« first day (3702 days earlier)      last day (1238 days later) » 
02:00 - 20:0020:00 - 00:00

8:33 PM
@JBis yeah Republicans are only small government when it fits their agenda, when it comes to putting people in jail for drugs, military spending or forcing women to have children, they are all about big government
 
yes, but its the same with dems. They are political parties not ideologies.
also @DaveS wanna see the latest project im working on? it's another copy, this time Jenkins.
 
yeah I don't disagree JBis
that's why I consider myself a moderate/centrist not a democrat/republican
liberal centrist
somewhere between progressives and libertarians
 
interesting, i've always considered you a progressive/ultra-liberal
 
nah I think we shouldn't have a deficit, gun rights should be protected within reason, military too big
those are all libertarian ideas more than progressive
Like I support not letting kids into public schools if they don't get approved vaccinations but not mandating vaccinations
 
@DaveS very interesting
 
8:41 PM
like, rules for the public good required to opt in to society, ok. Forcing you to opt into society, not ok
 
do you think that opinion is affected by your wife being a teacher (iirc)?
 
no
I was very pro education before I met her
this country does a shit job teaching critical thinking among other things and we don't fund it nearly well enough
ultimately leads to a less informed voter pool and work force which hurts every single thing
 
education is this country is very problematic, i agree
 
I think anti-trust regulations and rules have failed to be enforced and we're entering an age of international corporate rule. The system favors those in power too easily, so I support government regulations to protect the rights of the average citizen, things like increased minimum wage tied to cost of living, universal healthcare, abolish private prisons
but I believe strongly that capitalism has an important role to play in innovation and would never support a take over of the economy by the government in a communist sense
 
At least in NY (and I think other places), the issue was teachers were teaching inconsistently and it was hard to judge performance. So they implemented standardized testing, but then teachers just taught to the test and people could just memorize information. And they still can't fire shitty teachers due to tenure. And that just scratches the surface.
 
8:46 PM
I just thing the bar is shifted way too far towards the richest, most powerful people
depends on the state
the issue in Arizona is there aren't enough teachers to fill the jobs, the pay is such shit no one wants to work here as a teacher and they have people without a teaching degree/qualifications filling in as long term semi-permenant subs
class sizes are huge and there's no funding for electives / special interests
so it's the same standardized testing problem with no room for anything else but that
then they say, why pay these teachers more if they aren't doing a good job? and it's because they can't possibly do a good job if there aren't enough teachers to go around
the career needs to be more attractive
 
@DaveS but adding tenure and crazy benefits doesn't help anyone
 
yeah but I'm not pro tenure/crazy benefits
you don't get that in Arizona
 
Maybe more of a NY thing
 
I'm just pro living wage
 
I think teachers should make more than minimum wage
 
8:51 PM
My wife has a master's degree and 15 years of experience, she makes ~50k a year teaching high school seniors
 
but i hate the gimmicks used for payment
 
elementary school teachers with similar experience make like $36k/yr
 
@DaveS yeah i don't think that is right
 
so when I'm talking about education funding, remember I'm talking from an underfunded conservative state context
not crazy overpaid NY context
 
good point
@DaveS does your wife work a second job in the summer?
 
8:56 PM
no, she traditionally would travel back home but now that we have the kids, the type of job she would get when you factor in daycare costs is just not worth it
she has taught summer school once or twice
 
when she taught summer school what'd she make?
 
an extra few thousand
 
10k or less?
 
like 2k or something for a 6 week class
 
ok well thats stupid
 
8:58 PM
yup
 
So dave dates a teacher, nice catch
 
now is that because state/town doesn't have money? or they are spending it on something else?
 
