Hasnain says:

Looking forward to the next post! Learnt a lot about Java from this one.

“In this article, we’ve looked at a bunch of things that Java 21 allows us to do (I haven’t covered certain things like how generics interact with switch patterns, however). In the next one, I’ll show you some interesting quirks and a few practical examples of how we can leverage these functional building blocks to improve how we write Java code.”

Hasnain says:

Great read. From 2011 but still holds up and I found myself nodding along.

“Software often stays in use longer than anyone expected when it was written — until recently I supported a law office billing system that was written in 1986 using OMNIS 3 and wouldn’t run on any Macintosh newer than an SE/30. Clients who depend on legacy systems will pay plenty to keep those systems running, because they can’t risk their business on new software, and they can’t afford to fund new software development and the subsequent data migration and training. There’s a rich vein of maintenance work out there that most programmers turn up their noses at, preferring ground-up development projects that neither they nor their client are well-suited for.”

Hasnain says:

“Each suit corresponds to a different type of meat. Feeling fishy? Deal the clubs to learn to how to gut a salmon or dismantle a lobster. The diamonds were for fowl, from duck to pheasant to pigeon (which shouldn’t be carved, but simply “cut through the middle from the rump to the neck”). The hearts featured “flesh of beats,” from the “Sir Loyn of Beef” to a haunch of venison—“begun to be cut near the buttock”—and a boars’ head, which “comes to the Table with its Snout standing upward and a sprig of Rosemary tuck[ed] in it.” Coney, or rabbit, was “most times brought to the Table with the Head off” and placed alongside the body. Instructions for carving “baked meats,” such as pies and pasties, were on the spades.”

Hasnain says:

Did not know this. This is super scary and eye opening.

“As underlined by Innocence Project cofounder Barry Scheck in the book’s foreword, it is essential that the public and all professionals involved in these cases comprehend the forensic unreliability of determinations of SBS/AHT. That does not mean that suspicions of child abuse shouldn’t be reported, that cases of children with unexplained traumatic injuries shouldn’t be investigated, that intentional head trauma does not occur or does not cause severe injuries. However, healthcare professionals should recognize that child abuse is a legal determination, not a medical one. While physicians have a duty to report suspicions of child abuse, asserting the “certainty” of a hypothesis without disclosing to the courts the unreliability of its scientific foundations is unethical and unacceptable.”

Hasnain says:

Some great benchmarking and database insights here.

“Insert speed games are revealing of database performance characteristics, but are themselves impractical. The fastest tests all involve insertion into unindexed tables. As soon as indexes are applied, their costs dominate.
Rapidly inserting millions of unindexed rows is only useful when later read sequentially, perhaps as part of a data pipeline. A SQLite format does add some conveniences for this role, but if you are trying to emit rows as fast as possible, consider the database only sinks integer rows at a rate of about 40 MiB/s; In comparison the same computer's unremarkable SSD has a sustained write rate of 454 MiB/s for regular files.”

Hasnain says:

alg=none strikes again.

“Chaining the two bugs together, an unauthenticated attacker is able to achieve remote code execution (RCE) on the target SharePoint server. 😁.”

Hasnain says:

No words

“Later, Matima alleges she learned from a colleague that she was commonly referred to by managers as a “black snake” and that her direct supervisor said that “black snake” was the “spirit animal” that he associated with her.

“I can’t stress enough how dehumanizing it was to learn of that,” she said in an interview.

After Matima formally complained again about discrimination from her manager, ByteDance earlier this year let both Matima and her supervisor go, according to the complaint. The company told her she was being fired for poor performance, according to the complaint.”

Hasnain says:

“In the first few months after quitting my job, I worked a lot. Probably 12 hours a day, or even 16 hours/day if you also count Twitter as “work”.

So when I reached $4K MRR, a decent amount considering my living cost in Vietnam, I started to slow down.

I still want to get more revenue, but I realized that this is a moving goalpost, and it will never stop. $10K, then $20K, then $50K. I knew I would never satisfied.

It’s much better to work and play at the same time.

So I traveled. I went for a trip around Vietnam.”

Hasnain says:

“Later, when talking with my girlfriend about this, I suddenly understood Steve Jobs, and others like him, much more deeply.

People often complained about Jobs: when his team showed him their work, he would say “It doesn’t feel right,” and when they asked how to fix it, he said “I don’t know, make it better and show me again, and then I’ll know.”

This confused a lot of people. He found problems but didn’t know how to fix them or why they were problems.

Now, I totally get where Jobs was coming from.”

Hasnain says:

“All of the experts I spoke with suggest people avoid storing and heating food in plastics altogether. “Without testing the entire landscape of these products, it is hard to really know” if any of them are truly safe, says Rogers.”

