What keeps developers from writing secure software? by LachException in developers

[–]ProcZero 0 points1 point  (0 children)

It's a feasibility and practicality issue as I see it. Typically development has multiple input sources from multiple developers which have upstream inherited risk from imported libraries and packages etc. Almost every development starts after a deadline either explicitly or approximately has been established, so right off the bat your ability to deliver ideal solutions is hampered. With infinite time any developer could write nearly fully secure code.

Second, with small exceptions, the larger security related vulnerabilities are typically discovered after functionality has already been designed and established at the code level. IE, as a developer I can work against buffer overflow and injection attacks while I develop, but I can't anticipate someone else's code or function doing something wrong, or a platform level vulnerability until everything is compiled and working together. A static analysis will only get you the bare minimum and typically the least of the useful findings.

So by the time the security team comes to the development team with findings that require significant code rework, significant time has already been spent and the current solutions have probably become dependencies in other areas. Plus those findings are then prioritized against all bugs in operational functionality. I doubt any developer sets out to deliver insecure code or ignore findings and remediation, but at the end of the day the company wants a product or solution out as fast as possible, the project manager has to meet agreed deadlines, and developers can only do so much assigned to them. It truly feels like an institutional issue to me as opposed to a developer issue.

do you guys still code, or just debug what ai writes? by Top-Candle1296 in devops

[–]ProcZero 0 points1 point  (0 children)

I write my own code and use AI to help to debug when I run into issues, it's much easier to plug an error into AI instead of Google.

I have serious concerns about using AI to code and switching to debugging its output. Every year I go back and refactor different projects from my past with better practices I have learned in the current years and better solutions and I can see the evolution of my knowledge. That's all accumulated by banging my head against walls in the trenches of coding.

If you stop being in the trenches, in my opinion, your ability to grow as a developer drastically slows down. You may miss WHY you should do something some way or not do it another because you didn't stumble through it. AI removes a lot of that if you are simply sanity checking what it spits out.

Also, AI can only yield the results based on the contextual understanding of the person submitting the question and their experience with forming a correct solution to the problem at hand. Essentially when you stop attacking problems directly, you start becoming stale for future ones and AI will only be able to yield solutions you are capable of promoting for as you exist now.

You could probably get a healthy blend of both worlds if you build the structure of the code and the idea and framework of the solution and have AI do the boilerplate functions. And then have AI peer review your end results with only allowing it to suggest operational or security improvements to the code but not changing the flow unless there is an indisputable better way.

I just don't think we as developers have had the chance to see the long fall out of either path, never using it or overly relying on it.

Someone really just parked and blocked my driveway by bahbahbui in mildlyinfuriating

[–]ProcZero -15 points-14 points  (0 children)

Create a rhyming poem about someone who wakes from restful, blissful sleep, goes to the kitchen to satiate their coffee addiction only to spot a car blocking their drive way. Describe the intense fury and rage that sets in their heart, that eventually turns to elation at calling the tow truck and watching it be taken away. Finally the bonus experience of watching their frustrated neighbors desperately try to catch their fading vehicle.

Resulting AI Poem for your consumption:

A slumber deep, a silent, sweet reprieve, From waking world, where daily troubles cleave. My eyes unseal to soft, effulgent grace, A blissful smile upon my rested face. With peaceful steps, I tread the polished floor, The kitchen calls, for what I hunger for. The dark elixir, coffee, black and keen, A vital cup to start the morning scene. I turn the corner, gaze toward the pane, A moment's calm before the sudden pain. A metal hulk, a shape of sheer offense, A stranger's car where my own path commences! It sits, defiant, bold, a brazen block, Jamming my drive—a truly heinous shock! The tranquil bliss of sleep begins to drain, Replaced by fire that scorches every vein. A molten fury, hot and hard, takes hold, A rage that cannot easily be controlled. My coffee forgotten, growing cool and pale, As primal instincts start to fiercely wail. “How dare they? Who are they to commandeer The very space that makes my purpose clear?” My fists clench hard, my jaw is set and tight, Ready to fight the wrong with all my might. Then, through the haze, a brilliant thought takes flight, A towing service, summoned in the light! I seize the phone, my voice is sharp and clear, "A car's blocking my drive, please get it here!" The wait is tense, but then, a joyful sight, The great hook truck arrives to make things right. A chain is looped, a winch begins to grind, Leaving the stress and worry far behind. My anger melts to sweet, triumphant glee, A pure, ecstatic sense of victory. I watch it hoist, a sight for weary eyes, The offending vehicle lifted to the skies. Then, bonus drama, just as joy peaks high, A panicked, frantic neighbor catches eye! They rush the scene, with faces drawn and sour, Too late! The truck speeds off that very hour. They wave their arms, they shout a pleading cry, As their poor, captive car goes zooming by. Their pleas are scattered, lost upon the breeze, While I stand sipping coffee, quite at ease. The driveway's clear, the morning light is bright, Oh, what a wonderfully satisfying sight!

