pyjug

you can just update the webhook URL

Fair enough, but often consumers that use multiple vendors receive webhooks in the same service; think about going from /v1/webhooks -> /v2/webhooks, they'd have to change the URL for every vendor. Easier to redirect first then update the URLs later. I think it's a reasonable expectation that a HTTP client would honor redirects as long as the usage isn't malicious (like loops etc)

Disallowing redirects altogether is probably too big of a hammer. There are legit reasons to use redirects (like migration to new versions). A limit to the number of redirects seems ideal -- that's what Twilio does, for example.

Domains that resolve to private IPs: attacker could set up foo.com which resolves to a private IP

There's a clever extension to this attack; a naive way to mitigate it is to do a DNS resolution first to verify it's not a private IP and then do the actual request. An attacker can simply return a public IP on the first DNS resolution (with a 0 TTY) and then return a private IP on the second. This is called a "TOCTOU" (time-of-check time-of-use) vulnerability. I've written about this and other security best practices on my blog here - https://www.ameyalokare.com/technology/webhooks/2021/05/03/s...

I've also built an egress proxy that prevents such attacks here - https://github.com/juggernaut/webhook-sentry

Same caveat applies, use at your own risk :-)

In this architecture, the authorization service was properly validating user authorization to packages based on data passed in request URL paths. However, the service that performs underlying updates to the registry data determined which package to publish based on the contents of the uploaded package file

I have a similar story . At my old job, we had a web socket gateway that authenticated using JWTs , then hit an internal service to request REST resources. The issue was that it didn’t actually validate the requested REST resource URL; a malicious user could authenticate as themselves but request a resource for any other account.

I found it as I was getting up to speed on the code base, having recently switched teams. Funnily enough, nobody on the team really understood the vulnerability - the EM marked it low priority and wanted the team to work on other things. I had to essentially go directly to the security team and convince them it was a sev 1. I sometimes wonder if it’s easier to just report security issues as an outsider through the bug bounty program; internal reports don’t seem to get taken as seriously.

The FAANG have a lot more leverage over their employees than people seem to think.

Very few if any outside of these companies pay a mid level engineer 700k (yes, this number is real, can we please stop debating this fact?). So, if all FAANG force their companies back to the office, the employees have effectively no leverage.

This is similar to how the top cos colluded to keep engineer wages low in the 2000s, except they don’t need to explicitly make such a pact.

I'm not really making contortions

I would politely disagree — in any case the thread is there for all to judge.

If you sincerely believe that this is a product that should exist and will positively impact everyone involved, I can only hope you’re right [0]. In the end it’s all up to your conscience, but I do wish our leaders in tech were a bit more sensitive to seeing the broader picture.

[0]: pour one out for all the naive devs that will no doubt sink 100s of hours to be on the leaderboard for little benefit to them.

You didn’t address whether engineers at Netflix would put up with this.

I'm pretty sure that is what they are going for here with the global leaderboard

Sorry, I’m confused. This seems like a change in your position? Earlier you argued the intent is for employees to be able to showcase their skill to recruiters… you also responded to someone else who said they already have recruiter attention with “you are not their intended audience”

paid her full time salary just to compete on Deepracer

Wait, are you seriously comparing a global competition in cutting edge tech to squashing bugs … in your own codebase? Come on.. there’s no comparison. If anything, a company would be semi embarrassed that they have so many bugs in their pre existing codebase.

I’m asking you in good faith. Why the contortions to defend such a product? I see from your profile that you are an investor and advisor. I would seriously try pushing this product to your companies and see how they react. If they do adopt it, run an anonymous survey of the devs .. then I would love to see you argue with a straight face that it “benefits developers”

The structure already exists. It’s called your bug tracker. By building tools to gamify this process, it’s clearly incentivizing devs to put in more hours. I have no doubt that the global leaderboard will consist of devs that would’ve clocked 100s of hours above their regular hours. For very little benefit to the employee.

Let me put it you this way - would an engineer at Netflix ever “play this game” to win ? Would employees at Netflix even put up with something like this? If not, why would you think employees at random tech co should?

the employee overvalues their skill, thinking that showing up on the leaderboard is a shoo-in. Maybe the employer is right, maybe the employee is right,

Come on, this is just being coy — you and I both know this is a terrible deal for employees — as you write earlier, there’s a very low chance that a random dev will appear on the global leaderboard. What’s more, the best devs won’t even play this game, so it’s left for juniors and people trying to “prove themselves” to trample over each other for peanuts.

