Skip to content
0
  • Home
  • Piero Bosio
  • Blog
  • World
  • Fediverso
  • News
  • Categories
  • Old Web Site
  • Recent
  • Popular
  • Tags
  • Users
  • Home
  • Piero Bosio
  • Blog
  • World
  • Fediverso
  • News
  • Categories
  • Old Web Site
  • Recent
  • Popular
  • Tags
  • Users
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone
David Chisnall (*Now with 50% more sarcasm!*)undefined

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange
About
Posts
16
Topics
10
Shares
0
Groups
0
Followers
0
Following
0

View Original

Posts

Recent

  • I did not have Trump killing the Fortran 77 compiler industry on my bingo card.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    I did not have Trump killing the Fortran 77 compiler industry on my bingo card.

    (The F77 compiler industry is entirely subsidised by the DOE, because they have a codebase written in F77 that, by law, cannot be modified unless its revalidated. It can be revalidated only by modelling a nuclear bomb exploding then actually exploding one and seeing whether they are the same. They would love to move it to F90 or newer but can't as long as the test-ban treaty is in effect.)

    Uncategorized

  • The FreeBSD platform was merged into the OCI runtime spec!
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    The FreeBSD platform was merged into the OCI runtime spec!

    FreeBSD is now an official target for OCI containers (it’s been working in Podman as an unofficial target for a while).

    #FreeBSD #OCI

    Uncategorized freebsd oci

  • A lot of people talk about how Columbus was genocidal and various other kinds of awful, but there isn't enough coverage of how much of an idiot he was.'nThere's a myth that he was trying to sail around the world to prove that the Earth was round.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    A lot of people talk about how Columbus was genocidal and various other kinds of awful, but there isn't enough coverage of how much of an idiot he was.

    There's a myth that he was trying to sail around the world to prove that the Earth was round. This wasn't a thing that needed proving. The ancient Greeks not only knew that the Earth was round, they fairly accurately measured the diameter. By the time of Columbus this had been refined with even more accurate results.

    Columbus wanted to open up a trade route to India via the ocean. He struggled to get funding because ships of that time couldn't carry enough supplies to feed the crew for the time it would take to sail all of the way from Portugal to India in a great circle arc. They would all starve before they got half way.

    He was lucky that there was an unexpected continent in the middle (which he thought was India, because he had zero clue about the size of the Earth) and that the people he met were Indians (because he was racist).

    He was a lucky idiot. I'm sure you can think of modern analogues.

    Uncategorized

  • I disagree with a lot of people here, and that's fine.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    I disagree with a lot of people here, and that's fine. We can disagree on what tax rates should be. We can disagree on the best mix of public and private ownership. We can disagree on the amount of government involvement in markets. We can disagree on what privacy rights need to be protected by governments versus which need to treat the government as the adversary. We can disagree on which OS is best. We can disagree on the best way to build a Free Software ecosystem (we can even disagree on whether that's a desirable goal).

    But we can't disagree on which people are people. If your perspective is that some people are not people, there is no way that we can still have a meaningful conversation. That's not a 'there are two sides' kind of debate. That's a 'no, this isn't a debate and we can't build a functioning society if you disagree' kind of debate.

    Uncategorized

  • My (non-programmer, definitely not a programmer, does not like programming) partner just said:'n'n Google sheets is ridiculous.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    My (non-programmer, definitely not a programmer, does not like programming) partner just said:

    Google sheets is ridiculous. This is so much easier in Jupyter notebooks [with Python + Pandas]. I'm going to do it in Jupyter.

    In case anyone is wondering what prolonged exposure to me does to a person's sanity.

    Uncategorized

  • If you want to understand humans, start by looking at clip-on ties.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    If you want to understand humans, start by looking at clip-on ties. These are the result of a surprising amount of design work to look like normal ties, but they have the benefit that you can wear them around heavy machinery and, if they get caught, your head doesn’t get pulled in and squashed between cogs. Most humans prefer to avoid painful death, so this has clear benefits.

    Now, those of you more familiar with rational species may ask ‘wouldn’t it be simpler to just change the dress code so that people operating the machinery didn’t have to wear ties?’ And, of course, the answer is yes. And, it turns out, factory managers are not complete idiots and realise that having skilled workers killed by machinery (and then having to take the machines out of service to clean the blood and bones out) was not beneficial to profits.

