Ah yeah I guess it’s true they don’t have permission. At the end of the day I think it comes down to the owner choosing to press charges or not, or even detecting it and subsequently reporting it. I would guess that if the systems have ways to be hacked, the owners likely won’t see the hacks until the white/grey hat reports it to them.
Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.
Greyhats and especially bug bounty programs, pen testers, etc, have explicit authorization from the owners of the systems to access their systems, and perform ethical hacking with a mutually beneficial goal, hackers get paid, and the company gets a little bit less of an attack surface.
That’s not illegal
What’s illegal is accessing a computer system without the authorization of the owners of the computer system. Technically speaking, port scanning the internet is illegal hacking, as you are not authorized to scan each port number on any of those machines. Ever find a random ip and give port 22 a few random tries over ssh to see if the root password is “guest”, you just committed a federal offense, because you were not authorized to access and attempt to login to that system. Is anyone going to report port scans to the fbi? Failed ssh loggin attempts? (Use a vpn/tailscale and don’t expose ssh to the internet anyway).
I often wonder where “knowing” someone’s password and “hacking” their social accounts falls in this discussion. You see or hear about it all the time. “So and so hacked my page” If you have someone’s FB login info and they have no idea that you do, you may have permission to access FB, as everyone does if you accept their TOS, but you don’t have the account owner’s permission to access their account, and if FB knew it wasn’t the account owner, they would not allow that either. So if they don’t allow that, you’re likely violating their TOS, and no longer allowed to access their systems, so maybe it could technically be able to be prosecuted as illegal hacking, idk.
I will agree that recently, esp the last 2 major versions, the OS has gotten worse from a stability perspective. I have errors in my logs at a steady pace even on new machines and fresh, untouched OS install from the factory. They just never go away. The cloud services are always on and phoning home, even when you have everything that uses an Apple ID signed out. It’s becoming more intrusive and less configurable, but nothing beats the shortcuts or the mac keyboard layout, and the UI intuitiveness. I can’t go back to ctrl-s and everytime I’m on my Linux machine I struggle to do the ole carpal tunnel-s to save haha
Golang is in a special class on its own. Write some handler functions and pass around a context struct and call it a day. I wish every stdlib took care of all that stuff :)
A large number of extremely talented engineers might beg to differ. Everything you listed as an issue has a solution. Like any operating system, you have to spend the time to learn the intricacies of how it works and to customize it to your liking. For me, must haves are Alfred to replace spotlight, my dotfiles which change a ton of defaults in various apps like finder, the dock, etc, setup key repeat, iterm2 colors and profile, etc. divvy and magnet for window management. Caffeine to prevent sleep. Stats open source menu monitors to replace istatmenus
I’m sure there are newer equivalents to what I’ve listed. I’ve been using those programs for years.
Smaller file sizes or less LOC is not inherently safer than larger sizes or more LOC. if you’re building web apps, you’re more than likely reaching for a handful of packages, and so are millions of other people, and so are multi billion dollar companies, companies with staff who’s job it is to do supply chain security, PCI compliance auditing, security assessments, who hire pen testing firms, and some even write browsers and can sway the direction of our entire industry and the internet as a whole. Countless static code analysis is ran on the millions of CI jobs a day on builds that pull in the package, etc. If you’re using popular and maintained open source packages, people are looking at them. Shy away from no name packages with no usage unless you personally look at the code. That’s my take on it. I tend to trust the open source community to all be working towards the shared goal of well crafted and secure code for the world to use and benefit from
~You can have a root user with SIP enabled. SIP protects core OS files from being modified while it’s enabled. This prevents processes, even root processes, from swapping out core libs with modified ones, installing root kits, back doors, etc.~
I misspoke
> System Integrity Protection (SIP) in macOS protects the entire system by preventing the execution of unauthorized code. The system automatically authorizes apps that the user downloads from the App Store. The system also authorizes apps that a developer notarizes and distributes directly to users. The system prevents the launching of all other apps by default.
How’s your vulnerability reporting process and how much experience do you have interpreting complicated pen tester bug reports about some buffer overflow zero day in your homebrew query string parser?
Huge difference between working fine, and working right. The security implications of rolling your own, is why I say “you don’t want to…”
Also, none of that code has anything to do with the product you’re actually trying to build. Imo it’s additional maintaining, tech debt, attack surface, and it’s a solved problem by a large community and has more knowledge from the security community baked in, and more eyes finding and plugging holes.