Not to single you out, but I wish influential tech folks like you would speak up more about the cynical exploitation that’s going on here in plain sight.

The risk to the company is pretty low that their employee would show up on a global leaderboard.

This invalidates your other point that it benefits developers. Why would a dev sink countless hours for a “very low” chance at being on the global leaderboard and hence moving jobs.

You can’t simultaneously posit it’s good for both companies and developers.

For a lot of people at a lot of companies, a trip to re:invent is a huge prize

Only for cheapo companies. Companies should (and do) _pay_ their devs to attend re:invent. I get your point though. For naive devs, it’s like getting to go to a concert. But it’s quite cynical for AWS to exploit this

The companies that put up the contest benefits

if you’re looking to make a job move,…

Why would companies allow their best developers to be poached? Unless of course there’s a way for companies to keep their developer scores private…

LOL. Developers are so gullible. It would be cute if it weren’t so tragic. They’re giving out t shirts and jackets for 10s of thousands of $ worth of work and we’re lapping it up. Vogels openly said it helps AWS customers reduce “costs”, he’s not even trying to hide it

It’s not surprising considering that employees and founders of ad funded companies hang out here. In this case, jedberg (correct me if I’m wrong) was an early employee at Reddit, which is almost entirely ad funded.

I’m not saying he’s being malicious - he probably genuinely believes he likes personalized ads. The “self” or “ego” is a very tricky thing. It can rationalize almost anything to maintain its world view. Everyone likes to think they’re doing good in the world. When faced with the fact that may not be the case, it’s natural to rationalize it away. It takes an extreme level of awareness to be objectively neutral whenever your “self” is involved.

Heh, so many valley people microdose openly. It's not a fireable offence. Also, that incident happened in 2019. Why fire him now?

The ad would simply display some of the information collected about the viewer which the advertising platform uses. Facebook was not into that idea.

Genius! But it’s unclear to me if the examples in the blog were actual ads shown to users before their account was blocked, or the campaign never got off the ground at all. If it’s the latter, the blog should make it clearer otherwise it makes it look like those were real ads

Sorry, I didn’t mean to come off condescending at all, it was a genuine question! At the end of the day, these are all just tools and people have their preferences. I try not to get too attached to any of them personally.

Also, if it wasn’t clear I was addressing programmers with experience in more than 1 language, not absolute beginners. If someone who is learning Go as their first language, I wholeheartedly endorse learning it! (Although Python would be better :-))

I sympathize with the general sentiment of your argument, which is what initially drew me towards Go (in addition to the hype).

For better or worse, Go is where all the energy is in terms of OSS, so I do hope I see the light some day, but for now, the dev x for me is pretty underwhelming compared to Java

Right, I wanted to have the “modern development experience” as much as possible. Most tutorials out there still recommend VSCode to get started with Go.

As an experienced Java programmer , I decided to do a project in Golang to see for myself what the hype was all about. And it was...underwhelming. The Go plugin for VScode barely works - terribly slow, inconsistent autocomplete, hanging during debugging etc. I had to pay for Goland just to get a reasonable experience which is still worse than Java+IntelliJ community edition.

Language wise - you need for loops for everything, no maps or streams. Also where are the concurrent collections in the stdlib?

I wonder if all the Go love here is from people who never worked in earnest with Java ? Or only worked with dynamic languages before?

Also, to caution folks who think India is only a place for "cheap devs", there is a perfect confluence of factors happening right now that is driving salaries up and incentivizing good engineers to stay back in India -- immigration restrictions, remote hiring and a domestic startup scene. Some startups who are building for the US/international market are all but Indian, they only have a US HQ for ops, sales etc.

This hasn't gone unnoticed by investors. See PG's recent tweet - https://twitter.com/paulg/status/1381669057548713984?s=20

The US runs the risk of being "China'ed" again, in a different field -- this is not outsourcing anymore, this is real competitive software products being built in India.

