• 0 Posts
  • 208 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle


  • I can’t imagine how you think it’s incredibly simple. These things are hell to explain to pretty much any normal person who needs to know why there’s no picture on the monitor or why their laptop/phone is not charging, or why the keyboard isn’t working in BIOS (no USB 3 support so you gotta switch to a USB 2 port). Add to that the combinatorial complexity of different cables and hubs supporting different things, and no tools for troubleshooting what feature is missing (and where in the chain) or what is suboptimal.

    Worse, sometimes it’s my boss who thinks they can cheap out and get a USBC dock instead of a proper dock, forcing me to run at non-native lower resolutions or unable to use a second screen.







  • Oracle has a product called Oracle Policy Automation (OPA) that it sells as “you can write the rules in plain English in MS Word documents, you don’t need developers”. I worked for an insurance organization where the business side bought OPA without consulting IT, hoping they wouldn’t have to deal with developers. It totally failed because it doesn’t matter that they get to write “plain English” in Word documents. They still lack the structured, formal thinking to deal with anything except the happiest of happy paths.

    The important difference between a developer and a non-developer isn’t the ability to understand the syntax of a programming language. It’s the willingness and ability to formalize and crystallize requirements and think about all the edge cases. As an architect/programmer when I talk to the business side, they get bored and lose interest from all my questions about what they actually want.









  • Is it really too much to ask that apps/devices are made secure from the ground up?

    In a way, yes. They can and should definitely be made with security in mind from the ground up. But they will never be totally secure, and a necessary part of what constitutes a “secure product” is to continuously and quickly patch security issues as they become known.

    Surely that’s just a secure end-to-end encrypted connection?

    I would bet it’s still a bit more than that. But even if it’s just a secure end-to-end encrypted connection, here is the list of vulnerabilities fixed in OpenSSL (which is probably what they use for secure encrypted connections). It’s five so far in 2024. Then there’s some OS kernel below that which can have security issues as well. The Thermomix probably also has user authorization components and payment methods, plus various personal information that has to be protected under GDPR.


  • I agree that the current system is broken. So let’s say that instead of paying $300 for a pair of headphones that last three years, you pay $8.33 / month for renting the headphones. Now, if the headphones break after three years the manufacturer has to produce new ones for you. That’s an undesirable cost for them.

    It is now in their best interest to make headphones that will last a long time and that they can repair if something breaks. But also, since you can easily cancel the subscription at any time, it is in their interest to offer you something that is competitive. They might even upgrade to better technology over time or add new features to the bundled app to keep you as a customer. Or alternatively, lower the subscription cost over time to reflect the relative value of the headphones.

    For you, there’s also the benefit that there’s no high upfront cost that you can’t reverse. You’re paying for what you can afford in your current situation. If you lose your job you can stop paying for the headphones at a moment’s notice. I imagine that this would leave fewer people in credit card debt.



  • Something like myfitnesspal or a thermomix shouldn’t be a subscription, there is no major updates to how someone tracks their exercise uses a hot blender that justifies it beyond users being locked in.

    I won’t dispute that both of these likely abuse the subscription model for their benefit. But they definitely have a social responsibility (and in many cases a legal responsibility) to keep updating the software in these products and the network infrastructure that go with them. The internet of things is one of the most vulnerable attack vectors we have. It has been exploited many times not just to attack individuals, but to create massive bot nets that can target corporations or even countries. The onus is on the manufacturer to continuously keep that at bay. You know what they say - the “S” in “IOT” stands for security.