• 1 Post
  • 32 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • Well "Device based" is even more broad, haha. If you're also including iOS and Android.

    Then you'd be looking at a cross-platform developing lanuage, like Flutter, React Native, Xamarin etc.

    So the question is, what is the goal for your GUI? Is this a personal project where you just want to have a GUI for a specific system? (Windows / iOS system) - Or something published that you want people to be able to use on all devices?


  • When you said "GUI Programming" What kind of GUI are you talking about? A web-based GUI or a desktop-based GUI?

    Web-based the go to framework is generally React or Angular.

    If you're talking about Desktop based, you probably want to stick with the language that you're also building the logic in. Like you could use another language like C# and write a front-end in Avalonia, but then you'd have to interlop from C# to Python.

    You could also pick a language that's supported by Electron, then you'd basically be doing Web-Development but for desktop.



  • About 4 ~ 12 a day, though roughly about 50 ~ 60 hours a week.

    A 4 hour day would be if I have some problem that I know has a good implementation, but I just can't figure out how to do it. Then it's better to just stop and do something unrelated.

    Though then once the problem is solved and all the puzzle pieces fall together - and I can just work on implementing it, and refactoring it into a good solution - I can continue working on it without caring about the time.

    But I don't have a lot of days where at the end of the day I'm like "Yess, I'm finally done working, now I can start doing something fun!" - The working itself is already fun, so that creates a different "Working vs Not Working/Having Fun" dynamic


  • 23 and Me are technically correct in that it’s customer behaviour that caused the issue.

    Maybe I don't really understand what happened, but it sounds like 2 different things happened:

    The hackers initially got access to around 14,000 accounts using previously compromised login credentials, but they then used a feature of 23andMe to gain access to almost half of the company’s user base, or about 7 million accounts

    14k accounts were compromised due to poor passwords and password re-use -

    And then they got access to 7 million accounts. Where did that 7 million account breach come from? Were those 7 million connections of the 14k or something? Because I don't think your connections can see many in-dept details


  • PaaS takes away your flexibility: [...] sometimes, you also want to use the compute to run cron jobs, run background jobs, or host a small service. With PaaS, you don’t have the flexibility to do so. [...]

    I don't really agree with that. I'm using AWS for that, and for my "small cron jobs" I simply create a lambda for them. Then you can create a CRON rule in Event Bridge and schedule the lambda to start whenever you need




  • He gave me one last tip. If I ever want to have a career in a management role, like CTO in the future, I must emphasize more on “taking credits” from the beginning of my career. He said being humble or modest is overrated and it would not do me any good for my career.

    I don't really know if any of this is true, or what the context is. Maybe this is how it is in American Corporate culture, but it's not really how I experienced it.

    If you're a beginner programmer, sure, you can brag about how cool your code is, and how much you've build. But if at some point you become a lead developer and you're still doing that, it seems kinda toxic.

    As lead developer in the standup or reports I'd usually downplay what I did - like instead of saying "I build this cool new feature" - present it as "The backend team build this cool new feature". If someone else build something cool, I would specific say something like "Bob build a really cool feature"

    I must emphasize more on “taking credits” from the beginning of my career. He said being humble or modest is overrated and it would not do me any good for my career.

    A good Team Lead or CTO needs a good team, and the team usually appreciates it a lot more if you're spreading the credits around instead of taking them for yourself.

    Besides that, a random developer in a big company is very unlikely to just become the CTO by not being humble. If you want to become a CTO, you either join a startup or start your own company







  • How do you stop this? (Sorry I only have paint on this machine)

    Show

    1. Computer/Network is compromised

    2. User requests public key from Server

    3. Hacker intercepts it, sends his own public key

    4. User tries to connect with "verification" servers

    5. Requests get redirected to compromised servers to OK the verification

    6. User sends request to Server via Hacker with Hacker PubKey

    7. Hacker decrypts it, re-signs it with Server PubKey

    8. Sends it to server, gets response

    9. Hacker decrypts server response, re-encrypts it with Hacker Private Key

    10. Users receives message, can decrypt it with Hacker PubKey, everything looks normal

    You're just substituting a local "Chain of Trust" with a server based trust system... Why would you trust that you can securely call the verification servers, and even if you can, why trust the verification servers?



  • Really I don’t understand why we are still using a chain of trust that is

    It would basically be mutually assured destruction if one of these trusted root certificates would hand out false certificates. If evidence comes to light that a Root Certificate Authority creates false certificates or can't be trusted somehow, they get delisted. For example, look up "TrustCor" - they were too closely tied to US intelligence that everyone (Mozilla, Microsoft, Google, Apple) removed them as trusted CAs

    a DNS record that hold the HASH of the public key of the certificate of the website !

    How are you getting that record safely, over the internet? There's DNS cache poisoning and other attack vectors on DNS related services that would still let you MITM https.

    Systems that rely on you to go on the internet to check if the internet is safe can just as well be compromised. How do you ensure the "internet based trust lookup" can be trusted?