I'm confused by the status page. It says no active incidents, also no recent incidents. But when you click on a list of all incidents, there are 4 from earlier today with the most recent one from 1 hour ago. Is that not considered "recent incident"?
There are these charts, studies, and articles about global wealth inequality that make the rounds every now and then. They often make the point one would expect them to make. I was nonetheless surprised to learn that because of the way assets and debt are used to calculate these numbers, the poorest people in the world aren't those surviving on $0.10 of daily income in some underdeveloped part of Africa as one might think, but rather an odd mix of med or law school graduates in the US and stock traders or gambling addicts in rich countries. One French dude alone is at the bottom with a net worth of -$8B.
Probably depends on the company. Plenty love to publish useless blog posts about how “We, a SaaS company that produces React components, fixed a vulnerability in Ubuntu Kernel” because we’re involved in all of our tech stack like that. Linux kernel, node and react is our stack and we take ownership of it seriously dawg.
I don't disagree with you, but I think generally when the mistake involves compromised user data, the answer is a bit more emotionally driven. People get rightfully mad when things like that happens, and services usually keep the incident in a "Mitigated" status while they "work with their customers to ensure blah blah blah" or whatever. Everywhere I've personally worked the Mitigated->Resolved involves publishing a postmortem, repair items, and general assurances or safe guards based on learnings from the incident that the issue won't happen again. However, the industry as a whole doesn't have a standard for what the line between Mitigation and Resolution is.
So the active incident is now fixed and they've already reached out to impacted customers but they can't mark it as resolved yet because they are still yet to publish a more detailed blog post?
Okay so let's just say you are one of those affected users
The founder of the company has already emailed you with details and their support team is around for you to ask any follow-up questions. Also the bug/exploit has been fully fixed
At this point are you saying you would actually be upset and leave because the incident on their status page has been marked as resolved?
What makes you think it's fixed? They just state that they "blocked the exploit", and that could mean anything:
- did they just take the affected API offline?
- or did they just disable the account of the attacker?
- or is the exploit actually being fixed?
Environment variables are sensible data, and marking a security incident as resolved with that little detail is quite a take. Even changelog entries for harmless bug fixes are more detailed.
I assume it's fixed based on it being marked resolved and from what was communicated. Yeah I agree it's a major issue but if it's fixed what they have done so far seems totally fine
This has been happening before AI, but AI has turned it up to 11. The way I usually put it, senior engineers are the new engineering manager, engineering managers are the new product managers, and product managers are now something in between sales, consultants or social media contacts. AI made senior engineers pick up more product management from their engineering managers, and engineering managers are picking up more sales and social engagement, and product managers are in a limbo but the young ones are pushed to junior engineer roles.
In large companies there is also the politics game. The more freed time senior engineering manager and senior product managers get, the more politics intensives and waste more of their time.
I use the term “product management” in its traditional sense of establishing scope, feature prioritization, user experience, shape of integrations, etc.
I’ve worked most of my career without dedicated product management support (very early startups and internal infrastructure teams at large companies), having to do that myself (both as an individual contributor engineer and as a very technical manager). So I have to wonder how much has the industry changed, and how much has your location within the industry drifted?
Yes my view mostly from within large engineering organizations. And yes, what you describe is pretty typical for engineers (and especially founding engineers) in young startups. Doubly so if it’s a startup with a technical product. Large organizations always envied startups’ efficiency and pace because of that, which is why the traditional sense of product management has been handed to engineering teams. This has been happening in the enterprise side for a long over the last 15 years and predates AI as I mentioned. It’s just more collapsing of disciplines now which is the answer I was giving to OP’s question.
Warren Buffett once gave a great answer to a similar question, but it was about the textile industry. He said technological advances that promise to reduce waste by x% or improve efficiency by Y% or boost production by W% or reduce cost by Z% rarely actually pay off. They would get textile machines manufacturers promising them great improvements in the new line of machines, and for the most part, those improvements would be realized, but their end margins as a business wouldn’t improve. He said it’s simply because the same technological edge is given to all their competitors as well. With no moat (his famously favorite metric) all textile makers were always competing on the same grounds regardless of the technological progress.
Maybe moat is also just product quality? I.e. having the "taste" or knowledge of what the consumer actually wants, and the ability to apply it correctly, can also allow you to win. Because right now some of the AI industry wins on Moat (mostly hardware - both in terms of ownership and production know-how), while some wins on perceived quality being higher regardless of price (e.g. Opus 5.5 dominates from what I can see despite Deepseek Flash V4.1 existing). People will choose the best product, not just the cheapest, unless the quality loss is okay in a given context.
Well, the net growth is taken by the AI/tool providers, who indeed bring productivity growth, so the society as a whole see improvements. I guess this is not bad?
I think it's mostly about attach surface. There is nothing fundamentally different in the threat model or security boundary between any language in terms of how they manage their dependencies. Even platforms like Maven or NuGet that don't have an install script, you're still likely to trigger a build or a quick run for the application right after installing that would trigger code execution anyway.
The chances of a person getting hit during the `npm install` phase is bigger but not that different than the `dotnet add package ... && dotnet run`.
I do agree though that the massive surface of npmjs, pip, and even cargo means that package signing is also not realistic. If you have the average 300 npm packages, no one is gonna pay attention to the authenticity of 200 different signing keys. It would be a lot easier with something like java where you probably just need to trust a handful like openjdk, jackson, junit, or log4j keys and be 90% there. (And hope the supply chain attack hasn't compromised the signing keys too of course)
The reason execution on install is a bigger deal than execution on import/run is because a lot of developers today run their code inside of sandboxed environments (containers, VMs, etc.) which prevents the malware from easily accessing stuff like session tokens.
not saying it's not possible to setup your environment that way, but in my experience, if you're installing outside a sandbox, you're also running outside a sandbox. I don't even follow the flow of installing packages outside said sandboxed environment being a container or VM and running inside it. People who use dev containers will have the entire toolchain in the dev container, and with VMs, while you could share the file system with something like virtio-fs or SMB/NFS, I don't understand the flow of `npm install` on the host then run in a VM. that sounds pretty awkward to me.
That sounds insanely expensive. AWS S3 only makes sense if your workload is also in AWS. Using AWS S3 while having your compute elsewhere is a recipe for an insane egress bill.
reply