I’ve rolled my own mvc framework before, In php even! This was years ago when CakePHP was the new hotness and Laravel didn’t exist. Take it from someone who had your mentality and set off to make a tiny and no bs mvc that just gets the job done, the amount of work these frameworks are doing for you (backend frameworks) that you don’t consider, is why you should run a framework.
You don’t want to deal with processing a raw http request from the web server. You don’t want to split headers. You don’t want to sanitize input params, deal with character encoding, content types, gzipping, cache control, etags, basic authentication, flushing headers, chunking bodies, file streaming, tcp sockets, slow client avoidance, and probably 1000 other things I can’t recall.
No matter how unnecessarily complex you think a http framework might be, I assure you, it’s saving you from a mountain of already solved by people smarter than you or I complexity.
Sounds like it’s by design. Payouts for clicks is way higher than impressions. Sneaky sneaky. Or, malicious payloads await on the other side.
My favorite is when a full react site loads up, doesn’t have error boundaries, hits some unimportant js exception, and the entire page that was fully rendered and ready to go just pops out of existence and you are looking at a white page. That doesn’t seem like forward progress at all.
The US government doesn’t have legal permission to kidnap and murder you, not within the US. So it seemed to me like the comment was about china, sparking my reply. The comment could honestly apply to either imo, and maybe that’s the point. Do cops arrest people and kill them? Way too often. Those cops should be charged with crimes. But cops not being charged with crimes is not the same as it being legal, even if the end results are both the same. Or are we talking about the ability to imprison a criminal and put them to death for their crimes?
This is the problem with the original comment, it’s way to vague, or I’ve failed to make sense of it.
Not defending TikTok but there’s a wealth of public real time data from not just the US, but the entire world, some public api calls or scraping scripts away. Tiktok isn’t any more invasive than any other social media post, many of which are public and anyone in any country who wants to use the data can do so easily.
What trove of intelligence is being gathered by self obsessed videos of people mouthing a clip of some song or inspirational talk while begging for attention in the form of likes and follows?
I haven’t seen any sign of intelligence on TikTok that they even could gather lol, and if anything the app’s purpose isn’t to spy on us, it’s to make us dumb, inattentive, mindless consumers who all fight over everything and can’t compromise or work together.
My dad literally comes home from his job and scrolls TikToks of increasingly radical political rants and half naked chicks before inevitably passing out in his chair, phone in hand, mouth open, and whatever TikTok was on screen when he fell asleep playing on loop until he jerks awake or the phone dies. He’s not unique. So much of people’s lives are wasted on social media and it does them no positive
Google is “friendlier”, because they run some automated scans on the apk and you’re good. Apple has humans run your app to confirm it does what you claim, as well as a battery of automated scans and since they are using the app I’d imagine they look at network traffic as much as possible. I know iOS isn’t shielded from malicious apps, but there’s malware and viruses all over the play store. That’s because it’s free and “friendlier”.
> At Apple things have gotten way worse. Trying to automate release building is practically impossible and will require hours or CI pipeline debugging with error messages that don't mean what they say.
This isn’t Apple’s fault… every build system sucks up a decent amount of time during initial setup. You can cut down massive amounts of time between iterations by adding some common optimizations:
1. Cache artifacts when that step or job succeeds, so if a subsequent step/job fails, you can adjust it and start up where you left off, using the caches artifact to restore the workspace state. This complicates debugging efforts and I personally don’t do any optimization until the pipeline is reliably green each time. I just deal with slow builds and switch to other stuff or work ahead while they run.
2. Fail fast. The CI run should bail out if any critical steps don’t pass, so anything further down doesn’t run for no reason, burning compute time and delaying queued jobs waiting for a runner. While developing the pipeline, watch the logs and when you see something you don’t like, slap the cancel button, or collect a couple things you need to change and iterate with passes with 2-3 changes.
3. Use adequately spec’s hardware. Xcode is resource heavy and compiles need plenty of memory and cpu cores. Play around with what is a good compromise between power and cost. See if your project builds faster with more cpu cores, or faster cpu cores, etc.
4. Cache build dependencies. Mac builds have cocoapods or something close to that, and whatever that package system pulls down can be reused between builds, just remember that cache issues are a pita to spot, reproduce, and regression test, so I’d again not add this in until you’re green.
