jurassic

Github has lost trust. This wasn’t an isolated incident.

There's currently no way to have a private issue queue associated with a public project. This is exactly the sort of structural problem with the product that I'm talking about. They make it very easy to do dangerous things and very hard, if not impossible, to work securely.

Even if you didn't have an agent work off public issues, there's nothing stopping a malicious user from dropping a comment on your pull request. If an auto-fix agent read that comment and incorrectly took action on it, you're hosed. That's exactly the story we saw today with Snowflake.

Today everyone's talking about the availability problems, but GitHub has a much bigger problem which is that its way of modeling work is not aligned with how people need to work with agents. I think the social value of GitHub has always been really overblown, and now it's actually an Achilles heel.

Now that we know prompt injection is such a massive risk, it seems insane to allow members of the public to leave comments on issues and pull requests that your agents may see. Which means the way that open source interacts with the public needs to fundamentally change away from the open GitHub model and towards a model of trusted contribution only. Feedback from the public has to come through carefully monitored channels that we can be sure our agents are not gonna pick up and run with. Public comment has to be kept totally segregated from our trusted work queue, which is how many people treat GitHub issues. We just simply can't have people, including malicious actors, able to drop a comment any and everywhere they want. I'm honestly astonished that GitHub hasn't even taken the most basic step of allowing you to create a read-only public repository with no commenting functionality.

X’s revenue is down by 2/3 from the acquisition peak. That’s all you need to know about whether the decline was real or not.

Sorry you are having a rough search. I was part of a large layoff so I know plenty of people who’ve been through it recently, some more than once if they went into another company that then had layoffs. I’d say the average search in my circle for those actively looking was about 3-4 months, with people who were very junior taking perhaps double that. I got some rejections that shocked and upset me at the time, but now that time has passed I’m glad I’m not in those roles because I found something later I liked much better.

For myself, referrals were a huge part of getting a job somewhat quickly. As more people are looking, the slush pile of resumes gets bigger which causes employers to feel they can be more picky. So if you’re relying on a cold application turning into an interview, that will definitely have a very low success rate.

I know only one person who didn’t get a job for an entire year, one of the smartest people I worked with at my last job, but to be honest it seemed like they were having some mental health / mid-life crisis things going on and not actually applying much if at all. I don’t know you and your situation, and I’m not saying this is the only explanation for a long and fruitless search, but if you think you might be like this person then I’d encourage you to reach out to someone who knows you and get the support you need. Marinating in negative thoughts won’t get you anywhere. This stuff has to be addressed because attitude, emotional state, and overall vibes can bleed into the entire interview performance and undermine what is otherwise a solid showing.

I hope something good comes your way soon.

A small percent of tech workers struggling to get a job doesn’t change the overall picture that most people working in tech are living relatively prosperous and comfortable lives. We are paid at a level that means we don’t feel stressed at the grocery store figuring out how to feed our kids or wonder how will we get to work when our cars break down. And as a bonus, we get to sit comfortably in air-conditioned rooms and spend a good chunk of our day thinking about things we actually take some enjoyment from.

None of this is true for the “underclass” mentioned above who have little to look forward to each day; the labor they provide is in various amounts boring/tedious/demeaning/physical, and doesn’t pay enough to give them the middle class lifestyle they feel entitled to (e.g. home ownership, healthcare, etc).

I and many people I know have gone through job searches over the last 18 months. Yes, it was more work than we’ve come to expect over the last 10 years. But ultimately everyone I know has landed on their feet. As an industry we are still incredibly privileged compared to most.

Not as I understand it. When I've seen this discussed, a "logout requirement" has usually meant some stakeholder thinks they need a way to prevent previously issued access tokens from being used even though the tokens are signed by the trusted authorization server and not expired (i.e. still valid). This requirement asks that you find a way to instantly shut off access even though the auth server has previously issued access tokens that should entitle the bearer to perform actions against protected resources until the token expires.

