« first day (3388 days earlier)      last day (1542 days later) » 

1:33 AM
@MarkR What does T do?
 
 
1 hour later…
2:53 AM
Generics.
 
3:15 AM
What is this generics thing and how do I get one?
 
You offer lots of encouragement to Nikita and possible bribes of money and/or alcohol
 
Let's do this thing!
 
If I had a million dollars to throw at it, i would have
 
Just ask Jeff Bezos for a small loan.
He can afford it.
 
He's too busy investing his money in a private army to invade saudi arabia after he got hacked
 
3:30 AM
Teaches him to open random video files on the Internet!
 
I was kidding of course, but would be nice to have so much money you could literally build your own army big enough to take out half the known world... literal fuck you money
 
I think a 12 figure networth, definitely qualifies as fuck you money.
 
Good morning
 
Although Saudi Aramco is worth 13 figures, so...
I guess they got him beat.
 
 
3 hours later…
6:36 AM
yesterday, by NikiC
And on Windows, it performs a dark ritual involving the sacrifice of a goat
And in UNIX if any processes still have the file open the file will remain in existence until the last file descriptor referring to it is closed.
So really, you could write to files that were already deleted in UNIX.
Just a useless piece of history
 
 
3 hours later…
9:43 AM
Mornings
 
10:19 AM
You all just have to provide feedaback on github.com/PHPGenerics/php-generics-rfc/issues/… and following post @Sherif
 
11:07 AM
Hi All, Having some issue Regarding POST API Created in PHP
Can any one help me out on it so I can explain it bit more
 
@Mayur No one can help you until you explain what you need help with
 
@Sherif thanks for responding actually suddenly from today all of my Apps POST APIs stopped working in iOS only
it works fine on Android even it works on POSTMAN
 
How is this a PHP issue?
 
I did checked & found some issue like this :
403 Forbidden - You don't have permission to access this resource.
 
iOS broke your PHP?
 
11:18 AM
So it indicates that something has gone wrong on server side that's effecting iOS API Calls
 
Does it?
Sounds more like something went wrong on the iOS side.
 
Because same APIs I have tried uploading to the Another AWS server currently & its working fine
 
That would support my thesis statement.
 
how is it possible that suddenly all live Apps API stops working & its iOS side fault
:)
 
How did the API stop working?
 
11:19 AM
I did checked my live apps in iOS API stopped working suddenly on all
Its giving error message
2 mins ago, by Mayur
I did checked & found some issue like this :
403 Forbidden - You don't have permission to access this resource.
 
That doesn't mean it stopped working.
It just means the request was not acceptable.
 
yes agree but something changed from server is sure
 
How did something change from the server "for sure"?
 
sorry I have not much idea about pHP & backend side
 
I get that. That's probably why I'm trying to point out your glaring logic problem.
 
11:21 AM
@Sherif actually I googled it & found all points relevant to backend side only
 
Did you now?
So why are you here?
You figured out the problem?
 
not figured out the issue
 
Good. So how about we do that?
 
I just got to know its not app side issue
 
How do you know that?
 
11:23 AM
because same APIs copied to other server worked fine
 
And how does that support the theory that it's not an issue with iOS?
If anything that supports the exact opposite hypothesis.
If X and Y and Z all work fine and W doesn't then chances are the issue is in W and not X, Y or Z.
No?
So why don't we try to figure out what went wrong by looking at the facts rather than just making random guesses based on mysteriously magical whimsy from the ether?
Start by gathering a HAR of the request sent from the iOS side that failed. Then we can actually have some facts to look at.
Until such time this conversation has reached an impasse.
 
11:55 AM
agreed
 
@cmb when the default, development and production value for the INI setting are the same you don't need to specify them correct?
 
Depends on what you mean by "default".
To PHP default means the hard-coded values that if no php.ini is present it will use those.
 
cmb
specify where?
 
In php.ini-(production|development)
See:
; Default Value: 1
; Development Value: 1
; Production Value: 1
; http://php.net/session.gc-probability
session.gc_probability = 1
No need to have them, right?
 
I wouldn't trust what php.ini says is "Default".
 
12:02 PM
I'm making a bug fix
Also it just means engine defaults
 
yea, the hard coded default values will load if nothing is provided in php.ini
They are technically already loaded, just overwritten later by php.ini
 
I know
I need to go about writing the patch for deprecating non explicit php short tag usage
 
-.⁻
 
cmb
I think all options are (can be) listed in php.ini-(development|production), but those matching defaults are (should be) commented out. All others are (should be?) also listed in the quick reference.
 
