ewokhead's comments

"Sorry for the snarky reply" is not enough, considering that you wrote it at the same time you could have gone back and rewrite the text into a polite, well-worded argument. That's just condescension - if you really were sorry, you'd have rewritten your text."

You are right. I am not sorry for the snarky reply.

"By replying like that you've ensured that your point won't come across - for all I know you might be technically right, but using that tone ensures that lots of people will refuse to read past the second paragraph."

Okay.

"If your argument is solid, that's all you need. IMHO, snark makes your point come across as bragging, and no one likes that."

Okay.

a: $port != 22 is enough to thwart most bots and skiddies. If you think the port number is a guarantee that you are safe or that you are communicating with a blessed ssh you are sadly mistaken.

b: Uhh the port number means nothing. Host keys are there for a reason... Someone does not understand the functions of SSH. http://www.snailbook.com/ <- great book

c: If you are not investigating fingerprint issues when logging in via SSH and you call yourself a sysadmin, please stop. You are going to be the reason your company ends up in the news because your shit got owned and 2,000,000 user account hashes were leaked blah blah.

d: If you are not using key based auth and you have a fly by night keystore policy. Which means you have a keystore - stop. The whole keystore for SSH shit irritates me. I cannot tell you how many times I have heard sysadmins say a that a single private key is a "best practice". It is not a best practice it is a stupid practice and really prevents you from protecting unauthorized logins on other machines for the obvious reasons.

   Put your public keys on bitbucket.com or source 
   management. Put your private keys on an encrypted disk
   in an encrypted archive if you must. This is still dumb
   imho because it is not needed.

   Leave one account (root) with console only/no ssh access
   that will allow for keys to be revoked/recreated when
   users need new keys.

e: The original article http://www.adayinthelifeof.nl/2012/03/12/why-putting-ssh-on-... Is wrong and misguided. port knocking or knockd is an obscurity measure, precisely the kind he argues against. The linked article from the OP calls this out.

f: Spinning up daemons is a big deal for non-priv users? So spinning up a remotely accessible Lisp out of emacs from a screen that is running in the background is bad? Hmm, here I thought that computers were meant to be tools for humans to get work done... Sorry, background processes are part of getting shit done. Users should be able to spin up the stuff they want to spin up in the network segments they have access to without the bureaucracy of misguided fools making the jobs of others more difficult because they think spinning up a gunicorn process or a custom daemon is worse than their unpatched kernel, apache tomcat and mysql listening on a publicly accessible address. Stateful firewalls and hosts allow/deny are there for a reason.

Sorry for the snarky reply here but there are a lot of people chiming in that obviously have very little knowledge about managing *nix ops and remote access. I have pretty strong opinions about this kind of stuff. Especially the single key stupidity and not checking host fingerprints.

"For an organization that fishes for ideas like it already owns them, its application process sure does suck. Not too innovative or creative there. "

Okay, so you think it sucks. How about offering up a solution. As it stands, you are still a part of what you perceive as a problem. Why not become part of the solution by proposing ways to "fix" the process? It seems like you are just complaining to complain. That sucks.

I am not sure what you mean by "For an organization that fishes for ideas like it already owns them" because by the definition of their business model if they invest in you then, well, they do own part of your business. Investments are best treated with objectivity and as if you were the owner, that is one of the basic principles of the Graham(as in Benjamin) and Dodd approach.

" It's not like I'm going to go into the scientific details of what I have in mind, what I am actually doing, or how I am doing it, when asked about having ever hacked something besides a computer."

You are missing the point of that query it seems.

"I know that I have the technical ability to accomplish what I have in mind."

Okay, so do it. Stop whining about the Y-Combinator process and execute on your vision. Why is seeking capital so important if you know you have the technical ability, since the implication in your statement is that the technical chops are all that matter. Go build and make them regret not investing. You realize that YC is one of many capital management companies that do early stage investing right?

What happened? Why are you angry about the process? How can it be improved? If you hate something, work to improve it. If all you do is complain about the problem and never attempt to fix it, you are part of the problem as well.

I hope that I see dgabriele running a successful company by the end of the year. That would be awesome.

I just show up and leave when I want. Being the average human I only think about things that impact me. Rather short sighted and selfish I know. But I have never thought about why people do not negotiate work hours because I assumed everyone did because it is what I negotiate hours when I decide to sign on somewhere.

I think that it rather obvious that people are comfortable with accepting the status quo. 9-5 is the standard workday. Because it is the "standard" people do not question it.

Going back to the original question, it is not a bad idea to negotiate work week hours.

I always negotiate work week hours. If a job requires that I show up at a certain time, I don't take the job. The job needs me. I do not need the job. As long as I ship, they should not care when I show up or don't show up.

It is an antiquated belief system that dictates work hours.

I still use Perl for a lot of things. I love it!

Switch modifications should never stop work.

Prod code push != prod infrastructure changes. Which is what the article is talking about. Specifically the agg. switching layer.

My reply is not about code deployments. It is about managing network devices with high visibility and impact.

I still stand by my original comment with a critical detail added:

Freeze prod ~infrastructure~ changes two weeks prior and two weeks after major holidays.

Push code all you want.

The RFO that they provided addresses link aggregation changes which are a part of an infrastructure change.