Arizona has one of the lowest teacher salaries in the country
 
I can imagine parents picking up their kids and you go home with the teacher while looking back at pure envy of fathers
 
and it's because of a refusal to raise taxes and generate revenue to pay them
lol mw
 
9:01 PM
@JBis here in my country they tell nurses "no extra salary for you" while spending millions to make street signs 'more welcoming'
 
i'd wonder what it is as a percent of federal budget compared to other states
 
Our government donates millions to shady football clubs like Ajax and whatnot, guess what Ajax used that money to buy a new expensive player
shady football club is a pleonasm
 
@JBis when talking about education funding you typically want to look at spending per student
 
well i want to see out of what they "could" pay
 
it's not a federal budget
it's a state budget
 
9:04 PM
because if they aren't generating enough taxes then thats the underlying problem
yeah state, mispoke
 
here's education spending by gdp
 
interesting
well if you want to see how overpaid some of my teachers are take a look: seethroughny.net/payrolls/135064341
 
yeah NY spends an insane amount
 
my school district specifically
 
$15,746 per student across the state
 
9:09 PM
they are ridiculous
 
by GDP it's not terrible
I'd understand those salaries in Manhattan
 
NY is a rich state
 
by comparison arizona spent almost 1/4 of that per student
$4,077
 
yeah so what is arizona spending it on
 
9:12 PM
y'all get low gas prices tho :D
 
lol sure
 
@DaveS sorry im still on this, was she teaching every day for like 6 hours or what?
 
yoo
 
yeah it's an accelerated class so it's like a weeks worth of work a day
 
jeez thats terrible
 
Tim
9:15 PM
what up canada
 
speaking of which, if summer schools kids are generally consdiering to be the worst of the bunch and they can learn stuff that fast why can't they teach at that speed normally
 
not much nederbro!!
 
because you only have 1 class instead of 6
 
Just had my one-on-one meeting, with the new CIO at my company , my boss's boss, went really well
I like him, he's a solid dude, they made a good choice with him
How u doin netherlands?
 
another side note, i have no data to back this up but im convinced the idea of senior level and freshmen level classes are bullshit for the most part
i think anyone could take any class and succeed just as much as they would succeed taking it 3 years later (for the most part)
 
9:18 PM
barring pre-requisites I agree
 
@MwBakker lmfao
 
AZ has english 1-2, 3-4, 5-6 etc
but if you have the right pre-reqs you can take classes whenever
 
@Tim T!M
 
Yeah agreed with Dave
 
yeah fair enough
 
9:19 PM
as long as you had the pre-req or can at least prove that you have the knowledge to pass
that's how Universities do it
I got into classes without the pre reqs because I just proved I knew the pre req lol
 
yeah they do placement tests
 
up to the prof's discretion
 
yeah i skipped a pre req for compsci
and did terrible ironically
 
Yeah was gunna say, I actually did pretty poorly in those classes
 
I didn't have to take a single english class at ASU because I took the single english pre-req as dual enrollment my senior year
 
9:20 PM
lmao
 
but that was because i got into fights with the teacher constantly
 
that was so fucking nice
I hate writing english papers
 
he didn't know how to code well
and nor did i, it was java, but i knew more than him
 
actually no that's not true, Ididn't do poorly across the board, but I got into the database class without a pre-req in that fuckin' math logic language
and failed a few questions on exams that were about it
 
ouch yeah discrete mathmatics is really tough to fake your way through
 
9:21 PM
@DaveS oooh nice
Yeah is that the one with the symbols for unions and stuff?
 
I had to take it over again because I tried to do that
yeah that's the one
 
Like I knew the core fundamentals of what it was doing, but I didn't know the actual syntax of the language at all so it was a struuuuuggle
 
I was naturally good at math so a lot of classes I could ace if I half assed
 
teachers always seem to hate when a student knows more than them
 
but it's such a foreign thing you have to pay attention
 
9:22 PM
or more than they should
 
@DaveS yeah same here, especially once I hit grade 12
 
im pretty terrible in math
 
I felt math before that was self explanatory but boring and unnecessary
but once derivatives and integrals came into the picture I was hooked and just got it instantly
 
like relative to the general population im good but relative to people in STEM im trash
 
thankfully you don't need math at all in security...
 