    But ties were worn by professionals. People would rather ignore a rule that would literally save their life than violate the social norm that people in their in group wore ties. Being perceived as not being a member of the professional class was a bigger risk than possibly dying.

    Eventually, these things shifted and (almost a hundred years after the clip-on tie was invented), more people are happy to not wear a tie as an in-group signifier (they have other ones, don’t worry, humans didn’t suddenly become sensible).

    Sometimes they shift because a respected person ignores them. For example, the Department of Computer Science and Technology in Cambridge is informally known as the Computer Laboratory. This used to be its official name and before that it was the Mathematical Laboratory. At the time it was founded, all faculty were required to wear gowns most of the time (in lectures and so on), but there was one exception. For entirely sensible not-being-on-fire-related reasons, you didn’t have to wear gowns in laboratories. Maurice Wilkes really hated gowns, so designated the entire department as a lab: no gowns permitted.

    He was willing to violate the norms, and gradually the norms changed.

    Note also that he could do this because there was a loophole in the rules (as there always is). Give humans a set of rules that they disagree with and they will search for loopholes. Give them a set of ludicrous cultural norms and they will defend them with religious fervour.

    Rules don’t change how people behave. Rules that actually work encode things everyone agrees with and provide you with a mechanism to deal with the outliers who refuse to follow them. Most people refrain from murder because they think living in a society where people aren’t randomly killed is a good idea. Laws against murder don’t prevent it, they give you a process to deal with the tiny minority who think killing people is a good solution to problems.

    With very few exceptions, successful laws follow changes in broad consensus on acceptable behaviour. They don’t cause these changes.

    Uncategorized

  • How to design a GDPR-compliant cookie banner:Have a 'reject all' button that is as easy to press as the buttons that grant consent
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    How to design a GDPR-compliant cookie banner:

    1. Have a 'reject all' button that is as easy to press as the buttons that grant consent.
    2. Test your site with no consent for user tracking.
    3. Realise that all of the tracking bits are unrelated to site functionality.
    4. Remove them.
    5. Remove the cookie banner.
    Uncategorized

  • I posted this on LinkedIn a couple of years ago, but some recent posts made me think it was worth reposting on a platform that people actually read
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    I posted this on LinkedIn a couple of years ago, but some recent posts made me think it was worth reposting on a platform that people actually read.

    No, you don't need to hire more women

    You can't solve any problem until you understand the problem that you're trying to solve and diversity and inclusion (D&I) is no different. I was Director of Studies for Computer Science at Murray Edwards (an all-women Cambridge college), have been Chair of the Microsoft Cambridge D&I Committee and sat on the D&I Council for Microsoft Research (worldwide), so this is a topic that I find myself discussing a lot.

    A lot of the D&I-related conversations that I've had over the last few years have begun with someone telling me that their group needs to hire more women (or members of some other under-represented group - feel free to mentally substitute any other such group as you read this post) and asking me how to do it.

    The number of women in an organisation is very rarely the underlying problem. It is a trailing indicator of an underlying problem, a spot health check, not an optimisation goal. If hiring more women is really the most important requirement, it's easy to solve: walk into any unemployment office and you'll find around half of the people there are women looking for jobs. Of course, most won't have the skills that you need (that, after all, is why you have a hiring process involving CVs, interviews, and so on) and hopefully that gives you a hint that just hiring people because they are women isn't actually the right solution.

    It's very easy to set up metrics about number of women in each organisation and drive evaluation of culture based on that. This can often make inclusion worse for your company. Imagine being a woman in an all-hands meeting when someone in a leadership position puts up a graph of the number of women in the org and congratulates the leadership on the fact that it's going up. Your first thought will probably be something along the lines of 'was I hired just to meet some quota?' Your second (more worrying) thought may be 'do all of my co-workers think I was hired to meet some quota?' Now, you're immediately second-guessing your own competence and expecting other people to think you're underqualified.

    So why should a company care about the number of women in a group? If just hiring more women doesn't solve the problem, that suggests that what we really want to do is hire and retain the most qualified people; if a particular group is underrepresented, that may be because your hiring and retention favours or disadvantages some people for reasons other than competence. If the best candidates are self-deselecting before you even get them to interview, that's a problem. If the best candidates are being filtered out because HR doesn't really understand the job, or because your hiring process magnifies implicit biases, that's a problem. If the best people are leaving because of your team culture, that's a problem.

