random5634

For a long time this must have been on the recommendation list - because password forms with insane complexity (12 charachters, upper, lower etc), but then non copy pastable forms and 60 day change requirements remained very common.

The current IRS requirements are 90 day password changes. Ergo - many people write their passwords down in a text document next to the software launch icon.

What I don't get - if your computer is hacked, and you force people to write down their passwords on the computer being hacked, they will even more easily be able to access the systems you have access to.

Google seems to get this right. I have had same password for 20 years, if I login with a new device I use my MFA (no SMS). If I do a security sensitive op I need to login and do an MFA again (password reset etc). I imagine they actually monitor and rate limit bad login attempts etc. A 10 character password is really fine then in my view as an example.

The first point would be gamechanging.

Also used to do govt work. I'm sure everyone has stories.

My takeaways.

1) Understand what people need -> AND LET THEM DO IT.

2) DO NOT ADD A SINGLE NEW THING with the IT / automation. If the old system doesn't have it DO NOT ADD IT. No 20 extra fields for demographics if you didn't track that before. That can be added later IF it's a MUST.

If they would take away all various fifedoms and hassle - people actually would bring a lot more tech into gov. Let the local business / division people make a decision. The only requirement be that they go through a 1 hr training and be exposed to 3 packages in their space (ie, do demos no powerpoint).

Take away all other requirements. Be OK with smaller failures. Govt is so scared of just letting folks try stuff out that everything turns into a 100M project that goes totally of the rails in terms of scope etc (ie, what people need / want is long forgotten, it's what MANAGERS want that gets emphasized).

Result - even if successful (rarely) for downline workers the software brings TONS of extra (not less) work.

----

My own examples. The IT folks say that passwords have to change every 90 days. Google for example does not default to this (stupid) rule - they push two factor without SMS (which is better). Bam - you are out or have to pay for a "security" solution on top of whatever standard platform you are using with admin rights that can force rotate passwords (and is a MASSIVE backdoor itself vs self-serve password mgmt).

Then purchasing. We need an ipad to edit some videos. OH, Apple is not supported. This is 10K employees but you can't get an apple product to use unless the city atty will sign off on a variance (no chance).

I made a pretty concerted effort to bike (I used to bike to public transit every day at an old job and loved it).

At my current job I'd have to go through a very loud car tunnel without enough space for bikes. I've tried it a few times - just not workable. You have to ask - is this commitment worth dying over? Having your lungs filled with crap from being in an enclosed space with cars? Having your hearing killed.

So making the environment support biking would be great.

Very helpful, thanks for this!

Just to echo that going to Ryzen made a world of difference. I had a big jump from some intel APU part to the 5600x - makes jetbrains much more pleasant.

I'm not planning on switching back over, but others in the family are and Jetbrains packages were always clearly "slow" so speed of the chips actually made a difference to my eyes.

This proves my point. 39 bits for time in 10 msec is something like 17x years.

ULID runs through 10889 AD

I'm in Windows / Linux, my wife is on MacOS. She wanted to help with some python programming. Yep - playing super nerd is LAME. I thought getting environment setup to match mine would be pip requirements.txt but no go.

Really facinating. I think things like go / rust etc? may work better - you compile everything and compile to binary on platform, so don't need to build and carry around environments everywhere.

I moved to docker deploys / dockerfiles locally for pretty much everything. Totally overkill, but when I switched to working from home was so glad I could just get up and go without getting my overall system sorted out.

I haven't totally figured out the WSL2 python remote interpreter / debugger code flow yet however, so still using docker. I'm sure WSL2 will or is an option.

I've been tempted to just vnc or similar into a cloud instance, but my local machine is to fast by comparison for the price.

What the heck?

"Boycotting noncollaborating hardware vendors by FOSS is LONG overdue"

Is this serious. What does apple even use PyPy for?

We need to boycott APPLE because of a group making software they don't use? Huh?

I suppose we will need to boycott my home builder because they don't support my mattress company that works with the house they built me?

Apple uses python. They ship python3. They contribute to python. That get's folks into python, that get's folks interested in ARM64, so python work and golang and others start targeting ARM64 more, which in turn will probably help Microsoft and AWS whenever they inevitably release ARM products into production. That's the traditional open source cycle. We don't boycott these folks.

One issue - Apple WILL NOT ship GPLv3. Many other companies are EXTRMELY careful about shipping GPLv3 (I wouldn't be surprised if google was strict hell no on GPLv3). So there is going to be some fragmenting as the GNU folks and other put out things like Bash as GPLv3. Probably from the same folks that boycott, so it may not matter in the end.

