• 0 Posts
  • 75 Comments
Joined 3 years ago
cake
Cake day: June 11th, 2023

help-circle

  • Yup. The risk of someone breaking into your house and stealing your post-it note is vastly different from someone guessing your password, and the risk changes again when it’s a post-it note on your work computer monitor.

    One of the best things you can do with your critical passwords is put them on a piece of paper with no other identifying information and then put that piece of paper in your wallet. Adults in modern society are usually quite good at keeping track of and securing little sheets of paper.

    I’m paranoid, so I put mine on an encrypted NFC card that I printed to look like an expired gift card to a store that went out of business. It’s got what I need to bootstrap the recovery process if I loose all my MFA tokens (I keep another copy in a small waterproof box with things like my car title. It’s labeled “important documents: do not lose” and kept unlocked so any would be thief feels inclined to open it and see it’s worthless to them rather than taking the box to figure that out somewhere else. The home copy is important because there’s vaguely plausible scenarios where I lose both my phone and wallet at the same time. )

    Stealing my laptop and getting my stuff is a significantly larger risk than me leaving my computer on and unattended without locking the screen.

    Passkeys are a good trend because they’re just about the only security enhancement in recent memory that increases security and usability at the same time.


  • My standard for an orm is that if it’s doing something wrong or I need to do something special that it’s trivial to move it aside and either use plain SQL or it’s SQL generator myself.

    In production code, plain SQL strings are a concern for me since they’re subject to the whole array of human errors and vulnerabilities.

    Something like stmt = select(users).where(users.c.name == 'somename') is basically as flexible as the string, but it’s not going to forget a quote or neglect to use SQL escaping or parametrize the query.

    And sometimes you just need it to get out of the way because your query is reaaaaaal weird, although at that point a view you wrap with the orm might be better.

    If you’ve done things right though, most of the time you’ll be doing simple primary key lookups and joins with a few filters at most.


  • They likely did do actual training, but starting with a general pre-trained model and specializing tends to yield higher quality results faster. It’s so excessively obsequious because they told it to be profoundly and sincerely apologetic if it makes an error, and people don’t actually share the text of real apologies online in a way that’s generic, so it can only copy the tone of form letters and corporate memos.







  • This isn’t the best or most popular way to do it, but: https://learn.microsoft.com/en-us/windows/wsl/install

    There is a way built into windows to deploy and use Linux from inside windows.

    It’s not the most pure experience, but it’s a way to make sure you have something like a feel for how some parts work before jumping in any deeper.

    A bootable USB stick is another way to try before you commit. Only reason I might suggest starting with trying it the other way first is in case you run into issues connecting to the Internet or something you won’t feel totally lost. Having to keep rebooting back into windows if you have a problem can be frustrating, so getting a little familiarity with a safety line can help feel more confident.

    Issues with a USB boot are increasingly uncommon, as an aside. Biggest issue is likely to be that USB is slow, so things might take a few moments longer to start.

    From there, you should be pretty comfortable doing basic stuff after a little playing around. Not deep mastery, but a sense of “here are my settings”, “my files go here”, “here’s how I fiddle with wifi”, “here’s how I change my desktop stuff”. At that point a dual boot should work out, since you’ll be able to use the system to find out how to do new things with the system, and also use it for whatever, in a general sense.

    If it’s working out, you should find yourself popping back into windows less and less.



  • So, I wasn’t referring to enjoyment. I spoke of engagement or interest. It’s why programming is more appealing than data entry.

    You’re just doubling down on the false dichotomy I spoke of. It’s not at all uncommon to find someone with plenty of experience who can easily and honestly tell you why they think what the company they work for does is interesting.

