• 2 Posts
  • 23 Comments
Joined 1 year ago
cake
Cake day: March 27th, 2024

help-circle











  • Generally, no. On some cases where I’m extending the code or compiling it for some special case that I have, I will read the code. For example, I modified a web project to use LDAP instead of a local user file. In that case, I had to read the code to understand it. In cases where I’m recompiling the code, my pipeline will run some basic vulnerability scans automatically.

    I would not consider either of these a comprehensive audit, but it’s something.

    Additionally, on any of my server deployments, I have firewall rules which would catch “calls to home”. I’ve seen a few apps calling home, getting blocked but no adverse effects. The only one I can remember is Traefik, which I flipped a config value to not do that.


  • This smells a little funny, as others have suggested. I read an article a while ago that suggested that we’re not running out of raw materials; we’re thinking about the problem wrong:

    Chachra proposes that we could – we must – treat material as scarce, and that one way to do this is to recognize that energy is not. We can trade energy for material, opting for more energy intensive manufacturing processes that make materials easier to recover when the good reaches its end of life. We can also opt for energy intensive material recovery processes. If we put our focus on designing objects that decompose gracefully back into the material stream, we can build the energy infrastructure to make energy truly abundant and truly clean.

    This is all outlined in the book How Infrastructure Works from Deb Chachra.





  • I’d take those last 5 bullets. I’ve worked hard to gain salary only to find that it didn’t matter. Every review I’ve ever had was a lie. If I was given a good raise, I was told that it was my hard work. If it was a bad raise, they found one item to give me ‘satisfactory’. A bunch of us shared our salaries over drinks one evening and we all were about the same. That was a big surprise to me.

    Back to the point of the original article, employees talking is bad for employers. Unionization is one way to solve the collective agreement problem, but there are others. When employees (or any group for that matter) organize, they can make things happen.


  • I hear this argument against unionization all the time:

    During those days the only thing a tech union would do would make your life balance better, but at the cost of your salary.

    It feels like fear mongering when there are no data to back it up (this is not a knock against your post, it’s a complaint against the argument against unionization). I only know one person in a union and they have limited anecdotal data that shows that the cost of being in a union is offset by salary gains.



  • I was hacked years ago. I was hosting a test instance of a phpbb for a local club. Work blocked SSH, so I opened up telnet. They either got in from telnet or a php flaw and installed password sniffers and replaced some tools (ps, top) with tools that would hide the sniffer service they installed.

    After that, I changed my model. My time lab is for learning and having fun. I’m going to make mistakes and leave something exposed or vulnerable and hackers are going to get in. Under this new model, I need to be able to restore the system easily after a breach. I have a local backup and a remote backup and I have build scripts (ansible) so that I can restore the system if I need to. I’ve had to do this twice. Once from my own mistake and one from hardware failure.