iloveponies

As a degreeless, high school drop out who works for a very large corporation that's not the case. In a time where many are screaming about shortages in skilled IT people, mandating a degree is only going to narrow the already small pool of possible candidates down even further for no explicable gain. Many job advertisements I've seen will say "degree or relative experience", the latter being the key part here.

I suspect mirror delay is less of an issue than you might perceive it to be. Many CPAN mirrors manage to stay within tens of seconds/no more than a minute from the main CPAN mirror that PAUSE publishes to.

Of course not. It's open source, nobody would do anything malicious right?

Also, I imagine the various regulation ISPs and hosting providers are obligated to inside the country - if customers can siphon off data that local officials disapprove of to another region easily, it puts Amazon in a difficult position.

On the flip side, Homakov personally has incredibly bad OPSEC practices which would make me think twice for using him. There's a correlation between what you pay and what you might get.

Yes, npm itself is the only reason why.

No, actual whistleblowers should be covering their own asses as much as possible with informed decisions and good opsec/infosec practices and not trusting anyone or anything else which includes the press. If a whistleblower's identity is exposed, it stands to reason media outlets have more to gain from the fallout.

Mandatory SSH keys mitigates the brute forcing risk, and turns it into a nuisance. My employer presently has this arrangement and has done so for a while. Bastions only get you in the door: different entrances for different environments, users keys are only propagated to the machines they need.

It's far simpler to remove the need for passwords alltogether or at least minimise them than to offset the liability against your employees using security software correctly.

2FA and VPNs are not exclusively the only way to secure things. X.509, bastion servers, airgaps that require physical access to a secure facility etc are also valid options, dependent on your systems and their configuration.

Bike shops already do this in some places. In the UK and Japan at time of purchase you can register your bike with the police and it's handled by the store themselves. Both countries use the serial number imprinted by the manufacturer.

If there is indeed a problem of a lack of registration at point of purchase in your area, have you considered bringing this up with the cops, the shops and the politicians?

The idea that code be "self-documenting" is naive at best. Action does not necessarily infer intention, and without explanation can lead to assumption. To reach the code we end up committing a process of thought should have occurred by those who wrote it. For some things such as "boilerplate" code this may not be seen as significant. For others of increased complexity like explaining interactions between two pieces of logic, performing a complex set of logic or the expected usage of an externally provided interface comments are in my opinion essential.

In contrast to what you've said I completely disagree with the notion that the "best code transcends the need for comments". I'd argue the best type of code has the most effective comments in line with code to ensure the next person can gain with the least amount of effort clear understanding of both the rationale and of the functionality that lead to what they see before them.