Hacker Newsnew | past | comments | ask | show | jobs | submit | scolfax's commentslogin


One word: Bionic Commando


that's two words :-P


Triggered. That damn hook.


Don't blame your tools for an over-engineered project.


Agreed.

But feel compelled to add: Agile is only a problem when teams pretend to follow it but actually don't.


When everyone misuses a tool, it's the tool's fault. And everybody misuses Agile.


some over quoted thing about bad workmen comes to mind...

i prefer to think that a master craftsman is one who can take any tools and materials and use them to produce good work... if not exceptional.


That is not what "a poor craftsman" means.

Doing awesome things with primitive tools is a parlor trick. Grandstanding.

The craftsman blames themself for using the wrong tool for the job, not the tool.


Sure, and I agree to a large extent, but if I'm doing woodworking and my blades are so fragile that they snap with the tiniest amount of friction, I'm probably not going to be very happy working like that for very long.


But why would you ever intentionally use (or vigorously defend) demonstrably bad tools? Just because you could do well with a bad tool doesn't mean you should or that you couldn't do better with easy-to-get other, better tools.

If you are forced to use an inferior tool like Agile, then sure, you want to make the best of it and be a craftsman who can still succeed.

That is an endorsement of being adaptable and self-reliant as an engineer, not an endorsement of Agile.

And if a tool is bad like Agile, it's useful to point it out and slowly steer the bureaucracy that feeds it into bastardizing whatever the next tool is, but hopefully inching forward to a better global state as well.


I'm an XP fan, but I'm always wary of saying "they didn't do real agile". It can descend into "No True Agile" pretty quickly, with a dash of victim-blaming.

Agile is actually hard to get to grips with. It requires lots of discipline. So did the pre-agile methods that worked best. And it gets half-done for the same reason that the pre-agile methods got half-done.

It's hard. Hard to do, hard to learn, tempting to stop.


Perhaps, but one problem often seen in large orgs (I've been there personally twice, and heard many more stories from close colleagues) is that they adopt the agile methodology (sprints, stories, etc), without adopting the culture shift (shit does not get added into the middle of a sprint, ever) necessary to make it work.

Agile process without agile culture objectively isn't True Agile. It's worse than everything it sets out to solve with the alternatives.


I disagree that Scrum is the whole of agile, so the concept of "sprints" doesn't exist for me. If the product manager wants to rearrange stories, that is his or her business. My business is advising on the relative complexity of stories and then undertaking to deliver the next story in the backlog. The roles are well-defined, after which, we talk to each other like we're adults trying to achieve the best outcome for everyone.

Putting aside that particular nitpick, it's easy to cargo-cult the practices. I sometimes use the analogy of the introduction of lean manufacturing in the US. At first what was introduced were the tools: boards, line-stoppages etc. But tools are just tools, by themselves they're not enough.

The uncomfortable, expensive and difficult truth in our industry is that people, process and tooling are not substitutable. You need the best of all three that you can get.


I'd prefer to say "misinterpret" than pretend to follow... but even so, following it as presented to its totality is still going to be sub-par.

Some of the points in the Agile manifesto are just arrogant, unjustified statements of fact or vague and useless comments.

Some people hate face-to-face interaction... and what the hell is a 'regular interval'... and sometimes a clear vision and direction from above achieves the very greatest of results that the team without it would have failed to produce.

Its not useless, but its not without fault either.


- If this post is satire, it's hilarious and spot-on!

- If this is real, quit while you can, and may god have mercy on your soul.

- The fact that it's difficult to tell if it's real or not says a lot about our industry.


It's not satire, it's hypothetical.


It reeks of humble bragging and pretentiousness. The Dark Souls analogy just tops it off...


Reading it again, I can see that. However, I personally am a fan of rigorous - not ruthless - code review, the purpose and level of which has previously been explained to a new employee.

Obviously being an asshole is out of line, and if someone is being a dick in code review, that's a problem with the reviewer. But I think that being rigorous about maintaining consistency and quality is important.


Decent positions dont usually need disclaimers. Theres a difference between preaching, teaching, and coaching. Its not obvious that being an asshole is out of line. You make it sound like this mystery of pure "collaboration" is all about giving raw feedback. Raw feedback is inferior to polished feedback. Its just as important to communicate in positive ways instead of throwing this ruthless word around.

Honestly, your problem is that youve approached code discussion from a purely quantitative approach - ability to convince and ability to convey arguments in a persuasive yet unbiased way is huge. No one wants to do things by demand, decree, or just general hate.


