gav

10 か月前議論

For those that want to travel light the Panasonic MultiShape[1] is great as you can share one rechargeable base with multiple tools. It is annoying as it's not USB, but inexpensive cables are available[2] and work great.

[1] https://shop.panasonic.com/pages/multishape [2] https://www.amazon.com/dp/B0CMGQWM1B

gav

昨年議論

The desired result is a 500 so it's possible to audit.

As much as this is a pain, the alternative can be more painful.

I used to have a client that would forward me an email from their security team every six weeks saying "we found a SQL injection issue with your site, can you look into this and confirm that it's fixed?" and I'd reply back saying "that not possible" and they'd go "ok, we've marked this as a false positive".

Eventually I got bored of having the same conversation over and over, so I asked them to show what they were finding. It turned out their scan would do the following:

  html1 = request("https://example.com/search?query=test")
  html2 = request("https://example.com/search?query=test' or 1=1--")
  if (html1 != html2) 
    sql_injection_vulnerable = true

Which of course is total nonsense, just because it returns different content doesn't mean anything.

This is a perfect use case for a WAF, I can stick one in front and then have it return 500s for all these requests and not worry about it any more.

In our case, we didn't have a WAF, but they had a obvious User-Agent, and it turns out that blocking all of their requests passed the scan too :)

gav

昨年議論

It's more so that Cloudflare has a WAF product that checks a box for security and makes people who's job it is to care about boxes being checked happy.

For example, I worked with a client that had a test suite of about 7000 or so strings that should return a 500 error, including /etc/hosts and other ones such as:

  ../../apache/logs/error.log
  AND%20(SELECT%208203%20FROM%20(SELECT(SLEEP(5)))xGId)
  /../..//../..//../..//../winnt/system32/netstat.exe?-a

We "failed" and were not in compliance as you could make a request containing one of those strings--ignoring that neither Apache, SQL, or Windows were in use.

We ended up deploying a WAF to block all these requests, even though it didn't improve security in any meaningful way.

gav

昨年議論

To paraphrase a previous employer's strategy: fixed fee projects are for ones you plan to do over and over where it makes sense to invest at getting good at them.

The first one you lose a bunch of money, the second you might break even if you are lucky, and the tenth onward you make a bunch of money.

gav

昨年議論

One example is LookML, which used to build semantic data models in an analytic layer: https://cloud.google.com/looker/docs/what-is-lookml

gav

2 年前議論

Dijkstra was talking about Dartmouth Basic in 1975:

  - Variables: Single letter, optional digit.
  - Control flow: FOR loops, GOTO for others.
  - Subroutines: GOSUB line, RETURN.
  - Parameters: Passed via global variables.
  - Functions: 26 (FNA–FNZ), one line each.
  - IF statements: One line only.

gav

2 年前議論

When I had a blue collar job, my coworker used to divide jobs into "shower before work" and "shower after work".

It's perhaps less relevant now that a lot of people can roll out of bed and start their remote job in sweatpants, but it's stuck with me.

gav

2 年前議論

You need to treat any animal bite seriously.

I had to convince a coworker to go to the ER to have a cat bite looked at, and she ended up spending a couple of days in the ICU with the doctor being clear that delaying treatment another few days would have been fatal.

gav

2 年前議論

There's a risk for wooden ones that are glued, specifically bamboo, or finished with something toxic. You should probably stick to ones made from a single piece of hardwood and are unfinished.

There's also a risk that any cracks will fill with bacteria.

gav

2 年前議論

I imagine that it would be along the lines of:

If you are a service worker earning less than $44,725 (the Federal 12% bracket) your first $10,000 of tips are tax free.

This would mean that an income of $40,000 including $10,000 tips would owe roughly $1,748 Federal tax vs. $2,820 tax.

gav

2 年前議論

See Living Worlds: http://www.effectgames.com/demos/worlds/

There's a iOS and Android app: https://pixfabrik.com/livingworlds/

gav

2 年前議論

You can use MJML - https://mjml.io/ - which abstracts away a lot of the ugliness and Outlook hacks.

gav

2 年前議論

At some point there is a physical limitation, there's no passport in the world that accepts a 666-character name.

The US only gives you 21 characters on the DS-11 for a surname.

gav

2 年前議論

I make heavy use of Slack's Later feature as due to timezone differences the first half of my day is significantly busier than the second.

Asking people to move to email feels like a passive aggressive way to add enough friction to discourage question asking.

gav

2 年前議論

In a previous role I was responsible for developing architecture that supported a bunch of different teams, so I started being pulled into a lot of meetings as the easy option for them was asking me. I ended up having 6-8 hours of meetings a day on top of my actual workload.

My solution was to not accept meetings and have a PM go grab me if they really needed me, that was enough friction to allow me time to get work done. As in your case, this created a bunch of mystique as I was now that guy that showed up in the middle of a meeting, said a bunch of smart things (hopefully!) and then left.

One of the difference about the new Zoom-centric world is that it's zero effort to add an somebody to a meeting "just in case". I push my leads to decline meetings where there is no clear agenda and/or clear idea of the value they can provide. It's ok that your default isn't to hit "accept", it's the meeting organizer's job to convince you that it's worth attending over other priorities.

gav

2 年前議論

As much as I agree that 98% of the conversation on Nextdoor is worthless, it was invaluable to me one day when a stray dog showed up on my doorstep and I had to track down their owner.

gav

2 年前議論

Recently I had to support a client who had a "no CVEs in a production deploy, ever" policy.

The stack included Linux, Java, Chromium, and MySQL. It took multiple person-years of playing whack-a-mole with dependencies to get it into production because we'd have to have conversations like:

  Client: there's a CVE in the this module 
  Us: that's not exploitable because it's behind a configuration option that we haven't enabled
  Client: somebody could turn it on
  Us: even if they somehow did and nobody noticed, they would have to stand up a server inside your VPC and connect to that
  Client: well what if they did that?
  Us: then they'd already have root and you are hosed 
  Client: but the CVE
  Us:

So I definitely appreciate any vendor that tries to minimize CVEs.

gav

2 年前議論

One interesting read on the topic of near misses and High-Reliability Organizations is the paper "Going Solid", which has a great summary here:

https://cohost.org/mononcqc/post/888958-paper-going-solid

gav

3 年前議論

The last time I ran into a similar thing I solved this race condition by not erroring out on an invalid lookup until a reasonable number of seconds to allow the backend to catch up.

gav

3 年前議論

I assume there's some point where they will start declining transactions and it could be some fixed number or some complex calculation based on all the data the bank has about my finances.

My point is that these examples are bad ones because they don't match the real world, which is messy and complex and inconsistent.

投稿

Arguments to make managers care about technical debt

AP’s Twitter Feed Hacked — Did Markets Just Panic?

Don’t get stuck: Continuous Deployment

USB device pretending to be a keyboard

You should always submit a cover letter

コメント