What is a well known 'public secret' in the industry you work in that the majority of outsiders are unaware of?

Permanently Deleted

Y2038 is my "retirement plan".

(Y2K, i.e. the "year 2000 problem", affected two digit date formats. Nothing bad happened, but consensus nowadays is that that wasn't because the issue was overblown, it's because the issue was recognized and seriously addressed. Lots of already retired or soon retiring programmers came back to fix stuff in ancient software and made bank. In 2038, another very common date format will break. I'd say it's much more common than 2 digit dates, but 2 digit dates may have been more common in 1985. It's going to require a massive remediation effort and I hope AI-assisted static analysis will be viable enough to help us by then.)

Are there currently any that are showing signs of imminent collapse? (Twitter, maybe?).

Or what are the signs to look for those who are untrained in this field?

Package management is impossible. When a big enough package pushes an update the house of cards eill fall. This causes project packages with greatly outdated versions to exist in production because there is no budget to diagnose and replace packages that are no longer available when a dependency requires a change.

Examples: adminJs or admin bro... one of them. Switched the package used to render rich text fields.

React-scripts or is it create react app, I don't recall. Back end packages no long work as is on the front end. Or something like that? On huge projects, who's got the budget to address this to get the project up to date?

This has to be a world wide thing. There is way to many moving targets for every company to have all packages up to date.

It's only a matter of time before an exploit of some sort is found and who knows what happens from there.

As an everyday user of software who's not a developer, this is not a secret. Nothing works well for any extended period of time.

Does leftpad count as a collapse?

Donate my body to the worst medical student in the collage college. I'll definitely be an F level carcass.

You didn't talk about how coffins are sold for many thousands of dollars when they are just cheap plywood boxes that shouldn't cost more than a hundred bucks and that serve no purpose other than to decay as quickly as possible.

Not so fun story:

One of my first jobs when I was barely 18 was with one of the big funeral home/cemetery providers in the US. It was positively horrible, and not for the reasons most people think.

As a new hire, you’d start on the cold-calling phone banks, which was bad enough. Nobody wants a cold marketing call from a cemetery. But it got worse from there.

After a month on the phone bank, I’d done well enough to be promoted to field sales, which meant going to the most impoverished areas of town to follow up on the appointments the phone bank had made, basically trying to scare poor elderly people into handing over what little they had to ‘pre-plan’ for their deaths, with the pitch that if they didn’t, their family would suffer.

After a few appointments it was clear I didn’t have the stomach for that, so they moved me to on-site sales, which was somehow worse.

On-site sales included helping to host the Mother’s Day open house at the large main cemetery. They set up a greeting station at the entrance with refreshments and ‘in memorium’ wreaths that could be bought by bereaved family (on that day, mostly children of the deceased, but also mothers who had lost their children, some at a very young age). It sounds like a kind thing to do, because many young mothers/fathers coming to visit were so distraught, they hadn’t stopped for coffee or thought about flowers.

I was not stationed at the welcome station. I was a ‘roamer’, meaning I was one of several staff expected to meander through the graves and check on families graveside – to ask if they needed anything and to upsell them pre-planning packages for themselves or their other children. I am not kidding, we were expected to do that.

I had to be prodded to approach my first mark (a young couple ‘celebrating’ the woman’s first Mother’s Day at the grave of her several months old child, and I couldn’t stomach it. It felt barbaric, to even try to sell someone who could not stop crying at the grave of her young child. I couldn’t do the pitch, obviously, and backed out as soon as possible, then hid by the skips behind the main building until the end of the day when I quit.

I’ve done many jobs in my life, including cleaning bowling alley toilets, but I’ve never been asked to do anything as vile.

I’ll bet everyone in the funeral industry can guess which company I’m talking about.

What do you mean by "public funeral"? What's the alternative? It sounds like you'd consider an event with only friends and family where there was a coffin in a room to be a "public funeral". That seems to be what most people have, but it isn't very public. Is a non-public funeral one where the family makes the coffin themselves and there's no event where people see the dead person and the coffin?

Permanently Deleted

And how you're tracked online. I've worked on Google ads accounts every day for a decade and I don't see you,the user, and your data.

I just click "female, 50+, likes home decor, uses a phone" and then a little business I work with bids 10% extra on you because they think you might be interested in their new autumn wreaths they're super proud of, and Google think you fit that box I ticked.