Indian tech salaries are very bi-modal. I'm not talking about body shops here - I'm talking about capable engineers who can get hired in SV, though not necessarily at FAANG. Think tier 2/3 cos. These engineers know their worth and want to maximize their earning potential. If it were easy to immigrate to the US they would choose SV in a heartbeat, but are looking for alternatives. My advice to them it's either SV or stay back in India, it's certainly not worth immigrating to Germany (I don't know about other EU countries, only have first hand experience in Germany)

The salaries in Germany for engineers are astoundingly low. Good engineers from India (I'm Indian working in SV) often ask me if it's worth migrating to Germany since US immigration is so hard.

The answer is absolutely not -- you can easily make 70k USD in India as a decent mid-level engineer which is the same as Germany. And you get to live like a king in your own country, don't have to learn German, put up with racism etc. In fact, a lot of US companies hiring in India pay more in India than Germany! I know a couple friends making ~200k in Amazon India at 8-10 years of experience.

Fair enough, good for you. I'm not sure if you're a Googler, but nevertheless, my point was that this luxury isn't afforded to the vast majority of people in tech. I highly doubt it's even afforded to the majority of Google engineers either (based on my acquaintances), but that is beside the point. Somehow whenever you mention Google in any context, a bunch of people come forward to defend Google culture -- so, my mistake that I sort of pulled Google into it.

Sorry if I wasn't clear - GP's thesis was that white men are overrepresented in senior positions _because_ they can more easily "fight back" and "be open" than others. In other words, they still believe in meritocracy, it's just that white men are afforded the chance to be more meritorious.

I'm disputing that thesis based on my experience. You don't need to be vulnerable or "be open" at all - you just need to be part of the in-group. I know "Senior Director of Engineering" who had no clue what the hell was going on. They never spoke up in meetings, or did anything useful at all - it was clear to everyone they added no value whatsoever. Turns out they were just floating from startup to startup moving up in seniority in the process. Presumably, nobody bothered to question them during the interview process as it was assumed they were "competent" based on their background and past positions.

I just never made a separate “work self”, and it’s been a deliberate decision

This is amazing self-awareness. I wish I had it earlier in my career.

And in my opinion is why white men are so overrepresented in senior levels of companies: the psychological safety is there for them in the rest of their lives

This is interesting, but I don't entirely agree. I have seen both sides as an Indian male who has worked both in India (privilege) and SV (no privilege). It's not a matter of "fighting back" or "being open", it's just in-group mechanics at work. There is a tacit understanding among people in positions of power about who is the "in-group" that doesn't need to be expressed or acknowledged even. For example, in India, even as a junior engineer I would be invited to important meetings whereas more experienced female engineers wouldn't. If I'd simply shown up and done the bare minimum, I would have quickly risen up the ranks, IMO. I had the exact opposite experience in SV, being seen as the "out-group" of the "worker bee" class by default.

psychologically safe in a world with climate change, cancer, random attacks of violence, earthquakes, etc?

Obviously, "total" in this context means in the workplace. Also, psychological safety essentially means "ability to express yourself and make mistakes without the fear of negative consequences" - it has nothing to do with shielding yourself from cancer, climate change etc. Ironically, the Buddha, who was quoted in the OP grew up with "total psychological safety" as you defined it, and you know where that led him.

just like it's possible to have a reasonable level of physical safety while driving a car

Again, this is not a comparable analogy at all. If you're unable to in no uncertain terms say "this project is going to hurt users" out of fear of getting fired/looking like not a team player, that is not even a "reasonable level" of psychological safety.

All of them

Really? Why are y'all working on FLoC then? :-)

employee forgetting the nature of the relationship in the heat of the moment

Curious to learn others' experiences, but I've never seen this in my career, ever. I've seen _peers_ yell at each other, but never seen an employee slip "out of character" with their superiors, at least publicly. And if it isn't happening publicly, there's no psychological safety, is there?

Most people (including myself) have been conditioned to bring their "work self" to work, not their "true self". As such, there's very little chance of "forgetting the nature of the relationship" even in heated moments.

Sometimes I feel like a lot of managers don't live in reality. Sure, psychological safety as a concept is nice to talk about, but how can an employee be totally psychologically safe in an employer-employee relationship?

How many line engineers at Google let alone a random tech company can question a VP/director's pet project? Heck, how many middle managers can? Psychological safety should mean you should be able to call BS and be okay with others calling your BS (in a non-inflammatory way), but in reality it means stroking others' egos, especially of those in leadership.

It is easy to see the faults of others, but difficult to see one’s own. — Buddha, Dhammapada

Indeed, like all of Buddha's teachings, it also applies to the author of course.