Morning!
 
12:16 PM
posted on January 24, 2020

Did you see it? Did you go? The Misremembered Tales of Dr. Lobster & Steve has officially launched. Get in early while the getting is good. For the foreseeable future, I’ll be posting a remastered comic every few days on that site. Go there. Go there now. There might be a newish comic in it for you. It’s been a busy week, but a good one. In addition to that launch, I FINALLY have my c

 
@cmb You know some people rely on forking the php.ini-(development|production) from master and packaging that. This might differ from defaults in older versions. So may not exactly be desirable to leave them commented out.
 
cmb
@Sherif ah, okay, makes sense
 
Well some of them are commented out
Some are not
 
Which is fine. I'm just suggesting don't change the existing behavior without documentation as some people are actually relying on it.
But then again, we don't even document php.ini-(development|production) so ... It's a tough call.
Some of the values set in those php.inis though are actually saner than what we hard-code into php.
short_open_tag, for example, is hard coded as "1", but in both inis it's "Off"
you comment that out, boom
 
I know that one way too well rofl
 
12:35 PM
Morning
Wonder if my head won't hurt today
 
 
1 hour later…
1:50 PM
You'll get that RFC passed... one day @Girgias :P
 
I mean the change to warn on non explicit usage should be alright
 
Any sane reason for keeping case insensitivity of function name in latest upgrades or future version(s)?
 
6 months ago I stockpiled food expecting riots and food shortages with Brexit... now I'm doing it again thinking that supermarkets and such will be closed down if we get a pandemic. I'm beginning to think I just like food too much.
 
I mean who doesn't lol
 
2:35 PM
@Tpojka "backwards compatibility" or something
 
 
2 hours later…
4:11 PM
Since I work with PHP I've never heard that someone uses advantage of function naming case insensitivity. Primarily reason why I ask [could be anticipated].
BC with PHP 3 if I'd be forced to answer.
 
4:50 PM
@Tpojka bring it up in the internals mailing list, I can almost guarantee you'll have at least one or two responses of "no!!! this feature is ABSOLUTELY VITAL to my code base!" and then to exaggerated effect "you'll be hurting thousands of programmers who rely on this!!"
Someone, can't remember who, brought up removing case insensitivity for constants, and there was a lot of complaining from two people, one more vocal than the other who used name-calling as part of his arguments
 
That's why I ask here. I'd like to hear responsible (for PHP development) people to list at least one reason why it is still there. For me, having it there is totally not intelligible. (I'd like to read what I am missing?)
 
Nevermind, misread
 
Upper case of constants are part of semantic readability.
Having functions name insensitivities just gain unneeded noise in frame of semantics. Nothing else.
 
Pretty sure it came up again here to merge the symbol tables
 
5:09 PM
^Above my knowledge, but thanks. I'll check symbol tables in general.
 
So IIRC there are two of them, meaning that the same name can be used for different things, and one of them is case insensitive probably
 
I am not sure I am following. Two things (values) can be dedicated to same name but sensitive type. Otherwise I am not sure.
Probably there is no living person that defines function with one string and calls it by different string. But it could be also just my boring Saturday's reconsideration.
 
You can have a constant and a function named the same way
 
5:25 PM
Still very big difference in parenthesis syntax and it is well known what is called. There, where function is called by name by language construct/definition is known it is place where function name is expected and not constant.

My point is just that function named myAwesomeFunction(){} shouldn't be allowed to be called with any other low/up cased name.
Also this (would be nice if worked):

https://3v4l.org/b5Olm

:D
 
@Tpojka what? You don't need to 'use' it
 
o.o Thank you. :/
 
const are scoped bound
 
Long time since wrote something outside class. OOP ftw.
 
 
3 hours later…
8:38 PM
@Trowski just found a reason why handling web sessions using postgres ROLEs wouldn't be a great idea. Any role on the database side is able to read the entire list of roles through the public view pg_roles, which means only part a SID could contain a password.
 
@Code4R7 Why would you ever expose your database roles to a web session? o.0
 
@Sherif I've been pondering about the possibility to use postgres roles for session management.
 
@Code4R7 Aren't postgres roles used for database access?
 
Yes, and so are session ID's for common web applications
 
o.0
What does a session ID have to do with your database?
I don't know about you, but I've never in my life allowed a web-facing session be directly tied with database access grants.
That's just ridiculous.
 
8:45 PM
I've been asking around why it would be a bad idea.
 