And that's advanced marketing for most businesses. Most businesses won't even get into the audience side of things and they'll stick to keywords: they'll show you an ad because you searched for "autumn home decor" and that's all.

Google take advantage of most advertisers by saying "let us be in charge of your keywords, and how much money you spend, our AI is smarter than you and you don't have time!"And most businesses just use the automatic stuff because they don't understand it, and it's true, they don't have time... so then Google takes your "autumn wreath" keyword and shows your ads to someone looking for "Christmas trees", because they're both seasons and they're both plant related, right?

And then the small business gets charged $1 by Google to show their autumnal page to someone who wasn't interested and left right away.

My job is to help these businesses actually make an advertising account that doesn't fall for all these little bear traps that Google sets all over their ads interface. They weren't there 7 years ago, but things have been getting worse and worse. Including third party sales companies like regalix, hired by Google to constantly call you and telling you to trust the automation and spend more.

::hugs my PiHole::

I'd be interested in the amount of electricity that gets wasted on this

I'd be interested in finding out why some of the ads I see (mostly in Android games I play where I voluntarily watch the ads for in game rewards) are so badly matched to me. I'll get ads in Spanish when I only speak English. I'll get ads for dating sites when I've been married for over 20 years.

Very few of the ads seem to be anything I'd even remotely consider. Not that I mind too much. I ignore the ads (sometimes even muting them) and do other things until they stop playing and I can get my rewards. Still, those very mismatched ads seem to be badly placed. Is it just that nobody else is bidding for this ad spot so "let's play this Spanish ad for toilet paper" wins the rights to advertise to me?

I heard that (at least on YouTube) it isn't only how high people bid but how likely someone is to click on your ad. Like if you have an ad they're likely to click on you may get shown even if you bid less. You probably know more about it, I'm just sharing this because it sounded fascinating when I heard about it.

The past decade of the tech industry has felt very snakeoil-y.

INB4 "It always has been."

scared laughter

Tom Scott on Computerphile

And his own channel's sequel

It is kind of hilarious that airplanes are seen as being safe and reliable, when if they were given the same factor of safety as most other consumer goods, they'd never get off the ground from being too heavy.

I do NOT recommend you do this, but if a ladder says it is designed for 300 lbs, then it should carry 1200 lbs. 4X is a fairly common factor of safety for things like ladders where people's lives are in jeopardy. Most other items are usually 2X. (I want to point out that there are qualifications to this... static loading and dynamic loading are totally different things. Also a simple point load is not the same as a cantilevered loading condition. A new piece of equipment is not the same as one abused on the job for the last 10 years. All these things will dramatically affect safety ratings for things)

I like to use https://explainxkcd.com/2030/ since I get the title text, an explanation, and comments.

Works fine in Brazil, shit is audited every single year by universities and other especialists, only rightoids scream that it's bad and only when they lose.

Hold up, you mean that market in the middle of nowhere (like Kansas) with “fresh caught” fish was not caught by my local fisherman.

Shocked, I tell you 😂

In the UK that's not true here. I work at a supermarket distribution centre and fish comes in chilled not frozen.

Along with this, just because you are going to a shoreline restaurant, doesn't mean you are getting fresh seafood. The same frozen fish that gets deep fried in that quaint shore town is the same frozen fish served 6 hours inland.

Yep, I always ask for the bag of frozen shrimp, and smack my husband upside the head when he buys the thawed stuff. I've TOLD you, over and over, get the frozen bag!!

I have an allergy to a bacteria that grows on fish during the freeze/thaw process. I can definitively say that if you don't catch it yourself, or witness it being caught and prepared, then it's been frozen. I've tried a few "fresh" fish places, and the result is always a sleeve of benedryl and being itchy for 3 days.

Sounds like they didn't spend any money on Cyber security's team to properly implement it then....data exfil %100 would have been picked up by any real DLP solution and even barebones heuristics based EDR would have thrown a red flag as well.

Sounds like the company doesn't have a clue about cyber security then. Tens of thousands is a piddling infosec budget for anything but a tiny company. Also, Insider threats, malicious or otherwise, should always be on an infosec professional's radar.

Companies not giving a shit about cyber security is probably not a secret but it is still pretty common, I think, so nobody should be surprised when there are major breaches.

Infosec is usually seen as an expense that cuts into profits. Assuming top level management and the board give a shit about security that's great but often the risk isn't fully appreciated at the top or is managed poorly.