Haha ok dude. I didn't write the article. And that wasn't a disclaimer; I was empathising with your point.


Oh, well carry on then, my bad ;-)


FTA:

Advantages: "The primary advantage of these operators is their expressive capability"

Disadvantages: "Their expressive advantage is minimal"


True, but... you obviously don't have kids! ;)


> you obviously don't have kids

"kids" should never have administrative privileges on the system (up to the point they can burn a CD - then they can have admin privileges because with enough googling they can do it themselves). And you might want to install a sandbox type program - http://alternativeto.net/software/deep-freeze/?license=free


Windows is a consumer operating system. You and I may know the "right" way to use it, but mother-in-laws don't like passwords, kids like Minecraft, and kids = chaos.


Well said. I checked the article, and apparently I didn't write it.


The only time it doesn't pay is during the interview:

http://recruitinganimal.typepad.com/.a/6a00d8345220fb69e201b...


Actually, you'd be surprised. I'm taking the "jerk" definition to mean a sense of self-entitlement and sense of power.

You don't need to be a jerk and eat the last cookie but having a strong sense of "alpha" confidence in most interview-like situation pays off really well.

Next time you have an interview (or a one-on-one or a salesy meeting), try to exude some sense of power[0] (don't overdo it!) and see how the other person reacts. I know that it blew my mind the first few times I tried it.

As an aside, it's crazy to me that we engineers are so focused on hacking systems but seem to denigrate hacking personal interactions as if it's something dirty/beneath us.

[0] http://www.ted.com/talks/amy_cuddy_your_body_language_shapes...


I love Dropbox. Use it all the time without any problems.


What are you using it for? Are you part of a company that shares everything on Dropbox, and how often do you use it?

I'm also a "happy" Dropbox customer -- but I'm part of a 3-person startup and we only share relatively small files and folders. This post (and numerous others) make me think it's time to move on when we grow the team.


I always wondered, why do small companies use Dropbox at all?

A 1 TB NAS in RAID-1 by Synology or QNAP will cost you about 400 EUR (including VAT). That's about 9% of what the author of the article paid for some 700 GB in Dropbox. It will do everything that Dropbox does, except you can use standard protocols (SMB, AFS, WebDAV, whatever) and the data will not leave your company.


> and the data will not leave your company.

That is a two-edged sword. The data is also inaccessible outside of your company. There are ways to make it accessible outside the company (VPN, WebDAV over https), but they tend to be complex, fragile, and sometimes unworkable (see next).

> standard protocols (SMB, AFS, WebDAV, whatever)

Support for the standard file sharing protocols (SMB, NFS, I presume AFS, and WebDAV) sucks or doesn't exist on mobile devices.


Well, every single NAS box offers VPN solution that can be enabled by few clicks (usually OpenVPN).

Also, most NAS vendors provide mobile applications, so you can access the data. They realize, that the standard protocols on mobile devices are lacking.

Anyway, to pay someone to get you such a NAS and configure everything for you is still a fraction of cost, that you would pay for cloud providers.


But then you have to worry about keeping that VPN access secure. There's been cases where that's been a problem, like the ransomware attacks on Synology NAS boxes (see http://www.anandtech.com/show/8337/synology-advises-users-of...).

> to pay someone to get you such a NAS and configure everything for you is still a fraction of cost, that you would pay for cloud providers.

Dropbox for Business costs what, $75/month for 5 users? That's less than you'd pay for an hour of a competent person's time.

I'm not a huge fan of Dropbox for several of the reasons that have already been mentioned above (I use SpiderOak myself), but on these specific points they definitely beat the roll-your-own approach.


That ransomware attacks were on Synology boxes that had their web console exposed to the web. Nothing to worry about when using VPN.


>> Nothing to worry about when using VPN.

If you are a services/consulting company and do client work on-site, you often have to sign an agreement from the IT department that prevents you from using a VPN on the client's network. In those cases, your remote workers need web access to files.


Well, that didn't happen to us.

We have access either to completely separated guest network, where we have to use VPN to both our network and customer network, or access via Citrix or Remote Desktop, where to exchange the files we have to use the built-in file share facility.


Synology offers mobile apps to access the shares.


It will do everything that Dropbox does

Only after a whole lot of hacking and you'll probably end up having to slap a real server in front of your NAS.


What would the real server run?

I haven't found anything, that Dropbox does that the NAS doesn't. Maybe there is some marginal function, I don't know. But is that hypothetical marginal function worth the 900% price premium (per year) plus reduced privacy?


