For business running the same code on their 1 node instead of N is not a replacement, because their counterparty has no reason to trust whatever is running on that 1 node.

Your reasoning re: N nodes are expensive is also flawed. Executing a single payment transaction takes a fraction of a second of compute. Even if it is replicated 10,000X, it's still extremely cheap compute-wise. The low cost of transactions has nothing to do with subsidizing.

If I understand the argument of the author here:

> Attackers like me use SQL injection attacks to recover SQL schemas. The schema is the product of an attack, not one of its predicates

The author appears to imply that once the vulnerability is found, the schema can be recovered anyway. It is not always the case. It is perfectly viable to find a SQL injection that would allow to fetch some data from the table that is being queried, but not from any other table, including `information_schema` or similar. If all the signal you get from the vunlerability is also "query failed" or "query succeeded, here's the data", knowing the schema makes it much easier to exploit.

> the problem is that every computer system connected to the Internet is being attacked every minute of every day

If you specifically log failed DB queries, than for all the possible injections that such 24/7 attacks would find you have already patched them. The log would then be not deafening until someone stumbles on the actual injection (that, for example, only exists for logged in users, and thus is not found by bots), in which case you have time to see it and patch before the attacker finds a way to actually utilize it.

Knowing schema both expedites their ability to take advantage of the vulnerability, but also increases their chances of probing the injection without triggering the query failure to begin with.

It took me a while on the website to understand what it was all about. As it is it looks more like a website for a functional programming language.

Comments URL: https://news.ycombinator.com/item?id=22947105

Points: 2

# Comments: 0

Similarly, Google quality is in big part due to invaluable information of what URLs were clicked for what queries.

If duckduckgo had access to that information, their quality would've been way higher, and there's no reason I as a user shall not be able to give access to the information I generated for Google to another service.

The investor day can save you a lot of time fundraising later if you close few people on the spot, so make sure to be ready for a 20 minutes session with a longer coherent pitch and answers to the common questions.

In my batch (W17) the investor say was completely deemphasized for some reason, and many companies came unprepared, myself included

A good startup with strong engineering team and fast shipping cycle will provide with way more learning opportunities than FAANG.

Personally, I think for a fresh grad going to an early stage startup or to FAANG is a close call in terms of value. 1.5-2 years at FAANG gives a good boost to the resume to pursue better opportunities later, while 1.5-2 years at a startup can provide more learning and potentially some upside already. At that stage there's time to take chances either way. A close-to-IPO company is also a viable option.

My goal in the article was not to say startups are bad (or good), but rather to provide insights so that people can make more informed decisions.

ICPC is a great way to start your career if you were unfortunate enough to get born in a noname city somewhere in ex-Soviet Union, thus people are pretty motivated to do well. In US by the time you graduate you already have few internships in your resume, and are pretty figured career wise, so naturally the benefits of ICPC are less attractive.

Comments URL: https://news.ycombinator.com/item?id=19266862

Points: 3

# Comments: 0