n0rdy

That would work from the technical point of view, I do agree.

On the other hand, how would we make "lazy" people use those? And ensure that won't reuse the same password on some vibe coded forum that will store them in the plain text and get hacked in a few weeks =)

That's why I mentioned that mindset shift as the prerequisite.

Sorry, I might be too young to remember those times. Can you tell me more, please? I'm genuinely curious.

Because from the sound of that, it feels that it would patch the `123456` problem, but opens up a new vulnerability - the password is known / being sent through / printed, so it can be leaked from that source.

Unfortunately, the humans' laziness (or lack of long-term thinking) was, is and will be a bottleneck.

If we technically restrict the minimum length to, let's say, 12 chars, the default passwords will be smth like `123456789012`. If we add the requirement to have 1 letter, at least, the passwords will be `12345678901a`. If we require a special character, we'll get smth like `1234567890a!`.

I believe the issue is not technical, and it's not about the one particular guy. It is about accountability and understanding the impact and responsibility of the "I don't care"/"whatever"/"ship fast" mindsets.

We need a proper social agreement for that, as this goes far beyond the passwords, especially these days when the quantity and speed are valued over quality.

Flipping through the source code is like a time machine tour of tech's evolution over the past 50 years. It made me wonder: will our 2025 code look as ancient by 2075?

And, btw, great infographics within the post.

I wrote this post in December 2023, and rediscovered it today. Seems like it hasn't dated yet, even though the AI landscape evolved a lot in the dev tooling space.

Yes, indeed, in this particular case it is exactly as you said. However, I've seen this in the tech industry, that's a surprising bit for me

> How does a company whose only job is security screw that up so badly?

While I don't have any answers to this, I've realized that it's an ideal showcase of why fuzzy testing is useful.

There is a discussion about that on the security stackexchange (https://security.stackexchange.com/questions/133239/what-is-...). The TLDR:

> SHA-2 family of hashes was designed to be fast. BCrypt was designed to be slow.

Slow == harder to brute-force == more secure.

Author here: thanks for reading the post.

It's great to hear that Zig covered both cases. However, I'd still prefer the opposite behavior: a safe (without truncation) default `bcrypt()` and the unsafe function with the explicit name `bcryptWithTruncation()`.

My opinion is based on the assumption that the majority of the users will go with the `bcrypt()` option. Having AI "helpers" might make this statistic even worse.

Do you happen to know Zig team's reasoning behind this design choice? I'm really curious.

I like following the OpenAI vs. NYT case, as it's a great example of the controversial situation:

- OpenAI created their models by parsing the internet by disregarding the copyrights, licenses, etc., or looking for a law loopholes

- by doing that, OpenAI (alongside others) developed a new progressive tool that is shaping the world, and seems to be the next “internet”-like (impact-wise) thing

- NYT is not happy about that, as their content is their main asset

- less democratic countries, can apply even less ethical practices for data mining, as the copyright laws don't work there, so one might claim that it's a question of national defense, considering the fact that AI is actively used in the miltech these days

- while the ethical part is less controversial (imho, as I'm with NYT there), the legal one is more complicated: the laws might simply say nothing about this use case (think GPL vs. AGPL license), so the world might need new ones.

And so on...

Indeed, nostalgia is a great selling point

Since those are mostly old movies, my immediate thought was: "maybe it's a new creative way to create a new income stream for hard-to-sell-otherwise assets?". If a decent enough number of users watch them, it could bring some cash to the publisher, couldn't it?

That's a great way to view it, I haven't looked at it from this angle before, thanks.

> What is anti-competitive tho, is stuff like Apple Music and Spotify, where spotify has to pay 30% cut to apple while apple music doesnt have to pay anything.

Yeah, that's why the monopoly is rarely a good idea for the customers, in my opinion.

I've always found this approach of reducing the number of employees unwise from the company perspective (but pretty good for the employees, though).

While the unsatisfied employees are the target, my observations indicate that a high percentage of active and skilled people are willing to take this offer, as they are sure that they will find a new place within a reasonable time, so it's basically, free money. And those are the people that the company should try to keep as much as it could. While the "give me a task with the perfect description, and I will do it" folks will stay until they are kicked out, as, usually, they are not up to taking the initiative.

That's why I saw how the companies that were changing the rules in the process: "well, it's an offer, but your manager needs to approve that first", and other tricks to be able to reject it for the top performers. Needless to say, it leads to the bad moral.

However, the companies I'm mentioning had way fewer employees than the federal workforce, so the chances are that with that size it's impossible to do it the "right" way.

