Email me: adam@middle.app
> I've found very few projects where a bit of poking can't turn up memory safety issues. I'm working on a Rust project right now, and I'm probably one of those people who are overestimating the correctness of my code! I…
You are free to choose buildings with multiple stairways if that's a requirement for you! We're talking about easing mandatory regulations, allowing builders to meet demand. We're not saying that all buildings must only…
Oh, I see the issue. The HIBP database is SHA-1 hashed with no salt. It was created from unhashed passwords. You can't download the unhashed version (you could of course compute it, if you really wanted to; but there's…
One can only implement a HIBP check when one has access to the user's unhashed password. So, at login, registration, and password reset.
Yes, same scenario, but far fewer logins are successful. 3 orders of magnitude sounds right, but I don't know precise numbers. (Can others shed light?) Three orders of magnitude is a lot!
This is true. The story as written probably didn't happen with HIBP's database. Troy Hunt's database only includes SHA-1 hashes, and passwords in your own database will be hashed with a stronger algorithm (hopefully)…
Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's…
Websites should mitigate credential stuffing by checking against known cracked passwords. All you have to do is download Troy Hunt’s hashed password database, check it when someone logs in and if it’s cracked do your…
A few months ago, I did some analysis on JSON data in our platform, and discovered that more than two-thirds of bytes were field names. Two thirds! That’s a lot of potentially unnecessary extra bytes. In my case, I was…
Alpine is a trap! For a Python product, we tried to make it work for about a year before throwing our hands up and switching to a plain Ubuntu image. We’ve had no regrets.
I haven't heard of the idea of the "hard problem of consciousness" before, but after reading this Wikipedia article, it sounds like nonsense. Like, take this passage: > For example, it is logically possible for a…
I had a really fascinating conversation with the lead architect at Frost Giant the other day. They're making the next StarCraft, basically. They don't use floating points. He didn't mention (IIRC) the possibility of…
"At one point in the harrowing footage, he appears to be stumbling toward a car, and then falling to the ground as the car drives away." This was so sad to read. I bet the driver thought Lee was a dangerous or disturbed…
I've been slowly reading this book on cognition and neuroscience, "A Thousand Brains: A New Theory of Intelligence" by Jeff Hawkins. The answer is: Yes, yes we are basically fancy auto-complete machines. Basically, our…
I don't know! I think you might be right, but my intuition tells me it's a little more than that. Other ideas: * Is it a mind-body connection thing? Writing seems to involve a lot more fine motor control and muscle…
Within Lambda, yes, sucks. This is why container-based serverless is so much more exciting. (Which Cloud Run offers.) I'm in the early stages of this rearchitecture but so far I've had no difficulty with local…
This is from the perspective of a small startup CTO: We've used AWS Lambda for about 4 years, and it's been so good and so cheap that I'm shifting literally everything (except Redis) to serverless. Also, GCP has a…
Well, this is cool. I had a convincing conversation with a squirrel. (Aside: Forest animals might be one of the most perfect use cases for this. A squirrel wouldn't be expected to remember facts for very long, and might…
I recently read a fantastic book on Cold War brinksmanship. It was, "The Bomb: Presidents, Generals, and the Secret History of Nuclear War" by Fred Kaplan, published in 2020. It's a fantastic book. I couldn't put it…
So I'm pretty sure this is the technology revolution that we're all sleeping on. Like, self-driving cars? VR? Meh. Accessible programming? A safe environment for folks close to a business problem that lets them solve…
I completely agree! Beavers make habitats! They create entire ecosystems! They turn semi-arid land into lush wetlands. Their lodges become homes for muskrats and otters. The wetlands they make support bird, and frog,…
So, in some ways, it is not that different. It uses ideas that have been around for years: The core of the product is a visual programming language, plus a database, plus a low-code Python editor. All of which have,…
I found myself nodding vigorously to Ms. Atkinson's (fictional) responses. > You fixate on some technical solution and then completely forget what is the context in which you're building it. Good software designers…
Nice! > I wonder if you've felt the pressure of implementing or embedding a scripting language client side? You're already developing a DSL, whether it's text or graphical is not 100% the point So, yes. Right now,…
Going backwards in the questions here: > Maybe a better question would be who are the target customers for this? So far, our customers are software companies (and one brick and mortar company) in the fitness space.…
> I've found very few projects where a bit of poking can't turn up memory safety issues. I'm working on a Rust project right now, and I'm probably one of those people who are overestimating the correctness of my code! I…
You are free to choose buildings with multiple stairways if that's a requirement for you! We're talking about easing mandatory regulations, allowing builders to meet demand. We're not saying that all buildings must only…
Oh, I see the issue. The HIBP database is SHA-1 hashed with no salt. It was created from unhashed passwords. You can't download the unhashed version (you could of course compute it, if you really wanted to; but there's…
One can only implement a HIBP check when one has access to the user's unhashed password. So, at login, registration, and password reset.