That's like a bank giving you a key to their vault when you ask for a key to the bathroom.
When does that ever make sense?
 
for normal PHP apps, one creates a session ID and returns it to the browser using a cookie. With that ID, the app can maintain state for an already logged in user.
But what if Postgres could do that: create a random number, that can temporarily be used to log in, just like with sessions?
The advantage should be that an application account, with all rights to the database, is no longer necessary
 
Maintaining state and granting database access are the difference between Mars and Pluto.
 
really? State is often already preserved in the database.
I already use postgres for autorisation, I'm exploring the possibility to rely on authentication (and sessions) as well..
currently, my app stores all the sessions in the database already. when a cookie is received, the session data is retrieved and the connection switches to the role of the logged in user.
It's all valid PHP, the code just implements SessionHandlerInterface
But could I skip my custom session table, having the same data stored in postgres ROLEs that inherit all rights from the logged in user?
Is that more safe, because I then can avoid using a global application account that has ALL access to a database?
Because ROLEs are not explicitly made for session management, there can be downsides, like the public view pg_roles. Are there more downsides?
 
9:05 PM
You have some pretty screwed up views of what is "safe".
 
9:21 PM
Good afternoon
 
9:43 PM
@Sherif apart from your opinion, do you have any arguments for me to work with?
 
I do like the idea of having a database-level audit trail based on the authenticated user which could be tied back to application-level users, but other than that the whole concept feels generally icky and hard to manage
I've seen SQL Server-based GUI apps that do it and it's ugly af
also iirc pg roles are only controlled via a config file on the server under /var somewhere, which means that you'd need direct write access to the file system of the database server in order to manipulate the user list, which really sounds like a not-great idea (although I might be wrong about some/all of those things)
as in which users can log in from where - it's a while since I touched pg, can't remember exactly how that works
1 hour ago, by Code4R7
The advantage should be that an application account, with all rights to the database, is no longer necessary
 
@DaveRandom Because postgresql keeps an audit of per-user transactions?
 
^ a better approach to that problem might be to have multiple "app accounts" with specific purposes and access profiles
 
Oh, finally, we're back to sanity.
Thank God. I thought I was in the twilight zone for a minute.
 
@Sherif I assume it logs the authenticated user in the query log, I mean
 
9:55 PM
A super user role can manage roles from within postgres. Also, database functions can be created with a security definer flag, which makes the functions run with the priviliges of the role that has created them. With that flag, a web application would not need a master account that, once hacked, has access to all the data at once.
 
@DaveRandom o.0 For every single query?
I doubt that.
 
yeh idk off the top of my head
 
@Code4R7 If they gained access to your database access grants already, you're too far gone to save.
 
it probably can but probably doesn't by default
transaction logs must have some sort of info like that though, so that you can't manipulate stuff by replaying a maliciously modified transaction log
maybe not
 
You're suggesting because you have MANY access grants that that somehow makes it impossible for someone to gain the elevated privileges. If they found a way to gain any privileges at all they're already too far into penetration for your theory to be valid.
 
9:58 PM
@Code4R7 the key (constructive) take-away thing that I think about the whole thing is chat.stackoverflow.com/transcript/message/48426152#48426152
I can sort of see where you're coming from with the idea, but gut reaction is that it doesn't feel sane
The basic concept of avoiding the use of god-mode db account for All The Things is good though
I must confess I've never designed an app like that but I think I will be doing so from now on
I've never designed a database layer I was happy with once in my entire life, everything feels crap in one way or another :-/
 
@DaveRandom Thanks for sharing your insights. You warned me about that is will be hard to manage. I think your right about that.
 
I also suspect that RDBMS user systems simply aren't built to deal with that sort of thing, they wouldn't scale
no actual evidence for that, just a gut feeling
I actually really like LDAP for user management, "directory" is generally closer to the real-world model than "table of users" which is what RDBMS always ends up as
 
Now I'll go think about this all, I'll get back to you :)
 
that will probably be unpopular though :-P
full disclosure: I work with AD a lot in general so will be biased there
 
If you're not using secrets management tools you're doing it wrong.
 
10:09 PM
Yes but too vague to be a useful generalisation, this stuff is always context-dependent
like, do you need SSO, what's the scope of the userbase, yada yada
Like I might build an app that authenticates directly against AD if it's for internal use in a company, but I'd never expose AD-driven SASL directly to the internet
equally there's no point in building some hideous complex OAuth-based thing for 30 users
(*usually)
 
tl;dr turns out security is hard :-P
 
Hey, this guy's onto something
I need that "Easy Button" for security. Where's that?
 
tbf we sort of built one, it's called X.509 client certs with password protected private keys, it's just no-one uses it
it's still not "easy" obv but it does solve a lot of problems if done right
 
The problem with that is you still need to distribute the private key.
 
