Don't Take the Black Pill [video]

I would not characterize what he shared as vitriolic, but from the comments when the post was submitted one would get the impression that is not a majority opinion here.

https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.ht...

If anything, the opposite thing is true. Each of the MD4, MD5, and SHA1 results are essentially exploits of design weaknesses: iteration insufficiency, too much traceable control over state given message words, weak and linear message schedules.

In the history of hash cryptanalysis, we continuously get better at exploiting these kinds of weaknesses, successfully exploiting differential analyses with smaller and smaller windows of opportunity (which is why SHA1 was such a big deal). But in the same way that you can foreclose entirely on a SQLI with parameterized query, or a memory corruption vulnerability with automatic bounds checking, you can also just make the message schedule (not understood in the era of MD4 to be that big a hinge point) strong and nonlinear.

It is very unlikely that the future of CS holds some reliable way to defeat bounds checking, and, for the same reason, you can find cryptographers like JP Aumasson (a coauthor of BLAKE and BLAKE3, with no particular reason to stan the older NSA construction) saying we're unlikely to break SHA2... ever.

In my experience, yeah, but how they do it is... not what you'd expect.

Leadership has no clue about the scope of tech debt in their products and if they do decide to fix it, it will be by coming up with a bunch of ridiculously optimistic estimates and then foisting them off onto engineers who are already overworked trying to keep up with tech debt to launch new stuff. This feels awful and generally doesn't lead to anything being properly fixed because it turns fixing tech debt into a "just get it barely good enough and mark it as done."

After the inevitable surge in attrition, more often than not the tech debt is "solved" by throwing out the old codebase and starting from scratch with a new team. This is expensive, but in a lot of cases produces a better product.

Why do Europeans get paid so much less than Americans for the same jobs? Like it or not, at-will employment makes it much easier to justify hiring a new employee because they can just be let go if things don't work out. I'm not even talking about the employee not working out, forcing companies into continuing employment can be disastrous if the market shifts (e.g. what's happening at VW right now).

A requirement to provide x months of notice with y% chance of success is a quantifiable risk with a dollar price tag. It is definitely brought up when companies decide to expand in places where labor law is different, and it scales directly with how much the employee is being paid.

> There's nothing preventing merit based promotions either.

So why do most of our unions have time-in-grade promotions? Merit-based promo is quite rare in unionized jobs in the US. There are obvious incentives that push unions away from merit-based promo, and you're being intentionally obtuse if you refuse to see them.

> Even if that is true today, it may not be tomorrow. The corporation you work for is not your friend. They aren't looking out for your best interests. They are worried only about themselves. You should do the same and unions give you more power in negotiations with your employer and more protections against them as well.

You're right, that might not always be true. Every time that's happened I've just changed jobs for a raise and sometimes also a promotion.

That's my defense against shitty companies: I can just leave. If people were MORE WILLING TO LEAVE when things got bad, companies would get away with much less and make more efforts to retain employees.

I get the argument when we're talking about working-class people who might have a lot of difficulty finding a new job, but IN SOFTWARE? Demand for qualified engineers is insane! I haven't bothered to apply to a job since college, I've just set LinkedIn to "open to work" and replied to a few recruiters. FFS, even when I've been voluntarily unemployed, just holding onto my stock was enough to see my net worth INCREASE.

> It's still probably worth looking into them a little though because you've been being lied to by people who want to keep you ignorant and misinformed on the subject. Those people are afraid of what unions are capable of and that isn't because they're worried about your career and want to protect you.

I don't understand why pro-union folks always assume that skeptics think their boss is their dad. Rest assured, I am very cynical about my job and corporate politics.

Look man, I'm fully aware of what unions are and what they do. They're a great deal for some union members! They're also why American ports are the least efficient in the developed world, they're a big part of why RICO exists, and I'm already doing an in-demand well-compensated job. My peers and I are all going to be able to retire at 40, barring a major war or other disaster. If I get laid off, I get 90 days of COBRA and then Medi-Cal, and odds are I won't even need the Medi-Cal.

What exactly is a union going to get me that I can't get myself?

The pythagroean theorem breaks down in elliptical geometry. This is why it is a theorem and not a law.