Adequate infosec requires a company to have very mature processes across the board in IT (and likely beyond). C-level "buy in" isn't enough. If the C level management and board doesn't actively demand it, infosec will lose out to myriad other priorities every time.

The big tell is the org structure. If the CISO reports to the CEO, great. If they're reporting to the CIO, CFO, etc., that can cause conflicts of interest. It can still work. If there is no CISO or they are the same person as the CIO, or if infosec reports several levels down in the org--beware!

That sounds highly illegal depending on what's on the databases.

Lol same here. Some for ecomm, but the most egregious was underwriting PPP loans. There was a database none of us could access after the loans were underwritten and sent to processing. But most of those documents came in thru the portal and we had to download that package and combine it with anything we got in email... Tax forms, IDs, and all the most sensitive personal info as a lot of businesses that applied were sole proprietors. All those documents say on my local HDD and I catalogued them in case they were needed again.

None of that was handled securely, it was on my home network with no VPN, and after the project was over very suddenly I sat on that laptop for 6 months until they sent a return label. I was a good worker but it was a mass hire and not a lot of vetting that happened.

Wow that suck. I always spend time turning off every legitimate consent button. So I get cookies anyway?

Most of these consent pop ups are designed to be insanely annoying to the point where you just click accept all on a long list of cookies for individual things and they are not even grouped

That doesn't sound realistic. There are real fines for non compliance and it's trivial to find out what cookies you have.

Security theater.

EU, can you just make that shit go away? I am so goddamn tired of clicking cookie dialogs I could puke. kthxbye

If anyone is interested in a good read about the active changes coming to Cookie Law in the future: https://www.itpro.com/network-internet/web-browser/369894/the-cookie-law-is-finally-crumbling-good-riddance

50% seems conservative lol

Permanently Deleted

Permanently Deleted

Isn't password rotation a horrible practice because it makes people use passwords like "MyNewPassword15" since it's the 15th password reset they've been forced to do?

We have a custom backend website I have to log in for my work. You don't have to use a password, just an email address. The only "security" is it's on a weird URL that people wouldn't likely know if they weren't given it.

Not to leave out the Active Directory Admin password that gives God mode and everyone has it.

Password rotation is very insecure. No one should be doing that. I also hate when companies set maximum length for a password, like 12-16 characters. Bitch, my 32 character password is much more secure!

I believe Microsoft’s 365 platform helps a lot in that matter. Even without any security strategy or custom configuration M365 offers a better security level than those businesses could ever reach themselves.

90% if IT Security is theater, including password reset schedules, so even if a company has “policies” in place, I don’t expect any of it to secure anything. Most IT “security” would be better solved with a mandatory class on data security, but for some reason executives and IT depts push these useless policies as if they actually did anything other than make work more frustrating for 90% of people.

Which might explain why medium sized companies that are not completely clean-nosed are happy to run Windows 10 with all its spyware elements running unregulated.

It's also terrible in the government sector, which is why the NSA's huge database on US internet traffic is accessible to rivals like Russia, Iran and China.

A lot of the same things you mention about game development are also apparent in open source software which is why it is usually so terrible. Someone that can program some complicated visuals for a 3D modeling program does not mean that same person actually does 3D modeling, which is why the interface for so many open source programs are abysmal.

This is probably true of many many other industries. I work in automotive and while a lot of us care about delivering a quality product, the majority are not "car people" and have never changed a part on their car.

I've been a game programmer for >10 years and I would be fucking miserable if I spent most of my free time with video games as well. Isn't that what we call work/life balance? And from my experience, most game devs either stop being "gamers" at a certain point, or they burn out and quit the video game industry.

That being said, almost everyone I know from gamedev is really excited about video games, and they have a ton of experience, even if they are not playing games in their free time anymore. It could be because I've only worked for indie projects and small publishers.

I'm not sure what kind of role you had in the industry, but I'm not sure what you're saying is entirely accurate... although there are some bits in there I agree with:

Lots of programmers and artists don't really care about the final game, they only care about their little part.

Accurate. And that's ok. A programmer whose job it is to optimize the physics of bullet ricochet against thirteen different kind of materials can go really deep on that, and they don't need to (or have time to) zoom out and care about the entire game. That's fine. They have a job that is often highly specialized, has been given to them by production and they have to deliver on time and at quality. Why is that a problem? You use the corrolary of film, and nobody cares if the gaffer understands the subtext of the Act 3 arc.... it's not their job.

