HNHacker News
TopNewBestAskShowJobs

salmo

966 karma · joined January 7, 2017

submissionscomments
salmo··on Okta’s Investigation of the January 2022 Compromise
No, definitely not full admin access. Just a support tool called “SuperUser”.

It was a customer service rep who could send password reset emails.

Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed.

Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool.

They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access.

Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company.

The fact that the tool is named Super User is killing them more than anything here.

salmo··on Random number generator enhancements for Linux 5.17 and 5.18
Tangentially, I do use a LaTeX inspired Hugo theme[1].

It’s not perfect, but I like it. I worked on math textbooks and LaTeX as a side gig in college and it’s very comfortable for me.

Probably off putting to a non nerd audience, but it’s a self indulgent site, so whatever.

A LaTeX static site generator could be cool itself. I markdown so much these days it might be refreshing to revisit my past. One day I’ll Google that, I guess. :)

[1] https://github.com/queensferryme/hugo-theme-texify

salmo··on Inferno: A small operating system for building crossplatform distributed systems
Yeah, they both share Rob Pike and the Bell Labs heritage.

Weird side note: Renee French did both the Plan 9 and Go mascot designs as well.

https://go.dev/blog/gopher

And to the further above, there are other languages and compilers supported on Plan 9/Inferno. Like Go.

salmo··on German Government Agency warns about using Kaspersky
LOL. Different batch of software.

I think this experience is called “enterprise.”

MS really shot themselves in the foot adding the ability for stuff to insert itself into I/O that easily.

salmo··on German Government Agency warns about using Kaspersky
It’s also part of Windows hardening standards that are then pulled into compliance frameworks.

My company installs at least 3 antimalware/security management products that cripple, I mean, protect endpoint systems. 2 vendors. None of them are integrated with each other. So files and executables are all scanned 3x. Git runs abysmally slow because of all the processes involved and tiny files.

One of the reasons I run the paperwork gauntlet to run a Mac. Windows is crippled, Linux is banned on endpoints, so Mac it is. I have to run 1 AV, but it doesn’t do a lot. And I love apple kicking everyone out of the kernel over time (except VirtualBox, that’s annoying).

Luckily it’s mostly an application-level concern on Linux. Scanning files and such on file-servers, mail gateways, etc. ultimately protecting windows systems w/ normal user processes not all up in my kernel, and on limited systems. It actually kinda makes sense.

Now, commercial IDS/IPS, I don’t even want to know how those are architected. I haven’t touched an OSS one (Snort) in years.

If I won the lottery, it would be kind of fun to just sit and find horrific exploits in these things.

salmo··on A brief reflection on Mac software stagnation
autocomplete has worked for a long time with extensions like deoplete. Syntastic pulled in all the normal syntax and style checkers.

But the most recent major neovim release has lsp support + treesitter. Some Linux distros don’t ship it yet, but Arch and Homebrew on my Mac are up to date.

There are lots of examples out there for the configuration. I don’t think that mine’s great enough to share.

I’d just Google “neovim lsp config” or such.

salmo··on We do not believe Poland’s proposal is a tenable one
It’s not new. It’s the difference between a proxy war and an actual war.

Rome did it with Germanic tribes, China did with step tribes. You help the little guy fight the big guy to sap them, but avoid going head to head. When they failed at this, they’d get run over.

Direct help is a generally understood act of war. We’re tip toeing that line right now with what we’re already doing. And we should be afraid because there isn’t a quorum calling the shots in Russia right now. It’s essentially 1 man’s mood and folks trying to talk him down.

salmo··on MicropolisJS: A JavaScript clone of the original SimCity
Oh wow. Thanks!

I actually downloaded the TCL/Tk version because the railroad stopped dropping for me right on the web one and I was hooked again.

My 8yo daughter saw me playing and said “is that game like Minecraft”. I almost cracked up and told her it was a game I used to play when I was a little older than her. She sat with me a while and we played together.

It was so much fun. Just like when we’d huddle around a PC together pre-Internet. I was so glad to share that experience with her.

Thanks for all your work over the years on this breathing life into this.

salmo··on A brief reflection on Mac software stagnation
Thanks! I’ll check it out.
salmo··on A brief reflection on Mac software stagnation
3rd party Mac apps that I like better than any of their counterparts on any OS are:

- iTerm2 - it works right, it feels responsive. I don't have to futz with it but can

- Pixelmator Pro - it's what Photoshop used to be to me 20 years ago

- Omnigraffle - When I need to hand-layout a diagram it's my favorite ever

- Postico - It's weird that I like a single DB UI. But it's nice over just pqsl sometimes.

