BC TECH
Saved by @zmbnski

A thread on HN about bad code in legacy projects both makes me think how little we've learned as a discipline over the years and, honestly, how little credit we give ourselves for some pretty major

 Fun going down this list and thinking: "Hmm, plausible at a well-run modern software shop", "Hmm, possible, but requires implausible tradeoffs", "Literally disallowed by languages", and "If you were to attempt doing that our test suite wouldn't let you merge."
I think we as an industry celebrate (not quite the right word) failure too much and don't celebrate success nearly enough. There is no DailyWTF for competent execution, word of which generally stays pretty local to the source while incompetence passes into legend.
Alrighty let me try to thread the needle on being the change I want to see in the world while not giving away anything that will get me in trouble:
Ruby has wonderful developer ergonomics. Typed languages are easier for machines to guarantee the correctness of. We built a type checker for Ruby (and I believe it is slated for OSS release sometime).

c.f. https://t.co/S5XIDxFUrH
We have an infrastructure at work which allows one to specify an invariant about not just code but e.g. objects or the environment and then have a range of response options if that invariant changes.

(Parallel evolution of code: I wrote a less-well-specified one at last gig.)
Git, continuous integration, and workflow-driven mandatory code reviews are all younger that the Joel Test, at least insofar as them being common features of median-sophistication engineering shops.
It is not astonishing to start a new engineering job in 2018 and have a developer environment which reasonably approximates the production environment available on one's laptop or tested, repeatable ways to spin up and spin down a new server w/o "build it by hand."
It is highly likely that a service which is hard down learns of that fact faster than Twitter can apprise them of it, assuming that service is operated in a professional fashion.

At risk of stating the obvious: this is a relatively novel development.
The industry has decisively adopted:

* a single, common encoding for almost all human languages
* a single, parseable, human-readable data interchange format
* a default protocol for information transport
You can round to "Any new application talking to any application written by a competent team in last 10 years will be talking to it over an encrypted link which neither side had to think deeply about because the technology is reliable, ubiquitous, and uncontroversially legal."
While it's not literally the case that you could replicate an entire modern software company's deployment for zero dollars in software licenses, that can almost round to true, due to the pervasive use of OSS.

This is very good for learners.
You can get a full development environment capable of doing Hello World spun up in your well-supported language of choice in, almost certainly, less than ten minutes of effort (contingent on you using a Mac, sadly).
The majority case for libraries, APIs, and file formats of interest to you will overwhelmingly be "If you Google the thing you want you get exactly what you need very, very quickly."

More from Patrick McKenzie

Patrick McKenzie
Patrick McKenzie
@patio11
A thing which I unironically and enthusiastically believe which is unpopular among smart people of my acquaintance: financial engineering has in the recent past and present contributed substantially to human welfare. We should hope to see more of it.

Maybe more geeks need to meet someone who says “My job is teleporting value across time and space.”

Financial engineering is sort of a squishy term. I don’t primarily mean payments infrastructure or financial rails, although both of those involve substantial engineering.

I mean more “We took a thing and performed some alchemy, and now have a new thing.”

Except instead of alchemy it is generally quite a bit of math, a huge amount of contract law and due diligence, often an impressive amount of ops work, and a dusting of technology that web devs would recognize as such.
ALL
Patrick McKenzie
Patrick McKenzie
@patio11
I like this heuristic, and have a few which are similar in intent to it:


Hiring efficiency:

How long does it take, measured from initial expression of interest through offer of employment signed, for a typical candidate cold inbounding to the company?

What is the *theoretical minimum* for *any* candidate?

How long does it take, as a developer newly hired at the company:

* To get a fully credentialed machine issued to you
* To get a fully functional development environment on that machine which could push code to production immediately
* To solo ship one material quanta of work

How long does it take, from first idea floated to "It's on the Internet", to create a piece of marketing collateral.

(For bonus points: break down by ambitiousness / form factor.)

How many people have to say yes to do something which is clearly worth doing which costs $5,000 / $15,000 / $250,000 and has never been done before.
ALL
Advertisement
Patrick McKenzie
Patrick McKenzie
@patio11
It’s underremarked upon that stablecoins accomplish basically all of the original design goals for Bitcoin qua a transactional mechanism (instant free value transfer anywhere), but that nobody cares about this because nobody ever cared about that part of the pitch.

“Why do people care about stablecoins then?”

A mix of “they encourage dollar-denominated liquidity in the cryptocurrency ecosystem and discourage withdrawal of the same” and “they’re good for money laundering.”

“But they make value transfer between exchanges much faster!”

This was a solved problem in traditional finance, too, mostly through the extension of credit. (It doesn’t matter how long settlement takes if there is sufficient trust to enable credit.)

The Bitcoin ecosystem is *positively allergic* to credit, so you have to call it a coin for them to accept it. And after you call it a coin they ignore everything the world has learned about credit, like risk management.

“Stablecoins aren’t credit!”

They’re pretty much exactly credit? A tether is a zero-coupon Bitfinex bond with a non-functioning call option. I
TECH
Patrick McKenzie
Patrick McKenzie
@patio11
There are a *lot* of software shops in the world that would far rather have one more technical dependency than they'd like to pay for one of their 20 engineers to become the company's SPOF expert on the joys of e.g. HTTP file uploads, CSV parsing bugs, PDF generation, etc.


Every year at MicroConf I get surprised-not-surprised by the number of people I meet who are running "Does one thing reasonably well, ranks well for it, pulls down a full-time dev salary" out of a fun side project which obviates a frequent 1~5 engineer-day sprint horizontally.

"Who is the prototypical client here?"

A consulting shop delivering a $X00k engagement for an internal system, a SaaS company doing something custom for a large client or internally facing or deeply non-core to their business, etc.

(I feel like many of these businesses are good answers to the "how would you monetize OSS to make it sustainable?" fashion, since they often wrap a core OSS offering in the assorted infrastructure which makes it easily consumable.)

"But don't the customers get subscription fatigue?"

I think subscription fatigue is far more reported by people who are embarrassed to charge money for software than it is experienced by for-profit businesses, who don't seem to have gotten pay-biweekly-for-services fatigue.
STARTUPS
Patrick McKenzie
Patrick McKenzie
@patio11
My friends @robwalling and @einarvollset just launched TinySeed, an accelerator for software companies where a successful outcome is a healthy, sustainable business rather than attempting to ride the rocketship trajectory. https://t.co/LSHqZNcVid

I have some thoughts:

As somebody who bootstrapped ~4 companies, I feel like I had to make some clearly suboptimal decisions early in them for lack of what is, in hindsight, not all that much money. But there's a huge gap in the product space for investment options.

It's weird: you can get $25k from Amex trivially, and angels are very willing to write a check for that much, but you have to make representations about your goals/ambitions/market/etc which don't really apply to everyone.

And so you see the traditional angel/VC ecosystem fund companies where honestly the returns are probably not there, and this is knowable pretty early, but the chase of them will wreck what could have been a perfectly happy business.

(To make the math work for traditional VCs the company has to at least have a market-appropriate shot of $100 million a year. There are a lot more $10 million a year companies than $100 million a year companies. That is *not* a bad terminal outcome for founders/employees.)
ALL

More from Tech

Tinker \u274e
Tinker ❎
@TinkerSec
Singing the Blues:
Taking Down an Insider Threat

"I had all of the advantages. I was already inside the network. No one suspected me. But they found my hack, kicked me off the network...

...and physically hunted me down."


Many pentests start from the outside, wanting to see how the perimeter might be breached.

This pentest started from the inside. My client wanted to assume they had already been breached, and, if breached, how far could an attacker go.

Could they stop me once I was inside?

So they snuck me in. Disguised me as a new employee. Gave me a work computer, an ID badge, an account in their system... hell, I even had a cubicle w/my assumed name on it.

The only person who knew who I really was was their CISO. Everyone else thought I was Jeremy in Marketing.

During most of the first morning, I completed onboarding, made introductions, and completed menial tasks.

But I had to act quick. I only had a week onsite. I had to hack their network while not raising suspicion.

So I set about it.

You have to understand... most "Internal Pentests" are straight forward. The hard part is breaching the network, but once you're inside, it's a target rich environment. End of Life computers, default passwords, everyone a Local Administrator...
TECH
Michael Dearing
Michael Dearing
@mcgd
An irony of facebook's situation.

Sheryl got her MBA at Harvard. One of the most famous cases (Extra Strength Tylenol) in one of the most famous classes (Business History) she took: in 1982, someone put cyanide in Extra Strength Tylenol capsules and killed 7 people in Chicago.

What do you do when someone turns your product into a weapon? When they use the system you built to harm? James Burke, CEO of J&J, was shockingly open with the public, he pulled the product and made significant packaging changes to make product safer (but not tamper-proof).

He over-shared every step along the way re investigation, redesign, stood up as both CEO and human. The reintroduction of new Extra Strength Tylenol succeeded. Burke saved the brand.

