michaelw
Joined 16 years ago
Joined 16 years ago
It appears that Veriff's data retention is set by their customers (in this case Porkbun). Porkbun's policy says that this information is deleted as soon as they have verified that you "pass." They aren't quite as explicit as saying that they require Veriff to delete it that quickly.
Unfortunately there's a giant loophole in Veriff's policies (emphasis mine):
(5) Fifth, we store Personal Data only for as long as the retention of data is required by law, a contract *or is necessary for the provision or development of our Services or required for protecting us against legal claims.* At the end of the retention period, we shall permanently erase the Personal Data or anonymize it.The OS was so clean but it lacked a lot of basic tooling. Back then there was no GUI or even a graphics library. We had to build or port a lot of things, including a VCS, from scratch. My editor of choice was JOVE (I couldn't get Emacs to build). I remember digging up various papers on graphics and creating our first graphics library.
That said, I would love to see more organizations implement private staging repositories for their upstream package supply. This is where they can and should apply policies to protect their applications.
Developing a single multi-protocol or even multiple open source caching proxies will cost real time and money. I'd love to see more solutions here but at this stage it will take more than a few volunteers and a "PRs welcome" in the README.
Malware scanning, AI slopsquatting, and typosquatting are just a few of the things that package managers do today. Implementing emerging standards like Trusted Publishing ( https://repos.openssf.org/trusted-publishers-for-all-package... ), the Principles for Package Repository Security ( https://repos.openssf.org/principles-for-package-repository-... ), and improved infrastructure hardening will all important.
The key insight is that these are services that require development and operations budgets that scale with their usage.
The root-cause problem is that package managers are funded like charities when they should be operating like non-profits. Their costs scale with usage but their donation-based revenue is dwindling. This problem has been partially masked by generous infrastructure donations but the operational costs are not just network and compute. There's a lot of security engineering development and ops in running a package manager service.
There are three major types of risk in software supply chain:
- Correctness. Does the source have flaws (or backdoors) that allow it to be exploited.
- Integrity. Was it tampered with from source to binary (typically to inject intentional flaws or backdoors)
- Availability. Is it available for use in a build.
This last one is often ignored. It's less sensational and "nothing ever goes away from the Internet, right? Right???"There are all kinds of nasty examples of dependencies going away. The two big patterns are:
- Infrastructure availability. That's this case and yes, CDNs are a nasty point of failure. Wanna guess how many package managers depend on a single CDN?
- Intentional delisting. This has happened often enough over the past few years. When the package maintainer throws their toys out of the pram and either removes the package from public access or effectively zeros it out. This can happen to the source too (hello colors.js)
The ideal is to have your build process be hermetic, not just from when you kick off the build but over a longer period of time. At the very least have an artifact management solution that you control as a caching proxy.I'd like to see the major cloud providers caching all the major package repos inside their networks.
I'd also like to see multiple CDNs for every major package ecosystem.
I highly recommend reading https://slsa.dev
1) If you don't have an amazing idea now, leaving won't make it easier. If anything it will be worse since you won't be constantly exposed to real-life problems.
2) Building great product is about a lot more than ideas. It's about execution, timing, scaling and a ton of luck.
3) After only two years at Google you're probably an L3 or L4 engineer. You have much to learn. Seriously. It probably took you a year to become productive so you've only scratched the surface. Go find a senior mentor and get them to talk about their journey. You'll be surprised.
4) Startups are hard. Don't believe the hype. Your startup will fail you. Even if the startup succeeds, you personally are unlikely to hit a payday. Remember the Golden Rule: Those who have the gold make the rules. The most likely outcome from any startup is that it fails. The second most likely outcome is that it fizzles and gets bought. Your equity would turn into a diluted options over 4 years.
5) In another 3 years at Google you'll save so much money that you'll have an entirely different set of financial options
6) Your long term career impact and financial success will actually be better off if you find a way to apply your ideas and passions within Google.
7) You are currently surrounded by some of the smartest software people in the world working on some of the hardest problems.
8) Look for a transfer to one of Google's SE Asian offices. Lots of interesting projects there.
To be blunt, it sounds like you're finding out that working as a software engineer is, well, work. It is. That doesn't mean you can't find your passion in what you do.
Buy yourself your own computer and work on your dreams at home while receiving the engineering and execution experience of your lifetime. Actively seek to learn more about your craft from a company that is still writing the book on this. Take advantage of internal instruction opportunities to expand your skillset (where else will you get paid to learn about ML from some of the best). Once you've earned your stripes at Google you'll be able to work anywhere on a just about anything. You'll also find that you actually understand the realities of product development and software engineering in ways you do not today.
I started working at Microsoft in the late 80s. I'm now at Google as a PM. I've done a bunch of startups and consulting along the way. My career has spanned over 30 years and there's no doubt in my mind that it was the time at Microsoft that gave me experience, skills and opportunities I would never have had elsewhere.
If your heart is set on the romance of startups, go find it. You'll learn a lot there too. Just don't do it because you're bored of work.
PM me if you want an extended version of this with Google insider specifics.