5. Write your pipeline steps in a regular bash script. Then make your CI jobs and steps just execute the shell scripts. This allows you to develop them all locally, executing the script/step you need and then CI becomes just a wrapper to glue it all together and do some caching and optimization. The more of the process you can work on locally the less you have to run on CI and wait for. Once the scripts are all working locally, wire them into CI and see what breaks. ProTip: whatever breaks on CI due to missing software, deps, configurations, is going to break for any new hire engineer trying to get up and running, so document those things and make sure your getting started readme has them, and you’ll make new hires onboarding suck less :)
As for useful error messages, or lacktherof, I’d like to introduce you to programming, we’ve been waiting for you ;) but for real, useful error messages are the rare exception, and many apis are this way. That’s not to say it’s ok, but you kinda gotta learn to work around it. I’m sure there is enough context to point you in the right direction. Also, the errors might be from random pieces in your build pipeline and not necessarily from the actual Xcode build, so make sure you know what is erroring in addition to what the error is trying to say.
> At least Googles process is quite simple and can be dockerized.
One man’s simple is another man’s “practically impossible”. Simple comes from familiarity/exposure which builds knowledge and confidence. Anyway, you can totally run your builds in docker if you want to, and many do, but I’d personally not introduce more complexity until you have your pipelines running the slow way with the least amount of mental modeling to do. Once you know it all works, then have a go at running the build you know is good, inside a docker container (which in this case is just packing up kvm/qemu/libvirt to facilitate the running of a vm back on the host, but it means you can run mac containers on Linux runners, which will be much cheaper than Mac runners since those are usually Mac hardware)
> Also why do I have to pay Apple $125 a year when it costs $100 in the US? The exchange rate from CHF to USD should be in my favor.
Couple theories. 1. They have additional processing or tax expenses when dealing with your currency which they aren’t going to eat the cost of. 2. The higher price could be to deter abuse if for some reason there is an abnormal amount originating from accounts who pay with that currency.
Hmm, I remember being 4 years old, not knowing anything at all about the brain, the mind, or much else for that matter. I actually was pretty confused about everything around me. But I knew the voice in my head was me thinking, and I know for a fact that not a single thing was taught to me directly or indirectly to influence that. I just knew that those were my thoughts, because I was thinking them. I’m not special so I’d guess most people “just know” that it’s their own mind, without having to know what a mind is a or have any knowledge at all, and that they aren’t hallucinations.
It’s pretty weird to me that many folks view the people in our past as being unable to be intelligent near or on par with today’s levels. These people were not hypnotized by hallucinations, that’s saying they were not smart enough to even have a thought that they could understand it came from themselves. Yet they were smart enough to develop pulleys and create pyramids, or many other wonders of the world. Things we literally do know how they weee able to do at that time in the past. Things that none of our modern structures will outlast. Things that took understanding of complex subjects, capacity planning, raw material refining, site surveying, astronomy, physics, math, weather patterns, etc.
I wonder in 12k years if humans will look at us and say we were incapable of knowing that our thoughts were ours and lived in a hypnotic state viewing our thoughts as hallucinations. They couldn’t possibly know for one. And also, doesn’t that seem like a odd way to view people who accomplished things we still don’t fully understand?
> Brain death is defined as the irreversible loss of all functions of the brain, including the brainstem. The three essential findings in brain death are coma, absence of brainstem reflexes, and apnoea.
Yet 12,000 years ago there existed cultures who were similar enough to have sequin ornaments for decoration. Sure, we are not the same as them, that’s fine, but also, we kinda were in terms of common societal things. We were putting sequins on stuff 12k years ago which means they had customs, traditions, ceremonies, organization, tools, knowledge retention and exchange. That’s stuff we still do today, so what caused 12k years to go by before we blasted into being an advanced species in 200 odd years? It’s interesting because every answer I get to explain it just makes me wonder why even more because the sudden progress just doesn’t plot, it should be earlier and we keep digging up more evidence we were more advanced long ago, and often before we thought too, then things seemingly just stalled and went nowhere for millennia
I can’t remember what culture it was but there’s evidence of primitive batteries in pottery. Long before electric. That is odd no?
Knowledge was spread in written form before the printing press. Yes less of it and a lot slower, but you don’t have plumbing systems or built pyramids without knowledge being persisted for generations. The printing press is a factor I think but it not existing doesn’t explain why no progress was made for so long imo.
If we are applying Occam’s razor then the reason that they are letting the IP rot unused must be because there’s more value in doing so than there is to use it. Business don’t burn 9 figures by mistake usually and the fact they haven’t sold it off to recoup their losses tells me they didn’t make a mistake and the IP rotting unused is exactly where they want it to be and that it was worth the cost to get it. Companies will sell off losses to use the funds elsewhere. They don’t sit on assets that are worthless to them.
Somewhat related, the hackers submitting a vulnerability disclosure to the companies are in a very “extortion-y” dynamic. I wonder how often companies get something like “pay us X amount or we let the world know today instead of waiting for you to fix it”.