rprospero (u/rprospero)

rprospero commented on How IMAP works under the hood blog.lohr.dev/imap-introd... · Posted by u/michidk

dbcurtis · a year ago

That is an immature view on how real products and real standards work. The standard document may say one thing, but what people do in the real world is the real standard.

For context: I spent 11 years at Intel managing pre-silicon and post-silicon processor validation. No processor that does only and exactly what the Programmers Reference Manual says, and takes the phrase "undefined behavior" seriously, will be successful. Google would do well to adjust their philosophy.

rprospero · a year ago

It's been an odd running theme for me today that I've misinterpreted posts. Up until your final sentence, I thought that the thesis of your post was:

The standard document may say one thing, but what people do in the real world is the real standard. If your software has issues with the world's most popular IMAP server, you need to adjust your software to be compliant with the standard.

I'm personally more sympathetic to your actual conclusion, but it's odd how often a single argument can be used to support two conflicting beliefs.

rprospero commented on FIDO Alliance publishes new spec to let users move passkeys across providers fidoalliance.org/fido-all... · Posted by u/Terretta

commandersaki · a year ago

At a minimum we will see if KeePass is a provider that is supported; they seem to be the only pw manager in town that respect user freedom.

rprospero · a year ago

I'm curious if you count Pass (https://www.passwordstore.org/) as not being "in town" or if it has issues with user freedom that I'm ignorant of.

rprospero commented on Inside the "3 billion people" national public data breach troyhunt.com/inside-the-3... · Posted by u/bubblehack3r

lesuorac · 2 years ago

> The reason the Shaggy defense doesn't work is the default assumption of the courts is that you're a deadbeat trying to game the system

Isn't that the opposite of innocent until proven guilty?

rprospero · 2 years ago

When I was in the Boy Scouts, a local judge came to speak with us about the legal system. I asked a similar question and he admonished me that innocent people never wind up in court. He explained that every person who is in a trial (criminal or civil) is guilty of something. A judge's job was merely to determine if the prosecution or plantiff was correct about what the defendant was guilty of. He was very annoyed that ignorant people, who had never been to law school, kept spreading this nonsense that some defendants were innocent.

rprospero commented on Phish-friendly domain registry ".top" put on notice krebsonsecurity.com/2024/... · Posted by u/LinuxBender

paranoidrobot · 2 years ago

The thing is '.com' is relatively unknown. When was the last time you had a genuine .com file you needed to use?

And you're someone who's tech-savvy.

Most people are going to see ".com" and think "Website" not "Program". So if suddenly a .com file is downloaded there's at least a chance they might stop and wonder what's going on.

I run into this issue all the time - We get Bug bounty reports constantly because $SecurityResearcher put "example.com" into the "Company Name" field, and we sent them an email saying "Thanks for signing up. We hope you find $OurProduct useful at $CompanyName. "

When the email turns up in their Gmail inbox, Gmail "helpfully" turns the plain text "example.com" into a link to https://example.com - so $SecurityResearcher reports it to us as a vulnerability in our platform because "we" are linking to example.com - except we never did, and we have no way to tell Gmail, or Outlook, or any other platform to stop doing that.

Services we pay for, directly, also do this - Notion and Slack are two I can think of immediately. I have to fight them to stop turning my mention of some file into a link to a random domain. (e: Maybe Slack has stopped doing this, perhaps - in testing it didn't do automatic linkifying for messages to myself)

This was bad enough with .cs, .ts, .js., .json and so forth - but having a .zip link appear in the middle of documentation on how to do something with a zip file is a recipe for disaster.

I've had a document saying "please download package.zip from the build artifacts site" - which was then auto linked to https://package.zip - and anyone not paying attention might expect that it was a link to the build artifacts site.

rprospero · 2 years ago

The COM file exploit worked because it is relatively unknown. I remember a worm going around when I was in grad school where you'd get an e-mail with a link to https://giftcard.customerservice.savemoneyonanew.tv/amazon.c.... Users who had been through the phishing training would see the HTTPS at the beginning and the amazon.com at the end and know that this was a legitimate Amazon email. The e-mail instructed them to click the link and "open the PDF file". Users would click the link, down load the COM file, and the open the file, installing malware all over the machine and forwarding the worm to all their contacts.

rprospero commented on Panic at the Job Market matt.sh/panic-at-the-job-... · Posted by u/speckx

camdenreslink · 2 years ago

I'm not sure I understand. Somebody really needing the work being a red flag during a job application process is nonsensical.

Of course the need the work...that is why they applied for a job...

rprospero · 2 years ago

The truth is that, if a candidate competent enough to work for us, then they can get hired by a firm thirty miles down the road who pays way better than we do. Thus, one line of questioning during the interview process is figuring out why the candidate wants to work for US instead. Usually it's because they want more exciting work or are interested in the work we are specifically doing. If someone just wants ANY job, it's a red flag that they've applied to the wrong place.

rprospero commented on Panic at the Job Market matt.sh/panic-at-the-job-... · Posted by u/speckx

darth_avocado · 2 years ago

> I think the expectations for interviews became really distorted during the period a few years ago when some companies were hiring anyone willing to do a short interview.

I find this whole thread really enlightening. As someone who has been trying to move around in tech in the Bay Area, outside of Amazon who hired en masse, most companies have had 6-8 interviews as a standard hiring process for almost the last entire decade. What's really happening is that most of the people who were on the other side, being very selective in who they hire, are now really coming to terms with how bad the process is because they are the ones now trying to find jobs.