9:23 PM
@JBis haha yeah that seemed to be the main difference between comp sci's and comp engineers at my school
 
(that was a lie)
 
@DaveS i mean for cryptography you do but i don't (and can't) really do that so it's ok
 
yeah you could probably do ok with administrative elements
but you'll need cryptography to research
 
i mean i can apply the crypto
i understand it enough for that. High level how it works and when to use it.
 
I wish math in school skipped the bullshit tbh, I don't really wanna learn how to fucking graph a curve and use the formula to determine shit about a parabola
 
9:25 PM
But i don't get the math behind it. e.g. hashing
I have no idea how the hash funcitons works but i know how to use them
 
yeah that's as much as you need to know to write a secure system
 
give me problems about how many watermelons to fit in a car
 
but if you want to specialize and find vulnerabilities you
probably want to learn some of that stuff
 
yeah i don't want to do that type of research
but i find it very impressive
there aren't many people who seem to do what i want to do
 
hmmm I wonder why
 
9:28 PM
security people usually fall into 1 of 3 cateogires: NSA shit, IT security shit, math crypto shit
 
which one do you wanna do
 
i have virtually no respect for IT security people lol, the other ones are pretty cool
but i don't want any of that
 
you're just going to make up a brand new category of security person?
but there's only 3
 
it exists, just smaller
applicaiton security
 
go work for veracode
 
9:30 PM
so i review your shit code and tell you where you fucked up security wise and then i come up with a solution
 
they're my application security person
 
gtg to meeting
cya o/
 
I wonder who you would work for doing that
when there are services that provide that, I imagine you'd work for the service provider
cya dude
 
yeah that position is too niche for my company
 
yeah same
 
9:32 PM
it's just part of our jobs
 
software dev is niche for my company though, I'm the only one
 
yeah I imagine you could find room for that, where all you do is review pull requests
at a larger company with teams of 10+
 
yeah
 
but then again I can't imagine that's entry level at all
 
sounds like a pretty replaceable job to me though
 
9:33 PM
usually a senior's responsibility to do that anyway
yeah security isn't the only thing you'd look for in a PR review
 
But maybe not, I feel like it's akin to an editor in a publishing house
 
he could maybe find a job doing audits for a security firm
 
but yeah if you're JUST security, seems unlike
Yeah definitely
or he'll try to recreate veracode and get about 10% of the way to doing that and give up
 
first he needs to do twitter
 
hahaha
honestly though with how much AI is progressing over the past decade, I wouldn't be surprised at all if that job is 100% replaced by AI
Since it's more of a rule-based decision making job rather than creative like software development at a core level is
with respects to Security at least
 
9:36 PM
yeah, security reviews aren't hard in a standardized stack
sanitize input, filter output, auth layer, IT rules
 
Yeah exactly
 
encryption at rest, encryption in transit
 
its actually hilarious how bad the security is in our applications
 
JBis just gonna run NPM audit and send emails
 
but that should be expected for apps made in 2004
lmao
I think it hits like a 3/9 on veracode or something
I can't remember what their grading system is, but it fails by not a small amount
thankfully they're all internal applications and hosted inside of a very secure portal
 
9:40 PM
yikes
yeah rules are relaxed quite a bit for internal stuff
 
yeah, I mean "external" "customers" aka dealerships use it, so it's a bit iffy, but again the portal they have to go through is extremely secure so it's not the worst thing
Also I've tried to improve that but it's hard to push through the beurocracy sometimes, I'm hoping this new CIO will improve that area
it's a brand new position lol
speaking of security
 
Tim
nice reddit steal
 
thanks bro
 
Tim
:D
 
huw u doin man
noice noice, I'm off for now, ciao fellas
 
 
1 hour later…
10:58 PM
@ballBreaker yes and no, but i'd rather work at a software development company like apple, google, micorosft or even smaller discord, shopify, spotify etc. who need dedicated security people. I could potentially work for a startup but most don't know the funds nor knowledge to hire a security person. But I suspect that will change very soon.
@DaveS yeah i mean you guys aren't doing super security difficult stuff. But then agains your entire industry (applicances aka fridges) has terrible security.
 
