gav

The desired result is a 500 so it's possible to audit.

As much as this is a pain, the alternative can be more painful.

I used to have a client that would forward me an email from their security team every six weeks saying "we found a SQL injection issue with your site, can you look into this and confirm that it's fixed?" and I'd reply back saying "that not possible" and they'd go "ok, we've marked this as a false positive".

Eventually I got bored of having the same conversation over and over, so I asked them to show what they were finding. It turned out their scan would do the following:

  html1 = request("https://example.com/search?query=test")
  html2 = request("https://example.com/search?query=test' or 1=1--")
  if (html1 != html2) 
    sql_injection_vulnerable = true

Which of course is total nonsense, just because it returns different content doesn't mean anything.

This is a perfect use case for a WAF, I can stick one in front and then have it return 500s for all these requests and not worry about it any more.

In our case, we didn't have a WAF, but they had a obvious User-Agent, and it turns out that blocking all of their requests passed the scan too :)

It's more so that Cloudflare has a WAF product that checks a box for security and makes people who's job it is to care about boxes being checked happy.

For example, I worked with a client that had a test suite of about 7000 or so strings that should return a 500 error, including /etc/hosts and other ones such as:

  ../../apache/logs/error.log
  AND%20(SELECT%208203%20FROM%20(SELECT(SLEEP(5)))xGId)
  /../..//../..//../..//../winnt/system32/netstat.exe?-a

We "failed" and were not in compliance as you could make a request containing one of those strings--ignoring that neither Apache, SQL, or Windows were in use.

We ended up deploying a WAF to block all these requests, even though it didn't improve security in any meaningful way.

To paraphrase a previous employer's strategy: fixed fee projects are for ones you plan to do over and over where it makes sense to invest at getting good at them.

The first one you lose a bunch of money, the second you might break even if you are lucky, and the tenth onward you make a bunch of money.

Dijkstra was talking about Dartmouth Basic in 1975:

  - Variables: Single letter, optional digit.
  - Control flow: FOR loops, GOTO for others.
  - Subroutines: GOSUB line, RETURN.
  - Parameters: Passed via global variables.
  - Functions: 26 (FNA–FNZ), one line each.
  - IF statements: One line only.

When I had a blue collar job, my coworker used to divide jobs into "shower before work" and "shower after work".

It's perhaps less relevant now that a lot of people can roll out of bed and start their remote job in sweatpants, but it's stuck with me.

You need to treat any animal bite seriously.

I had to convince a coworker to go to the ER to have a cat bite looked at, and she ended up spending a couple of days in the ICU with the doctor being clear that delaying treatment another few days would have been fatal.

There's a risk for wooden ones that are glued, specifically bamboo, or finished with something toxic. You should probably stick to ones made from a single piece of hardwood and are unfinished.

There's also a risk that any cracks will fill with bacteria.

I imagine that it would be along the lines of:

If you are a service worker earning less than $44,725 (the Federal 12% bracket) your first $10,000 of tips are tax free.

This would mean that an income of $40,000 including $10,000 tips would owe roughly $1,748 Federal tax vs. $2,820 tax.

At some point there is a physical limitation, there's no passport in the world that accepts a 666-character name.

The US only gives you 21 characters on the DS-11 for a surname.

I make heavy use of Slack's Later feature as due to timezone differences the first half of my day is significantly busier than the second.

Asking people to move to email feels like a passive aggressive way to add enough friction to discourage question asking.

In a previous role I was responsible for developing architecture that supported a bunch of different teams, so I started being pulled into a lot of meetings as the easy option for them was asking me. I ended up having 6-8 hours of meetings a day on top of my actual workload.

My solution was to not accept meetings and have a PM go grab me if they really needed me, that was enough friction to allow me time to get work done. As in your case, this created a bunch of mystique as I was now that guy that showed up in the middle of a meeting, said a bunch of smart things (hopefully!) and then left.

One of the difference about the new Zoom-centric world is that it's zero effort to add an somebody to a meeting "just in case". I push my leads to decline meetings where there is no clear agenda and/or clear idea of the value they can provide. It's ok that your default isn't to hit "accept", it's the meeting organizer's job to convince you that it's worth attending over other priorities.