10:22 PM
no, users can do that themselves
the problem is that they need to protect the private key adequately, which is a harder problem to solve for non-techies
+ not lose it etc
the infrastructure for it currently sucks, no argument there
 
I'm just talking strictly from a devops perspective something like vault is way saner than what most people are doing in production today to manage their secrets.
 
The core problem genuinely is that security is inherently hard/complex, and the average person not only doesn't understand that, but doesn't actually want to understand it
 
I assure, I've yet to work for a company big or small that's dealing with secrets in an ideal way. Most larger firms just tend to build more layers of security around it and harden the infrastructure, which is crude but highly effective.
 
@Sherif oh yeh sure, we use something called Dashlane at work which seems OK enough, I use 1password personally although considering ditching it because it's not feeling as smooth as it used to
I don't know enough about specific products to really have an opinion
 
Even multi-billion dollar companies I've worked for like Spotify, have these gray-areas of security they tend to manage in a responsive manner. Like their iOS app key, for example. It's obfuscated in the code. So it's possible to jailbreak the phone, disassemble the app, and gain the privileges from the app key. The way they deal with it is to just reissue a new key everytime someone does that.
 
10:27 PM
I tend to do what people like Troy Hunt tell me a lot of the time, there's only so much space in my head and he seems to know what he's talking about
 
You'd think a better solution would exist... It does not.
 
@Sherif well sort of, but broadly I think that might just be another manifestation of this:
4 mins ago, by DaveRandom
The core problem genuinely is that security is inherently hard/complex, and the average person not only doesn't understand that, but doesn't actually want to understand it
the problems are much more human than technical
you make something complex enough to be secure, and people will just prop the door open with a chair because they are lazy
 
It's a technical problem. It just has no simple technical solution. So instead you must rely on a social one.
You know how we mitigated DDoS attacks at tumblr?
Our inhouse council sued people in court.
That's not even a joke. That was the "solution".
 
who? isn't a key property of DDoS is that it's generally really hard to figure out whodunit? :-P
 
Technically, no.
You know who owns the ASN. You can contact the technical administrator. You can subpeana them.
It's not /that/ hard.
It's just... painful.
 
10:33 PM
Yeh but the first "D" implies that it could be literally every ASN on earth
if your botnet is big enough...
 
Yes, but they tend to be feathers of the same flock more often than not.
 
huh, I've never looked into a DDoS post-mortem in any detail (thankfully never been in a position to need to) but that does surprise me
 
All you have to do is prove who is controlling the bot net. You don't necessarily need to go after each individual one.
 
I have always assumed that bit would be very hard, at least if the people controlling it are vaguely competent
that latter assumption is probably often false ofc, but not always
 
It's much easier when you serve the NOC with a subpoena and get their records.
 
10:37 PM
Then you find out they're all just hacked machines
 
/lightbulbs/fridges/IoS devices
 
The courts don't care that the systems are compromised. They just need evidence of who comprised them. The point is to place legal burden on the person responsible.
Shockingly, Internet traffic is easily monitored and traceable.
 
Only if you're either A) the NSA or b) know to ahead of time
and even then
 
This is why companies like Google and Netflix make you sign an NDA when you place their utility in your IX.
They don't want you advertising how they route their traffic :)
@MarkR Tracing IP packets is easy. Opening them up and reading them is another matter entirely.
 
yeh but surely a botnet would be designed to make the command centres hard to identify, at least if I was designing it I would make it all peer-to-peer TOR-esque, basically designed to generate so much intercommunication traffic that finding the originator is basically impossible
 
10:41 PM
Tracing them to what?
 
The header information is not encrypted.
@MarkR For routing purposes
 
Do you find an IP that is part of a DDoS on you, get a court order for subscriber info, trace it back, only to find it's some 70 year old grandma who's router still has "password" as its default password
 
@DaveRandom Not really. IP packets have TO/FROM headers. You know for sure who sent what.
 
Who sent it is absolutely irrelevant for enforcement
 
It's relevant.
 
10:43 PM
@MarkR well it depends, if they are all recieving a packet from one originating IP shortly before the attack starts that's easy enough to find
but I'm pretty sure I could make that not be a thing pretty easily
(not that I'm going to, ftr)
 
I can't tell you exactly how the legal argument is presented in court, but I can tell you I have been required to testify in court in some of these cases and they do prosecute them effectively when the threat is significant enough.
 