How do you use 64 bits and only get scale to 180 years? For that bit count I’d expect 1000+

Uber does seem to reinvent everything for itself - I’d be curious what their ops engineering spend is.

I’ve not fully understood how they can lose so much money given their fee per ride is so much higher than most apps would dream of for revenue

Great idea!

Curious about the speed diff - could some give notes on that?

WOW! I would not have expected that be the car used on the "Highway of Bones" with insane levels of cold! I hope they were running it with chains at a minimum.

If you dress right, have a good thermal sleeping bag, have calories in your system, you can do pretty well. A fair number of sleeping bags have survival temps as low as negative -40. I've done OK once or twice at surprising levels of cold (sleeping in the back of car / SUV on a ski trip other winter trek is not end of world, even without cars heater).

Not totally clear still why this is a story about google.

Here's a link with an image of the highway of bones:

https://elpais.com/internacional/2020-12-23/perdidos-en-la-t...

Here is a video of a drive along it between the cities mentioned in the article:

https://www.youtube.com/watch?v=J46vglp6g98

Insane cold in this area - I'd be curious what type of preparation they had for this, and why not turn back if things were impassable?

Google in the USA maps lots of roads that are 4x4 only (but totally fine on 4x4).

Is this really a ghost road with no use in 20 years? I could pretty easily find some towns that would seem to be connected with it. Also plenty of adventurers and motorcyclists (??? how cold would that be?) seem to take it?

Did they by ANY chance turn down a farm road or some other side track?

A brief check of sat views doesn't really match the "abandoned for 20 years" claim being made here.

"that requires rockets"

I'm curious about these absolute claims. Can a heavy mass object moving more slowly entangle a faster object to reduce velocity.

Can solar sails be used to reduce or change orbits?

Magnetic fields?

Physical characteristics and profile of sat vs orbit?

Put in a decaying orbit that is only maintained by a thrusters?

Very interesting to hear that the only way to slow something down is with rockets. Not atmo drag. No mag drag. No solar pressure etc.

Is there an actual serious claim that the first dose would be wasted?

This claim is being made despite CLEAR CDC guidance on how to handle delayed vaccination doses?

I'm serious - where is the citation for the claim you are making that the first dose is wasted if the second dose is not perfectly on schedule.

The reason this claim is likely a lie is that millions / billions of vaccines are given out. Every school child in America is getting vaccines. With very narrow exceptions, if you are off the exact timing (ie, you get a 12 month vaccine a bit later, you get the second shot 14 days later) which by the way happens ALL THE TIME because doctors and parents are busy etc - there is no evidence that the first shot is wasted or that you need to restart vaccination.

So please provide a citation for the "first shot wasted" claim.

Good lord, $3K for this?

These companies give two craps about security.

I thought the US govt actively BOUGHT these types of cracks and hacks and used tools that used them.

How do police departments crack open phones?

Does this mean they are breaking the law by buying these exploits?

If you can't articulate your own sense of your worth, it's very hard to engage with someone I've found.

Note - I've always given my number first (and all consultants tend to) and it's worked out fine.

Note, most people don't like dealing with places that are not upfront with the number to purchase the item / time etc. So if you are selling your labor, have some sense of its value /price.

I do hiring (not recruiting).

I generally want to understand what someone's ask is first.

After that I'm usually very upfront (ie, immediate verbal feedback) on how that falls into the position vs their apparent skill set etc.

If they have come in low (not uncommon for non bay area folks) I'll let them know that there are opportunities for growth beyond where they would start at. If they are someone we want we'll generally beat their ask as well to get them where they should reasonably be. Then usually there are two years of substantial pay increases. My own experience, these tend to be great folks to have on team if you can give them 3 years of nice growth.

If they are too high I'm usually upfront that at that rate they'd be flat compensation wise for a number of years or that the amount is simply too high relative to skill for position and our needs.

It used to be market was so tight, that if you found a great person you could go 2x what the planned budget was. Not sure if all orgs have that flex so that makes it a bit unusual.

I didn't know this. How do I contribute to Oracle's Unbreakable Linux or Redhat's RHEL? I know I can fork them, but not sure how I can push my commits into their code and didn't realize that was required!

Anyone dealing with dogs knows the pit bulls are FAR more dangerous than other breeds. Their physical strength and jaw strength in particular make them potentially deadly.