Blocking refresh in the authorization server is trivial, but trying to implement the same on access tokens in the resource server at the point of use breaks the entire security model of JWT. It's unreliable, because now every resource server has to take on partial responsibility for authorization which multiplies opportunities for mistakes. As the OP points out, you need to keep track of some sort of block list and lose out on many of the benefits of JWT (i.e. a resource server being able to rely fully on claims in a signed token before allowing an action).

When people show up with this kind of requirement, in my experience, it is often because they foolishly configured a client with a very long expiration on access tokens (e.g. ~months/years instead of ~minutes/hours). This creates a problem when some aspect of a user's access needs to change (e.g. disgruntled employee was fired, customer didn't pay their bill, etc). You can address this more easily by pairing a short access token lifetime with a long refresh token lifetime.

The more confidently people make blanket pronouncements, the less you should believe them. There are a lot of use cases for OAuth2 and OIDC that are not covered by “just use a web session”.

The real thing to push back on is the logout requirement. Everyone pretends they need this, when what almost everyone should do is just mandate appropriately short token lifetimes and revoke refresh tokens as needed.

I don't think this specifically is a great example of "being mean", but in the broader ecosystem it's definitely a problem that can wear down maintainers over time. I think it boils down to a widespread sense of entitlement from users of free software. It's amazing the demanding and disrespectful things people will say when the project you've shared with them, for free, doesn't meet their exact needs or preferences.

If something is provided free of charge and it's not working for you, there are constructive ways to engage and help nudge a project in a beneficial direction. But if you're not up to doing that, just move on.

It’s basically impossible to rent a place worth living in Boston without paying a broker fee. Even the listings you find yourself on craigslist won’t rent to you unless you pony up the fee.

When I rented a place in Cambridge in 2019, the rent was $3200/month. To get the lease signed I had to write a check for 4x that amount (first+last+security deposit+broker fee). $12,800 before even dealing with any moving costs.

The worst thing about it is that it increases the cost of moving very significantly. So people are coerced into accepting large rent increases as long as the increase is less than forking out another broker fee to move to a cheaper apartment.

Could be, I'm not really old enough to remember how linear TV dealt with new television series. Perhaps it is mainly a problem of perception. When you turn on the hotel TV and see a Law & Order rerun playing for the umpeenth time you aren't really thinking about all the other shows that never got beyond a pilot because they couldn't outperform a juggernaut like Law & Order and earn a slot in the schedule.

The way Netflix seems to drive every season into a cliffhanger ending and then cancel seems pretty short-sighted though. If they just let stories be a little more self-contained, then these one-season shows (dare I say "miniseries"?) would accumulate into a catalog of stories that are actually worth a damn for the audiences that find them later. Every piece of content in the library that they don't have to pay to license can earn back an ROI from a niche audience over a much longer period of time since they don't have to optimize the limited number of hours in the schedule like linear TV.

I think there is an emotional difference also that plays a role here. With traditional TV, people I think were maybe more accustomed to the idea of "you get what you get". Don't like what's on? You can change the channel, but you can't pick out exactly what you want, so you have to get used to settling for "good enough". So you leave Law & Order playing in the background even if, really, police procedurals aren't something that inspire passion in you. But with streaming, there is the illusion of infinite choice. The magic of it is getting exactly what you want exactly when you want it, and the magic fizzles the moment the thing you like and very much want to continue watching gets unceremoniously cancelled. It feels like having a choice taken away.

I don't follow it closely enough to know. I would assume because the child actors were aging out of their roles.

> a graveyard of prematurely canceled originals

This is the crux of the issue for me. I lost interest in even trying new Netflix shows because they developed a reputation for cancelling lots of good, not great, shows with loyal followings because they weren't pulling in blockbuster viewership numbers on the level of Stranger Things. This spray and pray strategy is fundamentally disrespectful to the audience.

I hear what you’re saying, but I think maybe we just have different standards for what counts as acceptable quality.

I find this difficult to believe; no matter how small your camera is, photography is about light. Art reproduction photography is surprisingly hard to do if you care about the quality of the end result. Unless you can surreptitiously smuggle in a studio lighting setup, tripod, and color checker card… sure you can take an image in secret, but not one that is a good representation of the real thing.