Hasnain says:

“"Now hold up there Herman! Won't this be triggered by valid users?" you say.

Perhaps, but it's fairly unlikely. In my tests I haven't managed to trigger it without explicitly performing a dodgy action. On top of that, it's been running in production for the past 3 months and I've only had one user report this as an issue. He was advertising online casinos.

Did it stop the spammers?

Yes!”

Hasnain says:

“The lack of available technical information from the vendors here made verification challenging, and it's questionable who this really benefits. Attackers are clearly highly motivated to track and exploit N-day vulnerabilities, and the lack of technical details being released won't significantly slow them down. On the other hand, very few defenders are resourced to be able to perform the type of technical analysis I've shared today. It's counter-intuitive, but withholding basic technical details about how these attacks are working in an asymmetry that mostly benefits attackers -- you quickly end up in a situation where attackers have access to insights about the vulnerability/exploit that defenders don't have.

This bug also shows that we have an over-reliance on fuzzing for security assurance of complex parser code. Fuzzing is great, but we know that there are many serious security issues that aren't easy to fuzz. For sensitive attack surfaces like image decoding (zero-click remote exploit attack surface), there needs to 1) be a bigger investment in proactive source code reviews, and 2) a renewed focus on ensuring these parsers are adequately sandboxed.”

Hasnain says:

At some point I need to sit down and write a database. This was an exciting read.

“As the DuckDB team points out, vectorized interpretation or JIT compilation seem like the future for database expression execution. These strategies seem particularly important for analytics or time-series workloads. But vectorized interpretation seems to make the most sense for column-wise storage engines. And column-wise storage normally only makes sense for analytics workloads. Still, TiDB and Cockroach are transactional databases that also vectorize execution.

And while SQLite and PostgreSQL use the virtual machine model, it's possible databases with tree-walking interpreters like Scylla and MySQL/MariaDB have decided there is not significant enough gains to be had (for transactional workloads) to justify the complexity of moving to a compiler + virtual machine architecture.”

Hasnain says:

The moves this guy has been orchestrating are amazing.

“The strategy the UAW is currently employing is led by the union’s new militant president, Shawn Fain. He was elected in March after the UAW changed its election process from a delegate system to one member, one vote in the most recent leadership election. He has assumed a new posture for the union’s leadership: for example, refusing to endorse Joe Biden for president until he supports the UAW’s efforts to unionize electric vehicle facilities, and rejecting a ceremonial handshake with auto manufacturer bosses before the start of contract negotiations.”

Hasnain says:

I’ve started playing it and liking it so far. Wish I had more time/energy to sink into it.

“In hindsight, Microsoft made a big oopsie; Baldur’s Gate 3 has no exclusivity tied to it, so its exclusion from the Xbox console was noticeable. In February, Larian Studios explained why Baldur’s Gate 3 didn’t have a planned Xbox release at the time. Vincke said on X — then Twitter — that Baldur’s Gate 3’s split-screen co-op didn’t work on Xbox Series S, Microsoft’s lower-priced console. Microsoft requires games to have feature parity across Xbox Series X and Series S, which held up the launch. By Aug. 24, after Baldur’s Gate 3’s major successes, Microsoft made a concession to let Baldur’s Gate 3 launch without split-screen co-op on Xbox Series S.

Baldur’s Gate 3 is now expected to arrive on Xbox later this year.”

Hasnain says:

"An early win is a well-documented technique known among gambling researchers and clinicians as a catalyst for addictive play, because it creates an early dopamine hit that gamblers are then eager to recreate, even as their subsequent losses mount.

A gambling operator that orchestrated this outcome would probably lose their licence to operate in Britain but there is no clear disincentive for gaming firms.

Gambling tends to spur much greater ethical concern and regulatory scrutiny, yet overlap – in practice and even game design – is becoming increasingly evident."

Hasnain says:

Chock full of amazing advice. I'm aiming to revisit this one periodically.

"“It’s about asking the right questions, the ones that keep you focused on growth and learning, not on moving up. My best teammates have been the ones who constantly pushed themselves to identify their weaknesses, systematically learn from their mistakes and get better,” she says."

Hasnain says:

This has been a glory to watch. still surprised the PR team let the CEO on TV to do that massive bungle earlier this week.

“But there’s something else, something maybe even more significant. While the Big 3 automakers have helped make this a pivotal moment, because fighting them means fighting corporate America in so many ways, the workers have also turned this into a crucial fight, because they embody our hope. Not only is the union explicitly fighting for the working class, they’re open about the class war nature of this struggle. UAW president Shawn Fain was recently asked about corporations and pundits accusing him of engaging in class war, to which he replied, “It's hard when I hear that not to just die laughing because the truth is the working class in this country has been under attack in a one-sided class war for decades.” And it’s true. What else could you call the CEO raises and the investor paychecks, when you stack them up next to the stagnant wages of workers? Not to mention the stripping of pensions, the creation of tiers where newer workers get screwed, labeling workers as temporary employees for years and years, and so much more.”