It's all passive channels now for the most part. Monitoring random websites, pulling data from DNS records hosted by providers in the middle of china
 
would be an interesting academic project though
@MarkR right, that could work
and you can just hide it all in SOCKS5
(probably)
 
One of the last major ones was killed off when a researcher found the sequence of domains it was looking at, registered one ahead of time and sent a self destruct command to the botnet.... then the USA arrested him for hacking
Marcus Hutchins, also known online as MalwareTech, is a British computer security researcher known for temporarily stopping the WannaCry ransomware attack. He is employed by cybersecurity firm Kryptos Logic. Hutchins is from Ilfracombe, Devon, UK.In August 2017, Hutchins was arrested in Las Vegas (where he was attending the DEF CON conference) after being indicted on six hacking-related federal charges in the U.S. District Court for the Eastern District of Wisconsin. Prosecutors allege that Hutchins assisted in the creation and spread of a piece of banking malware known as Kronos in 2014 and 2015...
 
dunno if wannacry counts as a botnet (not sure they ever phoned home)
but yeh
 
10:46 PM
Just an example of a passive C&C channel
 
I think you're over-estimating the majority of the people involved in these types of attacks. They're mostly juvenile and rarely that sophisticated.
 
semi-relevant reminder btw:
Jan 20 at 9:24, by DaveRandom
Windows 7 is now officially EOL. You can still upgrade to Windows 10 for free, but that may not last for much longer. Do it now.
 
A DoS is more like a prank call in reality.
 
let's not have a repeat of the WinXP bullshit please
 
People serious about DDoS don't roll their own botnets for the most part, they pay others to do it for them using the proceeds from other electronic crimes
 
10:47 PM
There you go over-estimating the again.
 
Some idiot who's just spamming sockets from his own IP isn't the problem
 
Now are you just guessing or have you ever actually been involved in the court proceedings of some of these cases?
 
It's the professional criminals who just tried to blackmail you for 10 million dollars otherwise they're going to shut you down using 100,000 compromised routers they've spent years building up
 
... or it's just some bored kid that hates your company and wants to wreak havoc.
 
The bored kid isn't going to usually going to be doing the kind of damage that can take a large international service off the internet
 
10:49 PM
Believe it or not that was more often the case than the genius mastermind security expert you're talking about. Because that guy doesn't actually make noise when they come after you. That guy, you won't even see coming.
@MarkR And yet they did.
An 80Gbps DoS attack is pretty serious.
There's what you think should happen and then there's reality.
I'm just telling you what happened in reality. You may not like it, but it happens.
This isn't hollywood.
 
Isn't the baseline level of Cloudflare's DDoS protection something like 500 gbps?
 
Who said Cloudflare was involved?
 
Well if you don't take precautions against DoS then yes you can easily get hit. But that's a dumb argument :| Oh look, this thing I know existed but took absolutely no defences against caused me harm
 
There are no precautions against DoS. What most people fail to recognize is that when you're getting DoSed you're still using up the bandwidth even you're dropping the packets at the server level. Your router is still getting fried. You may not realize that when you're hiding behind a Cloud service or something like Cloudflare, but what do you do when you are Coudflare?
You may never have experienced that problem, but I have. That's why I'm telling you the solutions are not at all technical.
That is how we practically mitigated these issues. We had to take people to court and sue them and file restraining orders to get them to stop.
Welcome to the real world!
 
Well good luck tracking down any of the thousands of pay-as-you-ddos groups :-)
 
10:57 PM
Oh, I personally don't track them down. The company had an army of lawyers and security experts to do that bit.
But it's cute that you think you know so much about this problem you've never had to deal with before. This is the sad truth of life. We believe as engineers we have this amazing ability to solve any technical problem with our technical prowess. And yet, practically speaking, there are no real technical solutions to these problems.
 
Question, have you ever been involved in any teams that provide mitigation? I saw you worked at Spotify I think but didn't look deeper
Or maybe im thinking of someone else (ah no, it was on your profile)
 
I did work at Spotify. Not sure what kind of mitigation you're talking about though.
 
The kind of mitigation that companies like cloudflare charge for :-)
 
That's very broad. Spotify is a huge company. I've never been directly involved in disaster situations while I was there. I did have some insight into their SRE operations, however.
Spotify is one of those companies that's actually not interested in building their own infrastructure. Unlike facebook, Google, and Apple, they tried it and realized it was hard. So they outsourced it to the cloud.
 