yeah that's mostly due to cheap chinese manufacturing
and otherwise cheap development
 
@DaveS lmao
I mean you can't just automate what I am going to do. At least not in the near future.
Honestly software development will be automated away faster then what I want to do.
it's not just running scanner software to check whether you santized inputs
thats just the basics and tbh falls more into penn testing
@DaveS @ballBreaker let me give you a better example. Let's say I came to you and said I want to build a new password manager. It's multi device, so I can login from any device and get all my passwords. Oh and if i forget my password I want to be able to reset it whenever. I also want to be able to share it with other people if I need to. And it'd be pretty cool if I could share it with someone without them knowing the actual password if its just for a one time thing.
Both of you could probably implement that, but the security would be dog shit. You likely have no idea how to implement that in a secure manner. I mean maybe you know to use HTTPS and to use prepared statment to prevent sql injection but you have no idea how to store those passwords.
am i wrong?
 
yes
4
 
11:41 PM
@JBis XD why did you assume they wouldn't be able to do that?
 
@Mehdi can't tell if this was a joke
fine Dave, how would you do it?
 
sorry, I came out of context, didn't realise you were joking ;D
 
How would I store the passwords? In practice I would use a database encrypted at rest, stored in a private network only accessible by my permissioned backend servers with the appropriate credentials
the server would use the auth layer to permission users and allow access to their passwords and their passwords only, the application would never store the passwords outside of application memory, no persistent storage
 
In what way would you encrypt them? What would be the key?
 
11:48 PM
@DaveS so I can't access them offline?
Lol so you are going to use one key for all password encryption?
 
then you could Bcrypt and salt them, then good luck for however gets their hands on them
 
@Mehdi it's a password manager you can't do that or no one could access their passwords
 
I'd let amazon do rotated key storage for me
 
i'm sorry again, I didn't read the context, just read store passwords XD
 
multiple keys wouldn't be more secure
 
11:49 PM
alright guys Cya
 
No dave
you shouldn't be able to access the passwords
and nor should amaxon
And nor should someone who has access to your database
 
then a user provided key would encrypt their password
 
well then I can't reset my password
as soon as I do all my passwords are lost
 
that's how all user provided keys work
 
i don't care, that's an application requirement
 
11:51 PM
if you lose your access key you're SOL
 
well that's terrible UX
 
then they would be accessible in some way to allow recovery
 
i forget my passwords on the daily that's why I use a password manager
@DaveS how?
 
by not using user provided keys
 
Ok but then you have access to the passwords
and you shouldn't
 
11:53 PM
ok so how do you have an application that can both return unencrypted passwords to you without having the key to them?
 
Wait you're asking me?
i don't have a job
Go ask the AI that automated me away
 
you either know something or you just posed a question without a known solution
 
I do have a solution. To many of the questions I posed. Maybe all If I thoughts about it. Here we go:
 
ok but why do you need to return unencrypted passwords?
that scares me, but i scare easy
 
out of nowhere @nebulae comes in with a good point
 
11:55 PM
Idk neb, I don't work in the password manager space, I wouldn't store need plain text passwords
but this is a password manager
 
nooo never ever
I dont know what you're talking about specifically and I'm too lazy to scroll up
 
he's talking about a password manager where the user can reset their passwords
 
they dont need to see them to reset them tho
 
We do almost everything client side.
 
so you have to encrypt the passwords not hash them so they can be viewed and you can't rely on a user provided key because if they lose it they can't reset it
 
11:57 PM
almost everything?
meaning some things aren't
 
you could add some user input as a seed to a recovery key but that's basically a user provided key
 
then I say put that responsibility on auth0
you can communicate with them completely client side
Im assuming you're talking web application?
 
yeah like 1 password
multiple device with user login
according to JBis's thought expirement
 
auth0 is pretty awesome, they have a great api
 
curious to see how he proposes letting the user recover their account when locked out without something unresettable and still not provide the server access
 
02:00 - 20:0020:00 - 00:00

« first day (3702 days earlier)      last day (1238 days later) »