Recent submissions

Comment · 5 days ago
Comment · 21 days ago
Not using the full names is a mitigation for talent poaching.

There are orgs that are moving to not including names at all as the next step on that trajectory.

Comment · 1 month ago
How does removing access to Clause equate to dehumanizing children?
Comment · 1 year ago
What does a 20 LLM signify?
Comment · 2 years ago
Perhaps the parent commenter was referring to the section in the report which stating the IOCs indicated that the attackers used the known third-party command and control system named Sliver. There are multiple public yara signatures for Sliver.
Comment · 2 years ago
It ruined the friendship.

I was uninformed on how stock grants worked and trusted their advice. They said "I'll take care of you."

They made millions from the venture. I was able to buy a motorcycle.

Comment · 2 years ago
Early in my career, I dealt with this garage.

Once, I reported the VP of engineering for instructing me to commit fraud. I got back "Just do what he says, he's got experience in these things.". Then they hired someone to take over my team.

Another time, I reported someone for sexual assault to HR. I shared the incident without names at first and HR told me "oh, that's awful. Who is it? They need to go.". When I shared the name, I got "oh. Well, they are too important to the company. I'll talk to them."

I put in my resignation shortly after that.

I won't work for people like that anymore.

Comment · 3 years ago
So... if you're referring to a challenge that did that during one of the DDTEK years of DEFCON-CTF, that was one of mine.

The expectation wasn't to buy time in an adjacent cloud, but to use out of order ip fragmentation or tcp segments, having the servers network stack reassemble the packets such that the read was coherent in one go.

My goal was to teach competitors to model real world challenges of exploitation.

Comment · 3 years ago
The dataset does not appear to discuss the lifecycle of Linux distributions taking the security patches from upstream, nor the update process for all of the downstream distributions.

Something that's been widely discussed elsewhere is how often security issues are silently fixed in Linus's repo and therefore not picked up by distributions for their stable/LTS releases.

I buy the immediacy of patches if you compile your own kernel from the latest kernel.org sources, not if you're relying on distributions.

Comment · 3 years ago
Microsoft has not implemented a monorepo.

However, it's not surprising when you consider the massive breadth of software that Microsoft builds, as one of the oldest and largest software development orgs.

Comment · 5 years ago
I've implemented each of these features using public apis, so... Probably?
Comment · 5 years ago
This brings back memories. I wore cargo shorts in college so I could carry my Libretto 70 to class.
Comment · 6 years ago
(disclaimer: I work for Microsoft, but entirely unrelated to the team that built this.)

The privacy ramifications are intense. As the youth is apt to say, "like woah".

That said, I would love to see a tool that gives work-day insight where the user entirely owns and controls the data.

I've found it helpful to have a summarized report on how much of my work day is spent in meetings and emails verses writing code. It helps me to have data, rather than a vague feeling as to how much time I'm spending on things and how I could optimize my time.

I have no desire for HR or my management to see that information and I fully see where others having that data is ripe for abuse, but for my own sake if I totally control the data, it's useful.

Comment · 6 years ago
How is that an unreasonable restriction for Google to ensure the work they pay for is usable in the company's products

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton