Souk's Notes - Unofficial Summaries

2024-11-21 · open the original ↗

• Onboardbase sells itself as a simpler HashiCorp Vault. Its homepage reads "if HashiCorp Vault was simpler, priced right and just worked". Lex, its CEO, says he used Vault extensively and likes it, but it suits late-stage enterprises with security engineers to set it up. He says the comparison wins customers who already know Vault and need little explanation, and that HashiCorp accounts have signed up without ever contacting the company.
• Secrets leak because developers favour convenience over security. Lex says developers are wrongly assumed to be "secure by default", and they keep secrets in text files, Notion, Google Docs and Slack. He has dealt with a data breach at a former employer. His conclusion is that the secure tool has to be as convenient as pasting a secret into Slack, or it will not be used.
• Developers should work with secrets they never see. By Lex's account, Onboardbase injects secrets in real time into local machines and servers. Per-environment service tokens limit each process to what it needs, and device tokens can be revoked when someone leaves or a machine is compromised. Tokens can auto-expire or rotate after a set number of uses (100, say) or a set time (30 days). Deliberate sharing goes through an encrypted link that deletes itself a few minutes after viewing. His stated goal is to eliminate .env files entirely.
• SecureLog catches the secrets developers leak into logs anyway. Lex says it scans console.log and console.error calls and React server components, then masks or removes the secrets it finds and tells the developer. He says this keeps secrets out of production builds, including the browser's developer tools. Asked whether it would make developers lazy, he said he already assumes negligence and that mistakes are certain. Hanselman framed this as his "pit of success".
• Lex claims every feature gets a week of security testing. By his account, the product gets automated and manual testing, with only the marketing website exempt, and the team uses Onboardbase on all its own projects. He calls friction "the one thing you can always control". He says setup takes five minutes or less and every product he builds ships with a live demo, which he credits with bringing in customers.

2024-11-21 · open the original ↗

• The host pitches the GL.iNet Spitz AX for semi-permanent mobile setups. He names RVs, construction sites, remote cabins and boats, and runs it with three WANs: Starlink, Wi-Fi as WAN, and dual cellular SIMs. GL.iNet sponsored the video, and the description carries a 30%-off link.
• It has dual 5G SIMs and removable antennas for external cellular antennas. The router has a 2.5 Gbit WAN port, a 1 Gbit LAN port, USB-A for storage or tethering, and microSD. The SIMs aren't hot-swappable, so install them before powering on. Four of the six antennas are cellular and two are Wi-Fi 6, and any can be swapped for external ones.
• Use an omni antenna on a vehicle and a directional one at fixed sites. On his RV roof, the host put a Mobile Mark omni antenna on the four cellular leads and kept Wi-Fi inside. For fixed sites he suggests a directional antenna such as the Waveform Quad Pro. He notes an RV's Winegard Air 360 picks up only TV, while the Air 360+ adds cellular and Wi-Fi.
• The host puts cellular last to avoid data caps and uses failover. His order is Ethernet, then Wi-Fi as WAN (repeater mode), then cellular, to limit data-cap and overage costs. He says failover suits most cases, but load balancing is worth it with several unlimited links. For the two SIMs, two different carriers is ideal.
• In his driveway test, cellular was fastest and Starlink was erratic. Starlink Mini gave 137/14.8 Mbps; he usually sees 60–70 up to about 220 Mbps. Wi-Fi as WAN to his house Comcast gave 174/128 Mbps through the RV walls, so good campground Wi-Fi may be worth preferring. T-Mobile through the roof antenna gave 268/34 Mbps.

2024-11-21 · open the original ↗

• Impact means your work changed something useful to the company. One co-host gives three kinds: a metric moved, a roadmap changed (an analysis that shuts down a business line saves the company a bad bet), or a process changed (a one-click experiment-analysis tool that everyone benefits from). The other co-host ties each back to dollars, ever more indirectly; their counter-examples of non-impact are a cutting-edge tool such as XGBoost or an LLM applied without business benefit, and an ad hoc answer handed over and never heard of again.
• Impact you never followed up on is impact you cannot claim. The co-host who manages a data-science team says they learned this only when job-hunting and being asked for numbers on a resume, and that knowing your impact also makes the work more exciting and lets you prioritize by it. The tactic is to ask PMs and engineers when the experiment ramps and what it showed, write it down, and put a 15-minute calendar block in the following week to ping the teams.
• The insight is the indispensable piece, so claim credit. That co-host relays an engineering director's puzzle analogy: remove the data scientist's insight and the impact is gone, even though engineers built it. Work whose impact goes unspoken gets treated as support and is less likely to come your way again; both co-hosts say to credit every contributor as a weighted share rather than arguing over "20%" of it.
• Support roles quantify through scope, audience and stakes. For dashboards and pipelines, describe the importance of the area — a north-star metric such as weekly active users, or the revenue it covers — and who relies on it. Their example resume line is a company-level dashboard used daily by executives with over 500 views; product data scientists should cite the roadmap shaped, the metric percentage and revenue moved, and the technique, and ML engineers the problem, the model and the metric, such as visits driven by notifications.
• Platform and research roles count through the process-change category. One co-host argues nearly everyone can map their work onto metric, roadmap or process. The example is an experimentation team that builds a more robust test-versus-control assignment to adjust for measurement bias, which is company-wide in scope.

2024-11-21 · open the original ↗

• Data careers rarely start from a straight technical path. The three hosts offer their own routes as evidence: one moved from software development in India via a US business-school master's into a Microsoft internship; Shane came from international studies, the Peace Corps and public policy at Carnegie Mellon, and found data through an R class taken with friends; the third studied statistics in the 2000s, when 98% of classmates became actuaries, and moved through social gaming in 2010 to Facebook, Pinterest, LinkedIn and Nextdoor.
• One break snowballs, so widen your "luck surface area." The co-host who was a director of data science at Nextdoor says everyone catches a break somewhere and should be ready to seize it, especially when employers want experienced hires. The other co-host, attributing the phrase possibly to Sahil Bloom, says their Microsoft internship came because a professor sent out resumes of the top 10% of the class, backed by SQL experience and SAS certifications.
• Stay open to adjacent roles rather than one target job. Shane says aspiring data scientists fixed on an applied role at one specific big-tech company may not even like it, and should explore analytics, data engineering, ML, product management, startups and large companies. He argues data skills transfer well enough that no early choice locks you in.
• Data job titles are a mess that funnels into a few families. A host's opinion is that the hundreds of non-standard titles reduce to five or six families and need a cleanup; data engineer and ML engineer are clearly defined, while analyst flavors vary by company for the same work. Shane recounts a LinkedIn commenter insisting causal-inference methods are econometrics, not data science.

2024-11-20 · open the original ↗

• Luck needs preparation before it and full acceleration after. The guest, a senior director of data science at Instacart and formerly at Facebook, says Google called him back six months after he applied because it kept his resume on file, but only after he had sent resumes to about 100 places and studied interview questions. His "unpopular" view: when your area suddenly becomes the company's focus, step on the gas like a driver who finds a gap in traffic, working 12-hour days and weekends to get the promotion.
• New graduates should skip prestige employers and prestige titles. This is the first of his steps: he calls a big-name company without an inside connection a lottery ticket, in what he calls the worst market for new grads he has seen, with the big hirers of junior data scientists cutting back. He suggests less prestigious companies, local connections and analytical roles without the data-scientist title, as he did starting as a business analyst at Capital One in 2012.
• Optimize for job offers, not applications sent. His second step: applications sent is a bad KPI for the same reason visits are a worse target than orders at Instacart. He spends about two hours per application, tailoring the resume and finding connections inside the company, since a junior role of his draws hundreds of LinkedIn messages and applications in the low thousands; a candidate who emailed him a typo in the job description got an interview, though he asks people not to copy that.
• Outreach works when it gives the recipient something. A host argues that even a student can offer a company something, such as a product observation; the guest adds that the student can offer the good feeling of helping, and that a specific question about something he said beats a request for "30 minutes to chat". He cites a person who became known for finding unreleased features in Facebook's code, and open-source contributions; a host who once worked on LinkedIn's job-seeker data recalls, without being sure of the figure, that referrals were about 50x as effective as blind applications.
• Interview as though you already work there. The guest says the best interviews he has given felt like talking to a coworker or a report, and that unnatural answers make it hard to read a candidate's signal even when they are qualified. He also warns that a sense of entitlement after a top school shows through in recruiter conversations, and says he plays the same hype song before every interview.

