bss03

@bss03@infosec.pub
0 Post – 30 Comments
Joined 9 months ago

Vocabulary question X + shell + powder = bullet, what is X?

Because usually the threat is that X will be delivered through use of powder the destination of the shell is ambiguous but not included in the delivery.

When you deliver while (unfired) bullets it's generally not considered a threat.

New messages will show on all your devices, but yes, it is intentional that old messages are not available to new devices.

22 more...

Yeah, I ghosted at least one company because the pre-interview task was far too much effort. I'm all for having some writing of code as part of the process, though IME reading code is much more frequent/important.

I guess we all set our own limits, but I refuse to work more than an hour or two without (at least an expectation of) pay. Maybe that's privilege talking, tho.

1 more...

I think of the Carlin bit... It's the American Dream because you have to be asleep to believe in it.

Multiple hour-long interviews I'm actually fine with. It's not ideal, but in that case at least the company is also spending resources on the process.

Homework / pre-interview projects that take more than a hour is unreasonable, to me. I have public repositories / commits I can share with you if you want to see how I write code.

1 more...

IMO: When you do it for the entertainment/feeling/rush, it's gambling. When you do it for the returns, it is investing. I also think the other poster that mentioned investing as being interested in the success of the endeavor, that would exclude shorting and I think might be a useful distinction.

Casino games and sports betting all have lower expected value (probabilistic value) than their cost, so they are not something you can do for returns (you have better expected returns by not participating).

There are plenty of people that are misinformed, dishonest, or stuck finding a bigger fool that will sell you a gamble by calling it an investment, and expected value is not guaranteed value.

3 more...

In the U.S., laws that disadvantage specific entities are generally considered to not be following the "equal protection" part of the (amended) constitution.

Countries without (their own) laws prohibiting it can (and do) prohibit specific services.

Member states of the WTO (like the U.S.) have agreed to allow themselves to be sued for lost profits based on any (new) laws they pass.

But, I'm no expert -- this is just the view from my (potentially misinformed) corner of the world.

If you can find it https://www.imdb.com/title/tt1228865 is a good watch. It covers other methods, but it becomes clear how fast, effective, and painless nitrogen asphyxiation can be, as the presenter has to receive assistance in order not to die while attempting to get close to the experience (without dying).

It's also a bit sad, as it makes it clear that for at least some capital punishment advocates, suffering is a desired part of the outcome.

I'd like to avoid death, but I can foresee a potential future when my quality of life is negative and no amount of volunteer effort can bring it positive. If that happens, I'd like to opt-in to mortality via inert gas (probably nitrogen) asphyxiation.

If we must have capital punishment, inert gas asphyxiation seems to be the best known way to do it. I'm not convinced we must have capital punishment, tho.

4 more...

I primarily operate in strict standard compliance mode where I write against the shell specifications in the lastest Single Unix Specification and do not use a she-bang line since including one results in unspecified, implementation-defined behavior. Generally people seem to find this weird and annoying.

Sometimes I embrace using bash as a scripting language, and use one of the env-based she-bangs. In that case, I go whole-hog on bashisns. While I use zsh as my interactive shell, even I'm not mad enough to try to use it for scripts that need to run in more than one context (like other personal accounts/machines, even).

In ALL cases, use shellcheck and at least understand the diagnostics reported, even if you opt not to fix them. (I generally modify the script until I get a clean shellcheck run, but that can be quite involved... lists of files are pretty hard to deal with safely, actually.)

I "upgraded" to a new Pixel last year because I thought the battery on my old 4A was getting wonky (and I have not had good luck with doing battery replacements). At the time, I did not know (enough) about the Fairphone, and I could not find a new Pixel with an audio jack (maybe I didn't look hard enough?).

I'd like to go back to having a jack. I do have one scenario where I want to use well-fitting BT buds, but I can do that on any phone. I want wired buds that I don't have to charge, can switch between devices in 0.5 second, without interacting with any software, and don't have misbehaving touch controls that trigger when I brush my long hair back behind my ear(s) or shoulder(s). In fact, I still have a set of completely dumb buds that I use for my work laptop that I'd love to be able to use with my phone -- don't need noise cancelling or controls of any kind. I really hope that I can find a phone with a jack next time I do an upgrade. I don't care if it is thicker, I'm gonna stick on Otterbox (or similar) on it anyway.