Why outsource it at all if, as you say, there are no technical solutions?
 
11:05 PM
Because the resources necessary to scale it are expensive.
There's this concept known as "Play where you're already winning so that you don't have to play where you aren't"
Meaning, do what you're good at. Get better at it. So that you don't have to compete where you suck.
Amazon has proven it is very good at building IaaS. Google is equally as good, though not as commercially successful. But Spotify wasn't.
In fact, they sucked it. Their data centers were about 35% less efficient and 50% more expensive than the average DC of its size.
 
Spotify doesn't need to run a million servers.
 
@MarkR And you know this because?
 
Because a) I'm not an idiot and b) Spotify's own reports said they had 12,000 servers in 2016 and 83x growth in server requirements is... unlikely
 
We're a long way from 2016.
Anyway, the number is not the primary factor. The decision is based on cost. If it costs you less to outsource a thing than it does to do it inhouse, you should probably outsource it.
 
Last I checked Spotify was actually moving to Kubernetes on Google Cloud
So my guess would be the number of dedicated serves they run is probably down to the hundreds
If even that
 
11:13 PM
I can't tell you specifics, but I can tell you that number is definitely wrong.
 
Which number?
 
Your estimation of how many instances they run on GCP.
 
I didn't say how many instances they run, I said the number of dedicated servers. My guess would be very few, and everything else is auto-provisioned scale-out
 
Not sure what you mean by dedicated servers, exactly. Spotify runs infrastructure in GCP, AWS, and a few private colos these days.
The colo usage is low. They shut down all of their Data Centers about a year ago.
But their GCP usage is definitely very high.
 
But the point of GKE is not to care about the machines.
Was my point
 
11:16 PM
They care. In some cases.
For example, there is an AI cluster that isn't elastic by nature. It needs to run at a specific capacity.
In terms of web, sure it's all autoscaled.
But some things are not of that luxury.
 
But is it provisioned to specific nodes always-on or is it provisioned to whatever is available that meets the node requirements?
 
None of this is to say their footprint is anything to sneeze at.
 
I have been quite impressed at GKE's ability to scale up. Flip a switch, one kubectl command and a minute later 100+ extra nodes are online
 
@MarkR Some of those services are fixed, yes. Because their capacity planning is not so variable and usually remains fairly consistent.
For example, the Discover Weekly cluster doesn't change much over time.
There's a reason why it takes an entire week to compute that data ;)
Also, just FYI, Kubernetes is a fairly recent thing at Spotify.
When I was there they had actually rolled their own inhouse solution. They invented Kubernetes before there was Kubernetes.
 
I know, it was one of GClouds flagship projects so there's a fair few case studies / videos about it
 
11:21 PM
But then again they were also running bare metal when I was there so totally different ballpark.
 
Evening cmb o/
 
Well, you can always pay an insane amount of money for Anthos :-D
Too much for my needs
 
I mean, the amount of money some of these tech companies will throw around at their compute needs is pretty alarming, in my experience.
I've seen companies that paid millions for a custom MySQL sharded cluster (about 80TB)
Pretty scary.
So I guess percona sets their price tag based on how many zeros there are in your networth.
 
In my experience, it's not paying for the cluster itself, it's paying for the support, and the (tens of) thousands of hours of validation.
 
11:30 PM
Of course. It was on prem managed.
But still.. It was ridiculous in my opinion.
But what do I know... I just work here
 
What was your role if you don't mind me asking?
I was assuming something networking related if you've been in court
 
@MarkR I was a software engineer on the team that built the internal tooling for content and safety at tumblr, at that time.
We were the ones that dealt with things like spam, porn, and illegal content on the site as well as a number other security issues.
 
... but Tumblr was 90% porn
 
Yes, but not all porn is legal.
:)
 
Fair point
 
11:43 PM
Child porn, for example...
They partnered with MS, facebook, and twitter in a lot of that. MS, for exampled, licensed their Imagine DNA technology to tumblr to help combat child porn and facebook supplied a lot of the learning data sets.
 
The training set for that certainly isn't something you'd want to take home to work on over the weekend
I seem to remember one set being lost a couple of years back
 
@MarkR It was very tightly controlled. In fact, the server that housed it was literally bolted down to the data center floor and chained with several biometric security devices around the cage.
The only team in the company that had access to it was our team,
 
I'm not at all surprised. Airgapped I assume?
 

« first day (3388 days earlier)      last day (1542 days later) »