> If you don't want your transactions to be public, don't use a public ledger.
That's exactly what people were attempting to do, with Tornado.
> You don't get to launder your money
There is no money laundering available with Tornado, it doesn't turn an illigitimate source of funds into a legitimate one. And it also has a compliance tool to allow proof of transfer between accounts.
> Tornado Cash wasn't free, there was a fee which as I understand it was sent back to various developers.
This wasn't sent to developers. It was a fee you would pay relayers to propagate transactions on the network and was optional. You could choose to fund withdrawals with a relayer or to use funds in your own wallet.
So I’ve read through the comments, and I can see that you’re adamant the seed phrase isn’t the attach vector, but I’m going to be listing things down in order of what I see as being a rough probability, please don’t see any of this as accusatory in anyway - it’s more that I keep an eye on OpSec for crypto generally despite not being an expert.
First question; was the amount stored on the ledger stolen during a transaction? If so then he may have been exposed to the same targeted Metamask attack as experienced by an NXM founder https://medium.com/@hugh_karp/nxm-hack-update-72c5c017b48. This wouldn’t explain the BTC and LTC transactions though.
My collection of possibilities:
1. The seed phrase was exposed. Maybe not from your piece of paper, but perhaps it was saved onto a text file, jotted down into notes, captured somewhere else. I realise given the other comments you are likely to disregard this one, I get it, but it still seems to be the most likely from the outside looking in.
2. The computer used to make transactions was hacked, as per the Metamask hack above.
3. Your nephew got into trouble and needed money. I’m not saying he’s lying to you, but he could be trying to save face.
4. A device on his network got hacked and he was subjected to a pretty targeted attack which could have made false transactions on his behalf if he accepted the certificates on his device, maybe. Perhaps a worm on his computer propagated to his iPhone to read the trust key.
5. Both ledger, and Trust are compromised to remote attacks. This would mean someone has found a way to read the seed phrase from ledger and trust remotely and then dump the wallet entirely. This would also make him probably the first person in the world to face these vulnerabilities on both apps. Hopefully you can see why 1 & 3 seem more likely than this.
I’d argue that just naming your app after it doesn’t even encourage the use of those drugs. Might as well enact a word blacklist on the app names if that’s all it takes.
It‘s currently in consideration and by the time we’re ready to make a call on it, Docker will be too. They almost are in fact.
But consider that we may be optimising for different things. Most new developers I hire can be thrown a MacBook and they’ll know what to do, Linux on the other hand doesn’t have that guarantee especially towards the junior and front-end market segments of where I work. It’s a (real) broad strokes opinion, but I’m of the belief that macOS and by extension MacBooks offer us fewer overheads in terms of setup, maintenance, onboarding, tooling suitability for the median developer. So that leaves us using macOS.
This is the factor we’re optimising for more than deployment portability - we optimise for vendor lock-in in less than the developer experience for the median of our developers. For many of us on this forum we may be best with Linux on a bleeding edge distro, but for our preferences we deploy MacBooks for portability. Whether it helps things overall, this is in Manila where a net monthly salary is often less than the cost of a laptop, so we deploy one device that can be transported between home and work as required for those that don’t have a personal device.
With that, I see this as Apple locking us into that ecosystem rather than a choice we’re making on our side, so I’d rather lean into this and explore it further than doing nothing. If it comes out positive then we’ll be ready to make the switch before Apple forces us into it, and if not we’ll deploy something thinkpad-esque and keep our production instances x86.
It’s slightly tangential, but I’m managing an engineering team of 28-30 and we’re currently considering a wholesale change to ARM CPUs across the board.
MacBooks are our de facto development laptop and all our services use skaffold for local development, Docker basically. If we consider the perhaps likely outcome that MacBooks will one day be ARM-only, that Docker will not offer cross-arch emulation, and that our development environment will be ARM only, it then becomes likely that we’ll migrate our UAT and PROD to ARM based instances.
If we go that route it’ll mean more money to the AWS Graviton programme and likely further development of ARM chips. I can’t see this affecting RISC-V but the M1 switch could very well benefit the wider ARM ecosystem.
I know it probably won’t be the advice you’ll expect to hear, but I’ve been there and perhaps just as badly.
What helped me was just to accept that I’ve probably got 10 good years, maybe 20, and I’m okay with that. My parents would be in old age, I don’t have kids to worry about right now either and I’ll do what I can to make it better - but I’ve accepted the worst. Even the worst case I’m at peace with. I’ll be 40 around then, which is probably better than most humans through the course of history.
Bleak but also liberating. Makes you value your time a lot more.
To answer your last question; let’s say I have some shared state that multiple micro-services rely on and all need to fetch that state synchronously. My example is that you’re a loans company and almost everything is driven from the loan book. Reporting services need to know the active loan counts this month, invoicing services need to fetch the loan book to generate transaction lines, borrower services need to know whether the current user has any active loans.
The standard wheel-and-spokes model would probably have a loan book service where all others call into it via HTTP requests, but you’ll have to build a query language on top of that REST API, or share DB access I suppose.
Or in this model you would stream the loan book updates through Kafka and every consumer that needs a copy of the loan book can keep their own, query it against their own chosen materialised store in its native query language (some might just append to Mongo, or kSQL, some might always use event sourcing per-request). “select * from loans where user.id = current_user” becomes possible here rather than stitching the HTTP responses.
Now I’m not saying one is right or wrong outright as you’re only trading a more native query interface with data consistency concerns, but this for me still feels like a valid architectural pattern and one I’d consider.
We're building an ethical financial services company in the Philippines, working hard to transform the lives of working people without stable access to financial services. We'll be advancing our suite of products to allow people to save for their first home, or understand the key elements of a financially healthy situation.
We, of course, need good people. For what it's worth I truly do think we're trying to do the right thing here and it takes honest, kind, patient people to do it. Having technical skills at the Senior/Lead level is important but we want mature and deliberate thinkers. In return we'll do everything to give you space to think, design, and develop your best work with a laser focus on transparency and honesty. Developer happiness is a topic close to my heart and this isn't just lip service.
For what it's worth we work on React, are keen on introducing Typescript for the front-end. We use Java microservices on the back-end and are keen to experiment a little bit on that side. Come and help us make the right choices.
I'm the new Head of Engineering so we'll be working closely together, please do get in touch: [email protected]
I wouldn't have an issue committing to those benefits you've listed. Agreed, app is a gimmick although I'm not too sure the other two are quite as far into the gimmick category.
It seems like you've taken it as either/or rather than 'and'. I want to offer all of the above things AND offer any specific benefits that also offer sleep enhancement.
Point taken - this is as valuable an opinion as any other. I'd love for an empoloyer to care about it enough to 'put their money where their mouth' is when it comes to making sure I'm looking out for myself sleep wise, but I wholeheartedly accept this stance.
> If you don't want your transactions to be public, don't use a public ledger.
That's exactly what people were attempting to do, with Tornado.
> You don't get to launder your money
There is no money laundering available with Tornado, it doesn't turn an illigitimate source of funds into a legitimate one. And it also has a compliance tool to allow proof of transfer between accounts.
> Tornado Cash wasn't free, there was a fee which as I understand it was sent back to various developers.
This wasn't sent to developers. It was a fee you would pay relayers to propagate transactions on the network and was optional. You could choose to fund withdrawals with a relayer or to use funds in your own wallet.
> Money laundering
This isn't money laundering.