HolyLampshade

You have a hard unenviable job. No reason for me to make your day worse, and you were right to call me out. Sometimes we all need someone else to give us a little friendly reminder that this is not the time or place.

Thanks for all the work you put into making sure this place isn’t a cess pool.

That is a fair criticism. I’m letting my frustration with longer-term behaviors in social media influence my comments, and this is an inappropriate forum. I appreciate the correction.

They (folks who work at a place like binance) look at banks with contempt for that speed. And I don’t entirely disagree with them.

But you’re absolutely right, it’s hard to compromise something that moves at such an absolutely glacial pace.

Jamie Dimon does not have credentials to log into back office systems at JPMS. I’d be surprised if he even had access to execute wire/asset transfers via front-end tools.

Best a hacker could probably achieve is sending some sketchy emails or messages, but even there people are just going to confirm by verbally communicating with him.

Banks are actually the worst analogy for this sort of thing because there is a ridiculous amount of system federation and ultra-conservative system controls. It can take a month to get a simple route or firewall port opened on controlled networks (god I hate change committees).

Glad someone else noticed that.

I’m going to sound like an ass, but is this the sort of crap we’re going to see published in 10yr when all these crypto folk grow up a bit and start reflecting on their “glorious revolution”?

At least the Beanie Baby people realized it was ridiculous.

I guess the better comparison is dotcom folks, and they were pretty insufferable for quite a while

Hey now, that's for tomorrow when someone writes an article about LLM contribution to these security events.

I worked on a non-crypto, sensitive financial system two decades ago and similarly the end servers that ran the application stack were severely stripped down Linux instances with no shell, no interface to interact with outside of an application command channel, the hosts that could access that command channel were air gapped, and still the entire thing was wrapped in three layers of transaction auditing that were entirely disassociated from one another (different devs, different access, different source of data for auditing the same record).

I cannot look at how these companies are run with anything but derision. It’s institutional laziness, and it’s sloppy.

And the amount of process and control around a wire transfer is monstrous to reduce risk.

Watching crypto rediscover 100yr of financial regulation and system/process design has never not been amusing to me, esp as someone who works in an asset that has solved the custodianship problem (not that people in the industry aren’t actively attempting to light those safety rails on fire to make a few extra bucks).

I think what’s not being considered here is if the barrier for entry of a product is so ridiculously low that a single individual can kick off a few agents to build it then work the sales channels, the companies buying the products can just do the same thing.

The value in buying a product or service from someone else is access to expertise, an expectation of support, and on some level the distribution of legal and financial/time risk in developing a new product. If you can do it all with some LLM then especially that risk of building a bespoke product is all but obliterated.

Anecdotally I started to see this at my last gig where bizdev folks were writing their own tools and in some cases their own little micro products (things 15-20yr ago they would have had to purchase from a third party, or get internal dev to work on). Now, I certainly don’t want to deal with that sort of technical debt, but plenty of firms don’t feel the same way (clearly given how much layoffs have been impacting everyone on the SWE side).

The first paragraph of the article drove me insane for that reason. MNPI is one of the bedrocks For a stable market system. If you trust, on some level, that the people who are counterparty to your trade and not pulling one over on you you’re more likely to participate in the market. The more that trust degrades, the less likely people are to want to interact with the market. The fewer people, the worse prices/spreads get.

Efficient and tight markets are almost entirely predicated on being able to determine that any informational asymmetry is irrelevant over differing time horizons.

Oh boy do I have opinions (mostly in line with your’s), but I actually think there’s another factor of “Devs left to the own devices will still write software.” It’s a “problem solving” skill set with a very low ceiling for implementation. That problem solving ends up as more internally developed (or newly integrated third party) applications that end up in the operational critical path, that now also need to be supported.

It’s something like a cargo cult. We have this system because of course we need this system and it “insists upon itself”.

The further development is removed from the final “product” of the company the more this crap piles up.

So, I agree that in some instances it’s intentionally obfuscated, but there are others where the bloat simply cannot be calculated.

Completely agree. The analogy I’ve used is the difference between someone working at an oil change shop vs a mechanic on a Formula 1 team.

And that isn’t meant to denigrate the oil change person. There are millions of that person to every one person working for an F1 team, and it’s important work. But, obviously very different things.

I think it is more likely SWE thought they were not replaceable where any function in a company is replaceable with enough motivation (whether wise or not).

The other issue I’ve been mulling over is two part. What in the hell have all these SWEs been actually doing? (As in, what software were the vast majority contributing to?) By extension, were many of these projects critical to the bottom line?

I guess what I’m getting at is if you can have a robot do a sloppy job of what you were doing before, and have that still be ok for the organization, maybe what you were doing in the first place wasn’t critical.

I’m not saying it’s not short sighted (I think many orgs are subjugating themselves to external entities, and are going to be violently bit in the ass when suddenly no one left in the firm has any comprehension of how all of their systems work), but, and I don’t say this lightly, maybe the SWE “profession” has a bit of bloat it can afford to shed?

I look forward to the LLM equivalent of lmgtfy in its original form.

I know I’m bordering on repetitive and strongly negative, but the combination of the two barriers you mentioned has all but halted all of my interaction with agents.

Even ones that cannot be easily dismissed (like the agent at the top of Google search) are often subtly wrong in a way that requires significantly more effort on my end to parse the loquacious output to determine where the inconsistencies are.

Look, can they be useful to generate the html or jscript for humanity’s 9 billionth iteration of a web form? Sure. But man, I wish sanity had reigned and people had applied ML models in general to more substantive and beneficial projects.

