• 5 Posts
  • 26 Comments
Joined 1 year ago
cake
Cake day: June 4th, 2023

help-circle

  • A few jobs ago, everyone hated the tech stack. The people who had come up with it had long left. I talked to everyone, then came up with a plan to transition to a modern stack. Got buy-in from management.

    Half the people (and all who had said they hated the status quo) threatened to quit if we made the change.

    Fortunately, it was just in time to collect the 1-year retention bonus. Life’s too short. Walked away.





  • I have many friends who won’t get off Twitter becauee they follow journalists and subject-domain experts and are addicted to realtime, breaking news.

    If large news-gathering organizations mandate their news staff to have presence elsewhere, or provide tools to let them simultaneously post and engage in other places, that will go a long way toward breaking the bottleneck.













  • Most products should validate their assumptions before they even start laying down designs, code, or hardware. If it’s super cutting edge (like this one) there is a temptation to question the feedback and get into ‘build it and they will come’ mode.

    But most of the time, testing with real users and validating the revenue model is the prudent path. Hopium is not a currency.



  • The RP2040 solution was pretty clever. And that’s just for line sniffing. He can still add clock or crowbar glitching into the toolkit to work around more advanced defenses. This is something that car ECU hackers figured out a long time ago. There’s no software solution to work around that bit of nightmare. FWIW, ChipWhisperer can do all of these, including the synchronous sampling method used to fake a clock signal right out of the box.

    As the piece mentions, setting a PIN can help, but all it does is annoy the user (who will likely choose something obvious and easy to remember) and transfer the problem to a simple dictionary attack.

    The minute you put the security component in a separate module, you’ve opened yourself up to line-sniffing and MITM. And as soon as someone has physical access to a device, all bets are off.






  • Wife: I don’t remember my {service} password.

    Me: Did you put it in {password manager}? We have a family plan.

    Wife: groans I never remember it. What’s the password?

    Me: How would I know? It’s your password.

    Wife: ruffles through desk, picks up tattered handwritten note. Aha! Here’s the {service} password. Same as {30 other sites}.

    Me: slowly bangs head on table

    [ Repeat once a month]