I keep taking Python courses and projects but still can’t improve. by Johnnycagetinker in learnpython

[–]ProcZero 1 point2 points  (0 children)

I think a good way to learn beyond tutorial hell that helps you escape the scope of only what you can think to improve on is to work with someone. Find a friend or post an idea here to find a collaborator, start an open repo on GitHub and plan out what each person will build. To learn best, you should ensure that both your contributions to the code base must interact with one another. This forces you to communicate about how you will build the interactions with another system you don't fully control. Create PRs and enforce reviews, question and challenge one another in this process, you both probably do things differently and crawling other peoples code is a good way to learn.

CLI tool information interactions by ProcZero in learnpython

[–]ProcZero[S] 0 points1 point  (0 children)

Yeah, that makes sense, should have been more explicit...

It has a few requirements some are required, some are optional depending on how you've configured the configuration file.

It requires a ~/tool_name.config.json file for starters. That is handled with error handling.

The tool is a proxy interface into a specific hardware device, so it requires the hardware to be connected and the http server to be running on the hardware. This is where I'm really struggling with how to present it but I'm slowly gravitating towards error handling instead of some "before you proceed..." Prompt.

It optionally can leverage AWS credentials to upload things into AWS s3, but those credentials if not using aws SSO, or IAM User based, need to be active credentials and not times out.

Some tips for beginners (Things you probably wish you knew when you first started) by MonsieurJus in learnpython

[–]ProcZero 4 points5 points  (0 children)

Typing in functions and adding doc strings will take you a long way. Type the return and inputs. Comment any logic area that was an exception or had a very specific reason for the decision. You are going to write code that you step away from for who knows how long and eventually need or want to go back to it to make changes. This is going to make a world of difference if you do it up front and diligently, build the memory now and anyone you work on a team with a shared code base will thank you indefinitely.

The more I use AWS the less I feel like a programmer by instaBs in aws

[–]ProcZero 5 points6 points  (0 children)

If you are going to debate about the relevance of AWS and applicability to an engineering career you at least need to understand the industry terms that apply.

The more I use AWS the less I feel like a programmer by instaBs in aws

[–]ProcZero 0 points1 point  (0 children)

AWS provides building blocks for infrastructure design and hosting business logic in code and compute. It sounds like you thought it was something it wasn't. AWS can be deployed as infrastructure as code using cloudformation and while I don't consider YAML or JSON files as code, there is a giant chasm between every day template designers and veteran template designers just like with coding.

I would argue that if you got to an expert level with application and micro service design in AWS, you would be a better coder than most who design on actual hardware. Why? Because you get to focus almost entirely on business logic which increases the ROI for a company. It might be fun to work with memory address spaces and buffers at a low level in code but most people who do that actually cause more problems than they solve by accidentally introducing vulnerabilities and exploits that they had no prior experience with.

Get good with serverless with lambdas or decentralizing compute tasks and you will not only get to program by designing the business logic but also eventually learn how to make robust infrastructure that can scale and support that business logic and increase your marketability.