I was also concerned about security, but full-power BT is fairly secure now. No one can "drive-by" and monitor or replace the audio; they have to get you during "initial" pairing.

An InstantPot (or other pressure cooker) can cut that time down quite a bit. I set mine on 40 minutes, but it takes a little while to get up to temp/pressure at the start and at least 15 minutes to slow/natural release the pressure at the end.

Still, dry beans to food in about an hour is great! Also much easier to control your sodium intake, it that's a concern.

The other suggestions are probably better, but you can technically self-host Wire (from Wire Gmbh) but I've never done it successfully.

Seriously tho, didn't one country determine that Subway sandwiches are served on pastry, not bread? I believe the legal definition (in that country) had to do with sugar content and Subway's was too high.

Late to the party. Idris had a bash backend (i.e. you could compile Idris to bash), and it's already bit rotted with new Idris versions.

I hope the language is at least as cool as Idris.

Expected return calculation https://en.wikipedia.org/wiki/Expected_return there are likely better "bets" you can make. On top of that, even if the expected return is good, you have to take into account the Kelly Criterion https://en.wikipedia.org/wiki/Kelly_criterion which limits how much of your bankroll you want to spend on a longshot, and if that's less than the cost of a single ticket, buying tickets is more likely to bankrupt you than for you to win.

https://quantwolf.com/doc/powerball/powerball.html

I build my own. Though I still need non-free software to run, I don't think it is from any DMCA enforcers.

System76 is not too bad if you want something mildly customizable but don't want to futz with doing assembly yourself. I get my laptops from them.

I've tried open phones (multiple) and I still use a Pixel. There is a choice, but I was willing to trade off my freedom for function there. I wish that wasn't the choice and when I can I support efforts to make it easier for people to choose freedom there.

So, yeah, there is often a choice. Doesn't make the status quo acceptable.

I believe it, but I came to the comments to check.

Web assembly ? It's not driven only by Google, but I think they have been involved.

When MS was pushing the Bing challenge with TV ads, it really was quite close. I did the challenge and Google "won" (only) 3/5 of my test searches.

Of course Bing already had a hilariously incorrect "AI" interfering with the first page of results for a week or two before Google decided to further fsck up their search with LLM response generation.

Cube theory clearly established that hot dogs are tacos. It's all based on the location of structural starches.

Theocratic confusion. Republicans worship Supply-Sidr Jesus. Christians model themselves after Jesus of Nazareth, Christ. The similar names are a source of confusion.

Also neither is related to Jesus that sells tamles at the farmer's market, tho I hear he is a pretty good guy.

The DJIA (e.g.) isn't "the house". It isn't something you are competing with in that your losses are its/their gain. You are misunderstanding both investing (in general and the stock market specifically) and gambling when you make that confusion/analogy.

Not beating the market but having positive returns is only "losing" when infinite exponential growth is the goal. Beating the market but having negative returns is not "winning".

The academy has been using the term "AI" for a while now for things that are much less sophisticated than the current/popular generation of media generators. I took an "Artificial Intelligence" class as part of my undergrad around the turn of the century.

It is confusing though, since sentience and intelligence are synonyms in the right context, but no AI has shown any good evidence of being a non-human sentient being.

I recommend having a public portfolio. You needn't have all your hobby code be public, but I think having source you've written available is an advantage.

When I was doing interviews, I definitely looked at GitHub (etc.) profiles of they were listed on the resume. I even found at least one indirectly -- either from their email or LinkedIn.

I like to point people at my accepted patched to open source software (Git and a Haskell library).

Just because you are wrong about your expected value calculations (or were right but the actual return was on the lower end of the range) and have made a bad investment doesn't change the fact that it was an investment because you were doing it for the returns.

In short, performance doesn't matter for this distinction, at least IMO.

1 more...

Love?

Same switch point for me, roughly, going from a Pixel 4 with jack to a Pixel 7 without.

There are situations where I prefer BT earbuds over wired buds, and I haven't tried the adapters, yet, but I still long for a audio jack: it's a lot quicker to switch my buds from work laptop to personal phone when they are wired.

I will look for a audio jack when buying my next phone... maybe someone will have figured a way to "hack" one into a Fairphone body?

I usually only have to deal with this feeling a few days at a time. I hope it gets better for you.

Great comment. I can't figure out which "one" you are talking about, because I find Facebook/Meta oppressive.

3 more...