specialk

There is a supply and demand tension in Dublin over accommodation. Building more apartments, i.e. increasing supply, will help alleviate this tension. That doesn't mean we can't also tackle the problem from the other direction by reducing demand. AirBnB is demand.

It's hard to tell how much any government would want to pull on a lever that might reduce demand. Those tourists bring valuable outside revenue into the city. We need them too. There's lots to balance here. Let's not optimise just revenue.

Wearing headphones

Working away from normal desk

Interruptions still happen, of course. When one does, we suggest letting the person know upfront that you’re concentrating on something, and asking them if it’s urgent. And if you’re the person doing the interrupting, try not to get offended when you get asked if your needs are urgent.

OMG yes big fan of this. Setting expectations up front for this kind of behaviour is great. Without a 'culture' for allowing people to stay focused without an immediate interruption, I have always found it hard to explain to people interrupting me why they could have used an asynchronous communication tool, like Slack/HipChat/email, for non-urgent questions.

So, if you'll indulge me, your argument is essentially 'us vs them' is a bad thing. About right? If so, I agree. We're not going to solve an exclusionary tech culture by excluding people or creating two sides to a debating war.

But what strikes me is that your comment didn't even reference Nicole Sanchez by name once. Your comment was "she" and "her" time and time again. Did you even notice yourself do it? I somehow doubt it was intentional. But I'm an optimist.

> The seemingly good news is that globally, SHA-2 is supported by at least 98.31% of browsers. Cutting 1.69% off the encrypted Internet may not seem like a lot, but it represents over 37 million people.

There is also an interesting discussion in Security Now #538 [2] there is also a transcript of the show [3]. Skip to page 2 of 39 just where Leo says "Yeah". Android 2.2 and Windows XP SP 2 are on the list of things that don't support SHA-2. These devices exist particularly in the developing world. It sends the wrong message, to the developing world in particular, if we don't support HTTPS for them. It encourages websites in areas where it isn't 1.69% of their users but maybe 5% of their users to just not enforce TLS. TLS with a SHA-1 signed LV cert is better than no security at all.

Facebook's also has a cool server add-on to dynamically serve LV certs to those who need them is very promising. If it is in-production at Facebook it is bound to be good.

[1] https://blog.cloudflare.com/sha-1-deprecation-no-browser-lef...

[2] https://www.grc.com/securitynow.htm

[3] https://www.grc.com/sn/sn-538.pdf

If the pull request is small, fixes a bug or is a blocking you, then you can spend you quick-code-review-chip for the week and ask the team to look at it at their first available opportunity. (Sometimes reviewed within 15 minutes, usually an hour tops)

It allows team members to ask the rest of the team to unblock them quickly. Limiting it to one a week prevents abuse of their team mates' time and encourages all team members to plan their work out ahead as to reduce blocking.

We also wrote a quick HipChat bot that keeps track of who's spent their quick-review-chip too.

In work I currently have 3 pull requests open all touching different sections of the product. The 3 PRs are all at different stages of the review process. For example, I'll be closing one first thing tomorrow and deploying it out (don't like deploying in the evenings - its bad luck). Another I just opened as I left work today, so I doubt anyone's reviewed it yet.

I'm sure Quora has a big enough codebase and not enough developers (like most companies) that they always have a list of things a mile long that they would like to do or should do, be that new features or just refactoring.

2-3 days isn't long for a review and iteration cycle in itself. I have one PR that is currently open for 5 working days at this stage. We decided that it didn't quite fit the bill on the first draft . It is blocking progress on two other tasks in our backlog but we also have 14 things on our backlog of goals for this week. The team is working around it while we finish it off or create issues for things we think have fallen outside the scope of the initial job.

One thing we've noticed alot on my team is that we try and make our pull requests for review as small as possible. We all have a rough guide of about max 500 lines. Sometimes we do go over but its a rough guideline. Smaller PRs are just easier to review for everyone involved. Reviewers don't have walls of code to break through or need to keep tons of context in their head.

Post-commit reviews (or post-merge into master or whatever you process is) is an interesting idea. I'd be curious to see what my team think of the idea tomorrow for a small sub set of our codebase.

I noticed one more thing on the job posting text: the word-breaking is a little off. Here's a image with one example: http://i.imgur.com/Zuv1Zjc.png CSS's word-wrap: break-word is probably not want you want to be using for that container.

