dininski · HackerTrans

3 yıl öncediscuss

It's good to see an assumption I had, be validated. The assumption was that Linux would struggle to make a dent in the desktop market until it managed to make a tempting proposition for gamers. Projects like WINE tried, but there's just not enough you can do only with open-source contributors, with such a massive undertaking. I'm happy that a big company is finally backing this effort and with nvidia open-sourcing their gpu kernel modules, I'd say exciting times are up ahead :)

dininski

4 yıl öncediscuss

Unfortunately this is a quite common scenario in big enterprises, such as Amazon, Google and the lot. Main reason is the promotion process.

Usually you need to gather evidence that you've contributed significantly to a project. And the easiest way to do that is to work on new projects. Maintaining an existing codebase is usually a thankless job, which is also hard to get you promoted.

And once the new project is released it eventually gets abandoned and people move to the next one, which would help them get promoted. Think of all the Google projects that have been discontinued, which were also a product of similar processes.

dininski

4 yıl öncediscuss

Funnily enough Amazon has its own internal repo, including NPM. And it can be a pain in the ass to add anything to it, especially npm packages. So sometimes you would have to spend 5 minutes, or sometimes an hour, to import a single existing public NPM package into the internal repo.

dininski

4 yıl öncediscuss

Some people meet this with a healthy level of scepticism, which is great. However I used to work at Amazon, working on the performance evaluation and HR tools used within the company. It was a couple of years back, but I am fairly certain that the same tools are still used, given that all of them were developed from scratch. At the time it was in line with the company's PR of removing its toxic work culture.

It's worth mentioning that it wasn't uncommon for people to move around teams, and to be honest HR is not the most exciting field for software development anyways. So, as expected, the HR dev teams had people move around quite a bit. Nothing toxic so far.

One of the projects I worked on was what used to be called the dev list or personal improvement plan (pip) now renamed to Pivot. Most likely the exact same same tool. Management wanted to update the processes in order to automate as much as possible and reduce the risk of managers putting someone in pip, just because they didn't like them. However the process was set up in such a way that a manager can progress an employee through a pip for waaaay too long, until a failsafe, or a second pair of eyes even takes a look at it. I, personally, voiced my concerns about it, but it was shrugged off as "it shouldn't happen", "managers wouldn't do that" and "it's fine" by the project stakeholders.

The project starts, development is going a usual and a couple of years go by. I moved to another project within the HR space. Most of the team developing the tool has also moved on to greener pastures. Apart from that one guy, who has been there since its inception. He went from being a backend engineer, learning React and painstakingly working on a messy frontend codebase, eventually leaving him the only person competent enough to make changes to it. Eventually he was fed up and wanted to move to a different team. Lo and behold - his manager, the manager of the team building the pip tool, put him in pip to prevent him from moving. Haven't seen someone decide and actually leave a company as quickly as he did. So if the manager of the pip company can use it to blackmail people not to leave, I can't even imagine what it's like for the rest of the company.

dininski

5 yıl öncediscuss

For both there are shortcuts already available for a "command" input. For example in IntelliJ it's called "Actions" - you can use it to look up basically any command/functionality from there.

I've been using Idea essentially without a mouse for a few years now. It takes a little bit of time to get used to all the shortcuts, but it definitely pays of in the long run.

dininski

5 yıl öncediscuss

I'll try to answer this from a JS-specific perspective. As someone previously mentioned - you do get hash checks if you're using `npm ci` in your CI/CD setup. You get the resolution path as well. Which is all you need to reproducibly resolve dependencies, *if* you have set up npm correctly in your pipeline. It would be unlikely to be exposed to this particular attack, at least not automatically in your deployment pipelines.

However this is still very, very dangerous, because of day-to-day engineering, really. Any engineer doing a simple `npm install` can inadvertently bring in and execute malicious code from their machine. From there on out it would be somewhat trivial to gain further access to the same network the code war run from.

dininski

6 yıl öncediscuss

Also don't forget projects like Cloud9. It is literally a cloud-based IDE similar to what the author was talking about. I do agree with someone else's comment that this is lazy writing - even a little bit of research/google-fu would immediately point you to similar projects.

