231–240 of 463 posts
Earlier quoted context omitted.
My god, they didn't say ban ai they said it makes vandalism easy. No need to knee jerk react to an argument that hasn't been made.
It's not knee jerk to respond to an obvious contextual implication.
I was sort of admiring the devastation a malignant actor can cause with a good tool.
It’s usually used for morally neutral neutral or good work.
Earlier quoted context omitted.
There are substantial differences between database access, snooping the logs, internal (no TLS) wiretap, and full MITM of the frontend. Hashing client side minimizes the risk of any blast radius exceeding the bounds of your own service. There's obviously no way to prevent an adversary who achieves full MITM from gradually harvesting credentials over time. The only solution there is to use keys instead of passwords.
We are not disagreeing, but I am not getting my answer: how is client side hashing really helping, what are the circumstances it helps with if you do have the basics right? In your enumeration, what is breached for this to be meaningfully impactful for other services where customers might be reusing credentials?
I already answered you that if you assume full MITM of the frontend then it is physically impossible to prevent gradual credential harvesting. Did you have a different scenario in mind?
> how is client side hashing really helping
Compared to what? Server side hashing? It prevents the plaintext from ever hitting your infra which minimizes to the greatest extent possible an insider or intruder gaining access to the plaintext. Since preventing access to the plaintext is the primary purpose of hashing it's the sensible option if you're forced to pick only one.
Of course there's really no good reason to pick only one of the two. You might as well elect for defense in depth against rogue insiders with full db access even though it's difficult to imagine what use they would have for a password based login at that point.
Earlier quoted context omitted.
It's not knee jerk to respond to an obvious contextual implication.
Absolutely wasn’t where I was going with that. I was sort of admiring the devastation a malignant actor can cause with a good tool. It’s usually used for morally neutral neutral or good work.
Earlier quoted context omitted.
Absolutely wasn’t where I was going with that. I was sort of admiring the devastation a malignant actor can cause with a good tool. It’s usually used for morally neutral neutral or good work.
Fair enough. I guess an LLM in an IT administration role could be aptly compared to a bulldozer.
Earlier quoted context omitted.
[flagged]
These are not remotely indicators that someone is an American citizen.
Earlier quoted context omitted.
If you're talking about Oracle, the large round previous to that they did had individual meetings with employee, manager, and HR. With so many layoffs it took a week+ to do, effectively torturing an entire set of employees who had no idea if they'd have a job by the end of the hour, let alone week. I'm not sure there's any good way to lay off large amounts of staff (besides not getting yourself into the situation in…
>I'm not sure there's any good way to lay off large amounts of staff Someone on HN once wrote that after the dot.com bust, Yahoo! HR had 1-1 meetings with every single employee that was part of the mass layoffs back then, and they did this for hundreds of workers. Boy what I wouldn't give to go back to such state of affairs, even though I wasn't yet part of the workforce back then. An older family friend of mine who…
Earlier quoted context omitted.
>I'm not sure there's any good way to lay off large amounts of staff Someone on HN once wrote that after the dot.com bust, Yahoo! HR had 1-1 meetings with every single employee that was part of the mass layoffs back then, and they did this for hundreds of workers. Boy what I wouldn't give to go back to such state of affairs, even though I wasn't yet part of the workforce back then. An older family friend of mine who…
Either your dates or experiences are off, because I've been working in software since 1999 and the easiest time to get a job was quite recent, in the back-half of COVID. The early 2000's were decent, but I didn't experience - or know anyone who did - any sort of "free jobs' period. Also pay was relatively decent but much less than what you saw even 5 years ago. It's only the in the past year or so that the world has…
IDK, I'm not from the US/Bay-Area, nor does my country have any big-tech/FANG jobs to distort the market for what constitutes a "high wage" in tech, it's all the same.
>in the back-half of COVID.
Sure, but Covid was only a short blip, a temporary exception, not a baseline norm for wage/job growth, like the years prior which was a longer period of getting a job was easy, like 2012-2020.
For me where I live now, the career depression I saw came in 2023 already when jobs become less abundant and harder to get, and it only got worse later when mass layoff started. So we're already 3 years in the decline, longer than the Covid boom lasted and things aren't going better yet.
I entered the workforce in around 2012-2014 and it was significantly easier to get a callback from sending a resume than it is now where it's mostly automated rejections. When I say "easy" I also mean you didn't need 7 stages of interviews to get a job back then, you'd have 2 stages and those were pretty chill and get a call back from every 2-3 resumes sent. Now you need to send dozens. I guess "easy" is relative.
>Also pay was relatively decent but much less than what you saw even 5 years ago.
Inflation also happened in that time.
Earlier quoted context omitted.
These are not remotely indicators that someone is an American citizen.
I take it you're not in HR at the CIA or FBI, which vet applicants' families for a reason. i.e. how long ago applicants and/or their families came to the US does help predict their loyalties... It might not be a strong nor fair predictor, but it's not zero either.