Hasnain says:

“The big solution? Remember at all times what our core mission is: to communicate truthfully, keeping top of mind that we have a public service mission to inform the electorate and hold powerful people to account. If that’s our north star, as it should be, every editorial judgment will reflect that.”

Hasnain says:

Okay this is pretty nuts, wonder what would have happened if cameras like this were not a thing.

“On Tuesday, however, when the hiker was spotted on the Dumpling Mountain camera, only a handful of viewers were online, making the sighting even more remarkable. On Saturday, when the Guardian checked the camera, only 19 people were watching the live feed.”

Hasnain says:

There’s some interesting anecdotes here about working in big tech and career growth but I cannot get past the fact that the author just… took code from one employer to another, then open sourced it at the second employer (without permission) when the project got canned. And even now just says the companies are welcome to contact him about this if they like.

Like….

“You won’t have the opportunity to take lessons away from the project if you see the sunsetting of the project as a failure: there’s often much to learn about what non-technical aspects of the project broke down. Perhaps there aren’t any, and maybe management is just a group of fools! But often that’s not the case; your delicately milled cog wasn’t ripped out of the machine because it was misunderstood, it was ripped out because it didn’t operate smoothly as a part of the larger system it was installed in”

Hasnain says:

“A mere zipfile with a csv in it seems so diminutive, but in fact an enormous mass of financial applications use this particular zipfile every day. I'm pretty sure that's why they've left those commas in - if they removed them now they'd break a lot of code.

When open data is made really easily available, it also functions double duty as an open API. After all, for the largeish fraction of APIs in which are less about calling remote functions than about exchanging data, what is the functional difference?”

Hasnain says:

Goodwill and trust: so hard to build, so easy to lose it all and never recover. Case in point right here.

“Despite the partial walkback, some developers say they still plan to move from Unity to another engine. Aaron San Filippo of Whisker Squadron developer Flippfly, for instance, said he doesn't care if Unity reverts the new pricing scheme completely: "They’ve made it clear it’s not safe to work with this engine."”

Hasnain says:

Great and insightful read. For all you think of Romney, there’s information here that’s new.

“He joked to friends that the Senate was best understood as a “club for old men.” There were free meals, on-site barbers, and doctors within a hundred feet at all times. But there was an edge to the observation: The average age in the Senate was 63 years old. Several members, Romney included, were in their 70s or even 80s. And he sensed that many of his colleagues attached an enormous psychic currency to their position—that they would do almost anything to keep it. “Most of us have gone out and tried playing golf for a week, and it was like, ‘Okay, I’m gonna kill myself,’ ” he told me. Job preservation, in this context, became almost existential. Retirement was death. The men and women of the Senate might not need their government salary to survive, but they needed the stimulation, the sense of relevance, the power. One of his new colleagues told him that the first consideration when voting on any bill should be “Will this help me win reelection?” (The second and third considerations, the colleague continued, should be what effect it would have on his constituents and on his state.)”

Hasnain says:

I’ve been watching TikToks for food and diet advice here and there so this is quite scary.

“The analysis of thousands of posts found that companies and industry groups paid dietitians for content that encouraged viewers to eat candy and ice cream, downplayed the health risks of highly processed foods and pushed unproven supplements — messages that run counter to decades of scientific evidence about healthy eating. The review found that among 68 dietitians with 10,000 or more social media followers on TikTok or Instagram, about half had promoted food, beverages or supplements to their combined 11 million followers within the last year.”

Hasnain says:

“The degree to which these problems just aren’t a thing in other languages can’t be overstated either. In Haskell or Go, “async code” is just normal code. You might say this isn’t a fair comparison—after all, those languages hide the difference between blocking and non-blocking code behind fat runtimes, and lifetimes are handwaved with garbage collection. But that’s exactly the point! These are pure wins when we’re doing this sort of programming.

Maybe Rust isn’t a good tool for massively concurrent, userspace software. We can save it for the 99% of our projects that don’t have to be.”

Hasnain says:

“Which means that people like me spend a lot of time studying these crashes to figure out what is going on, only to conclude that they were caused by other people abusing the system.”

Hasnain says:

“Some believe the true answer to Heilbronn’s triangle problem won’t be a whole lot bigger than his original guess of 1/n2. “If I put points in a structured way, I fail; if I put points in a random way, then I fail. It can’t be too structured, it can’t be too random, therefore it probably doesn’t exist,” Bloom said. But Zakharov is hoping for a different answer. The intuitions that support an answer of 1/n2 are “kind of boring,” he said. “I would very much prefer if it was n3/2.””

