There's definitely top-notch software and security engineers making well north of £150k in the UK. As you go up in levels, it's indeed a small set of people, but FB / Google comp for a top L7 engineer working in the same space as Signal engineers can be $700k+ in the UK. Just have a look at levels.fyi, and you'll see that even finance will pay over $500k in London. Furthermore, given how small the group of people are at the top of these companies, very few will self-report their incomes publicly, which is why you'll rarely hear about the engineers making $1M+ – but those cases do exist.
The people behind Signal pioneered end-to-end encryption, and as is pointed out in the blog post, there's still a lot of novel cryptography development involved in building a privacy-first messenger. You can't do that without top-notch talent.
On top of that, there are roles in FAANG companies and Silicon Valley that give ~5 weeks PTO. For example, Facebook historically has had a fairly good PTO policy in the US, and for the past several years gives at least 23 days (plus there's the whole extra month off every 5 years). I heard that as a result of that, Google had to increase their PTO in recent years.
Did you even read the comment above? Sauna usage in Finland has basically no correlation with socioeconomic status. Pretty much everyone has access to a sauna and the time to use one. Not only is it a tradition, but Finland goes to great lengths to prioritize the health and welfare of all its citizens, regardless of ones wealth.
Correct, and generally known as ‘passport control’ in Europe and many other countries.
I think ‘immigration’ is primarily used by English speaking New World countries which historically had large scale immigration (as in, settlement) programs after the world wars—although I don’t have a definitive source for this.
> Go was originally envisioned as a systems programming language. It was often called "a better C". This exposed Rob Pike's lack of experience in the area (IMHO) because anyone who had done any systems programming at all knew that garbage collection made any systems language a nonstarter.
I've said this before, but even back in early 2014 Rob Pike had said that he regretted the term "systems programming" because people misunderstood him to mean it as a language for writing operating systems, when what he meant was a language for writing servers, although that later evolved to cloud infrastructure.
Indeed, and in that respect Echelog was a great source of OSINT material for the anecdote I described above. That, along with `whois` data and other public databases can reveal a lot without putting oneself at legal risk.
A long time ago parsing Echelog logs was how I was able to monitor the IRC activity of an attacker at a company I used to work at. I didn't normally sit on these channels myself, but Echelog enabled me to look back and collect data on the various handles that this person operated under.
There were 20-something handles they used over approximately a 6 month period of monitoring. I was always able to find a small piece of information to correlate these handles together. Sometimes it started with a hunch, such as the language (even slang) they would use, but eventually they'd slip up in some way and we'd have a pretty irrefutable link to the person.
This information helped us develop a motive behind the hack and the ongoing public info was then fed to national crime agencies. My employer never went through with prosecution, but as this person was of much interest behind other hacks they were eventually prosecuted and convicted. I always wondered if my occasional Echelog intelligence reports ever had a role in that conviction.
I completely agree about having a dedicated team, and I'd expect a company of their nature to be at the forefront of security best practices.
I just checked some Equifax domains against SSL Labs, and while their Canadian site (https://www.econsumer.equifax.ca) scores an A-, it has no forward secrecy. I'm surprised to see a modern web server not supporting FS today. Worse, the main entry point to their Canadian site (http://www.consumer.equifax.ca) as indexed by Google does not redirect to a TLS enabled page, although they do seem to have a TLS endpoint for that domain -- but not sure how people are expected to get to it.
Edited to add: The first link is only accessible through a redirect by clicking on the "Get Started" button on their main Canadian site. Furthermore, even selecting Canada from the drop-down on https://www.equifax.com/personal/ redirects to the insecure non-TLS site.
Rapidly expanding Canadian IoT company with new products in the works. Plenty of interesting problems to work on, from crypto, databases, highly concurrent software, performance tuning, to running infrastructure at scale.
Friendly culture, generous work from home/remote policy. Opportunity to work with industry experts and thought leaders in Toronto on some exciting new technologies. Email me directly, jari <at> ecobee.com, or browse our other postings here, https://www.ecobee.com/careers/.
Great idea. I always thought that it's essential to log events in realtime to a remote system that is secure and harder to compromise to modify the logs post-intrusion. Way back in the day it was suggested to do this to an entirely offline system by cutting the rx pins on a parallel cable, thereby only allowing the one-way transmission of logs to the log server. I don't know if anyone ever did that in practice though.
Anyways this invites the question, are you allowing your production servers to make outbound internet connections? Generally, I would proxy outbound connections and/or use internal mirrors and repos for the installation of software.
When a process exits abnormally or not and if there's unread data in the receive buffer then the kernel will send a RST, otherwise it would send a FIN.
I gained a newfound respect for SQLite recently after reading Dan Luu's post on file consistency (http://danluu.com/file-consistency/). I had always thought of SQLite as a bit of a toy database, but having read that post I was surprised by how rigorously it appears to have been developed.