    When I've talked about D&I, I've often been approached by people afterwards saying that D&I is great, that helping disadvantaged people is nice, but that they need to focus first on business impact. This misses the point. Companies don't engage in D&I activities to be nice or to help people. Companies engage in D&I activities because hiring and retaining the best people has a greater business impact then hiring and retaining the best out of an arbitrary subset of the candidate pool. It's important to keep that in mind with diverse hiring: you are not doing diverse candidates a favour by hiring them, they are doing you a favour by allowing you to benefit from their skills and unique perspectives.

    Various studies have shown that teams with diverse perspectives do better. It's easy to focus on a single dimension here but a team of male, rich, white, Eton-educated, Oxford PPE graduates will not get much benefit if they start hiring female, rich, white, Eton-educated, Oxford PPE graduates. Diversity of viewpoints comes from a large number of axes, including education, interests, gender, ethnicity, and so on. Optimising for a single dimension will not give you the desired results.

    Even though the root problem for your company is not the number of women that you employ, that statistic is still an easy metric to give us a quick culture health check. In the last few years, the number of women graduating from computer science degrees in the UK has remained at around 20%, so at first glance you should expect an organisation that hires computer science graduates to be about 20% female.

    That high-level stat doesn't tell the whole story though. As a middle-class white boy, there are a lot of conversations I never had. No one told me I shouldn't be interested in computers because they're a girl's thing. No one called me a race traitor for being interested in mathematics because it's not a white thing. No one told me 'boys can't code'. No one ignored me as a possible candidate for extra classes in a STEM subject because I was a boy. In my time at Murray Edwards, I heard stories like these from countless (female) STEM students about their time at school.

    Any woman who even made it into the first year of an undergraduate computer science programme overcame far more obstacles than someone like me. By the age of 18, they've already shown a passion for the subject that let them push through these barriers. The fact that many will have left the field in spite of their aptitude is a separate problem that schools need to solve. As an employer, are you more interested in the candidates who care deeply about the subject, or the ones that coasted through looking for a well-paid job? If it's the former, then you should probably expect more than 20% of your candidate pool to be women. A lot of under-represented groups are far less under-represented in the top 10% of a field than in the field as a whole. That still doesn't mean that's the metric that you should optimise for, just a suggestion of where your ballpark culture health check should be.

    So why is your group less than 20% female? It might be simply a small group. For a team of five people, assuming that 20% of the qualified candidate pool is female and that you hire at random from that pool, you have around a 33% chance of being an all-male team. If you're hiring for a particularly rare skill set, there's a good chance that this will be higher: you're relying on candidates being available on the job market at the same time that you're hiring. The same probabilities work with respect to the available candidate pool: if there are only three qualified candidates on the job market at any given time, there's a >50% chance that they'll all be male. Groups that can hire speculatively (bring in competent people as they become available, rather than needing to hire someone this month) have a big advantage here, by being able to hire the most competent people when they're available.

    Does your hiring process favour a particular group? I'm not going to go into detail here because there's a staggeringly large amount of research on this topic. Whoever designs your company's hiring process needs to read a decent selection of this research and consciously design the process to minimise implicit bias. If no one has done this for your company then there's a very good chance that implicit bias is the dominant factor in hiring outcomes. This isn't limited to decisions made by humans. Amazon famously tried to use machine learning for hiring based on their current employee profiles and it learned that being male correlated strongly with being a good hire, so used that as the key metric.

    Do your culture or your HR policies favour retention of a particular group? The biggest single improvement that you can make for retaining women is, somewhat counter-intuitively, to improve paternity leave. If you offer six months maternity leave and six weeks paternity leave, then a mother in your team will be four and a half months behind a father. Worse, every manager of a team will have a higher expectation that women on their team may disappear with short notice for longer than men. There are lots of other subtle ways that team culture can favour groups, such as promoting people who speak a lot in meetings and so on.

    Gender breakdown isn't the only misleading metric. A lot of gender pay-gap reporting is nonsense because it shows that men and women of the same grade are paid the same, but doesn't account for promotional velocity or the relative expertise of people at a particular grade. If you're using any such metric then you need to be very careful that you treat it as a diagnostic indicator, not as an optimisation goal.

    Having a particular group under-represented in your workforce is almost certainly a symptom of an underlying problem but if you try to treat the symptom without treating the cause then you will fail.

    Uncategorized

  • Wow, Zoom is really leaning into dark patterns to make you install their app.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    Wow, Zoom is really leaning into dark patterns to make you install their app. Which, with their security track record is never happening on a computer that I even vaguely care about.