The problem always existed for someone else, now it exists for you.

rprospero · 2 years ago

I also find this thread interesting from the opposite direction as someone not in the Bay Area. In the past ten years, the longest job interview I had was two hours long. Honestly, most of the interviews I've been in (on both sides of the table) have been closer to half an hour.

rprospero commented on The struggle to understand why earthquakes happen in America's heartland undark.org/2024/07/15/eni... · Posted by u/Bender

shiroiushi · 2 years ago

He's probably hoping for emergency preparedness, like any sensible person. That would include stronger building codes, evacuation plans and facilities, emergency supplies, etc. Here in Japan, we have all that stuff, and we don't live with "vague anxiety" (certainly nothing like the high anxiety that most Americans live with these days). Big earthquakes are rare, but smaller ones are very common, but everything in society is engineered to handle it well so it rarely causes problems.

rprospero · 2 years ago

Honest question: how often do you do Tornado drills in Japan? A quick look look at the wiki[1] indicates that you do get them, but fairly rarely. I honestly don't know your cultural perspective on them.

[1] https://en.wikipedia.org/wiki/List_of_tornadoes_and_tornado_...

I grew up on the edges of the New Madrid fault area and, while earthquakes were never discussed, we did tornado drills about every two months while in school. After I entered the workforce, that got closer to once a year, but you were still expected to have a plan and supplies. It was basic emergency preparedness, like any sensible person. Granted, big F5 tornados are rare, but small ones were common enough to not even be noteworthy.

Having left that region as an adult, it was a small culture shock meeting people who never had this kind of training. After all, the places I've visited all experience tornados, though not as often as my old home town. Still, the usual attitude I encounter is "I've never seen a tornado - they don't happen here". It's true that tornados don't happen often, just like my birthplace hasn't seen a serious earthquake in my lifetime, but they do happen.

I guess that's why I'm curious about your experiences. I've never been to Japan and I've read enviable reports of your disaster preparedness, but I honestly have no idea how your schools and culture handle tornados.

rprospero commented on As an Employee, You Are Disposable (2023) nelson.cloud/as-an-employ... · Posted by u/nelsonfigueroa

throwaway7ahgb · 2 years ago

This is not an ideal way to run most companies however I can see this work under a few conditions.

1) This policy is known and communicated to current and future hires.

2) The company has found a way to pay each person the current market rate and makes efforts to adjust accordingly.

Otherwise why would anyone stay?

rprospero · 2 years ago

Many things about that company were not idea - the founder left his CEO position in handcuffs. However, the policy was not communicated to new and future hires in any manner. So why would anyone stay?

The founder was very public with other companies in the area about both his policy of firing 10x developers and hiring any warm body that could put a resume in his hand. He told stories at local business meetings of the various people he hired who couldn't find a computer and were fired on the same day. So, when you found out what the corporate culture was like after about a month on the job, you had two options.

1. Stay on for a year. This cemented to every hiring manager that you were a 1x developer (because you kept the job), but absolutely not a 10x developer. You might get a junior developer position somewhere else, but never more than that. 2. Immediately quit the job. You now had a one month stint at the firm on your resume. Every hiring manager in town knew that 5% of people with a short stint were good developers and the remaining 95% were people who just finished "COBOL for Dummies". You'd best just leave the gap in your resume if you didn't want your resume in the trash.

rprospero commented on As an Employee, You Are Disposable (2023) nelson.cloud/as-an-employ... · Posted by u/nelsonfigueroa

moffkalast · 2 years ago

Well he's probably right. There should be fixed and immutable company policy for automatic raises and bonuses based on independent quantitative measurements, i.e. inflation, local cost of living, and project metrics. No buts, no exceptions, on both the employer's and employee's side. This is how it works in most government jobs and it makes everything fairer, easier, and more predictable overall.

rprospero · 2 years ago

I happen to work at a government job partially because I saw how my father was treated by the private sector. However, our institution is failing at the requirements that you put forth. The government ministers complained back in 2015 that the independent quantitative measurements weren't accurately capturing employee productivity. As you would expect from Goodhart's law, there certainly were certain employees being underpaid and overpaid, respectively. Thus, the measurements were scraped. However, the bureaucracy has prevented a new set of metrics from being put into place. As a result, I've been working for eight years on what I was told would be a six-month probationary salary because there is literally no mechanism for anyone to receive a raise. Thankfully, recent events are looking like this might change to something sane in a year or two, but the last proposal I saw for someone moving out of the bottom of a salary bracket was: "candidate has won awards from professional bodies in at least three countries across at least two continents".

rprospero commented on As an Employee, You Are Disposable (2023) nelson.cloud/as-an-employ... · Posted by u/nelsonfigueroa

moffkalast · 2 years ago

> ask for a raise

The problem is that employers make this process as toxic as it possibly can be, using every trick in the book of emotional manipulation, making you feel like you're blackmailing them and literally destroying their life. Adds a lot of resentment on both sides every time regardless of outcome and it just accumulates.

rprospero · 2 years ago

When I was young, my father worked for a place where asking for a raise was a fireable offence. The founder had been a pioneer in the modern cattle-not-pets attitude toward servers, except he applied it to developers. When an employee asked for a raise, it meant on of two things:

1. The employee was a vain troublemaker who had over-value what they were worth in the market. Firing them would not only remove an inefficiency from the system (as they were likely not to work as hard if they believed that they were underpaid), but it would also helpfully remind the other developers that they were all expendable.

2. The employee was a 10x developer who was vital to the company processes and could command a much higher salary somewhere else. Even if you gave them a raise today, they could be hit by a bus tomorrow. The best course of action was to simply rip off the band aid. Fire the employee, have security immediately escort them from the building, and begin triage to ensure that the critical systems that they wrote/managed could be handled by the next resume in HR's pile.

The line I will always remember is: Developer are like eggs. They are heavily undervalued, but also will crack under too much pressure. Thankfully, like eggs, you can buy them for cheap in packs of twelve, so it doesn't matter if you break a few.