But four years later it happened again. A killer put cyanide in the capsules, this time a woman in Yonkers died. Same CEO, Burke, pulled the product again, completely changed the form factor from capsule to caplet and relaunched *again*. It worked *again*. How'd they do that?

Burke (CEO) tapped J&Js goodwill bank account w/ the public. Two big withdrawals from that bank account in four years + 8 dead bodies! But his honesty, openness, humanity (choked up about the deaths more than once), humility kept the goodwill bank balance positive the whole time.
TECH
Advertisement
Jonas L
Jonas L
@jonasLyk
Wanna disable Defender when enabled Isolated Core and Tamper protection?

Its a bit more trouble- but doable, without ruining Isolated Core/Secureboot etc.

Defenders process will run as a unkillable protected service- so new tricks needed.

Here we go:

Ok- tamper protection is easy, just make .bat - run as adm:
:again
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter\Instances\WdFilter Instance" /v altitude /t REG_SZ /d -1 /f
goto again

Then unload minifilter with process hacker:


The registry key will be changed while the minifilter do not protect it, when tamper protection makes the driver load again it cannot attach to volumes nor protect registry keys.

Removing it will make it recreate, but invalid altitude do the trick

Notice now the service is: Protected light(antimalware)
Now we cant do anything to the service/process- not even see its open handles.


Lets start by elevating to SYSTEM- just launch a command prompt, then close process hacker- and run it again from the command prompt.
Now process hacker runs as SYSTEM
INTERNET , TECH
Zeke Hausfather
Zeke Hausfather
@hausfath
There has been a lot of discussion about negative emissions technologies (NETs) lately. While we need to be skeptical of assumed planetary-scale engineering and wary of moral hazard, we also need much greater RD&D funding to keep our options open. A quick thread: 1/10

Energy system models love NETs, particularly for very rapid mitigation scenarios like 1.5C (where the alternative is zero global emissions by 2040)! More problematically, they also like tons of NETs in 2C scenarios where NETs are less essential. https://t.co/M3ACyD4cv7 2/10


In model world the math is simple: very rapid mitigation is expensive today, particularly once you get outside the power sector, and technological advancement may make later NETs cheaper than near-term mitigation after a point. 3/10

This is, of course, problematic if the aim is to ensure that particular targets (such as well-below 2C) are met; betting that a "backstop" technology that does not exist today at any meaningful scale will save the day is a hell of a moral hazard. 4/10

Many models go completely overboard with CCS, seeing a future resurgence of coal and a large part of global primary energy occurring with carbon capture. For example, here is what the MESSAGE SSP2-1.9 scenario shows: 5/10
TECH
R for the Rest of Us
R for the Rest of Us
@rfortherest
Setting up Git/GitHub to work with R/RStudio can be challenging.

Here's a thread to walk you through the process step by step.

This thread also lives in blog post form. #rstats

Preamble: the best overall resource, and one I rely on extensively, is Happy Git with R by @JennyBryan and @jimhester_.

If you have additional questions about Git/GitHub + R/RStudio, this should be your first

The first step to set things up is to install Git.

Chapter 6 of Happy Git with R lays out the process for Mac, Windows, and Linux users.

I’m on a Mac so Git came pre-installed on my computer. I was able to verify that I had Git installed using the terminal in RStudio.


The next step is to configure Git.

This is covered in Chapter 7 of Happy Git with R , though I show what I believe to be a slightly easier process using the edit_git_config() function from the {usethis} package.
TECH

You May Also Like

Anshul Pandey
Anshul Pandey
@Anshulspiritual
THE NOTICEABLE SIGNS OBSERVED ON IMPENDING DEATH(मृत्यु के संकेत या चिन्ह)

As per Skanda Puran, Kartikeya had narrated to Muni Agastya about the signs of the coming death. This is as per this ancient scripture.


If one experiences the air coming out of right nostril continuously then it is observed that the person dies within three years. If the breathing is continuous towards upper side from both the nostrils, then the person can die within two three days.

If the breathing is through the mouth instead of the nostrils then the person may live only for two days. The person should take into coignance these signs of the occurance of any sudden death.

As per astrology when the Surya is in the 7th house and Chandrama is in its own house and the breathing is only through the right nostril then the danger exists. If you see a yellow black coloured figure who becomes invisible immediately then the life span is limited to 2 years.

If any person sneezes, passes urine, stool and semen all together he has only a year more to live. If a person sees blue coloured snakes flying in the sky then he has only six more months to live. If a person sees any thing opposite to its real self like colours
RELIGION
Sara Benincasa
Sara Benincasa
@SaraJBenincasa
#NationalAuthorsDay Hi! Here's a thread about how I love you for buying my books anywhere, but I especially love when you support independent bookstores. You can get delivery through @indiebound via a store near you. Read on for places I love around the US and beyond...

