Viewing profile — woodruffw

I think the advice at the end of this post is essentially sound: you should pre-filter your evaluation of others’ opinions through their understanding of related topics. But that i…

From a very quick look online, “Grade II” means that the building is of historic or architectural interest. I think it’s reasonable to infer that cleaning graffiti off of a buildin…

The author of that page appears to be a Holocaust denier[1]. Not exactly the example I would put forwards, especially if I want to make an unannealed appeal against Israeli war cri…

I left out the code on medical devices for a reason! And similarly for avionics software. (The distinction I’m making is between the code that operates the medical device and the c…

What does this mean? NIST and NSA are not even in the same federal department.

It might be an unpopular option, but I think the regulatory regimes that control medical and financial privacy as they interact with software are significantly lighter touch than e…

It seems to me like two things can be (and are) true: programming can be hard in absolute terms, and is also the easy part of the thing that we call “software engineering.”

How many programmers operate under that kind of regulatory and operational constraint regime? I think most don’t. (In interesting ways this is programming’s greatest boon and curse…

“Ultraviolet baths” for vitamin D. https://www.nationalgeographic.com/photo-of-the-day/photo/ul...

I meant shedding of legitimate base load, not retries. I think we can safely assume they do the latter.

I think they kind of have to operate that way if you want a control plane/access to GitHub’s own layered services like caching and artifact storage. There are plenty of things to b…

Why not both? Higher base load combined with insufficient internal controls for ratelimiting/load-shedding (as in, they don’t know who to shed) would be explanatory.

I don’t think the impact of these recent malware campaigns is below the threshold for federal interest.

I don’t think npm itself is measurably bad in ways that are useful to index on. Like others, I think that JS as an ecosystem has a culture that encourages both dependency sprawl an…

I would consider 2FA and signing to be strong layers, when applied well. I think everybody agrees we shouldn’t add layers just for the sake of it.

Yep. That remains the norm with Python source distributions as well. It’s a hard thing to overcome when it’s baked deeply into packaging assumptions.

RubyGems actually adopted Trusted Publishing before both npm and crates.io. To my recollection, they were second after PyPI. (I have no opinion about the overall security posture o…

That would be extremely surprising, given the number and severity of federal crimes involved. (I also dare say: many of these attackers demonstrate a better in-depth understanding …

Defense in depth is the “meat and potatoes” of security. In other words: people should be auditing their software, but we should also design systems and schemes that provide varyin…

Yep. This post is really old, I probably broke the CSS for these older posts a long time ago and never noticed it. I can try and fix it later today.

It’s funny to see this on HN. I wrote this 11 years ago as an undergraduate. The afternotes at the end of the post are worth reading; people have sent me various qualifications and…

Sure, I don't disagree. It's just not clear to me that developers actually index that heavily on hot reloading to begin with.

Rust has an incremental compiler. And TMU SwiftUI’s live preview is essentially a very rough approximation of what the actual build would produce; it’s not a suitable replacement f…