I have some handy utilities I like:

- The UnArchiver

- Flycut

- SwiftBar

- Disk Inventory X

- Amphetamine

- Skitch

- Magnet

I use Office 360 begrudgingly. But I do like it better on macos than Windows.

The rest of my GUI stuff is largely cross platform (and some electron)

- Firefox

- Chrome

- Notable

- Signal

- KiCAD

- Wireshark

- VirtualBox

- IntelliJ (I use less and less)

- Spotify

The killer app for me in a lot of ways is just Homebrew. I live in the terminal. I love having up-to-date dev tools. I hate maintaining it. Even with Linux it can be a pain to hit the sweet spot between up-to-date and DIY. I'm happy running a FreeBSD server, but I want my workstation to not require a lot of planning. I also love that I can install/update native apps from it. I always use it before I hit the App Store.

I've ditched making VSCode and IntelliJ like vim and made neovim like VSCode. It's glorious. I use git and text for almost everything I do, unless I can't or when a picture helps.

And I don't play games on my laptop anymore. Really just Minecraft on my tablet. Sometimes I let my kids play with me :)

salmo··on MicropolisJS: A JavaScript clone of the original SimCity
This is so much fun. I love the simplicity of the original feel of the game. No need for fancy graphics, etc. for it to be enjoyable.

And I'm amazed at 0 browser issues or weirdness. Takes me right back to my Tandy 1000.

My only wish it had the help stuff to remember how to resolve some of the problems in the city. I can't remember if that was in the game or in the book back in the day. I have housing and unemployment problems but have unpopulated residential, commercial, and industrial blocks. I know I'm missing something but my memory from the 80s/early 90s is failing me.

Instantly remembered to slow it down after a while to maintain roads and rail, get to nuclear power ASAP, keep industrial away from residential, build parks, and all of that.

Will need to start over again after a bit with better planning :).

salmo··on Pair Programming Antipatterns
I haven't physically paired in years. Even before the pandemic I'd often be screen sharing with someone across the table from me. We'd just be positioned where we could see each others' faces and our own screens.

These days it's all fully remote. And that's worked out incredibly well since my team has gotten more and more geographically dispersed. The few that were before are now always in the loop.

I haven't done it full time in a while because my responsibilities other than implementation take too much time.

I'm old in my team and when I can, it works well for me. I share my experience, keep software focused, etc. The younger, high performers teach me new tools and tech. The fresh folks learn more how to think and do work from us. Stuff like that it's not just about making something work, but making something maintainable. I probably teach as much backspacing through a "clever" idea I had, than by writing anything. That and how to break a problem into chunks. Then reevaluate that and make it clean.

Pairing is also great for the more ops side of things. I think in a lot of ways you get even more bang out of it there than programming. Have 1 person do the work and a newer person improve the docs as they go. Then flip for the next iteration, with the new person driving and the experienced one helping and tweaking docs. Call out places where automation could replace procedure and get them in the backlog to be prioritized later. The same pair can pick up those stories when they come back around.

I have experienced some of the pains of this list. I worked with a guy who I joked "painted" code. Lines just growing and shrinking like a horizontal EQ. It was dizzying and unpleasant. I often just checked out and pointed out missing braces every once in a while.

Same guy brings up an issue not mentioned here for physical pairing: make sure you bathe. Ugh.

Also, make sure you're rotating teammates. Sticking in 1 pair can be nice if you like the person... for a while. But it can ruin a friendship if you do that for months.

I think the real keys to success there are in luck and management's hands. Make sure you have a mix of maturity and skill sets, and have engaged curious people. Slackers and, uh, "dim" people drag everyone's morale down more in an environment like that. I've lost those teammates and seen team productivity grow. At the same time, it's hard for a team full of people with little to learn from each other to stick with it. It's more engaging when you're teaching or learning or ideally both.

salmo··on Zotonic, the Erlang Web Framework
Sounds like Drupal or Plone, but cooler. Looked at Plone once many many years ago, but it didn't actually fit my use case, and I can't imagine something like that w/ an opinionated data model ever fitting something I need to make.

But given the popularity of CMS tools, I'm sure it's great for plenty of folks.

I was hoping it was a simple Web framework for me to experiment with Erlang with based on the title here, but alas.

I keep false starting picking up the language, and then walk myself from Erlang to Elixir to Phoenix and just confusing myself. Then I run out of time or interest before I get anywhere.

salmo··on Show HN: Berkeley Mono Typeface
You should read Kernighan’s “UNIX A History and a Memoir”. Seriously a great book.