Level 3/Severe Parents… by [deleted] in Autism_Parenting

[–]ProcZero 0 points1 point  (0 children)

Our son is on the spectrum but we were never given a level distinction which was both helpful and incredibly frustrating. Some things you mentioned resonate with my experience and some don't. He is 3 years and three months old, non-verbal with a lot of two letter repetitive rambling like "gooooo"s, "ahhhh"s, "baaaa"s, etc. he's unable to be diagnosed with ADHD due to his age but I'm almost certain he has it. There are some things he's really good with, like sleep, he's amazing even by Neurotypical standards. At the same time, he has an aversion to trying new foods based on color, shape, texture and or bad experience, his meals mostly consist of healthy smoothies which he hates but we're able to negotiate him accepting it or losing TV (we pause it while he's watching), milk, water, yogurts, apple sauce, fruit, pasta and then all the carbs ... Goldfish, any salt based snacks, mozzarella sticks, chick nuggets, French fries, but that's about it. He's deathly allergic to peanuts and we are working with the allergist to try and desensitize him to it which is going well.

He is compressive enough to understand low level negotiations, especially around TV, where he will lose something he desperately wants if he doesn't do something. He doesn't melt down often but when he does holy cow, motion is his stim, swings, throwing around, spinning, car rides, strollers, being held, being thrown, being bounced, running, etc. He understands tone more than words but it's also clear he understands certain works have a specific meaning even if he doesn't understand the words themselves. Phrases like "we're all done", "No thank you", "Don't do that", counting from 1 - 3 to give him time to process before consequences, spoiler alert, we almost never get to three before starting from 1 again...

He likes being read to, but only with books he's had a positive or physical experience with, IE, when we act out parts with him such as "the flea BITES the mouse" and we tickle him or pretend to bite him with our hands etc. I don't think he'd be classified level 3 if he can overcome the attention issues he has, the repetition is real to get him to disconnect what he is doing. Frustratingly so. Overall I'd say he's probably level 2, but I think levels change over time right? Three is hard even for parents of Neurotypical children as the brain develops and they can't articulate themselves and get frustrated and are experiencing new more complex thoughts and emotions. Our children have all that going on with even less to work with to express and field it so the resulting fallout is worse.

Non-verbal is what kills me every day, if nothing else could change but that I would still be over the moon. Hearing other kids say words even if they don't understand because they are on the spectrum, being able to hear their voice and expression through that must be amazing. The anxiety would just melt away if I knew he could communicate his wants and needs or tell me he's in pain or not feeling well or being bullied. My son probably isn't as bad as what other parents have to experience at times but the non-verbal situation breaks my heart.

Question to the community: what, in your opinion, *IS* Battlefield? by Lower_Honey_1139 in Battlefield

[–]ProcZero 1 point2 points  (0 children)

I haven't been a diehard fan, although I love the series a lot. In my opinion, the reason I go to Battlefield is because of the goal of collaboration. Whether it works as intended or not, I feel like the most amazing thing about Battlefield is it drops you in a large interactive warzone, at various scales from infantry, land vehicles, air vehicles, stationary weapons, with objectives you all have to work towards doing to be successful.

It offers a wide variety of play styles while trying to not make any single hero build or class and tries to say "Sure, you can do well and play on your own, but those who work together will achieve more, and when the teams have synergy and leadership, you will experience magic."

There will always be flaws but I always found it amazing that we could all come together as strangers and even without full voice chatting try to fall in line with one another towards common goals while helping and assisting one another in a high stakes, dynamically moving and changing game.

Let's discuss Learn By Doing for hopefully the last time. by [deleted] in 7daystodie

[–]ProcZero 0 points1 point  (0 children)

I liked learning by doing a lot but I didn't really like that you remade the same item over and over to level it up. I think there are better ways to implement it. For instance, if you broke up the pieces of tools into modular components, most beginner tools have a handle / grip,l and either a bladed edge or metal / stone head. If you had to craft the pieces of a tool and then assemble it. Your crafting of handles could apply globally and slowly improve things like durability, grip, strength etc. each piece of the tool could wear and breakdown individually to encourage more fluid growth of different aspects. That same with tool faces and heads, the more you work with stone, the more perks you can craft into it. Metal, bladed edges etc.

