Readit News logoReadit News
erroneousfunk commented on Detecting the use of "curl | bash" server-side   idontplaydarts.com/2016/0... · Posted by u/rubyn00bie
Waterluvian · 8 years ago
So yes, curl bash can be dangerous. But it's just so darn convenient. And when it's coming from a very prominent trusted source like for Get Pip or Amazon AWS it's hard not to just go with.

Surely there's some compromise middle ground? Let me download "safe-curl-bash" (scb) that only runs a script if it's trusted in some manner? Maybe the checksum matches from a crowdsourced database.

"Sorry only 9 people have declared this script valid and your threshold is 100. Here's a cat of the script and we will ask you if it looks valid or not or don't know."

I also think it's a bit more realistic than the, "anyone who does this should be reading the script first to check that it's safe." Yes, and I check the passenger jet for flaws before I board, too!

Just spitballing.

erroneousfunk · 8 years ago
Your solution depends on third parties checking the script or going based on some knowledge of "trusted sources." That has nothing to do with this hack, which exploits those who are "verifying" the script themselves before executing it.

The simple solution here is not to use curl/execute with a pipe. Just wget to save the file and check it locally (rather than through a browser) before executing.

erroneousfunk commented on What's in those mysterious cabinets?   blog.plover.com/2018/05/0... · Posted by u/jamesbowman
lfowles · 8 years ago
I skimmed the comments here before reading the article and was curious what a "gore" looked like. After a seconds pause, I decided I should get on with reading the article instead of searching for "highway gore" :)
erroneousfunk · 8 years ago
Fun fact, the the triangular piece in a clothing pattern used to add shape/dimensionality is also called a gore.
erroneousfunk commented on Why it costs so much to be poor in America   washingtonpost.com/news/p... · Posted by u/d99kris
virmundi · 8 years ago
I sympathize and agree with your general points. I do wonder about the general idea that there is nothing you can do. People can get bus fare for $1 [1]. They can scrounge money from people they know or total strangers to get more. They can move, even as a transient to a larger city. They can get housing in the new city with public support. They can live in shelters overnight until the support comes through. They can get jobs within walking distance in the city. They can do all of this on their own or with a little help from their fellow humans. Humanity has done this for thousands of years.

Would I want to do any of that? No. Would I if necessary. Yes.

1 - https://us.megabus.com/

erroneousfunk · 8 years ago
> They can get jobs within walking distance in the city.

In which fantasy world do people in poverty just regularly find jobs in the city within walking distance of their magical free house in the city?

erroneousfunk commented on Why it costs so much to be poor in America   washingtonpost.com/news/p... · Posted by u/d99kris
ilammy · 8 years ago
At first I was about to write why this is dumb and you should not be liable for not having an insurance. But while spelling it out I realized that it's perfectly reasonable for the owners of vehicles (and other licensable, high-possible-damage-dealing and really-accessible-to-almost-anyone things) to have a compulsory insurance. Just because there's reasonable probability to cause more damage than you can compensate on your own, which reasonable person should understand (that being a requirement for having a license). And if you don't then it's negligence.
erroneousfunk · 8 years ago
Tangential, but this is the same reason mandatory health insurance makes sense. We go around living in our bodies, and they break down sometimes. It's the law in this country that emergency rooms can't turn people away without evaluating and stabilizing them, so you're always one accident away from creating huge costs for someone else if you don't plan for these costs with health insurance.

In the case of car insurance, the injured party is the driver you run into, or the property you damage. In the case of health insurance, the injured party is the hospital/doctors.

I always thought it was strange that so many states were totally on board with mandatory car insurance, but not mandatory health insurance.

erroneousfunk commented on How I review code   engineering.tumblr.com/po... · Posted by u/peterstensmyr
pencilhappen · 8 years ago
> Each language has special strengths and weaknesses, there is no silver bullet that excels at everything. Go, C/C++, Lua, Ruby, Perl, Scala, Node.js, Python... each of these are THE best choice for certain classes of problems (and terrible for others).

Not quite true... not all languages have a sweet spot in a production environment. Node.js isn't particularly excellent at anything, the attraction is mainly "I know JS, and I don't want to learn anything else right now", which is a terrible attitude for someone who wants to have a career in tech. Knowing more than one tool in the toolbox is a key skill, since there is no one-size-fits-all.

Jury is still out on Scala. It's a big language, but unclear if there's a production sweet spot or not compared to other JVM hosted languages.

The rest of the ones you listed have their definite sweet spots. There are tons of languages though, and most don't have one.

erroneousfunk · 8 years ago
I had a manager that loved Java. He wanted to add a new helper service onto an existing service that was written in Python, but the new service would be Java (because Java is the best, obviously).

This new helper was responsible for transforming, combining, and synthesizing large API responses with somewhat variable and highly nested data structures into other large API responses with somewhat variable and highly nested data structures. It certainly was not Java I was proud of, but it would have been trivial (and FAR more readable) in Python. Ugh.

erroneousfunk commented on How I review code   engineering.tumblr.com/po... · Posted by u/peterstensmyr
scalesolved · 8 years ago
Ha it does make me think of this tweet https://twitter.com/KevlinHenney/status/381021802941906944

You nailed it really, senior engineers code is the most simple looking as generally they've picked the right abstraction for the problem.

erroneousfunk · 8 years ago
> they've picked the right abstraction for the problem

I hate to agree with you, but "picking the right abstraction for the problem" elegantly expresses what I've been trying to tell people for the last few years now, but far less succinctly (I usually ramble on about "underlying data models" and "what this actually is in the real world, not just how we view it in our application")

The reason I hate to agree with you is that I just became very disappointed that this is a difficult skill to master. "Just use the right model and the code is easy, duh. Why aren't you doing this?" Well. Now I just feel like a jerk. I thought they just gave me the "senior" title because I was old.