Yes, same scenario, but far fewer logins are successful. 3 orders of magnitude sounds right, but I don't know precise numbers. (Can others shed light?) Three orders of magnitude is a lot!
This is true. The story as written probably didn't happen with HIBP's database. Troy Hunt's database only includes SHA-1 hashes, and passwords in your own database will be hashed with a stronger algorithm (hopefully)…
Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's…
Websites should mitigate credential stuffing by checking against known cracked passwords. All you have to do is download Troy Hunt’s hashed password database, check it when someone logs in and if it’s cracked do your…
A few months ago, I did some analysis on JSON data in our platform, and discovered that more than two-thirds of bytes were field names. Two thirds! That’s a lot of potentially unnecessary extra bytes. In my case, I was…
Alpine is a trap! For a Python product, we tried to make it work for about a year before throwing our hands up and switching to a plain Ubuntu image. We’ve had no regrets.
I haven't heard of the idea of the "hard problem of consciousness" before, but after reading this Wikipedia article, it sounds like nonsense. Like, take this passage: > For example, it is logically possible for a…
I had a really fascinating conversation with the lead architect at Frost Giant the other day. They're making the next StarCraft, basically. They don't use floating points. He didn't mention (IIRC) the possibility of…
"At one point in the harrowing footage, he appears to be stumbling toward a car, and then falling to the ground as the car drives away." This was so sad to read. I bet the driver thought Lee was a dangerous or disturbed…
I've been slowly reading this book on cognition and neuroscience, "A Thousand Brains: A New Theory of Intelligence" by Jeff Hawkins. The answer is: Yes, yes we are basically fancy auto-complete machines. Basically, our…
I don't know! I think you might be right, but my intuition tells me it's a little more than that. Other ideas: * Is it a mind-body connection thing? Writing seems to involve a lot more fine motor control and muscle…
Within Lambda, yes, sucks. This is why container-based serverless is so much more exciting. (Which Cloud Run offers.) I'm in the early stages of this rearchitecture but so far I've had no difficulty with local…
This is from the perspective of a small startup CTO: We've used AWS Lambda for about 4 years, and it's been so good and so cheap that I'm shifting literally everything (except Redis) to serverless. Also, GCP has a…
Well, this is cool. I had a convincing conversation with a squirrel. (Aside: Forest animals might be one of the most perfect use cases for this. A squirrel wouldn't be expected to remember facts for very long, and might…
I recently read a fantastic book on Cold War brinksmanship. It was, "The Bomb: Presidents, Generals, and the Secret History of Nuclear War" by Fred Kaplan, published in 2020. It's a fantastic book. I couldn't put it…
So I'm pretty sure this is the technology revolution that we're all sleeping on. Like, self-driving cars? VR? Meh. Accessible programming? A safe environment for folks close to a business problem that lets them solve…
I completely agree! Beavers make habitats! They create entire ecosystems! They turn semi-arid land into lush wetlands. Their lodges become homes for muskrats and otters. The wetlands they make support bird, and frog,…
So, in some ways, it is not that different. It uses ideas that have been around for years: The core of the product is a visual programming language, plus a database, plus a low-code Python editor. All of which have,…
I found myself nodding vigorously to Ms. Atkinson's (fictional) responses. > You fixate on some technical solution and then completely forget what is the context in which you're building it. Good software designers…
Nice! > I wonder if you've felt the pressure of implementing or embedding a scripting language client side? You're already developing a DSL, whether it's text or graphical is not 100% the point So, yes. Right now,…
Going backwards in the questions here: > Maybe a better question would be who are the target customers for this? So far, our customers are software companies (and one brick and mortar company) in the fitness space.…