Hasnain says:

I remember poking at some of the code here back in the day and being excited - this is great to see.

“So there you have it. We kicked the tires on Static Hermes a bit, played around with a micro-benchmark, and even managed to soup it up — way up. Turns out, understanding a little bit about how Static Hermes (or any compiler, really) thinks can go a long way in making your code faster. But it’s not like you need to pull out all the stops for every piece of code you write.”

Hasnain says:

“In a separate case involving all 50 US states and the District of Columbia, Intuit, in May 2022, agreed to pay $141 million in restitution to nearly 4.4 million consumers who "started using TurboTax's Free Edition for tax years 2016 through 2018 and were told that they had to pay to file even though they were eligible to file for free using the IRS Free File program offered through TurboTax," New York Attorney General Letitia James' office said at the time. Under that settlement, Intuit was required to stop its "free, free, free" ad campaign.”

Hasnain says:

Talk about finding a needle in a haystack…

“Our investigation found that a consumer signing system crash in April of 2021 resulted in a snapshot of the crashed process (“crash dump”). The crash dumps, which redact sensitive information, should not include the signing key. In this case, a race condition allowed the key to be present in the crash dump (this issue has been corrected). The key material’s presence in the crash dump was not detected by our systems (this issue has been corrected).

We found that this crash dump, believed at the time not to contain key material, was subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network. This is consistent with our standard debugging processes. Our credential scanning methods did not detect its presence (this issue has been corrected).

After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor was able to successfully compromise a Microsoft engineer’s corporate account. This account had access to the debugging environment containing the crash dump which incorrectly contained the key. Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key.”

Hasnain says:

I regret that I canceled the NYT sub ages ago so I can’t cancel again.

“On August 22, the day before publication, Heidi says she began to fear the story would be just that. She’d traveled three hours to Springfield, Missouri to watch Reed testify at the Greene County Courthouse in a hearing on whether to allow Missouri’s gender-affirming care ban to come into effect.* Ghorayshi was there too, and watching Ghorayshi interacting with Reed “in the exact way she was talking to us,” Heidi began to suspect the story would be a positive portrayal of Reed, the woman she’d proved had misrepresented her daughter’s private medical history in a sworn affidavit. Angrily, she confronted Reed, identifying herself as “liver toxicity mom.” During their encounter she describes seeing Reed looking over to Ghorayshi during the encounter, seeking support.

According to Heidi, the confrontation ended with herself in tears, and Reed laughing as she walked away. “This is a positive portrayal of her,” she recalls telling Ghorayshi. “We’re out. We’re out.”

This wasn’t what Ghorayshi wanted to hear. As Heidi describes it, Ghorayshi followed her to her car, at one point standing in an open car door to prevent them from driving off, adamantly arguing for the family not to leave, not to end the conversation, and above all not to pull out of the piece. Eventually, Heidi and her husband drove away, feeling certain that they were through. But Ghorayshi called and called, and eventually they relented, allowing her to come to a hotel room they’d booked for the night. There, the three spent hours going over every paragraph, as described in detail by Ghorayshi, of what the upcoming NYT article would contain.

Heidi and her husband weren’t happy with what they heard, but now they were faced with a terrible dilemma. If they pulled out of the story there would be nothing on the record showing that Reed’s affidavit directly misrepresented a specific event.

“You’ve betrayed us, Azeen. You have completely betrayed us,” Heidi recalls telling Ghorayshi that night. Defeated, they eventually agreed that their story would remain in the piece.”

Hasnain says:

“But it’s striking nonetheless that Chili’s, and not church or the local playground, is where Americans today are most likely to cross paths with someone of a different income class.

Viewed one way, this is a failure of civil society: Public institutions have been woefully unsuccessful, in some cases counterproductive, in knitting together different socioeconomic strata. Of course, the kinds of policy changes that might encourage more inter-class elbow-rubbing generally face fierce political opposition (busing, for instance, or relaxing zoning rules). Some might also compromise other valuable services public institutions provide. Having more local libraries is good for promoting access, even if closing and consolidating a few could theoretically promote more class mixing.”

Hasnain says:

I found this interesting and kept nodding along - not just cause I worked on something called Invariant Detector. Programs need to have a model of the world and using invariants helps me get the machines to check my work. It’s hard to imagine programming without them.

“Invariants are a powerful tool for reasoning about algorithms, data structures, and distributed systems. It's worth thinking through a set of invariants for any complex system or algorithm you design or implement. It's also worth building your implementation in such a way that even global invariants can be easily tested in a deterministic and repeatable way.”