dininski

6 yıl öncediscuss

Early 2019 I went for an interview with Uber. Mind you it wasn't in Silicon Valley, but at a smaller office in Europe. Anyways, the interview process is very similar to other big tech companies - 5 interviews, 2 on coding, 2 on systems design and a manager one. I've done and I'm still doing phone screens and interviews for my current company, but the level of unprofessionalism in Uber still stays with me. Most of the interviews were okay, but I remember the last systems design one, where the interviewer walked in with a glass of Bailey's and was acting like he was owning the place. That really put me off. Don't get me wrong, I like a drink as much as the next guy, but there is a time and a place for that. Definitely not during an interview. When it came to offering me a job, they did send me a RSU package as well, with the promise that the stock was massively undervalued and will skyrocket once the IPO is out. Guess what - just as everyone expected the stock tanked. I'm so glad I didn't take the job. It just showed a culture of not-giving-a-fuck, laziness and false promises. And that's not even in the headquarters. I'm definitely not surprised about the different levels of misconduct going on there. I did report the Bailey's guy when they asked me for feedback, but I still regret not walking out as soon as the guy walked in. My point is - if that's how they handle interviews, I wouldn't even wanna know what the overall culture is and I'm glad I stayed away from it.

dininski

7 yıl öncediscuss

I have a funny piece of trivia for you. The name of the project struck me as a little weird. And given how labour intensive this would be it is kind of fitting tho. Oh - inat means spite/stubborn in Serbian.

dininski

7 yıl öncediscuss

I can't stress enough how much of a bad idea this is. I was stunned when a few days ago I was looking up something on Google Maps and started seeing advertised locations/suggestions.

Even though I love the product and have been a fan of Google products for the longest time, their current strategy of monetizing everything they can is very off putting. The direction Chrome is taking is also concerning.

Don't know what really is going on at Google at the higher levels, but from an outsider's perspective is seems like they are aggressively trying to grow even more. Maybe to raise stock price? But to invest in what? Maybe to compete with Apple and Amazon? I can't be the only one who thinks it all seems odd - going from "don't be evil" to shutting down a massive number of projects with a lot of potential (e.g. Inbox, Fiber)...

Don't mean to sound like a conspiracy theorist, but looking at the bigger picture, it looks like Google's strategy is going through some changes and I'm not convinced this would play out well for them in the end.

dininski

7 yıl öncediscuss

This clearly shows the different priorities for Google and Mozilla, amid the current feud.

Mozilla is advocating towards a free and open internet, where the web standards are not dictated by the monetization strategies du-jour. Meaning that ads and tracking are not inherent to the internet itself, but serve a more corporate interest.

This is where Google comes in. It feels more like they consider the internet more of a platform for business growth and are no longer that unbiased.

As an example - I wouldn't be surprised if at some point they start pushing for adding product metadata to the HTML spec, say a <product> tag. This would essentially change some of the semantics of the standard. Maybe a more generalized version of this: https://developers.google.com/search/docs/data-types/product

Just my 2¢.

dininski

7 yıl öncediscuss

I've worked from home (if that qualifies as remote) and was on a salary, paid directly to my back account with health, pension benefits, etc, handled by the company. Worked as a contractor for a couple of companies and have been paid using wire transfer and PayPal. My personal preference is wire transfer as it's much easier to handle taxes and usually has the least amount of fees and better exchange rates.

dininski

7 yıl öncediscuss

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m...). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even though a little dubious on the legal side of things, I believe it's great it was approached with transparency and a dose of humor.

Some might argue that this is harmful to matrix as a product and as a brand. But as long as there was no actual harm done and they react appropriately by taking infrastructure security seriously, it could play out well in the end for them. This whole ordeal could end up actually increase trust in the project, if they take swift steps to ensure that something like this does not happen again.

dininski

7 yıl öncediscuss

I partially agree with you. When I used to work at one of the big five, PMs for my team would regularly disregard the engineers' output on most matters (apart from occasionally letting us make purely technical decisions). This, of course, ultimately led to almost the entire team leaving, including me, and the rest transferring internally. It's not all the engineers' fault. One can push back as much as one wants, but it rarely changes anything at all. However the PMs' success is measured based on delivered features and projects. In most big enterprises the engineers are just worker bees, for the queen PM bee and if they don't perform or don't want to do something, they can be somewhat easily replaced with someone who will. And don't forget that a lot of the engineers might be on a working visa, for example. And why would they jeopardize their job and their way of life on moral grounds, instead of keeping their head down and just going through the motions. I'm not saying that I agree with them, but putting all engineers in the same basket seems unfair. Now that's why realistically it is much rarer for a group of engineers to take a stance than you'd think. This is why cases like the Google engineers who refused to work on military contracts got so much attention. As inspiring and empowering as it might seem, in reality it (almost) never happens.

comments