stairlane

I think it was prorated but am not 100% sure.

I think in your case it’s reasonable. Also a $1.5M contract is likely chump change in that realm.

This particular case was in cybersecurity- specifically static analysis of assets, for the purpose of providing a SBOM.

These metrics tend to be bullshit in contracts.

For example we had a 6 9 (99.9999%) requirement from a customer for any given 3-6 month period. If we violated that, we owed them their money back (baring the outage wasn’t caused by us - I.e our cloud provider shit the bed).

That’s something like 7.5 seconds. For a contract over $1.5M. Am I the only one who thinks that’s outrageous expectations?

EDIT: The web app was for generating SBOMs of static assets.

I don't see this ending well.

My fiancé and I have been doing better than most Americans. No debt, relatively high pay - we're pretty happy right now.

But we feel like we are stuck.

Perhaps its the golden handcuffs, or maybe we're being over-dramatic. But I couldn't imagine having a kid (or kids), and $XXX,XXX debt with the uncertainty of my profession alone. Having been through a couple layoffs in my ~10 year career. Take into consideration the state of the world, and we have decision paralysis.

I want to be optimistic, but I'm having a tough time.

This might come across as over-dramatic, but this country is a factory that mass produces the most dangerous thing on the planet. A young, lonely, angry man that has nothing to lose - a man that sees only doom in the future. And they can buy an AR-15 when they hit 18 in most states for less than it costs to get your teeth cleaned. Plus ammo delivered to your door!

Anyways enjoy your Wednesday.

Absolutely, and well stated.

The point I was trying to make was the fact that nobody (meaning govt bodies) was willing to make another collider capable of repeating the results. At least not yet ;).

> The only cost is then the electricity and used capacity. Not consumer pricing. So negligible.

I don’t think this is valid, as this point seems to ignore the fact that the data center that this compute took place in required a massive investment.

A paper like this is more akin to HEPP research. Nobody has the capability to reproduce the higgs results outside of at the facility the research was conducted within (CERN).

I don’t think reproduction was a concern of the researchers.

How do you know?

Hopefully this also introduces standardized auditing of open sourced packages. Just because something is open sourced, doesn’t mean it’s altruistic and not susceptible to malicious actors submitting seemingly innocuous code that gives bad actors a back door.

The xz fiasco earlier this year should encourage every organization to conduct such audits. A code smell could and should be enough for packages to not be supported.

Not pip, but we ran into an older version of glibc that had real circular deps. Sorry I don’t remember off the top of my head which one.

We analyze firmware and binaries, amongst other things at my day job.

Reconstructing dependency graphs is a necessary part of our day to day.

Assuming dependency graphs cant have cycles has shot us in the foot. There are absolutely real circular dependencies in assets in the wild.

Thanks for sharing! Yes things like this would help solve our problems.

Oh my mistake, must have missed that.

Something I didn’t see listed was the lack of a package manager for protos.

For example if I want to import some common set of structs into my protos, there isn’t a standardized or wide spread way to do this. Historically I have had to resort to either copying the structs over or importing multiple protoc generated modules in my code (not in my protos).

If there was a ‘go get’ or ‘pip install’ equivalent for protos, that would be immensely useful; for me and my colleagues at least.

I struggle to see the authors point.

His last sentence:

> It could have worked, at least in theory, in a world where preserving API compatibility (in a broad sense) is much more common than it clearly is (or isn't) in this one.

Is he implying that using vendor packages is more clear that using version tags in a go.mod? That would certainly be the first I’ve ever heard of someone preferring dependency management via vendor packages over a go.mod & ‘go get’.

Personally I absolutely love the way go manages dependencies. I have way more confidence that my old go programs will run with minimal dependency related issues compared to programs written in something like python.

Pretty good DNS server if you don't want to get DDOSed easily.