    Uncategorized

  • "Back to work today, forgot my pass so locked bike outside Cannon Street station.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    @futurebird @MarkHoltom

    I had a friend lose a key for a lock like that one, and we found that squeezing the barrel with some garden sheers popped it open. My bike came with a lock built into the back that has a slot for a chain (close it and it immobilises the back wheel). I really like that design and still have one, but the model it came with has the world’s worst lock: you can open it with a key blank.

    And no lock works against the attack that a gang did here 10-15 years ago: they came with a forklift and a low loader and pulled up the metal hoops that you attach the bike to. In five minutes, they were able to take an entire bike park. They presumably cut off the locks later.

    This is the main reason I haven’t bought an e-bike. My bike looks old and cheap. My main defence against theft is to always park near a more expensive-looking bike.

    Uncategorized

  • Once again, the depressing advice that security breaches have no long-term impact on share price has paid off.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    Once again, the depressing advice that security breaches have no long-term impact on share price has paid off. I bought UNFI at 24 in the dip after their big attack, sold today at 31. 30% gain in three months, roughly the same as I got from CrowdStrike after they broke everything. I wish this didn’t work as an investment strategy.

    Uncategorized

  • Remember, with the right it's ALWAYS projection.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    @cstross @Azuaron @Jennifer @ewen

    It's a bit more than that. A load of real estate funds were sitting on what was about to become negative equity because COVID reduced the demand for office space. A lot of loans came due this summer, but the new data centre leases let them refinance them and hide other losses. But that depends on their tenants not invoking early break clauses. Rather than the bubble bursting, it was propped up by another one. And that means they are likely to pop together.

    Uncategorized

  • Remember, with the right it's ALWAYS projection.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    @Jennifer @ewen @cstross

    The consensus at the end of the Second World War was that trade was a good disincentive for war. If all of your supply chains are threaded through potential enemy countries, it's very hard for you to go to war with them because it will break your economy. Asimov referenced this in the Foundation series.

    It's been quite successful. The down side is that it assumes rationality on the part of leadership. Putin is not acting rationally, but that's a relatively minor problem because Russia's economy is tiny and propped up by fossil fuel reserves that are rapidly dropping in value as alternatives price them out of the market.

    In contrast, the USA was a major advocate of free trade for most of the last century. This means a lot of supply chains are threaded through the USA. I think the statistic when Trump announced tariffs on Canada and Mexico was that cars made in North America enter and leave the USA seven times before they're finished.

    Nothing the USA does is irreplaceable, but moving to alternatives will take a while. Spinning up factory capacity and rerouting distribution takes a long time. And the drop in efficiency when this happens can easily cause recessions. The only way of avoiding that is a lot of government investment (which will likely cause inflation and so needs to be part of a broader stimulus package) and the UK government is completely incapable of that and I think most EU governments will also struggle.

    In the near term, the AI bubble is currently propping up the commercial real-estate bubble in the USA. When these pop together, it's going to wipe out almost a third of the value of the stock market, which will make a large number of pension funds insolvent. Trump is completely incapable of participating in the kind of multinational cooperation that followed the 2008 financial crisis, so the most urgent priority for other world leaders should be ensuring that they have a mechanism in place to instantly firewall the US financial system from the rest of the world. That probably takes at least a few years of preparation and I don't think the people who need to do it have started yet (I hope they have. And, for obvious reasons, if they did, they wouldn't be talking about it publicly).

    Longer term, a large part of the problem in the USA is caused of the concentration of wealth in the hands of a few. Incompetent politicians in the UK and EU want to recreate US big tech locally. What they should be aiming to do is create an ecosystem that is bigger and more valuable than the US big tech ecosystems, but where each individual participant is much smaller and where the failure of any company has limited impact. And that requires a lot more changes, starting with electing people able to think through the consequences of their actions more than one step.

    Uncategorized

  • Remember, with the right it's ALWAYS projection.
    David Chisnall (*Now with 50% more sarcasm!*)undefined David Chisnall (*Now with 50% more sarcasm!*)

    @cstross

    Wow, that thread is horrendous. Shows a big difference between the Fediverse's moderation (with overworked and mostly unpaid, yet amazing, volunteers) compared to those of a for-profit data-mining company.

    Uncategorized
  • 1 / 1
  • Login

  • Login or register to search.
  • First post
    Last post