How do you do offline syncing and sharing of folders with people outside of your network? Having to manage a bunch of VPN accounts for outside users seems like a major pain and getting them all set up with OpenVPN seems like an even bigger pain.


We are using IPSEC VPN for external access. It works with standard clients in Windows, OSX, Linux, Android, iOS, whatever.

It allows not only access to files on NAS, but also to webapps on another box and remote desktop on yet another box.

Though I'm thinking about how to configure haproxy to allow Remote Desktop Gateway and https on the single IP, that we have.


Having to manage VPN accounts for everybody I want to share a folder with sounds like a huge pain. Especially if I have to go ask the VPN admin each time. And I'm still curious how you do offline access and syncing to local disk.


There is no offline access or syncing.

The data is available over gigabit link. It is local, after all. No need to sync to hide the latency.

And after all, there is more data on NAS, that the drive on my notebook can handle. No need to have it all locally.


So you're not actually doing everything (or even most things) that Dropbox does. I mean we also have a file server with a several TB of disk and gigabit links and VPN and all that jazz at the office, but that is in no way a replacement for what Dropbox offers.


So I guess we have different needs.

For us it is important to work on the same files. To make them available to our co-workers, to have the same versions, etc.

Syncing is a mechanism. If it would help us to achieve our goals, we could use it. If some other mechanism achieves our goals more efficiently, we would use it instead. Syncing in itself does not have value to us.


Dropbox and a NAS or file server fulfill different needs with not that much overlap. Sure you can probably hack your NAS to be a bit like Dropbox and perhaps you can hack Dropbox to work a bit like a NAS, but a the end of the day they're complements not competitors. If you don't need what Dropbox offers that's cool, but that's not the same as saying that Dropbox doesn't have anything to offer over a NAS. Personally I use both and would never want to trade one for the other.



A NAS box is going to get hacked (X), have backups neglected/misconfigured/misdelegated and then have data accidentally deleted or experience disk crashes, etc. You can improve your chances by investing time and energy on taking good care of it, but even then you can still get bitten.

(X) devices from both vendors you mentioned are pretty frequent victims


Only devices with services exposed to Internet were hacked. Devices inside LAN, with external access provided by VPN, were not hacked.

This applies to any service or device that you run. NAS is no exception. Your printer could be hacked, if you exposed it to the Net.

Data can be accidentaly deleted anywhere, cloud providers or your own storage. You must make backups anyway.


No, that's 90s thinking. Current methods don't require the boxes/services to be directly internet-addressable.

An exception is when you have a completely isolated LAN that's not serving internet-connected computers. But that's pretty spartan.


The infections needed to have access to web console (in Synology case, that's port 5000).

Unless you are targeted, that's very difficult to achieve even in slightly secured networks (i.e. every possible toggle in settings is not ON).

When you are targeted, it does not matter, whether you use Synology or Dropbox, the approach is tailored to your situation.


For just one technique, read up on DNS rebinding attacks vs home "routers". Same works against NAS devices.

These devices are so common that it is cost effective to do against a bunch of device+vuln combos in a mass drive-by fashion (served by compromised or shady ad networks or any of the other 100 methods that get you to follow a bad link).

Or there's going to be another taiwanese device or PC compromised on your LAN and it'll automatically portscan & metasploit all your network in 5 minutes.

Also don't think getting "targeted" means you have to be James Bond-special. It can mean someone found a prominent blog they'd like to inject their rogue ads on. Or you pissed someone off online and they got some script kiddies to spend 10 minutes to ruin your day and get their laughs (or $20 in bitcoin).

Dropbox's security guys will detect these after they get used a few times (before they get to you), unlike your taiwanese NAS vendor who will only do something half-assed 2 weeks after it hits the news. Or nothing when it doesn't hit the news, as often happens.

All in all the mindset that you have "LAN" or "intranet" that's a significant security perimeter is outdated even if you're nobody. Don't make a network that's "hard and crunchy on the outside, soft and chewy on the inside".


Well, it the rebind attacks depends on multiple weak points. Our DNS cache does not allow for external DNS servers to return IP addresses from our internal range. But I guess not everyone's router does that.

But your point is valid.


>> I always wondered, why do small companies use Dropbox at all?

For smaller companies who don't want to manage infrastructure, the short answer is time.

* Setting up the NAS.

* Servicing the NAS when a drive fails.

* Setting up a backup for the NAS.

* Supporting people for connections to NAS


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: