withzombies

It's not about clothing, it's about a specific type of technology. :)

Articles of Interest is _so_ good. It's a great take on the 99% Invisible "design of everyday things". I was definitely blind to clothing and textiles and Articles of Interest is really enlightening.

You may enjoy Search Engine by PJ Vogt[1], it's really well done. Its the quality of the original Gimlet Podcasts and a bit different than his previous show (Reply All).

[1] https://pjvogt.substack.com

Statements can be enforced by the FTC or be used for the grounds of successful litigation. That’s why it’s a big deal.

Apple has had a great record of support, and I’m a huge fan of their products. A commitment to continue their great support would be a nice step.

They certainly have a few outliers. They released 12.5.7 in January 2023, which supports the iPhone 5s and 6 - 10 years after the 5s was initially released! However, that was an outlier; they haven't backported most security patches to older devices.

They only do it when there's clear evidence of in-the-wild exploitation or it's a big compatibility bug that would prevent you from migrating to a newer device.

Google's announcement was for full OS support for 7 years, not just security fixes. Comparing it to Apple's ~6 years of OS support is fair.

Committing to 7 years is a big step! Apple does't commit to its support timeline at all and seems to average around 6 years, so this is more firm and also longer.

I would like to see Apple respond by committing to their timeframe but they won't.

There's also the possibility that royalties were negotiated poorly. Some back catalog shows could cost more to show than they make due to things like music royalties or other production royalties.

You should contact your state's insurance regulator. They're very powerful and generally get proper reactions from insurance companies.

Is this one of those billion = long million mistakes in some languages? Not everyone agrees that a billion is 1000 million and it can get really confusing sometimes.

> Other countries use the word billion (or words cognate to it) to denote either the long scale or short scale billion. (For details, see Long and short scales § Current usage.)

> Milliard, another term for one thousand million, is extremely rare in English, but words similar to it are very common in other European languages.

https://en.wikipedia.org/wiki/Billion#:~:text=Other%20countr....

For these cities that lose their local authorities, does that include building code requirements for things like parking minimums and mixed commercial/residential buildings?

iPhone is licensed from Cisco though. Cisco bought Linksys which held it for its ip phones.

I think that's this bullet:

* Don’t waste time on your website design (but do write)

Specifically, "do write". Your writings will be way more accessible than conference talks.

He also may mean "don't sponsor or have booths at conferences or conventions". I personally find them valuable for connections but you don't need to attend them to make sales.

It's back

Being able to solve 80% of AoC is nothing to sneeze at. There are plenty of roles that are open to you. You should start applying to jobs that interest you.

If you have no other experience you can point to, I'd take one or two of last year's AoC puzzles you solved and write a short write-up on how you solved it. Explain the problem, explain why it's hard (it's a challenge after all), talk about failed attempts (this is important), and talk about how you solved it.

I'd include this with your resume or cover letter.

Remember, the goal is to get to the next stage of the interview process - so you want to give them something to signal you're worth interviewing. AoC (or open source work) gives the interviewer something to ask about.

I was pretty surprised to find C++Now's FAQ entry on interruptions:

  Why don’t they just let the speaker speak?

  A common question/complaint concerns how often C++Now speakers are interrupted by questions (and sometime by comments that aren’t even questions) from the audience. Sometimes viewers are thinking, “I’m not watching this to hear you, I’m listening for the speaker.” This results from a misunderstanding about the nature of our conference. C++Now is very much a collaborative conference.

  At most conferences, the assumption (usually correct) is that the most knowledgable person on the subject at hand is at the front of the room. But at C++Now, a speaker may be discussing features that were added to C++ based on proposals authored by members of the audience. The collective understanding of the speaker and the audience is what makes a C++Now session such a valuable experience.

  Questions and comments by the audience are not distractions, they are the reason that C++Now exists and why it is a different experience than other C++ conferences.

It feels very "um actually we know more than you". I think it probably works fairly well in person but it absolutely doesn't translate to recordings. It seems other folks agree (I found it via reddit)[2].

[1] https://cppnow.org/about/faq/

[2] https://www.reddit.com/r/cpp/comments/wf5g1z/people_who_are_...

Disclosure: I wrote the OP blog post

He doesn't make any time or effort claims but 10,000 iterations of libfuzzer generally doesn't take that long.

With the rate he is showing (38/second) it'd take just under 5 minutes (~254 seconds).

Ultimately, your work has to be sold or monetized either by you or your employer. Rarely do we know exactly what benefits our employers get from our work. A helpful starting metric is to estimate what your employer's costs to employ you are. Employers pay for time off, benefits (health, retirement, professional development, etc), and employment taxes that you'll now be responsible for directly.

Folks get hung up on rule-of-thumb advice like hourly rate * 2.5 because they're thinking about their take-home pay and not the cost of employment. In many defense contracting roles, the "fully burdened rate" for contracts is 2.9-3.5x the employee's pre-tax pay. When switching to contracting you can compete by offering better services and by undercutting your (large company) competition -- and that's just where you start. Once you establish yourself as a better performer you can demand a higher price also.

The standard rule is 2080 hours, it's 52 weeks * 40 hours. You might say, but what about vacation, and that's fair when talking about an employee-employer relationship but you're contracting. So your rate calculations have to include all your costs, including your vacation/sick days/etc.

I wrote a blog post[1] about my experiences with custom usernames and how I regret it. It was previously covered on HN here[2].

I came to the same conclusion as you, but additionally decided it has been a major waste of time and I'm slowly trying to undo it

[1] https://www.notcheckmark.com/2022/06/catch-all-domain/ [2] https://news.ycombinator.com/item?id=31585463

You're right, DEFCON had a competition called Amateur CTF that I remember now. My apologies (it's been 13 years!), but I did say that it was how I remembered it. :)

At the time ACTF was very overshadowed by DEFCON CTF and it wasn't really front of mind when I wrote the blog post.

If you're new to CTF and want to try your hand at it, the qualifying round for DEFCON CTF starts tonight.

DEFCON is easily the most prestigious of the CTF competitions, so much so that it needs to pre-qualify the teams competing and that competition[0] starts tonight and runs all weekend.

[0] https://nautilus.institute/

I wrote another Ghost in the Shellcode story up on twitter thread[0], but I'd like to share it here also.

In 2013, I wrote a GitS challenge called "hackerbook". It was a "misc" challenge where I presented you with a series of photos of prominent hackers at the time and asked you their name. It worked on the same principle as reCaptcha, I only knew the names of about 30 of the hackers and put those into the database. For the remaining ones, I accepted any answer but logged it to the database. If you correctly named all the 30 that I knew, you got the flag.

I wrote it because I thought it'd be funny to get people to give up the real names of their friends. I also thought it might be a good way to harvest the names of hackers[1] who are opsec thought leaders. For the remaining photos, I went to every CTF team's twitter, facebook, flickr, etc and sliced out random people.

The challenge worked pretty well at de-anonymizing a few folks. One player even sent me a photo of his friend's passport, claiming my challenge was broken and not accepting the correct name.

I think we already knew most people would give away all their personal details for a chance to win a free ice cream but they'll also give away their friends details for made up internet points.

[0] https://twitter.com/withzombies/status/1529145520027054081

[1] https://twitter.com/thegrugq

Glitch was the last iteration of FogCreek, right? There were some really fantastic companies to come out of FogCreek: StackOverflow and Trello being the big ones. It's a little bittersweet to see it get acquired.

Hah, thanks for pointing that out. The articles on it really should say when permanent daylight time would start, not when the bill would take effect.

The Hill article[1] says it won't go into effect until November 20, 2023.

> The proposal would not take effect until Nov. 20, 2023, to give airlines and other transportation industries more time to adjust to the change.

But we switch back to standard time on November 5, 2023. Just to get two weeks of that until we switch back to summer time permanently?

[1] https://thehill.com/homenews/senate/598314-senate-unanimousl...

It re-enables third-party scripts that were disabled when mikrotik updated the authentication algorithm with routerOS 6.45.1 (August 2019).

A1. From a cryptography perspective it's a little bonkers but nothing is glaringly wrong.

A2. This doesn't relate to any secure boot chains (if they exist -- i don't think they do)

Yeah, I specifically mentioned interactive disassemblers here. There are only a few that let you fix up and annotate the disassembly or decompilation and they're leaps and bounds above the ones that don't.

Thanks and you're absolutely right. It turns out tricks for reverse engineering to understand software help when you just want to understand software without reverse engineering also.

Bug fixes and performance improvements is often code for "frequent releases help us on the app store". The Apple App Store also lets you clear out past reviews with new releases. You'll notice that some super popular apps have a relatively low number of reviews for this reason.

Any data is better than no data though, if some products use this to provide accurate change log information then I'm in favor.

Any site that does ad blocker detection

It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).