• 122 Posts
  • 203 Comments
Joined 2 years ago
cake
Cake day: July 10th, 2023

help-circle

  • The constant distraction and availability resonate with me.

    The main thing is to put in systems where you don’t need as much effort to handle daily business. Usually you can engineer your way out of high touch, multi-step process glue.

    In my youth working manual labour jobs I was full of vinegar and wouldn’t wait for the trucking dolly. Older workers taught me to slow down and I took that advice into software work.


  • Thank you for a thoughtful and interesting reply.

    The public health angle is interesting. I know noise pollution has a measurable negative effect on quality of life.

    I bet making the signs bigger would actually have some effect in that it would socialise the message to control volume to the public in general.

    I suppose I don’t mind quiet conversations taking place but when I can hear it from five rows down it grinds my gears.

    Been better lately about getting up and moving when someone comes in and sits down making noise but I sometimes need to go two three cars to get away from that.

    Anyway cheers











  • Interesting. My perspective is that a strong, small team building a monolith has to think of constraints and design for them, and the microservices teams make choices in the local instead of the global maximum, which reduces cohesion and incurs communication costs. I would think that carving out a service from a monolith would be easier than the reverse direction, although maybe you’re with me on that.


  • Dude thank you for your detailed reply which I have been thinking about for a while.

    I don’t want to mischaracterise what you’re saying but I want to try to summarise the lessons, which I think are super valid.

    1. Some external layers or services are basically essential, like a WAF/auth/rate limiter/API gateway/reverse proxy. Or DB.
    2. Observability and logging, and rapid response to anomalies, together with a honeypot, go a long way toward maintaining security.

    This is definitely a way to think about this that I haven’t distilled. Thanks!


  • You have me thinking. My gut tells me this is true.

    For example, if you have a segmented auth service that someone gets root on, it’s possible for someone to act as anyone else, but not get the whole database if unavailable to all users.

    If your load balancer gets compromised, you could cause denial of service or act as a man-in-the-middle for all requests.

    If your database gets got, that’s the worst, but you generally can’t intercept web requests and other front-end facing things.

    But, I’d like to play devil’s advocate here. I feel that most of these segmented architecture strategies may have negative security implications as well.

    First, the overall attack surface increases. There are more redundant mechanisms, more links in the chain, probably more differing types of security/tokens/certificates that can get exploited. It also adds maintenance burden, which I believe reduces security because other priorities may get in the way if things are cumbersome.

    In my examples above, a compromise of the auth service in most cases pretty much means a complete compromise of the what your system allows its highest level users to do. Which is normally a lot.

    Getting a load balancer will allow an attacker to MITM if TLS termination happens there, and basically this can mean the same as in the auth service, plus XSS-type stuff.

    If the service hosting the database is compromised, it’s kinda game over. Including XSS.

    So what have we gained here?

    A monolith hosting all of these has more or less the same consequences if compromised. However, if it’s all together, it becomes everyone’s responsibility and there are more eyes on each aspect of your application. You’re more likely to update things that need updating. Traffic can be analysed a little easier.

    Just wanted to jot down some notes because I have a talk coming up and need to prepare for this question. Please prod my thinking, it would really help me out!





  • themaninblack@lemmy.worldOPtoScience Memes@mander.xyzAeroplane
    link
    fedilink
    English
    arrow-up
    29
    ·
    15 days ago

    You know what? You’re absolutely right.

    People: please leave flying 737s to trained experts with the know-how, FAA licensure, and medical clearance. They know better than you even if you think you can do it from a meme.

    It’s very important that you not touch ANY of the buttons and dials on a 737. People could get hurt or even die if you do.





  • themaninblack@lemmy.worldtoADHD Women@lemmy.worldIt is crazy
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    17 days ago

    Also you don’t seem to understand that ADHD is a mood altering disorder in itself. So in making the choice to give your kid a “mood altering drug”, which seems to be your particular axe to grind, you may in fact be helping them.

    You should also consider the possibility that the medical professionals you have talked to have detected your strong opinions and have chosen the most effective strategy - to validate your thinking to the extent possible - because it is in the best interest of your child. They gave you options because informed consent is a thing.

    There are in fact clinical guidelines for when treatment is recommended vs. not - a clinician can apply their opinion of course but there are evidence-based standards of care, derived from a huge amount of data and careful analysis over time. It sounds like you’re placing your individual judgment above the long history of the combined effort of some very smart people.

    Listen, I don’t know what is going on in your case. Your younger kid might not have any disorder or need treatment, but this arrogant “As a parent…” framing doesn’t help. I just hope they don’t grow up performing below a level that they potentially could, or in some degree of emotional distress, because they couldn’t get the treatment they needed at the time they needed it.

    Finally, please consider the known competing risks of treatment (including non-pharma) and lack of treatment.