pyjug
Fair enough, but often consumers that use multiple vendors receive webhooks in the same service; think about going from /v1/webhooks -> /v2/webhooks, they'd have to change the URL for every vendor. Easier to redirect first then update the URLs later. I think it's a reasonable expectation that a HTTP client would honor redirects as long as the usage isn't malicious (like loops etc)
There's a clever extension to this attack; a naive way to mitigate it is to do a DNS resolution first to verify it's not a private IP and then do the actual request. An attacker can simply return a public IP on the first DNS resolution (with a 0 TTY) and then return a private IP on the second. This is called a "TOCTOU" (time-of-check time-of-use) vulnerability. I've written about this and other security best practices on my blog here - https://www.ameyalokare.com/technology/webhooks/2021/05/03/s...
I've also built an egress proxy that prevents such attacks here - https://github.com/juggernaut/webhook-sentry
Same caveat applies, use at your own risk :-)
I have a similar story . At my old job, we had a web socket gateway that authenticated using JWTs , then hit an internal service to request REST resources. The issue was that it didn’t actually validate the requested REST resource URL; a malicious user could authenticate as themselves but request a resource for any other account.
I found it as I was getting up to speed on the code base, having recently switched teams. Funnily enough, nobody on the team really understood the vulnerability - the EM marked it low priority and wanted the team to work on other things. I had to essentially go directly to the security team and convince them it was a sev 1. I sometimes wonder if it’s easier to just report security issues as an outsider through the bug bounty program; internal reports don’t seem to get taken as seriously.
Very few if any outside of these companies pay a mid level engineer 700k (yes, this number is real, can we please stop debating this fact?). So, if all FAANG force their companies back to the office, the employees have effectively no leverage.
This is similar to how the top cos colluded to keep engineer wages low in the 2000s, except they don’t need to explicitly make such a pact.
I would politely disagree — in any case the thread is there for all to judge.
If you sincerely believe that this is a product that should exist and will positively impact everyone involved, I can only hope you’re right [0]. In the end it’s all up to your conscience, but I do wish our leaders in tech were a bit more sensitive to seeing the broader picture.
[0]: pour one out for all the naive devs that will no doubt sink 100s of hours to be on the leaderboard for little benefit to them.
> I'm pretty sure that is what they are going for here with the global leaderboard
Sorry, I’m confused. This seems like a change in your position? Earlier you argued the intent is for employees to be able to showcase their skill to recruiters… you also responded to someone else who said they already have recruiter attention with “you are not their intended audience”
> paid her full time salary just to compete on Deepracer
Wait, are you seriously comparing a global competition in cutting edge tech to squashing bugs … in your own codebase? Come on.. there’s no comparison. If anything, a company would be semi embarrassed that they have so many bugs in their pre existing codebase.
I’m asking you in good faith. Why the contortions to defend such a product? I see from your profile that you are an investor and advisor. I would seriously try pushing this product to your companies and see how they react. If they do adopt it, run an anonymous survey of the devs .. then I would love to see you argue with a straight face that it “benefits developers”
Let me put it you this way - would an engineer at Netflix ever “play this game” to win ? Would employees at Netflix even put up with something like this? If not, why would you think employees at random tech co should?
Come on, this is just being coy — you and I both know this is a terrible deal for employees — as you write earlier, there’s a very low chance that a random dev will appear on the global leaderboard. What’s more, the best devs won’t even play this game, so it’s left for juniors and people trying to “prove themselves” to trample over each other for peanuts.
Not to single you out, but I wish influential tech folks like you would speak up more about the cynical exploitation that’s going on here in plain sight.
This invalidates your other point that it benefits developers. Why would a dev sink countless hours for a “very low” chance at being on the global leaderboard and hence moving jobs.
You can’t simultaneously posit it’s good for both companies and developers.
Only for cheapo companies. Companies should (and do) _pay_ their devs to attend re:invent. I get your point though. For naive devs, it’s like getting to go to a concert. But it’s quite cynical for AWS to exploit this
> if you’re looking to make a job move,…
Why would companies allow their best developers to be poached? Unless of course there’s a way for companies to keep their developer scores private…
I’m not saying he’s being malicious - he probably genuinely believes he likes personalized ads. The “self” or “ego” is a very tricky thing. It can rationalize almost anything to maintain its world view. Everyone likes to think they’re doing good in the world. When faced with the fact that may not be the case, it’s natural to rationalize it away. It takes an extreme level of awareness to be objectively neutral whenever your “self” is involved.