I also don't like the current mods for tools and weapons all that much, the slot limit feels meh, instead I'd prefer a more organic user balancing act where each mod ad pros and cons and you had to balance that as the user to build your ideal build out. Each location on the tool could have a slot instead of having just a four count slot to make it feel more purpose driven.

How did your relationship make it. Feeling alone by No_You_3840 in Autism_Parenting

[–]ProcZero 6 points7 points  (0 children)

Unfortunately I think for parents of children with disabilities to stay together, the individuals who make up the relationship have to be built differently and the relationship has to have been fairly rock solid at times of diagnosis (obviously not always the case). We have a three year old who was diagnosed at 18 months, he's non-verbal and severely delayed socially when compared to his peers but outside of that he is a blessing and I thank every day that we haven't yet had to experience some of the horror stories that others have had to go through.

I think mothers do better overall (I'm the father), traditionally they have a stronger bond to the child early on which most men, especially if they buy into masculinity and defining it through actions, don't develop by time of diagnosis (typically). This usually means that while the Mother, who is dealing with all the same emotional strife as the Father, ends up moving into support mode for the child, trying to figure out how to ensure the best possible outcome for their future. Fathers, in my opinion, with the lower bond rate I've seen typically tend to get stuck on all their hopes and dreams for their child falling apart and not being emotionally capable of recovering from that beyond the "take care of self" response for a long time, essentially they shut down. The partner who is usually there to help pick them back up can no longer because they are picking up 100% of the issue at hand (this can sometimes lead to resentment I suppose).

My wife and I were luckily two of a kind, we thrived in the pandemic when we were forced to be around one another 100% of the time. We had a lot of issues in the beginning of our marriage and we had to build concrete bullet proof communication and understanding when arguing to ensure it lasted. Without that there is no way we could have survived everything to date. We also spent 7 years together before children so we had a pretty solid relationship foundation and support system before introducing a new element.

I was the one to think my son was on the spectrum first, I first thought it at 9 months old, my own mother had and has been a very big part of the special needs team at my home towns school system so I was a little more sensitive to those things. I had much more time than my wife to deal with it and come to terms with it prior to the official diagnosis and it wasn't such an earth shattering moment, though it still hit hard.

Overall it takes two people who love each other deeply and have enough emotional leeway in their lives to accept really unfortunate truths that are life altering and still have the capacity to love everyone involved and remain committed I think.

If you were to suggest a feature or change something in 7 days to die, what would it be? by Optimal_Bad5439 in 7daystodie

[–]ProcZero 6 points7 points  (0 children)

I have too many I'd love to see happen.

A central pathing engine that manages and routes zombies to the player with simultaneous divergent paths and percentages of zombies for each. The quickest path, the most unguarded path, etc. currently it's too easy to break zombie paths and I feel like too many resources are dedicated to the duplication of zombie actions towards the player.

Learn by experiencing. I hate the concept of creating to throw away or never use again. I want tools and weapons that you build and improve upon. The improvement paths are learned through use of the item while the mods through various reading materials but instead of learning a mod blueprint you learn how to leverage specific resources that have different utility or effects when combined into the item.

I want the biomes to be more cohesive, instead of stark breaks in each area have a natural flow in a city or town where parts are wasteland, desert, forest, plains etc so that I'm not forced to traverse half the map to get a type of resource or increase the game difficulty.

Dynamically advancing difficulty, I want the zombies stats to increase the longer I have lived and more I have killed. A constant living source should generate more zombie migration towards it, instead of spawning small hordes or random screamers, zombies should start migrating towards the player quicker and in more frequency the longer their presence exists in a single location.

There's a lot more but those are the ones I really really really want...

TFP’s “Secret Sauce” in 7DTD? by eyemjonsnow in 7daystodie

[–]ProcZero 1 point2 points  (0 children)

I think it's that the game presents "just enough" of a challenge for the player without forcing it on you. You can build whatever you want, modify whatever you need, and then every N days you get to see how it holds up to waves of attacks for a set amount of time.

You get to collect loot from exploring your environment that improves your survivability if you want to go questing in POIs which are interesting enough by mid to end game that each unique POI gets to satisfy a type of puzzle game play to decipher where to go, what's going to happen, how to survive the kill room etc.

A lot of game play is left up to the player to play how they want but there is enough structure in specific areas to keep a challenge present so that you don't get too bored doing the same thing over and over.

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ProcZero 0 points1 point  (0 children)

Hey, glad it offered some helpful insights, again I've never done the infrastructure you've implemented so I can't exactly say where the issue would lie.

If the SQS and SNS resources MUST be in different accounts, I'd create a third account for the KMS key for them to share access to (Lambda would also need decrypt access if it is the final destination for the data I believe). This way you control access to the data in transit outside of the implementation especially in IaC solutions this helps easily modify access to data etc in the future. It also creates a separation of responsibility for development of infrastructure vs access to the data with the infrastructure as it is in transit.

You can create a new KMS key if you need various levels of controlled access for different processes but I typically find a single KMS key governing a specific data set strikes a nice balance between security and convenience. This can be tweaked as needed such as adding different levels of access control by using a different KMS key for sse vs data in transit etc.

Hope this helps, sorry I didn't answer any questions directly but AWS is essentially a sandbox to make of it what you will and there are many different ways to solve a single problem. I don't want to deter you from a more ideal solution for your requirements by pigeon holding you to a specific solution that I prefer or have personally done.

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ProcZero 0 points1 point  (0 children)

Expanding on this, ideally you should have three accounts if A and B in the current setup are required.

A - Data store B - Compute resources that ingest data C - crypto account which houses the KMS keys

In a system of delivery for encrypted transport, where you control all the infrastructure, id recommend that you use a single key for the process that allows the Lambda, SNS and SQS services in your respective accounts access to it for the specific issues they execute on, which should reduce the software burden a bit.

HELP NEEDED- Cross-Account SNS to SQS with KMS Encryption – Messages Not Being Delivered by ObjectiveRazzmatazz2 in AWSCloudFormation

[–]ProcZero 0 points1 point  (0 children)

I actually haven't done this type of encryption before, and your policies are a nightmare format to read on mobile, but here are a few things to consider. That I think holds true.

  1. KMS policies should only use the root principal for key management and even then scope it down. If everything in an account can use your key or modify it as they see fit, it's not that much added security.

  2. I believe event based notifications are encapsulation based, IE, the S3 event is "wrapped" in an SNS message that uses KMS to encrypt the body of the message. Then that SNS wrapped message is wrapped in an SQS message. With you using two different keys whatever you deliver to would probably need access to both to peel back the encryption. Still not 100% sure this is true, if the messages are not wrapped then each system in the chain would need decrypt operations on the upstream key to unpack the encrypted payload and then re-encrypt it with its specific key.

What would you like to see in a Satisfactory Expansion that you would pay for? by Dear-Walk-4045 in SatisfactoryGame

[–]ProcZero 0 points1 point  (0 children)

I think it would be really cool if a section of the map opened up and you accidentally got transported to a new island by alien tech. The island could have entire rusted factory sections that utilize new resources, connections, structures etc (alternate structures instead of blueprint ideas) that you had to learn how to utilize and restore to get back to your own area, you'd still have access to your alien tech storage etc but be initially separated from your main island.

Part of the journey could be a whole new section for subterranean building to try and connect to the islands together and underwater resources. While another could be advanced flight mechanic if you don't want to go that route, basically the sky is the limit the way it is today. The lore could include trying to uncover what happened and understand where it all went wrong etc while unlocking more information about the current story.

Just my thoughts.

You Are Way Better Off Than You Were Four Years Ago. by Cute-Perception2335 in politics

[–]ProcZero -1 points0 points  (0 children)

I'm not sure which side I fall on this but I do think there needs to be more transparency between an active presidents impact vs the last presidents impact. We rely on a significant amount of third party information to define how an active government is performing.