UNIX was created with no purpose in mind other than to get some MULTICS-like functionality out of an old machine and not worry about design-by-committee.

The first real use for it was document processing and it took off from there. Never was a telecom system ever at AT&T AFAIK and didn’t do networking until much later.

There were no “teams” there, just someone would see what someone else was working on and dive in to help. Stick a bunch of smart people in a building and see what comes out.

R&D at Bell Labs was to play with ideas first and then find an application. That’s how we got the transistor and UNIX, and waaaay more things that never saw the light of day.

That mode of R&D is dead now. It was dying even as UNIX was being developed, and they got management cover. The use for speeding up technical documentation really was the first business value justification. That was also how they managed to get the PDP-11 and how C got created for the port.

salmo··on Armbian 22.02 Release Announcement
Just installed the Debian flavor of this on a Rockpro64 today after failing to get the upstream Debian installer to work.

Great experience. Got my ansible config for Raspbian working with a minor tweak or 2.

I was worried from the description that it would include a DE and stuff I don’t need for a headless machine, but found it was just made to be easy to install with armbian-config.

I’ll probably migrate my raspbian hosts to it over time. I like the idea of a consistent OS across my single board machines.

Haven’t messed with GPIO, etc. yet. This one is just destined to run grafana and a tsdb.

salmo··on OrioleDB – solving some PostgreSQL wicked problems
It’s not a fork. It’s an extension. That’s both in the doc and build instructions.

That is a very appropriate way to run ahead and add experimental features that could be folded in later, even just later maintaining the extension as part of the OOB release.

It speaks to the architecture of Postgres that this is possible to implement this way.

I would love to see this be successful. Much cleaner than stacking software in front of and around Postgres, and not just a wire-compatible DB like Cockroach.

salmo··on Pyrite – open-source video conferencing
This has been my experience, even now. I still prefer it to Teams and WebEx because of the reliability.

I do like that Teams allows for a richer chat experience, but often just keep a Teams chat and Zoom call going when needed.

salmo··on OpenVi: Portable OpenBSD vi for Unix systems
Historically, this is why basic vi (of whatever flavor) was so popular. I could hop on any Unix and it was there OOB. I dealt with some mixed set of Solaris, BSD, HP-UX, Irix, Tru64, AIX, and Linux for so long.

For a host I did primary development on, I’d install vim (visual mode and then syntax highlighting was so nice).

But we managed config centrally with idempotent scripts that handled the differences (like no getent on HP-UX). We did have to install ksh88 or a clone everywhere to get a stable consistent shell. GNU was flaky on so many platforms then.

Vi was always there for those WTF scenarios, less as a primary programming editor. And it is so nice on slow connections, where repainting the whole screen for every keystroke sucked.

It really annoyed me when Linuxes dropped the basic vi everywhere in favor of nano. I’d be fine with nano as a default for accessibility, but at least have some vi in my path.

Our standard images include it, but I always forget when I’m testing/debugging locally with Vagrant or a Docker image.

Vi is always a little weird. I don’t think any 2 people use it the same. Everyone has their own go-to set of commands. Pairing with grey beards influenced me so much.

I actually started with emacs in college, but real life with 1,000s of servers forced the change. I don’t have the muscle memory for it anymore and have no desire to go back.

Nowadays my local neovim config is almost VSCode. But I still like VSCode-ish in vi more than vi-ish in VSCode. I tried, but inevitably do something that VSCode’s vim plug-in doesn’t support.

I do use go more and more for complex stuff, but often am forced back to shell due to old kernels still out there which hurts my soul.

salmo··on Akamai to Acquire Linode
The closest I can think of is the IBM PC.

But we can all think of 100s of companies that did not do this and either died or are hollow shells of their former selves.

Cloudflare et al are commoditizing their gig. As more new blood goes into enterprises, they’ll want to use what they’re already familiar with vs the big enterprise thing they’ve never touched and find awkward.

I don’t know that a) I’m right or b) that they’ll be successful.

But Enterprising Linode would be folly. Even late entrants like Oracle Cloud are struggling due to lack of support from Enterprise cloud products. Changing them to support all the annoying acronym requirements of an Enterprise is a many year journey. AWS and Azure really only did that to support their huge government contracts.

I think the only other viable theory is for them to try and keep Linode as Linode as just a diversification play.

That would be odd, to me at least, because they’re buying an offering that seems to be slowly dying anyway. It really never left the hobbyist/tiny shop market, and even there, AWS/Azure is eating into them. I do have a soft spot for them as they’re a much more “human” company.

salmo··on Akamai to Acquire Linode
Linode isn't used by Akamai customers and won't be.