2024-11-19 · open the original ↗

• Fing Agent turns a Raspberry Pi into an always-on network monitor. The host says it keeps a live device inventory and alerts you to new or unauthorized devices, which you can block one at a time or by default.
• The host says it also scans for vulnerabilities and reports performance. He says its automated scans find open ports and weak router configurations, and it reports on network health, internet speed and ISP performance. He pitches it for small businesses through to growing enterprises; the short doesn't mention sponsorship.

2024-11-18 · open the original ↗

• Mark's skincare routine is deliberately minimal. He uses Head & Shoulders and bar soap, shaves with a cartridge razor because electric razors never shave close enough, and uses a moisturizer he shows on screen without naming. He is unsure whether it has SPF. He keeps a short stubble rather than a clean shave to avoid ingrown hairs.
• Hanselman argues men should moisturize with SPF daily. His routine is longer. He co-washes his hair with conditioner and uses Jack Black Double Duty face moisturizer with SPF 20 every day. He also uses Clinique All About Eyes serum, recommended by a makeup artist at Microsoft Build, a Neutrogena dark-spot corrector for sun spots, and retinol at night. If limited to two products he would keep the moisturizer and the shampoo. He says none of the products carry affiliate codes.
• Hanselman says clear aligners suit only light corrections. He got braces in his 40s and says they fixed his bite. He argues that aligners cannot apply enough torque to move a tooth more than a few degrees.

2024-11-18 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2024-11-15 · open the original ↗

• US producers are already at full output, leaving nothing to unleash. He quotes the CEO of Exxon saying Trump will not be able to unleash new energy production because US production is not constrained and there is no near-term opportunity to unleash more, because most US operators are already optimizing production. He reads this as producers already running at maximum output.
• He reads the remark as rebutting four years of Republican messaging. In his view it contradicts the claims of the Republican Party, the American Petroleum Institute and big oil that Biden held back the oil and gas industry — the argument he says he has been making for those four years.

2024-11-14 · open the original ↗

• Islam argues Kotlin took the best of its predecessors. He calls it the newest major language: its first official release came in 2016, against roughly 30 years for Python, Java and C++ and 14–15 for Go, Julia and Rust. He credits it with clean syntax, type safety, elegant null handling, first-class functions and freedom to mix functional and object-oriented styles. It is fully interoperable with Java, including automatic translation of Java code and direct use of Java libraries. When Hanselman raised how much Kotlin borrowed from Scala, Islam said he does not know Scala.
• Google and JetBrains drove Kotlin's rapid adoption. Hanselman notes that the first commit was in 2010 and that Google made Kotlin its preferred Android language less than three years after the 2016 stable release. Islam cites figures he looked up: about 60% of professional Android developers use Kotlin, and it has been downloaded "more than 200,000" times. He adds that it comes built into JetBrains' IntelliJ IDEA. He says Compose Multiplatform is still evolving but is production-ready for Android and desktop.
• The book teaches problem solving, not Android development. Hanselman counts about seven mentions of Android in nearly 400 pages. Islam says the book began as one on computational thinking, and he chose Kotlin over Python for researchers and other non-professional coders. It has 37 projects using only high-school maths, such as calculating Earth's circumference. Its code comes in small chunks that mirror how the problem is broken down. He credits the in-code numbered callouts to his publisher, No Starch Press.
• Kotlin's academic future depends on visualization and ML libraries. Islam used JavaFX in the book but says it can look dated, and he found Julia better integrated with visual libraries. TensorFlow has been ported to Kotlin, but he says many data-mining and machine-learning tools remain in Java or Python. For casual research projects he says Kotlin already has enough, and he calls Python error-prone because it is dynamically typed. He plans to publish solutions to the book's exercises on Medium.

2024-11-14 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2024-11-14 · open the original ↗

• Kim's security company has stayed bootstrapped and founder-run for decades. He started it at Cornell with two college roommates, a political science and a hotel management major, before graduating in 1990; the first product ran on DOS 2.0 and locked and encrypted drives, files and directories on the fly. He says the three are still together 38 years on, took no VC or investment money, and now serve enterprises (Walmart, Boeing, Bank of America) and, more recently, government work he cannot detail. His closing advice is to start a company with friends who share your passion, vision and principles.
• Assume attackers are already inside, and hide the critical assets. Kim calls the end user a weak link that cannot be re-engineered. He says his lead architect, an ex-CIA hacker, saw two freshly started Azure VMs attacked more than 5,000 times over lunch, which led to a product (captioned as "Shepard") that removes the need for open ports without changing the application or server. He claims an unnamed agency averaging up to 10,000 attempted breaches and breaches a month went to zero after deploying it, and pitches it as additive to existing defences.
• AI scaled attacks first; defenders are using it to catch up. Kim says threat actors used AI to scale their attack vectors and were ahead at the start, while defenders now use it to learn user behaviour and spot a hacker's, alongside behaviour-analytics firms such as CrowdStrike. He puts the average time an attacker sits in a network before ransomware or exfiltration at three to four months; Giard adds that AI can track patterns spanning months that no administrator could.
• Education is a prime target: regulated data, weak defences, easy ransom. Kim says he has heard education is the third most attacked industry, because children's data is regulated like finance and healthcare data while schools have low cybersecurity resilience, and hackers are "inherently lazy". He says a sister school of the high school where he volunteers had its student information system data encrypted a couple of months earlier and paid a half-million-dollar ransom the next day; he adds that a small business with its order system down can be put out of business.
• Kim's nonprofit aims to bring hands-on STEM and cybersecurity to all students. He says his nonprofit, Quest, began as a San Jose STEM program, built with NASA a permanent experiment unit on the International Space Station with capacity for 8 million experiments, runs an underwater facility 20 miles off Monterey, and now teaches middle and high school students cybersecurity, including a Chicago event in Microsoft offices organized by Microsoft's Lori Kim. He argues cybersecurity needs communicators and managers, not only deep hackers, and that the biggest change he sees is in underserved students' confidence.

2024-11-13 · open the original ↗

• Roman repression, not Arab conquest, ended the Jewish majority. The host cites roughly 1 million deaths in the revolt from 66 AD and another half million around 135–136 AD, then exile from Jerusalem, which was renamed Aelia Capitolina. By the fifth century Jews were a small minority; only the peaceful Muslim takeover of Jerusalem in 637 let them return after about 500 years.
• Muslim rule was more tolerant than Crusader rule, the host argues. Crusaders who took Jerusalem in 1099 slaughtered an estimated 10,000–75,000 Jews and Muslims, and under Christian control only Christians had safe passage. Crusades, Mongol raids, Mamluk demolitions and the 1347 plague left a backwater: population fell from about 2.5 million in antiquity to 225,000, then 150,000.
• European persecution, not ideology alone, drove Jewish immigration. Pogroms, the 1894 Dreyfus affair and Herzl's 1897 political Zionism fed successive aliyot; Jews went from 7,000 to 43,000 by 1890, 84,000 of 752,000 (about 11%) in 1922, and 630,000, about a third, by 1947. Because the Ottomans barred most sales, associations bought mainly sparsely populated coastal land.
• The Mandate became three-way violence that Britain served for itself. The host reads the 1917 Balfour Declaration as self-interested and notes the 1939 White Paper's ban on land purchase in 95% of the territory and 15,000 immigrants a year. The 1936 Arab revolt cost about 600 Jewish, 300–500 British and over 6,000 Arab lives; the host labels Haganah, Irgun and Lehi attacks — including the July 1946 King David Hotel bombing, 91 dead — terrorism.
• The 1948 war left Arabs far less than partition promised. Their share fell below 40% of the partition allotment. UN Resolution 181 passed on November 29, 1947 by 33–13 with 10 abstentions; Israel, declared May 14, 1948, defeated Egypt, Jordan, Syria, Iraq and Lebanon. Over 750,000 Palestinians were displaced, Jordan took the West Bank and Egypt Gaza, and over 1 million Jews expelled from Arab states helped double Israel's Jewish population by 1951.

2024-11-13 · open the original ↗

• Mark says language choice divides first on garbage collection. Systems code cannot tolerate garbage-collection pauses, their unpredictability, or the memory that builds up between collections. He says C/C++ and Rust are the only mature non-GC languages, meaning they have the tooling and package ecosystems behind them.
• Azure allows no new C/C++ code, by Mark's own policy. He says he declared the policy a few years ago. Agents on Azure's Boost offload card, which runs Linux and were ported from Windows-based C++ on the host, are being rewritten in Rust, and new ones are written in Rust. For non-systems code he would use C#, Python, Go or maybe Rust. He credits Rust's ownership system: without the unsafe keyword you cannot create a memory-safety problem.
• The ecosystem, not the syntax, decides where a language dominates. Mark says AI research has pushed him into Python for the last couple of years because the ecosystem leaves no choice. Hanselman argues that languages are converging on the same keywords and collections. He offers a half-joke for why Python won ML: it is "more fun to say".
• Hanselman argues languages need not "win" to justify existing. His analogy is Finnish, which suits its speakers, while JavaScript, like English, is an undesigned mash that steals from everything. He also says languages built with hindsight are better, calling Kotlin "demonstrably better than Java". Mark has no favourite language and says languages serve different purposes and stylistic preferences. Hanselman says his own favourite is C#.
• CSnakes lets C# call Python in-process. Hanselman describes Anthony Shaw's tool, which uses source generators to parse a Python file and generate C# bindings, then marshals data across. The goal is to consume Python data-science libraries such as PyTorch from C#. Hanselman says they have that working, with edge cases likely. He contrasts it with earlier projects such as IronPython, which tried to reimplement Python.

2024-11-12 · open the original ↗

• Trump inherited low prices from a huge global oversupply. An EIA outlook the week before he took office in January 2017 expected only slight crude increases through 2017 and 2018. He cites $50-a-barrel oil, $2.40 gas and 3 billion barrels of working oversupply left over from the late-Obama crash.
• The 2018 crash was Trump's own doing. He says Trump promised Saudi Arabia sanctions on Iranian oil, got higher Saudi output, then granted Iran waivers, double-crossing OPEC. Bankruptcies averaged one a week through the last three quarters of 2019, before COVID, and 30% of drilling rigs were lost.
• OPEC 2020 was OPEC's revenge, and it hurt consumers under Biden. He reads the two-year 10% production cut as retaliation for 2018, lasting until 18 months into Biden's term and producing the highest US gas prices. He calls it a huge driver of global inflation and says refining capacity was also lost.
• Consumers gained almost nothing from the crash Trump caused. He puts the saving at 7 cents a gallon and weighs that against a bankruptcy a week and later record gas prices, and says gas never touched a $3 national average when Trump did it.

2024-11-11 · open the original ↗

• Democratic election-denial now serves America's adversaries. Speaking as a Kamala Harris voter, he tells those spreading stories of Russian interference in 2024, including theories that Starlink was used, to stop. His reading is that Russia, Iran and other competitors aim only to keep America divided, used the Republican platform to do it until this election, and now appear to be using Democrats through 2028.
• His own 2016 denial achieved nothing. He says he spent hundreds of hours disputing Donald Trump's 2016 win, as did millions of other Americans. The only real change came at the ballot box, with the modest 2018 Blue Wave and Joe Biden's 2020 election, while the mistrust it sowed hurt Democrats and the country.
• The result is legitimate and should be accepted. He asserts the electoral system is secure and monitored and checked before, during and after the vote. He argues the Electoral College excuse no longer applies because, in his words, the vast majority backed Trump. The choice he lays out is to accept Trump and work on communities and families, or get nothing done for two to four years.