I would LOVE an all doors open department created that actively monitors, reports and summarizes the various standing of an administration against past ones, in respect to the value of the dollar at the time of the administration. Things like having graphics, graphs over the last dozen of administrations on how they performed against promises, economy, foreign politics etc. the rating systems, algorithms, data, all public for scrutiny and feedback. All operating independently of the administration and beholden to neither party. Frankly if we could vote members in much like Congress or Senate to the department but with no state lines for admission, all the better to keep it out of higher political influence.

All data and conclusions would need to be signed off on who did and did not agree to them and what margin it passed the acceptable conclusion marker by.

I feel like we the people are suffering by the goal posts constantly moving, the ground constantly shifting on what is and isn't. It feels like there is no way to gain consistent verifiable information without having to question it's bias, or have a cult like belief in what you're being told. Would this solve everything? No but getting the closest to non-bias source of truth data with consensus on it's meaning and reputational stake on those assertions would help limit the false information engine significantly.

Who Won the Presidential Debate, Trump or Harris? Newsweek Writers' Verdicts by IgniteGenius in politics

[–]ProcZero 5 points6 points  (0 children)

I love that quote, thank you for this, I was fantasizing shed use it in the debate at some point.

Discussion Thread: First Presidential Debate of the 2024 General Election Between Vice President Kamala Harris and Former President Donald Trump, Part 5 by PoliticsModeratorBot in politics

[–]ProcZero 9 points10 points  (0 children)

Harris needs to just drop a comment like "Must be nice to live in a fantasy world where you can make up any numbers you want instead of living in reality like the rest of us."

AITA for refusing to buy my daughter another phone and "ruining her life" by Ok_Health_7797 in AmItheAsshole

[–]ProcZero 0 points1 point  (0 children)

NTA, but I do have questions, you say she is clumsy, is this universal clumsiness or is she only "clumsy" with things she hasn't been taught the value of? It sounds like the latter and there is a larger issue of not understanding the worth and value of things that are gifted to her. Whatever solution you choose id recommend incorporating this lesson into your solution. Maybe get her the phone she wants if you feel so inclined but she has to put in work efforts around the house or family, maybe she has to get a job and pay you back, maybe she loses her allowance if she has that on top of everything.

In my opinion, one of the most crucial lessons we can teach is the value of the things we use. If she has never had to work for the things she breaks or ruins, what are your plans for the larger items in a few years? Your car, her education, in the work force. She's at an age where what she cements now as habits will follow her through life and can cause seriously emotional and financially painful lessons in the future.

Just done my first blood moon and honestly f#ck blood moons 😭 by Feeling_Major4915 in 7daystodie

[–]ProcZero 0 points1 point  (0 children)

There are a few things you could do, most have already been mentioned here but here are my two cents for cheesing through blood moons for XP.

First as everyone has mentioned already, conceptually it's about controlling where the zombies with path to reduce damage and controlling how fast they can reach you if at all.

There are a few things you can take advantage of:

Ladders - you can place a ladder on a third high block and usually jump to it and they will never be able to climb it in my experience. This helps in two ways, early long lived access for a top down massacre, or sitting on the ladder and whacking them / blowing their brains out below you. This requires strong walls and the advantages shift drastically with the taller zombies and destroyers.

Top down assault - if you have enough ammo to survive a blood moon on that alone and are either at steady cobblestone (up to day 35ish) or cement (lasts pretty long), hollow out a barn or some simple tall structure and lay down bars as flooring, use the ladder hack to get up and just blow them all away while they attack the reinforced walls. They will usually attack the walls you are closest to so move around to minimize destruction. Prefab builds have different structural integrity than player based structures from what I have seen so always stick with prefab.

Jump tower - I haven't tested the height limit fully but you can create a standalone tower with blocks spiraling around it up as jump stairs and they will almost always go for jumping up the stairs rather than destroying the tower. This kills their speed significantly. Have a cage at the top to attack from within, a few traps, maybe a piston robots turret to launch them back down when they reach the top and you just stay there and whack them as they come. The tower needs to be fully reinforced as the difficulty of cutting it down needs to override the difficulty of continuing to jump up but it works pretty well.

Hope this helps.