In Asheville, North Carolina, go buy or order some great books by authors you love (hint, hint) via @Malaprops! #NationalAuthorsDay

In Chapel Hill, NC visit @FlyleafBooks. If they don't have my books in stock, I bet they'll order them for you! This is also true for other authors! #NationalAuthorsDay

In New York and NJ visit @wordbookstores! Ask for my books if they don't have them, and also buy lots of stuff by other authors! #NationalAuthorsDay

In Washington, D.C. visit @PoliticsProse for all your #NationalAuthorsDay needs. Ask for my books and those of hometown hero @baratunde and also buy cute objects!
WRITING
Advertisement
Murray \U0001f1fa\U0001f1f8
Murray 🇺🇸...
@Rothbard1776
NEW: @GenFlynn interview w/ @newsmax [on his view of the 2020 Election and what should happen next] "First of all, @realDonaldTrump won on the 3rd of November. The things that he needs to do right now [are]: appoint a Special Counsel, immediately; seize all of these Dominion and

2/ other voting machines that we have across the country; he needs to go ahead and prioritize by state, and probably by county [Fulton County, Maricopa County, as an example]. Exactly what they did up in Antrim County, MI, and what they discovered. I think if he looks

3/ at a random sampling of some of these counties, he's going to find exactly the same problem. These machines are clearly, CLEARLY, there is a foreign influence that is tied to this system, and it goes back to China. It likely goes to Russia. Likely goes to Iran. We know that

4/ Venezuela has participated in the development of these machines. There's been problems all over the country with them. Not only with Dominion, but with this Smartmatic software. He's got a couple of options that he can take, and he needs to take them right now.

5/ The President could, immediately, on his order, seize every single one of these machines around country, on his order. He could also order, within the swing-states [if he wanted to], he could take military capabilities and he could place them in those states & basically re-run
POLITICS
Patrick McKenzie
Patrick McKenzie
@patio11
If an employer is willing to be abusive to you prior to hiring you, when you have maximum leverage and they are maximally incentivized to play nice, I think that gives you *extremely actionable* signal as to how they'll treat you when you're working there and dependent on them.

For candidates: evaluate prospective employers accordingly.

For startups employing e.g. engineers: given that your candidates should evaluate you accordingly, be *extra special* careful to operate like professionals with regards to e.g. interviewing, offers, and negotiation.

"Can you be more explicit about 'abusive' here?"

Not without violating a confidence, but as someone who has been on hiring side of table and is a capitalist, there are *clearly* things you could do which would be "sharp operating, but we're all sharp operators" in some contexts.

Hiring employees is often not one of those contexts. The nature of the relationship, the asymmetry in power, and the social contract strongly counsel you to be a lot better there than you are minimally required by law / contract.

A thing which aesthetically frustrates me is that a lot of the things I've heard companies do here serve *no legitimate business purpose.* In some cases it's getting tens of dollars of advantage. TENS! On an engineering candidate!
ALL
Anshul Pandey
Anshul Pandey
@Anshulspiritual
IMPORTANCE, ADVANTAGES AND CHARACTERISTICS OF BHAGWAT PURAN

It was Ved Vyas who edited the eighteen thousand shlokas of Bhagwat. This book destroys all your sins. It has twelve parts which are like kalpvraksh.

In the first skandh, the importance of Vedvyas


and characters of Pandavas are described by the dialogues between Suutji and Shaunakji. Then there is the story of Parikshit.
Next there is a Brahm Narad dialogue describing the avtaar of Bhagwan. Then the characteristics of Puraan are mentioned.

It also discusses the evolution of universe.( https://t.co/2aK1AZSC79 )

Next is the portrayal of Vidur and his dialogue with Maitreyji. Then there is a mention of Creation of universe by Brahma and the preachings of Sankhya by Kapil Muni.


In the next section we find the portrayal of Sati, Dhruv, Pruthu, and the story of ancient King, Bahirshi.
In the next section we find the character of King Priyavrat and his sons, different types of loks in this universe, and description of Narak. ( https://t.co/gmDTkLktKS )


In the sixth part we find the portrayal of Ajaamil ( https://t.co/LdVSSNspa2 ), Daksh and the birth of Marudgans( https://t.co/tecNidVckj )

In the seventh section we find the story of Prahlad and the description of Varnashram dharma. This section is based on karma vaasna.
RELIGION