(Before anyone chimes in, I’m familiar with implementations of ML applied to esoteric domains; but by their very nature these don’t get all the news cycles, or hiring, or any of the other absolute insanity that the domain seems to contain)

Seems like the devices they found in the IBM Selectrics during Project GUNMAN (though, same ‘conflict’).

https://media.defense.gov/2021/Jul/13/2002761779/-1/-1/0/LEA...

Haseltine’s The Spy in Moscow Station is also a fascinating account of events.

> security has a cost associated with it, and unless there are _real_ consequences, it's a cost that most software houses ain't gon' pay.

Good to see someone say this. Software need only be good enough to do the job, and only as safe as reasonably required. Systems can be secured and audited through other means, sometimes at lower expense than guaranteeing every line of software has zero risk associated.

I’ve only worked in a single company where it really worked out, and it took a massive amount of work to massage egos on both sides of the “fix” (one side sees their hammer tool and wants to fix everything with it, and the other has the mother’s honor issue). You really had to spend time with both parties helping them understand things were a certain way for a reason, but that there were always small changes that could improve things.

Encouraging the inverse of fixing relationship helped both parties as well.

That said, I’ve worked in a few other shops that either had the permissions/compartmentalization shit show as a permanent blocker, or were just completely devoid of a culture encouraging people to care about anything beyond their own career/fiefdom. I absolutely despise both cases.

This isn’t just AI…it’s ‘enterprise-AI’.

It’s AI, but with more bureaucracy and politics.

But I think you can do psychotic shit like applying punishing sanctions to anywhere that permits an ungoverned connection. Or apply physical force (military).

I’m not saying we’re even remotely close to this, I’m just saying State-level coercive action is not unheard of if a problem is perceived to be significant enough to warrant it. Shit, it even only needs to be viewed as significant by a small subset of the governing body (see: Iran conflict, or current pushes for “child safety on the internet”). It just has to be “useful” to a certain body politic.

> It's not the end of the world. But future will be rough.

Short term you’re probably right, but longer term is the realm where nation states will start to police the avenues of attack.

This is what will lead to govt needing to attach an actual ID your network connection.

I think it’s a bit like frontier development (like the US “Wild West”). You rob a bank because there’s no one to stop you, and even if you do get identified you can travel enough distance to regain anonymity. Application of legal recourse eventually caught up (as it will here), and the growing pains will certainly make things suck for all of us.

I’d argue even new freeways are challenging, at least in my area. They’ve been trying to close a loop around this city for 30+yr now, with a 3mi gap remaining. The last 3mi extension toward closing the gap took nearly 15 years to get through environmental reviews and legal challenges. This final segment will likely take an equally long period.

I’ll believe it. If someone were to try to achieve the same in my area (not even high speed rail), between two metropolitan areas, they’d have to contend with thousands of private land owners.

I lived in the UK for a few years, so I can appreciate and really enjoy a robust rail network, but it’s not an easy thing to achieve.

Man, I’d love more trains but we can’t act like the infrastructure necessary to support them, if not present, is very challenging to develop.

Even ignoring land acquisition (which is a big thing to ignore in populated areas where a train would most benefit the population), there are simple things like road crossings, other infrastructure crossing, etc.

In this case an airplane may be simply a lower friction solution.

One of the things I always told kids who came into these big trading firms is the owner(s) is/are a billionaire, and likely came up from one of the trading floors or something adjacent. They are not the “forgiving” types when it comes to shit like this, and they have infinitely more resources than you.

So maybe don’t try to steal code, or trade concepts.

Hasn’t stopped some people I know from trying…

(For clarification I am not ex-CitSec and do not know this poor SOB, but he serves as the perfect poster child for “Don’t do that”)

Shit, MIAX is just the old BATS/Cboe technology with some local flair. There are multiple derivatives of the old Island/INET tech stack, mainly in ATSs, but the iteration Nasdaq is operating on only diverges where extreme message volume factors in.

No one is silly enough to want the abomination of design that is Pillar, but the point still stands that technical differentiation isn’t really important in the way it was 15-20yr ago.

Well, listings had domestic regulator control for the most part but I think you hit it on the head. Brokers in Amsterdam, London, Frankfurt, or Milan needed to access 15-20 countries worth of exchanges, and the curse in the EU is the multi-currency cross listings.

Easier, if somewhat more verbose, to use the three in combo to identify. Helped somewhat by the message volumes being a small fraction of what they are in the US. Less need to optimize on a per order, or per market data packet basis.

Also explains why FIX is more prevalent in EU markets than it is in the US.

I tried for a while to push internally and amongst a few of the markets to move to ISIN, Currency, MIC but yeah…anything but that.

Honestly the problem is the ticker is too valuable advertising for the listed company, and since listings are not governed by a central regulator in the same way they are in Europe, for example, there’s always going to be this sort of friction about who is willing to bend the most to win the business.

Don’t disagree there, though this has been status quo for nearly two decades now.

By that measure regional exchanges were their own beasts for a long time. The environment has definitely streamlined a ton since RegNMS was implemented and the exchanges consolidated a bit.

Even the technology stacks the current markets run are basically identical within three families of design (even the upstart markets, and even those that are not directly licensing technology from ICE, Nasdaq, or Cboe). Differentiation just doesn’t pay like it used to.

Yeah, they tried to carry the suffix symbology into the ticker itself, but that fortunately died not because of some great sanctity of the symbols but because someone thought it would confuse too much with how ACT and the CTCI protocol handled security categorization.

NYSE (really the access stack that both NYSE and AMEX ran on; the name escapes me since it died back in I think ‘08) has for a long time included a completely separate field in their protocols to indicate classification (preferred, warrants, classes, when issued, etc), but CTCI just jammed it into the symbol field.