It would be a much bigger hurdle for Linode to become enterprise-friendly than for Akamai to become developer-friendly.

Akamai is "call for pricing" because they never evolved from an enterprise product. And no "enterprise" just buys off the shelf. They negotiate with a long budget, vendor risk management, legal, etc. process. Its unlikely that many of their contracts are even the same verbiage.

salmo··on Delphi Timewarp – 1995 and Delphi’s Mythical Origins
Same experience here! It was such a great first intro for me. Learned basic programming concepts but could quickly put together something "real" feeling. It was a nice middle ground. The Pascal aspect was pretty ergonomic for a neophyte, and the GUI design really was unparalleled.

Dabbled in UIs after: GTK, .NET, etc. All disappointing and awkward. Do web dev for internal tooling when I have to, but I don't enjoy it. I do backends but mostly stick to lower-level systems stuff after falling in love with K&R and Unix early in college. Well, and firefighting prod performance problems.

salmo··on A look inside the chips that powered the landmark Polaroid SX-70 instant camera
This is pretty cool. My dad was a Polaroid salesman in the 70’s, so I still have 2 of these and the 1 with the sonar autofocus. Have some of the sales material and his travel case for doing demos.

Loved my old Polaroid in the 80’s too, even when the company was already a shadow of its former self.

It’s sad. They really bet the farm on Polavision[1] and completely ignored video forcing that original vision of instant moving pictures forward. Beta and VHS w/ audio and working on a TV just made the product look dumb.

I used to have one of the projectors but it died to attic heat.

Then I could rant about how their sales practices killed them as well, but that’s likely full of hearsay bias.

[1] https://en.m.wikipedia.org/wiki/Polavision

salmo··on Poll: Do you prefer the office or work from home?
This is just my experience, not a right/wrong thing.

I’m the opposite. Part is that I irrationally hate lifestyle change. Part is that I work with so many teams.

I hated switching. I liked my busy workspace and being able to jump in and help people around me, get info, etc. I had the benefit of also having a private office I could retreat to when I needed long focus time.

I also love routine. I like predictability of my schedule.

But so much of the teams I primarily work with had been spread across the country. 3 cities at the time. They missed out on the hallway chatter and always felt behind.

After a couple months, I got into my groove. I was collaborating with the folks outside my city (and building) much better. But I was overwhelmed by notifications, and was working too many hours.

I disabled all chat notifications on my phone. I started enforcing a beginning of the day and my kids pop in to remind me it’s over (I lose track of time when I’m focused).

Those teams are now in 6 cities. I’ve learned to schedule collab time, offer myself up to teach new folks when I have time and jump in on things I don’t know the same way.

I also schedule 1 hour meetings with close coworkers for 10 minutes of decision just so the conversation can wander. We have an open biweekly call to just joke and wander into something brilliant.

Folks got super aggressive with meetings. So I block off focus time on my calendar and reject meetings that should be emails. I reject emails for things that should be public. I ignore “good morning” chat messages from people I don’t know. When I’m focusing, I disable notifications and turn my speakers off.

I’m more productive and collaborative now. I have more control with people not able to just walk up to my desk. I’m not distracted by others’ more appealing problems except when I plan to be. Folks in other cities have equal access as local.

I also switched to waking up early for my quiet time at home, before the kids wake up, and not staying up late. I stopped eating lunch out, but always take an hour away. Sometimes I just eat a snack and take a power nap. I quit drinking soda. I stopped caffeine after noon. COVID got me doing outdoor activities that I love regularly out of necessity.

I’m 60lbs lighter than when COVID hit, and just feel a lot healthier. It wasn’t an arching intentional goal, just a change here and there to feel better.

Also, I’m naturally an introvert. At work people don’t see that because I am jovial, kinda loud, and opinionated. But when I clock out, I’m done. I just want to chill with my family.

I’ve dabbled in hobbies. Outdoors stuff like fishing and hiking. Picked up sewing bags and masks. Small home improvements. Goofing around with guitars and drums. Making my own guitar pedals. I just don’t force myself to finish anything, it’s just entertainment.

We’re starting back “hybrid” soon, with “team days.” For some that’ll mean 2-3 days per week in office.