It's unfortunate that one of the most important skills in the industry is so intangible and difficult to quantify. Even more difficult to teach.

erroneousfunk commented on What Happens When Doctors Only Take Cash (2017)   time.com/4649914/why-the-... · Posted by u/SQL2219
erroneousfunk · 8 years ago
"If unforeseen complications arose during or after the procedure, the Surgery Center would cover those costs. Villa wouldn't see another bill."

So there is a sort of built-in insurance to this system. Those who don't have any complications are paying more to cover patients who do. They're simply passing the first line of medical costs (known, anticipated, where a price estimate can be created) on to consumers while letting insurance handle un-estimatable medical emergency type situations.

erroneousfunk commented on AirBnB units drop by 74% due to SF regulations   m.sfgate.com/business/art... · Posted by u/refurb
astura · 8 years ago
Being a landlord is a serious job with serious legal requirements.

Tenants can also be surprisingly good at destroying your property and they have a surprisingly large amount of legal rights.

erroneousfunk · 8 years ago
Amen. I rented in Boston, Somerville, and Medford after college, and it's amazing the number of landlords who are just random people who happen to have an extra property, or bought a house with an extra unit, and decide to rent it out. They print a template lease, we sign, and they hand over the keys.

Two landlords in particular didn't know about things like escrow account and interest laws for security deposits, contact information posting for vacant landlords, who's responsible for things like snow removal and smoke detector maintenance. I left those units in good condition (thankfully for them!) but nearly sued twice and, in one case, received triple damages on my security deposit.

One landlord said "To keep costs low, tenants generally organize snow shoveling" I said "Oh, sorry, I didn't realize we were breaking the law here."

There are some states with very few tenant rights where landlords can get away with a lot. California and Massachusetts are not those states. It's a very serious part time job that requires a lot more than just owning a property.

erroneousfunk commented on I was given new hands for Christmas   theguardian.com/lifeandst... · Posted by u/YeGoblynQueenne
erroneousfunk · 8 years ago
I think it's incredible that her health insurance didn't cover electronic prosthetics.

The hook prosthetic is just a simple open/close grabber tool. Imagine trying to navigate through life with two grabbers. The modern myoelectric prosthetics offer way more functionality and freedom. You can use a computer, dress yourself, drive a car, and feed yourself (of course the author can't do all these yet, it does take time to learn). You can't do this at all with hooks.

I fractured/dislocated multiple wrist bones two years ago and it wasn't life threatening but I would have had diminished functionality without surgery -- insurance covered it no problem. My hand is great.

How the hell does it make sense to fix a wrist in order to allow someone to do the activities of daily living but it doesn't make sense to give them a common commercial prosthetic in order to do the same thing?

erroneousfunk commented on Silicon Valley's Secretive, Orgiastic Side   vanityfair.com/news/2018/... · Posted by u/dbattaglia
nickthemagicman · 8 years ago
“I see a lot of men leading people on, sleeping with a dozen women at the same time. But if each of the dozen women doesn’t care, is there any crime committed? You could say it’s disgusting but not illegal—it just perpetuates a culture that keeps women down.”

How does it keep women down? Sleeping with a guy is a built in option women have to better their lives, that men don't have.

Otherwise they're just like the rest of us poor schmuck dudes that actually have to go into work everyday.

I'm so confused about what women expect these days.

erroneousfunk · 8 years ago
"Sleeping with a guy is a built in option women have to better their lives, that men don't have."

This is a complicated issue, and there's a lot to unpack here.

That technique may be used for women (and, heck, men too -- I'm the female 'breadwinner' of my household, although I didn't meet my husband at a sex party...) to better their lives, but those gains may be sporadic, and they depend on the continued cooperation of the man they're sleeping with.

I was in a "trophy girlfriend" relationship when I was young and my entire life revolved around "keeping" this guy. After a while, he broke up with me, I had to ask my parents for rent money (I had taken a first class trip to Europe the month before, but what was I going to do, ask him to put the money into my emergency savings account instead?), my entire life sort of fell apart. I went to parties with his friends, lived in his apartment, had a credit card on his account. Making sure he was happy was a job, but the skills weren't entirely transferable and there was no security. Not a situation I wanted to be in again, and I didn't.

Having a job, skills are easily transferable between employers, resources in my own name, and a relationship built on mutual respect and kindness, gives me far more freedom and security than sleeping with guys for the lifestyle perks. Even with alimony and child support in the picture (in which case you need to "get him" to marry you and/or have children) there is no facet of your life or lifestyle that is insulated from the whims of a single person. No, you may not starve after a divorce, but, especially if there's a pre-nup involved, the "betterment" in your life will always be temporary gain during the length of the relationship while his will be a permanent one.

Now, I'm not saying women shouldn't go to these parties or sleep with these men if they want to, or that considering a man's private jet ownership when debating about whether or not you want to sleep with him is an immoral choice. But saying "This is a built-in option for women that men don't have... the rest of us poor schmuck dudes actually have to go to work everyday" is an incredible simplification that makes the two choices sound like equivalent things, when they're absolutely not.

On a side note: The presence of these particular sex parties, and the fact that they're so closely intertwined with business in Silicon Valley, I think is an problem. As the article paints it, there's sort of a "damned if you do and damned if you don't" issue that they're introducing for women working in certain companies or who are seeking VC funding.

u/erroneousfunk

KarmaCake day571June 20, 2013View Original