2024-11-11 · open the original ↗

• Roman repression, not Arab conquest, ended the Jewish majority. The host cites roughly 1 million deaths in the revolt from 66 AD and another half million around 135–136 AD, then exile from Jerusalem, which was renamed Aelia Capitolina. By the fifth century Jews were a small minority; only the peaceful Muslim takeover of Jerusalem in 637 let them return after about 500 years.
• Muslim rule was more tolerant than Crusader rule, the host argues. Crusaders who took Jerusalem in 1099 slaughtered an estimated 10,000–75,000 Jews and Muslims, and under Christian control only Christians had safe passage. Crusades, Mongol raids, Mamluk demolitions and the 1347 plague left a backwater: population fell from about 2.5 million in antiquity to 225,000, then 150,000.
• European persecution, not ideology alone, drove Jewish immigration. Pogroms, the 1894 Dreyfus affair and Herzl's 1897 political Zionism fed successive aliyot; Jews went from 7,000 to 43,000 by 1890, 84,000 of 752,000 (about 11%) in 1922, and 630,000, about a third, by 1947. Because the Ottomans barred most sales, associations bought mainly sparsely populated coastal land.
• The Mandate became three-way violence that Britain served for itself. The host reads the 1917 Balfour Declaration as self-interested and notes the 1939 White Paper's ban on land purchase in 95% of the territory and 15,000 immigrants a year. The 1936 Arab revolt cost about 600 Jewish, 300–500 British and over 6,000 Arab lives; the host labels Haganah, Irgun and Lehi attacks — including the July 1946 King David Hotel bombing, 91 dead — terrorism.
• The 1948 war left Arabs far less than partition promised. Their share fell below 40% of the partition allotment. UN Resolution 181 passed on November 29, 1947 by 33–13 with 10 abstentions; Israel, declared May 14, 1948, defeated Egypt, Jordan, Syria, Iraq and Lebanon. Over 750,000 Palestinians were displaced, Jordan took the West Bank and Egypt Gaza, and over 1 million Jews expelled from Arab states helped double Israel's Jewish population by 1951.

2024-11-07 · open the original ↗

• Qiao left Meta because enterprises lacked the means to adopt AI. She spent five years taking PyTorch from a research project to production at Meta's scale. Working with companies such as Walmart, Disney and John Deere, she heard that they lacked the right software, hardware and teams. She judged that serving the whole industry was a bigger impact than staying at Meta.
• Fireworks chose inference over training as the larger problem. Qiao argues that inference demand scales with end users, bounded only by Earth's population, while training scales with the far smaller number of researchers. She says training is a hard business because models are superseded almost weekly and hardware generations now arrive several times a year instead of every two or three years. Fireworks bets on open-weights models plus lightweight fine-tuning. She names latency and serving cost as the two problems, and says startups that reach product-market fit can go bankrupt on cost.
• FireOptimizer tunes inference to each customer's workload. Qiao compares it to a database query optimizer. It shows each customer their own trade-off curve across quality, latency and cost, and lets them choose a point on it. Beneath it sit Fireworks' own PyTorch build, custom GPU kernels, a distributed execution engine and caching. She endorsed Hanselman's analogy of a reverse proxy in front of a model. Speculative decoding pairs a small and a large model, giving the small model's latency and the large model's quality only when the small one's hit rate is high. She says FireOptimizer aligns both models to the workload automatically.
• Qiao says safety starts with model providers, then customization. She cites Meta, for whom Fireworks was a Llama 3.2 launch partner, putting heavy post-training work into guardrails because it has no hosted API to control. She argues that safety means different things in different industries and regions, so customers must be able to adjust the model to their own guidelines.
• Qiao predicts business AI will move to ever smaller models. She argues that business tasks are constrained, not open-ended, so models of a billion parameters or fewer, plus customization, can match trillion-parameter models on narrow tasks. Hanselman added his own view: he is disappointed by the fascination with giant models and expects the interesting work in groups of small models running locally.

2024-11-06 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.