I see your point. There are a few objective moments, imho, that I'd consider, though:

> a team that will not run out of money and sell my data

While "not run out of money" is true, the "sell my data" part is not given. For example, in 2023 Google sold its domains business (https://domains.google/) to Squarespace. Also, while not directly selling your data, they might sell the outcomes of your data in a form of ads or AI models, for example. I believe that can objectively bother some people.

Another point: this is the way to build a monopoly, or a global dominance on the market, and then dictate the rules. I see that stories about some Big Tech monopoly controversial moves are often quite popular on HN, as those situations resonate with many tech enthusiasts.

As for the rest of the point, I agree with you, that a free, high-quality, and decent service is a benefit for us, consumers, over another subscription. I still feel sorry for small bootstrapped services. But that's my subjective feeling, I'm aware of that.

I have 2 conflicting feelings about this:

- I'm glad to see this, as it might be an easily accessible alternative to Facebook events, which I tend to miss as I'm checking my FB only once in a while

- on the other hand, each new Apple release adds apps that might kill some small start-ups that are offering similar services for the small fee. Having a free alternative on your phone out of the box with most of your contacts using will lead to a decent number of subscriptions' cancellations. A good lesson to build smth that is harder to reproduce, though...

I'd say not as of today's state of AI tools, but it's difficult to predict the future. So far, I can see many excited non-tech people who can build simple things or demos. But the real complexity starts behind that, once the solution needs to be deployed, maintained, extended with new features, bugs have to be fixed, etc. That's when it gets tricky.

I did a short experiment by trying to build an app with Cursor in the stack and domain I know nothing about. I got it to the first stage, and it was cool. But the app kept crashing once in a while with the memory issues, and my AI friend kept coming up with solutions that didn't help, but made the code more and more overengineered and harder to navigate. I'd feel sorry for those who'd need to maintain tools like this on stages like the one I described. Maybe that's the state of future start-ups out there?

I've just googled, and herring gulls are indeed the birds I was referring to here in Norway, good catch. We have the same, actually, when tourists/guests of the city are easier targets. A few times I had to "defend" (mostly, by hiding) my lunch sandwich or bun as well, if I wanted to eat somewhere with a view over the sea. However, even a few kilometers from the sea, they can still be on a "hunt". Very interesting creatures!

Author is here. Thanks for sharing my post. I'm open for discussions / questions about this topic, as well as curious to hear thoughts on the subject.

Got it, learning is something that can be acquired relatively quickly, while evolving needs generations. Thanks for the explanation.

It's quite a creative approach. I have a question about it, though, as the person whose expertise is far from biology: how much time does it take for the species to adapt / evolve under the new reality?

For example, the city I live in has access to the sea. Which means that there are plenty of seagulls and another type of bird that looks similar but has a slightly larger size (not sure about its name). However, I can observe that many of them are searching for food not in the sea, but rather in the trash bins quite far from the sea, in front of McDonald's and other fast food places, where they can steal the food from the hand of the person leaving the building.

This gives me a hint that their behavior changed quite a lot due to the new conditions they live in. Is the same possible with the mussels that the "mussels are well known for clamping their shells shut when water quality is poor" fact might change within a short time? Or does it take generations to evolve like that?

A good one! Appreciated the links that showed CEOs actually discussing such a schedule. I, personally, find this ridiculous. A simple math: 70 / 5 = 14 hours per day if 5 days 70 / 6 = 11,7 h/d 70 / 7 = 10 h/d 90 / 5 = 18 h/d 90 / 6 = 15 h/d 90 / 7 = 12,9 h/d

If we add 6-9 hours of sleep on top of that, and 1-2 hours of commute (I’d not be surprised if same CEOs forbid WFH), we are running out of hours per day. So, no time for anything rather than working. And for what? Sounds very dystopian.

Here where I live, home assignments with the follow-up tech discussion are way more common than the leetcode-like interviews. Therefore, I can't say that the process has already changed dramatically. Yes, I did review a couple of home assignments that had all the signs of being completely AI-generated. But it all became clear during the presentation of the solution, "why"-like questions, and extending the scope of the task to discuss the improvements. If the candidate could answer that, then AI was just a supplementary tool, which is great, as we also use Copilot, ChatGPT, and friends at work. If not, well, it's an obvious rejection.

It happened twice, that the candidate on the other side was clearly typing during the interview, taking a pause for a second or two, and then reading from the screen. That's very obvious as of today, but I can see how it will become a problem one day with the future AI development in terms of the speed of responses, and better voice recognition techniques (so, no typing needed).