Mama told me not to come.

She said, that ain’t the way to have fun.

  • 26 Posts
  • 9.48K Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle

  • Wait, so saving a ton of money by using a language that reduces production bugs is now a bad thing?

    I’m a senior sw engineer, and I don’t get paid because I know the vagueries of whatever language we’re using, I get paid because I can lead a team that solves problems. I don’t really care what the language is, but I do care that it’s relatively easy to on-board someone in case we have turnover or something.

    I don’t know about you, but I’d rather be highly paid because I’m able to be really productive instead of highly paid because I’m literally the only shot the company has of fixing the bug.




  • The only reason most of these places that do that though, is because they wrote in COBOL to begin with decades ago, and didn’t want to switch away to something more modern as other languages gained functionality and popularity.

    And it would’ve been much cheaper to rewrite once some years ago than to keep paying people to maintain it.

    And in many cases, rewriting something improves the code substantially by finding bugs and fixing architectural issues. Old code doesn’t mean it’s correct, it’s just old, and just today we had a high severity bug from code that was never properly tested and sat unchanged since near the start of the project.








  • I guess I’m old school. For me, “zeros day” was always about the time the developer had before the exploit was in the wild. In the old days of physical media, there’d usually be a window between an exploit found on pre-release software that had already been shipped, and the dev could get a fix ready in that time (day 1 patch, like in video games). But if it was found on released software, they’d have zero days to patch it before people are impacted.

    The severity has always been a different thing entirely, which is based on:

    • type of exploit - privilege escalation vs code execution
    • ease of exploit - does it need another exploit to work?
    • whether it’s in the wild or theoretical

    A zero day could be any of those.

    We still call disk partitions disks, even though that’s not really accurate anymore. An NVME drive with a C, D and E partition

    I don’t? But then again, I’m a Linux guy, so lettered “partitions” aren’t a thing for me, there are drives (physical), partitions, and mount points (where on the FS does that data live). I haven’t used Windows in a significant way for over a decade.



  • BitWarden

    Yeah, the level of effort required is extremely low, and it’s really nice for things like sharing passwords with an SO for things where separate logins don’t work.

    So yeah, I use Bitwarden. I plan to self-host soon (vaultwarden), I’m just figuring out how password sharing works before I go and switch my SO’s stuff over. But it’s audited, FOSS, and generally the dev makes decent decisions (though I hate the new UX overhaul).

    I self-host a bunch of stuff too. I am transitioning from Nextcloud to OwnCloud Infinite Scale now that I posixfs is in experimental status (I only use file hosting from Nextcloud anyway). However, my password manager has been very far down the list for me, because the level of effort required exceeds the value I’d get from it, especially compared to other things I can set up.

    The hard thing to teach people is that, you don’t actually need to know those 50+ passwords, nor should you care what they are.

    Exactly. Use literally any password manager that uses MFA, and set up MFA (Google Authenticator works, I personally use Aegis). I also recommend BitWarden, but there are several decent options available.

    The most important thing for them to know is that passwords should be different between services, and you can and should automate that.