Can a poodle kill you? In some edge cases maybe. Can a pit bull do it? For sure.

This is correlated with lower rates of spay / neuter as well. So you have an animal that is naturally MUCH more dangerous, and then you have that correlated with folks who LIKE that they are so dangerous and the bad outcomes multiply.

Want a poodle? Here you go. Want a pit bull? You should have to prove you are going to be able to train, care, etc for them and will keep them on leash in situations where they could kill others (ie, children's playground - yes - people bring off leash pitbulls occasionally - NOT a good situation).

BTW - same rule should apply to guns. Want a .50 cal automatic machine gun? You should need some kind of extra license given the danger you now pose.

Google has a big stick which they’ve used to whack marketing and management with.

Listening to these developers rant about what is probably the fastest and most user friendly effort while they push out stuff that makes yours eyes bleed is ridiculous.

All web developers should all be forced to browse with Adblock off and no auto play block.

Mgmt if it shows a tiny bump in some ad click metric for a quarter will shove a popover out while they burn the long term value in the web and their sites.

The fact that google has to push these types of things is embarrassing.

The domain is not a cost - it’s an asset - if they flop they should be able to sell it. The risk is paying rent and salaries etc

Another take - and why I like AMP.

Web developers deliver crap, ad laden slow websites - with HORRIBLE users experiences.

Content jumps around as the web page loads, sometimes even 5 - 10 seconds later!

Autoplaying content is hell - but they seem to love it.

Popovers, unders and sliders gallore.

And for some reasons the GIANT mess of analytics trackers and CSS and dynamic content means the thing is

a) slow b) nightmare on a phone

Google has basically FORCED a bunch of these idiots to actually make a page usable and pleasant. It loads fast.

What I don't get - all these high and mighty web devs can't seem to deliver clean websites that work without Google beating them over the heads with AMP. Is it that they cower in front of management with demands for YET ANOTHER tracker (seriously, websites ship with like 10 trackers - why?) They feel the need to show off their lazy loading dynamic content skills that jank the page?

So thank goodness for AMP, perhaps developers will actually try to compete with it a bit by building usable non-amp websites.

And trust me, users are getting trained that the lighting bolt actually does mean FAST.

Anyways - when I read another rant from a web developer about AMP - a small request. How about de-jankifying and de-scamifying the web first a bit more? Then we won't need to turn to google for all this stuff.

Except they were better at making a phone, and then controlling costs in making advanced phones. Nokia could NOT compete. Even Microsoft gave up (despite billions). Even now, with years of competition, their margins are FAR higher than others making smartphones. Eye wateringly higher.

IS this really the definition of slavery here on HN? Pathetic. I've been supporting nonprofits engaged in anti-slavery issues - I will ABSOLUTELY stop if this is what is considered slavery. Such pathetic misuse of language.

Once again anti-trust arguements are used because another business is impacted, ignoring user preferences or impact.

Heads up - some users WANT to have more transparency into how their data is exploited, and to be able to turn it off easily.

I know folks are saying this is apple abusing its position to hurt facebook or "small businesses". Who cares? I as a user like this approach apple is taking.

The same issue comes up with google and some of their behavior around spammers / scammers and others. I wish more of the anti-trust / abusing their position things kept a focus on user benefit and impact. Letting match.com and ancestry.com do their own billing and subscription renewals on iOS sounds like a nightmare from hell (having dealt with ancestry billing before!)

I just had to submit for a refund for an annual subscription that was misleading on the app store (10 minutes after I purchased). The process could not be simpler and MUCH preferable to sitting on hold for hours (as I have with others).

One issue is that anti-trust has moved from being concerned about harm to consumers (great!) to being focused on harm to other businesses (not so great).

For example, a TON of issues especially in EU around Google de-prioritizing some of the scam "Review" and shopping network sites that were just total trash and clutter. Yes, this hurt those businesses, but as someone who was absolutely sick of them in search results it was WONDERFUL to see them go down in flames.

To be clear, places like nextag were paid "comparison" shopping engines. To have enough margin to win the "comparison" you often had just total trash products advertising impossible claims.

Anti-trust seems focused on the harm shutting these folks did to these businesses, but no one asks if users actually liked these folks (or the auto review sites that someone generated just boilerplate but clearly never actually had product in hand). Again, SO glad they pushed some of these down, lots of complaints.

If you think people want this trash, just start your own search engine that emphasizes this junk.

Comcast same thing. I kept on saying, what is the serial number of the modem you are renting me - because I bought the one that is plugged in.