Genius! But it’s unclear to me if the examples in the blog were actual ads shown to users before their account was blocked, or the campaign never got off the ground at all. If it’s the latter, the blog should make it clearer otherwise it makes it look like those were real ads
Also, if it wasn’t clear I was addressing programmers with experience in more than 1 language, not absolute beginners. If someone who is learning Go as their first language, I wholeheartedly endorse learning it! (Although Python would be better :-))
For better or worse, Go is where all the energy is in terms of OSS, so I do hope I see the light some day, but for now, the dev x for me is pretty underwhelming compared to Java
Language wise - you need for loops for everything, no maps or streams. Also where are the concurrent collections in the stdlib?
I wonder if all the Go love here is from people who never worked in earnest with Java ? Or only worked with dynamic languages before?
This hasn't gone unnoticed by investors. See PG's recent tweet - https://twitter.com/paulg/status/1381669057548713984?s=20
The US runs the risk of being "China'ed" again, in a different field -- this is not outsourcing anymore, this is real competitive software products being built in India.
The answer is absolutely not -- you can easily make 70k USD in India as a decent mid-level engineer which is the same as Germany. And you get to live like a king in your own country, don't have to learn German, put up with racism etc. In fact, a lot of US companies hiring in India pay more in India than Germany! I know a couple friends making ~200k in Amazon India at 8-10 years of experience.
I'm disputing that thesis based on my experience. You don't need to be vulnerable or "be open" at all - you just need to be part of the in-group. I know "Senior Director of Engineering" who had no clue what the hell was going on. They never spoke up in meetings, or did anything useful at all - it was clear to everyone they added no value whatsoever. Turns out they were just floating from startup to startup moving up in seniority in the process. Presumably, nobody bothered to question them during the interview process as it was assumed they were "competent" based on their background and past positions.
This is amazing self-awareness. I wish I had it earlier in my career.
>And in my opinion is why white men are so overrepresented in senior levels of companies: the psychological safety is there for them in the rest of their lives
This is interesting, but I don't entirely agree. I have seen both sides as an Indian male who has worked both in India (privilege) and SV (no privilege). It's not a matter of "fighting back" or "being open", it's just in-group mechanics at work. There is a tacit understanding among people in positions of power about who is the "in-group" that doesn't need to be expressed or acknowledged even. For example, in India, even as a junior engineer I would be invited to important meetings whereas more experienced female engineers wouldn't. If I'd simply shown up and done the bare minimum, I would have quickly risen up the ranks, IMO. I had the exact opposite experience in SV, being seen as the "out-group" of the "worker bee" class by default.
Obviously, "total" in this context means in the workplace. Also, psychological safety essentially means "ability to express yourself and make mistakes without the fear of negative consequences" - it has nothing to do with shielding yourself from cancer, climate change etc. Ironically, the Buddha, who was quoted in the OP grew up with "total psychological safety" as you defined it, and you know where that led him.
> just like it's possible to have a reasonable level of physical safety while driving a car
Again, this is not a comparable analogy at all. If you're unable to in no uncertain terms say "this project is going to hurt users" out of fear of getting fired/looking like not a team player, that is not even a "reasonable level" of psychological safety.
Really? Why are y'all working on FLoC then? :-)
Curious to learn others' experiences, but I've never seen this in my career, ever. I've seen _peers_ yell at each other, but never seen an employee slip "out of character" with their superiors, at least publicly. And if it isn't happening publicly, there's no psychological safety, is there?
Most people (including myself) have been conditioned to bring their "work self" to work, not their "true self". As such, there's very little chance of "forgetting the nature of the relationship" even in heated moments.
How many line engineers at Google let alone a random tech company can question a VP/director's pet project? Heck, how many middle managers can? Psychological safety should mean you should be able to call BS and be okay with others calling your BS (in a non-inflammatory way), but in reality it means stroking others' egos, especially of those in leadership.
>It is easy to see the faults of others, but difficult to see one’s own. — Buddha, Dhammapada
Indeed, like all of Buddha's teachings, it also applies to the author of course.