Hacker Newsnew | past | comments | ask | show | jobs | submit | hn_99's commentslogin

Wow, that's really accurate. At my last job, I didn't think anything was wrong but I fantasized about leaving almost every day. When I actually left, I realized how burned out I actually was.


This discussion made me curious, how is the cause of their poverty and lack of opportunity relevant? There are hundreds of millions of underprivileged people in India, why should those from a lower caste be given precedence over others, even if there is a history of oppression behind their poverty?


So there's basically three views on social welfare. The far right doesn't want it to exist at all, or if it must exist it should be funneled towards the already powerful, because nobody deserves it. The left says that we need to distribute social welfare in order to equalize society, because everyone deserves a good life. The liberals, in between the two, view welfare as a means to make up for societal failures or outright wrongs. It's not about the fact that these people are needy, it's about the fact that they're needy and it's our fault.

Race/caste/etc based welfare distribution comes from that last model.


You’re presuming Anglo political dynamics and cleavages onto a completely foreign culture here. The Indian right wing I wouldn’t characterize as “anti-welfare” at all.


But that is exactly what exists. You could be born in a “lower caste” but a wealthy family, you’d have a preferential treatment over someone who is poor but is born in a “higher caste”.


I moved from windows to Mac when I switched jobs a few months ago. The biggest thing I miss is the ability to have a separate Taskbar entry for each window of a program. I have many windows of the same IDE open at once and I'd like to be able to switch between them quickly. Is something like this possible in Mac, maybe through a FOSS app?


command + ` (native) is the bind to swap through same-app-windows


>I've been struggling a lot with an online course from MIT but at least I'm enjoying learning a lot of stuff as I'm employed now.

MIT OCW is absolutely amazing, I've learned a lot from there as well.


Absolutely. They were the pioneers in open sourcing so much knowledge. I'm doing a course on EDX from MIT and there are deadlines for homework assignments. It's quite hard. But one can learn the concepts from the OCW course if they're not interested in a certificate.


I had the exact same experience, although I was older (9th/10th grade). I'd go so far as to say I might not be a programmer if it wasn't for my experience of tweaking the hell out of my jailbroken iPod touch.


And a comparable reduction in stress as well


Interesting. As someone who hasn't done any mobile dev at all, is there a way to prevent something like this from happening? Can't you somehow encrypt such secrets in the app?


You can try, but you won't succeed against a dedicated reverse engineer, simply dropping a hook in on the API calls would be enough to grab the decrypted key in a case like that, if not simply statically reading the encryption keys and decrypting it. That's not to say it's useless - some reversers will simply move on to the next app when there's a list of dozens.

You can also send requests via your own server, which would allow you more control over the requests that get sent out to your 3rd party APIs and just restrict tokens as much as possible to the minimal set of features necessary for your application.


What about secure key import on Android? It's still not that widely available, but should be everywhere in a few years. The idea is:

-a keypair is generated in secure hardware

- you send the public key to a server which encrypts the secret key with it

- the server sends the encrypted key back

- then it goes inside the secure hardware where it gets decrypted

The decrypted secret key is never in the userspace.


Mobile developers can implement certificate pinning to prevent man in the middle snooping. Twitter's app does this.


That achieves nothing against someone who uses something like apktool/baksmali to do static RE, let alone inject something like Frida to perform dynamic RE. There are even Xposed modules designed to just bypass certificate pinning.

Certificate pinning is a good security measure, but not a counter-RE one.


Certificate pinning is neither a good security measure nor a good obfuscation one.


I hope you did not just assume that general purpose computing and device ownership can be subverted by mere certificate pinning.

If it's executing on my device, you can be sure I can poke it and see what it's doing.


Frontend is in the hand of enemy. There is no secret on the client side.


You could proxy requests over a server you control. This might just shift your problem, depending on the use case.


Rate-limiting works really well in most cases, though CGNATs makes that a horror nowadays too.


I believe solutions like SafetyNet on Android might help here. AFAIK no one has successfully reversed SafetyNet enough to spoof it.


Please don't legitimize SafetyNet. It is an existential threat to real ownership of your phone as any flavor of Android but that blessed by Google trips SafetyNet. It's the equivalent of barring people from running software on their laptop because they've installed a flavor of Windows that wasn't shipped from the factory. People everywhere have a right to do with their phone what they want to.


I agree with all your points, but what's the reasonable alternative? There is a reason that apps have decided to go with SafetyNet as a requirement. It dramatically reduces abuse.


Unless an API you're looking at requires/supports attestation via SafetyNet or you're willing to proxy via your own server this is likely not an option.

Additionally, while it's true (to my knowledge) that re-implementing a full safteynet spoof is not currently publicly available, a combination of Frida and MagiskHide is able to bypass SafetyNet for dynamic RE purposes, just launch the app as normal with MagiskHide enabled then attach to it with Frida as root. If they enforce full hardware attestation this may change in the future, but right now we're good.


I don't know of any such mandate in GS, was it for a specific division or group of teams? The company culture supports moving internally, but I never heard of anything like a mandate in my very recent stint there.


Circa 2014 they started a program where Analysts temporarily work on teams that did not hire them, following their three-month orientation. Based on the parent comment, it sounds as if it was taken even further. I was in the Tech Division before it was rebranded as Engineering and merged with SecDiv / Core Strats by Eli Wiesel et al.


I'm very curious about this, why doesn't it work? I can understand it may be hard for smaller companies to add an entirely new location since it would change team dynamics. But for large corps already having teams across regions, why wouldn't the concentration shift heavily towards lower cost regions?


This is pretty much exactly how my experience was. I did the leetcode monthly challenge for about 4 months and did pretty well on my interviews. I got a job but I still had some more interviews scheduled. I stopped practicing after that for about two weeks and the interviews were much worse.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: