goes for the software I produce. If my securing it from copying that I do not approve of becomes a burden on society, then I do not have a right to be successful in securing it. Personally, I interpret a circumvention of due process and an attitude of "guilty until a successful appeal is filed" as a burden on society.

That the original commenter is pro-piracy does not follow from pg having voiced an opinion on copyright. Claiming as much only serves to mask the problems with these bills. Perhaps you meant to limit your statement on wanting more copyright infringement to pg?

Being against SOPA/ACTA/etc. should not be construed as being pro-copyright infringement. He might simply be pro-due process and pro-innocent until proven guilty. Those positions alone are enough to cause one to not support these sorts of bills.

Unless I'm misunderstanding, this is similar to what is currently recommended for storing passwords. Don't store the plaintext, store a hash instead (everyone's hash is salted, using a secure algorithm, right?), perform the same calculation on the input and compare (everyone's doing constant time comparisons, right?).

The problem is, someone out there isn't doing at least one of the above suggestions (or others that I've forgotten), or someone will intercept the original input while it's in flight (no one uses unencrypted connections on open public wifi, right?) or make use of some other arbitrary way that passwords can currently get stolen. And once they get that original digital representation of your typing style, you're done. That method will never be secure for you again for any service, unless you spend the time to change your typing style (and remember your new style should not be at all predictable to someone who knows your old style).