The article in nature: https://www.nature.com/articles/s41559-025-02748-x
69,558 karma · joined January 13, 2008
Formerly at kCura/Relativity, security. I do application penetration testing for hire these days. Happy to chat about application security, programming, and ham radio. My conversations about agriculture are not that interesting.
Security: https://ciexinc.com/ Of particular interest are the solarwinds articles at https://ciexinc.com/blog/solarwinds/index.html Old very fun projects: https://ciex-software.com
“Eventually, all things merge into one, and a river runs through it. The river was cut by the world's great flood and runs over rocks from the basement of time. On some of the rocks are timeless raindrops. Under the rocks are the words, and some of the words are theirs.
I am haunted by waters.”
Beware the anxiety industrial complex.
Vividly. I spent a full week on remediation, even though the risk we had was traced to a single linux box exposed to the internet that had tens of kb of traffic over the last year.
Being proactive, we reissued all certificates for all of our internally deployed ssl points.
> In my own experience, seasoned engineers often remind me that every line of code is a liability. Tens of millions of lines of C++ that work closely with the internet sounds like quite the surface area.
No question. I don't question the wisdom of rewriting all of it in Rust. Having spent 60 years in the software business, I have a feeling for the size of the effort. And for what it is worth, I don't have any doubt about the competency of the teams involved.
I'm wondering what the cost would be of rewriting Chrome, at 20 to 30 million lines of code, in Rust?
I suspect that despite the memory unsafety, the cost of maintaining it in its current form is vastly lower than this.
Plus, any rewrite will certainly introduce new bugs, some of them temporarily serious. Did you see the post years back about a Rust program that exhibited the Heartbleed bug?
These new bugs need to be taken into account when estimating the cost of rewrite.
I've luckily managed to avoid too many brain-dead execs, but there have been spells that the gig is boring.
Looking back on it, there have been very few spells in which I have not been programming, if not for a gig, but on my own to explore my curiosity.
Was a fascinating detective story to illustrate it.
You can count on the fact that the judge does in fact understand that this is a very routine part of such a process.
It is more like the users of ChatGpt don't understand the implication of giving "the cloud" sensitive information and what can happen to it.
It might surprise many such users the extent that the data they casually place at the hands of giant third parties can be, and has routinely, been the target of successful subpoena.
As an illustration, if two huge companies sue each other, part of the legal process involves disclosure. This means inhaling vast quantities of data from their data stores, their onsite servers, executives laptops. Including those laptops that have Ashley Madison data on them. Of course, part of the legal process is motions to exclude this and that, but that may well be after the data is extracted.
For understanding of this topic, pay attention to what DannyBee says https://news.ycombinator.com/item?id=44361478 and not what HN users wish were true.
Getting a well-designed SOC2 will help some of this. If you are in an industry with a lot of regulation, your customers will ask or insist on getting ISO 27001. That is a substantial amount of work.
So if you have both, the spreadsheets won't totally go away, but it will reduce the load.
I saw Cliff speak twice at the Dayton Hamvention. The first time was a retelling of his Cuckoo's Egg story, and the second time was about the joy of learning and all the marvelous things you could get at the flea market to build something.
Thanks, Cliff!
Lots of seemingly little things that are necessary to get something off the ground.
One wonders about the forensic implications of this.
My wife has a friend who teaches classes to students in several countries and time zones. She does them by Arizona time which is among the most confusing time zones to folks from, say, India.
We tried the UTC experiment in our household once. Lasted about half a day.
Some stations do use SDRs to feed the reverse beacon site. https://beta.reversebeacon.net/main.php
Admittedly, I mostly develop with sbcl and slime, so the judiciously place 'break' statement brings you to a stack trace.
Also with sbcl/slime, you can do ESC-. on a function and go to the actual source, even deep within the core of sbcl itself.
Nonetheless, I mostly depend on logging statements and print statements. When I need to go to python, print statements give most of what I need.