• 63 Posts
  • 659 Comments
Joined 3 years ago
cake
Cake day: June 11th, 2023

help-circle






  • I don’t get what your bridge example is supposed to show, nor what normalizing substandard practice has to do with politics or lack thereof.

    Depending on where you look there’s plenty of shoddy construction work and cutting corners for cost, big projects are notorious for taking longer and costing more in the end. Construction had more time to develop and be regulated, and has more physical limitations compared to software development. Both, in the end, can be (theoretically) held accountable before court.

    is to be able to communicate this effectively with management

    Isn’t this politics? Why are you saying politics has no place in engineering principles?

    Software engineers are much more replaceable than construction engineers/architects, both in-discipline and with less expertise.

    I do my part in what I can influence and control, delivering good and sound products, but it’s obvious depending on individuality doesn’t work across our whole industry.

    /edit: The linked article talks about how in-company politics are necessary to coordinate and deliver features. I don’t see that addressed here either? How would you deliver - taking the example from the article - Latex in Markdown on GitHub without politics?




  • Six months ago, distributed crawling hit code.forgejo.org, and the mitigation measures put in place then held until a few weeks ago. The mitigation measures relied on JavaScript-based proof-of-work, but the crawling software learned to resolve the measures, allowing the attack to return.

    Since November 24, a new blocking strategy has been implemented and successfully blocked around one million unique IPs daily. Only 5,000 unique IP addresses reach code.forgejo.org daily, and no reports of legitimate traffic being blocked have been received.

    Crazy. A 1M to 5k ratio.

    The linked to ‘new strategy’ information is interesting too. They’re blocking a specific user agent.

    TL;DR: 26 November ~900,000 unique IPs sent requests to code.forgejo.org and blocking one user agent effectively blocks over 90% of them. At the moment ~50,000 unique IP hit code.forgejo.org per hour, ~5,000 of them are not using the suspicious user agent and are sent to Anubis, ~1,000 of them pass the challenge and reach code.forgejo.org.

    && Header(`user-agent`, `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36`)
    

  • The author provided no evidence of it

    They’re contextualizing and sourcing it plenty. It’s their impression from their experience, from their years of being in that field. In the later adding of comments at the end they go into different takes as well, reiterating that it’s what they saw or see in [their] big corp[s] [and those he talks to].

    You’re saying people are rotating too often - which was one of their points. Not sure if you meant support that point or point it out [assuming they didn’t].





  • IMO the intro “[shared] to the respective secret scanning partner” is a bit misleading because it can be read as third parties unrelated to the secret that do secret scanning. The text later on only mentions the issuer of secrets, though.

    To protect the developer community, GitHub partners with hundreds of secret scanning partners to identify leaked secrets.

    GitHub works directly with industry partners like AWS, OpenAI, and Stripe to build detectors for their specific secret formats […]
    GitHub notifies the secret issuer when publicly leaked secrets are found, allowing the partner to take immediate action.