    Asking someone why they think working at the job they’re applying for is appealing isn’t “hiring for enthusiasm”, and it’s honestly odd that you keep casting it that way.
    I get where you’re coming from, and I partly disagree. It doesn’t seem like you’re parsing what I’m saying because of this “either one or the other” attitude though.
    No offense intended, but it makes you come across as burnt out and sad. I don’t work for small companies, with inexperienced people, and I’m not constantly shipping broken code that needs rewriting. I’ve been doing this for roughly 15 years and I can honestly say “working in security in general is interesting because it forces you to think about your solution from a different perspective, the attacker, and working at $AuthenticationVendorYouQuitePossiblyUse in specific is appealing because you get to work on problems that are actually new at a scale where you can see it have an impact”.
    That’s not gushing with enthusiasm: it’s why I’m not bored everyday. If you’re actually just showing up to work everyday and indifferently waiting to be told what to do because it’s all just the same old slog… That’s sad, and I’m sorry.


  • I’m lucky that after all these years still get those moments of great enjoyment when at the end of doing something insanelly complex it all works

    I just think it’s worth pointing out that that is an example of the work being engaging.

    No one is so naive as to think that you work a job for anything other than money. The original post doesn’t even seem to convey that it’s bad to ask about the pay and benefits. It’s saying that if, when directly asked, the candidate has no answer to what seems interesting about the job they might not be a good fit.

    You seem to be an experienced software developer. You’re easily qualified to do basic manual data entry. Same working environment, same basic activity. Would you be interested in changing roles to do data entry for $1 more salary?
    I’m also a software developer, and I can entirely honestly say I would not, even though it would be less responsibility and significantly easier work.
    Even the boring parts of my work are vaguely interesting and require some mental engagement.

    It seems there’s this false dichotomy that either you’re a cold mercenary working 9 to 5 and refusing to acknowledge your coworkers during your entitled lunch break, or you’re a starry eyed child working for candy and corporate swag. You can ask for fair money, do only the work you’re paid for, have a cordial relationship with coworkers, and also find your work some manner of engaging.

    It’s not unreasonable for an employer to ask how you feel about the work, just like it’s not unreasonable for a candidate to ask about the details of the work.


  • Sure. I wouldn’t disqualify someone for being ambivalent towards what we’re working on, but the person who seems interested is gonna be better to work with.

    Likewise when looking for a place to work, if the tangibles are equivalent I’ll prefer the place with better intangibles.

    I’m not in HR or management, so I don’t care about cost effectiveness or productivity beyond “not screwing me over”. From that perspective, it’s generally nicer to work with someone who finds it interesting than with someone who doesn’t.

    There’s no point asking “why do you want to work here”, because the answer is obviously a combination of money and benefits, and how food and healthcare keeps you from being dead.
    I can’t fault an interviewer who’s clearly trying not to ask the obvious question and instead actually ask how the candidate feels about the work instead of disqualifying them for not volunteering the right answer.

    It’s not unreasonable for an employer to ask a candidate how they feel about the work anymore than it’s unreasonable for the candidate to ask about the working environment.


  • I actually kinda agree with both here.

    It sucks working with someone who is utterly disinterested in the work, if it’s anything above rote work.
    Asking the candidate what they found interesting about it is at least a basically fine idea. If they can’t answer when you ask, that actually is kinda concerning.
    Big difference between asking and expecting them to volunteer the information.

    At the same time, if the people interviewing you can’t even pretend to show basic conversational courtesy by asking some basic “what do you do for fun” style questions or anything that shows they’re gonna be interested in the person they’re looking to work with, that’s a major concern.






  • Okay. You’re still doing tech support either way. I have no way of knowing how much free tech support you’re willing to give, hence my caveat of how much you’re willing to support them.

    Netflix would disagree. People feel like they’re supposed to be getting access to a service, and if they’re not getting it they’ll complain to the nearest party to what isn’t working. In this case that’s you or Netflix being asked questions about why the router isn’t working.
    That it’s wrong or irrational has nothing to do with who’s getting asked the question, and who’s the first line of troubleshooting when the service doesn’t work.

    If people didn’t ask the wrong people questions, Netflix wouldn’t need support articles on how to reset your router.