One other thing I noticed but that isn't a simple fix is postings like this one from HubSpot[1] list two locations Cambridge MA and Dublin Ireland but the ad only shows up in Dublin. I thought I'd point it out if you're looking for some more work :D

This is awesome.

[1] https://news.ycombinator.com/item?id=9813335

My guess is that so many users installed adblockers because of obnoxious ads on a few websites they visit without realising that it removes the non-annoying 'acceptable ads' that support the sites they love. Hopefully something like the acceptable ads manifesto will help stem the tide of quite frankly shitty ads .

[1] https://acceptableads.org/

[1] http://blog.pagefair.com/2015/adblock-users-click-more-ads/

This industry needs more social commentary along the lines of Silicon Valley on HBO and sites like this. Silicon Valley nails our industry almost every week. It's brutal, but it's reasonably accurate satire.

I'm a little concerned with a swarm of drones controlled by one human. Humans have limited attention span -- they just can't watch 30 video feeds. Could this pre-programmed approach with limited human control lead to greater civilian causalities?

I'm curious if it will catch on or if users stigma against livechat will hurt. Have to ask yourself when was the last time you used livechat? I'm having trouble remembering the last time I did.

I find it highly amusing that RMS doesn't seem to agree with Amazon's restrictive ToS agreement but his GNU software license is one of the most restrictive licenses out there. If I include a GNU licensed library I accidentally lose all my rights too. Funny that.

> "A study found that people who read novels on the Amazon Swindle remember less of the events."

Replace 'Swindle' with 'Kindle' then with any ebook reader ever. I doubt there is anything about the Kindle in particular, over other ereaders, that causes people to remember less. This is attacking Amazon with everything and hoping some of it sticks.

I'm trying not to defend Amazon but RMS's arguments are painfully bad at times.

From all the advice I've read security and crypto they don't work like that. The assumption is the other way around. A properly implemented, simple pepper can only hurt password security until proven otherwise by rigours testing and analysis.

Time and time again we read stories of a tiny implementation detail that created a sly and subtle vulnerability that simehow leaks information about original plain text by interrogating the cipher text.

bcyrpt with a large work factor and a per user salt is a PROVEN method to prevent attackers learning the plain text. Until I see evidence from a trusted cryptanalyst I'm not going to roll my own by adding in pepper they didn't plan on being there.

EDIT: sorry let me make my point a little clearer. In the event that the hacker can access the filesystem or memory -- whereever you store your pepper -- could the hacker use the pepper and an implementation detail in the peppering technique to learn information about the plaintext or the salt? This question is what needs to be answered by qualified cryptanalysts before developers start using peppers wide-spread in my opinion.

The best article I've seen against this technique is by ircmaxell [0]. Nicely summed up in this sentence "It is far better to use standard, proven algorithms then to create your own to incorporate a pepper."

Anyone have source material (academic paper, Bruce "The Crypto God" Schneier blog post) that shreds some light on peppering passwords?

I'd be much more interested in how many iterations of bcryprt Slack were using. That has a much bigger bearing on events for me. Anyone at Slack know/want to answer that question?

[0] http://blog.ircmaxell.com/2012/04/properly-salting-passwords...

I wonder is it is possible to create an apiary.io to readme.io auto-migration tool. Even if it does require me copying the markdown behind the apiary.io docs manually into some tool that spits docs into readme.io. That would honestly save me many hours, probably many hours for many folk too.

I've requested access to the open source pricing plan, after I hopefully get approved it is probably something I'll look into in more detail. I'm in need of a new (probably) needless automation side-project.

Edit: wow I completely missed the free trail. If you're an open source project they'll upgrade you to the Dev Hub pricing plan. Ugh feeling so stupid for missing that the first time around and not getting started 10 minutes ago.

It doesn't look like customers were given much warning either. This story was originally published on the 6th of Jan. Could you imagine trying to find alternate hosting setup by the weekend if you have any kind of availability expectations? It seems like madness to me. Even if you did move yourself to another host to cover this 48 hours of downtime how likely are you to move the majority of your business over to AWS, Google Cloud, Azure etc.

The lack of notice on this seems to be a bigger issue to me than the fact that Verizon is taking their whole cloud out of service for 48 straight hours.

For example in the disposal income visualisation what kind of magnitude of a difference is there. Is the average 2 thousand euro a year lower or 10 thousand euro a year?

What concerns me is that some of these stats can be massaged with the right visuals into producing a difference between East and West that isn't as big a difference as the graph makes it out to be.