But my teams aren’t local, so I really only see that happening when we can get folks traveling again for planning events. I’m not going to the office to Zoom, when I can do it at home without shoes. Maybe the occasional whiteboarding session. I haven’t found an adequate digital replacement for that.

salmo··on Finnish diplomats’ phones infected with NSO Group Pegasus spyware
And as has been noted before, similar relationships w/ the CIA/NSA that NSO does w/ Israeli intelligence. A lot of people shuffle back and forth between those organizations.

Not as "scary" because they aren't selling exploits to nation states and instead spying on their users/the internet.

Ike wasn't wrong.

salmo··on Ask HN: Is there anywhere to buy a Raspberry Pi 3 or 4 at a “normal” price now?
Current gen with the Rockchip CPU isn't, at least w/ official links :(. I don't know about OP, but I wanted 64-bit ARM. Found a Raspberry Pi 4 in the UK from the current top post.
salmo··on Ask HN: Is there anywhere to buy a Raspberry Pi 3 or 4 at a “normal” price now?
Brilliant! (Did I UK right, there?)

I just impulse bought one. I have a 1, 2, 3, and Zero (don't really want a Zero 2 or Pico). I was just feeling incomplete, and want to retire the 1 anyway... it's borderline unusable.

Only 2GB available (really wanted a 4GB, but I'll take it for now).

salmo··on NaturalDocs: Plain English code documentation
I should also say, not caring about megacorp adoption is also totally reasonable.

If I didn’t build it from scratch and didn’t want to start a company, that’s the route I would go.

salmo··on NaturalDocs: Plain English code documentation
That is a totally valid option. That’s a successful model for things like DataStax, RedisLabs, RedHat, and on and on. If you’re wondering how a company makes money just selling open source, this is it.

And for the record, I think this is dumb. But I’m describing the reality of what I have to deal with so folks making can understand.

There’s 2 basic routes here:

1) offer it for under 1k per seat through a distributor. Then it’s like buying an IDE. You won’t pick up a company-wide deployment, but team by team.

2) Have a commercial offering listed with pricing. Then have sales and legal folks.

The sales will be negotiating the price down by volume. The legal will go back and forth on the contract. Companies will require different language based on their requirements and legal culture. It’s not uncommon for them to require OSS indemnification. That can mean absorbing their risk if you don’t own 100% of the code. You’re basically their insurance policy on OSS violations.

Also, usually this includes some kind of (often useless) support agreement. Pricing can be tiered by response time (24x7, next business day, and so on.). It’s not a big deal on something non operational like this.

For the indemnification, the legal department doesn’t trust their developers (or contract developers) to take a shortcut, not pay attention, or whatever and expose them to a claim.

salmo··on NaturalDocs: Plain English code documentation
Just FYI:

This makes total sense. But that’s not how corporate lawyers read it in my experience.

I think it’s a) poor legal understanding of software and b) AGPLv3 signaling litigiousness.

And in some regards, even if the lawyer doesn’t fall in A, they know courts may. Their job is risk management.

If I submit, they’ll tell me to use a MIT, BSD, Apache 2.0, etc alternative or buy something and suck it up.

Also they have a bunch of these to review, plus contracts, etc. so understandably have no time to debate.

salmo··on Ask HN: Have you ever been “poached” internally? Is this even a thing?
Uh, yeah. Especially in large companies, this is common practice, even without that transition you describe.

It is often much easier to hire internally than externally. And that's good. It keeps people happy within the company vs forcing folks to move on. Onboarding new employees is expensive. If you can shift 1 and keep them happy vs having them leave and having to externally hire 2 it's a win.

For my team (I have no hiring decision, just input), I frequently look for smart people dissatisfied with their work somewhere else. Things I look for: people wanting to work on something more interesting, work with a higher performing team, having greater "impact" with their work, wanting a new skillset, stuck without upward mobility, wanting opportunities for more visibility, etc.

It also avoids the gamble of a resume and behavioral interview. You know the person and can take a reasonable guess on their "fit" with the team. You know their actual skillset ("hard" and "soft" skills) vs claimed.

We've lost a few to job hopping, but for the most part, it's a much better predictor of someone who will stick around, be happy, and be a valuable contributor.

You do have to followup with being an advocate for those high performing people. That can just be recognizing their work publicly or pay/promotion opportunities.

Also, if someone is frustrated with the job on my team, I try to use my internal connections to find a place that they will be happy. I really do care about them as humans and see happiness and job satisfaction as more important than hoarding them.

From the other side, every job I've taken (internally or externally) based on people I know has worked out great. Every one I took by just applying to a posting, notsomuch. No it doesn't sound fair or like a meritocracy, but it's human. Walking in with trust and understanding is a real advantage.

← PreviousPage 6 of 10Next →