I just realized that the Sys. Admin/Prod. Ops to Developer ratio here is crazy low. Everyone assumes I am talking about code changes when the article is about prod switching and network transit device changes.

MLAG or any LAG technology, LACP, bonds whatever should never impact the deployment of code. It should be invisible when it is working. Obviously it is very visible when it breaks though.

My heart goes out to the Github guys!

Sorry for the confusion everyone.

Shipping code changes is a different beast.

I am talking about the infrastructure side of things.

I have built large scale percentage-deployment, slice deployment (whatever you want to call them) scenarios like you speak of but modifying an AGG switch that provides connectivity to your entire prod space... Uh.. Go ahead and use your philosophy for managing large infrastructure and I will enjoy my days off thanks.

This change is not a SHIP IT! change. This is a switching infrastructure upgrade. This is not a push from your CI into your rolling rel. system that updates prod applications.

This is an underlying infrastructure change with high impact and high visibility with many stakeholders at risk.

Sorry for any confusion that my, very vague, post caused.

Maybe someday I will become a fisherman. But for now, I will keep these switches and servers up and running with 99.999% uptime. It is what I love to do!

Got any fishing tips?

Yep, it is a long time which is why I mean to speak specifically on the infrastructure side of things. Modifying the agg layer providing connectivity for all prod systems during a holiday weekend would suck.

When I say prod, I mean prod infrastructure. Not code.

Sorry for the confusion.

Note to Github:

Freeze prod changes two weeks before and two weeks after all major holidays.

Your employees probably don't appreciate the hassle when all they are thinking about is "YEAH! DAYS OFF!"

Just my opinion and how I run my systems in the DC.

Okay. I won't.

Go ahead and tell that to your shareholders.

I have been working on this for two years. It is very difficult but the key is getting access to sellers before they talk to a realtor. That is how I did it. If you get the information before a realtor does you can avoid issues of conflicting interest, data rights etc. The MLS data is covered by license agreements as you would expect so you need to get to sellers before realtors do. That is my experience at least. Getting to sellers first is not that hard if you have a good mailing list that buyers and investors are interested in. Building a good mailing list is damn hard though.

Where are you located? I am looking for help on the programming side (I am a programmer as well). I would love to crush MLS and make it irrelevant. I hate it and everything it is.

Also, MLS data has yearly costs. I did not want to pay so I get access to the sellers first. Get them to sign some contracts saying I have exclusive rights to the data forever but I do not bar them from going to a realtor in the contract.

The whole premise of the post in the link is something that has been said a million times before.

Yes, execution is everything... So what. Everyone already knows this.

It makes me wonder if all of us are trying to convince ourselves that we need to work in order to get work done...

What is so groundbreaking about this idea? As I said before, it has already been said. Many times before.

If a user enters a large number of characters in the "Enter A Password To Save This Dream" input box the application throws an exception that is visible to the end user. Please disable detailed errors in IIS and catch this exception, and show a div populated with a friendly error message based on the length validation failing. Assuming that it is a length validation that is failing and not special characters in the password.

I have a huge tattoo on my arm.

I am happy and I consider myself successful.

It depends on what you mean when you say "curtains for your career" I would imagine.

I would not worry about what an accelerator tells you. I am a single founder and having sold one company, and failed at many others I can say that I have been successful. Subvert the dominant paradigm. Just build it and sell it like your life depends on it. It seems like you are equating success as "received venture capital" I can tell you that success =/= receiving venture capital. Success is defined by you. You already know this. You have a wife and four kids. I am sure you have more life experience than I.

You are a builder and an innovator as an entrepreneur. By definition entrepreneurs find opportunity, create opportunity and build success based on those things. I would not worry about what a single accelerator has to say. They might have interesting credentials but the appeal of authority is far too alluring for entrepreneurs to ignore at times.

My advice:

Just go out and kick ass regardless of what the current cargo cult belief is. If you need help, find it where you can, outsource if need be. I recommend not outsourcing core product though.

Make your own road. Just because three people say "don't do x" doesn't mean you shouldn't do x. It just means that they heard that they shouldn't do x somewhere and are disseminating that belief or, they failed at x and now advise against doing x rather than advising against experiencing their failure.

If I listened to what other supposed "mentors" told me I would:

Still be stuck in a small town working in a restaurant for minimum wage.

Worry about employment.

Worry about the opinions that others hold about me.

Never have had hitchhiked all over the country and experienced what I experienced.

Be broke and worrying about how to make ends meet.

This is my opinion, take it as such or just ignore me. I have asked myself this same question and now when I think "can I really do this without help?" I just keep moving until I cannot do it without help... Then I find help.

To clarify, I was not saying "people will not use it because you need to use the Facebook login service" I was speaking for myself. There is a large body of individuals that will participate and a minority of stubborn curmudgeons like me that do not use Facebook that do not matter. Until people start leaving Facebook, in which case your strategy will change.

That much further down the road though.

Any site that requires Facebook to login is a site I will not use.

So, my feedback: it sucks until you implement login that does not rely on a third party that is known for its questionable privacy practices.

After you do that, I would definitely check it out. Well done by the way. "Finishing" stuff is hard and you have launched!

Fail spam post linking to a 404 page and an auto play animation.

I wish I could down vote this.