Game designers and UX designers are often clueless and lacking in gaming experience. Some of the mistakes they make could be avoided by asking literaly anyone who play games.

Which one? A game designer lacking in gaming experience likely wouldn't get hired anywhere that has an ounce of standard. A UX designer without gaming experience might get hired, but UX is about communication, intuition and flow. A UX designer who worked on surgical software tooling could still be an effective member of a game dev team if their fundamentals are strong.

Investors and publishers often know very little to almost nothing about gameplay and technology and will rely purely on aesthetic and story.

Again, which one? Investors probably don't know much about the specifics of gameplay or game design because they don't need to, they need to understand ROI, a studio's ability to deliver on time, at budget and quality, and the likely total obtainable market based on genre and fit.

Publishers -- depending on whether you are talking about mobile or console/box model -- will usually be intimately familiar with how to position a product for market, what KPIs (key performance indicators) to target and how to optimize within the available budget.

This is why you have some indie devs kicking big studio butts with sometime less than 1% the ressources.

This has happened. I'm not sure it's an actual trend. There are lots of misses in the game industry. Making successful products is hard -- it's hard at the indie level, it's hard at the AAA level. I would estimate there are a thousand failed Indies for every one you call out as 'kicking a big studio's butt.' Lots of failed AAA titles too. It's just how it goes.

The same, by the way, is true of film, TV, books and music. A lot of misses go into making a hit. Cultural products are hard to make, and nobody has the formula for success. Most teams try, fail, then try again. Sometimes, they succeed.

you expect the director, producers and distributors to have a decent level of knowledge of the challenges of making a movie.

But not about the source material.

Adaptations nowadays suck ass because there's no fans in charge.

Making games is an art form... The fuck

It was a thing I noticed regarding Ubisoft games that upper management seems to wish to make movies rather than games. It struck me home when the knife fight with Buck Hugues in Far Cry 3 was just a long chain of quicktime events like it was Dragon's Lair from the 1980s; disappointing because Far Cry 2 was all about game mechanics telling the story rather than cutscenes. (Which was, admittedly at cross purposes. It's a game about violence in a failed state in Africa with the futility of violence as a running theme. But it did that very well.)

Game designer here. I'd say there are degrees in these. Most game designers I know love to play game, but which type of game that they love? Well train designer should be able to design anything, you might say that, but most people have a thing that they keen more than the other thing.

So, they may be very well verse on some genre and might not so much on some. Now, getting a job in the right company that making the right game that you are keen of might not be that easy.

I've seen some young to old designers who only play certain type of games and be clueless on other type and some who can adapt their design skills to many types of games.

But game development can't be without testing if they design something wrong, it should show up on test...

Still, sometimes you got the best devs and the test results came out surprised you.

It's easy to point what is wrong looking from the end product pov but when the design starts with a clean drawing board it's also very easy to miss things.

Game dev is hard man...

I 100% believe this. It doesn't necessarily mean it's bad work, but the way you phrased it makes a dozen or so instances of "something feeling weird" make sense. Sometimes it's just a mismatch between the intensity of the fans fanaticism and the developer having to go to work every day and do a job.

I think game developers can harness this by embracing their modding communities. I'm currently waiting to see what Cities Skylines 2 is like. It has to be hard for a bunch of devs who seem like normies to develop a game for a bunch of nerds, some of whom know more about civil engineering and traffic planning than real engineers. :D The original was well-modded and it feels like the game was a collaboration between the community and the developers. To me, this kind of bridges the developer/gamer gap.

Idk but I really like Valve, I believe they care about the stuff they push out.

Do you think this occurs equally across all big budget games?

An effective therapist would develop a clear treatment plan with you that aims to meet objectively measurable goals within a certain time frame.

This is a great point and true for non-therapists as well. A good measure of whether or not someone helping you is providing you value is if you are progressively improving in measurable ways.

True for doctors, meds, physical therapists, coaches, you name it

This is very accurate. I worked 5 years in a BH Insurance company. We saw shitty providers all the time, and we were constantly having to play the game of deciding how much we (and our members) could tolerate before cutting the providers out of the network. Cutting too many providers doesn't correct bad actors or replace providers for people who need them and can cause backlogs if other providers aren't available to take on their patients.

The only thing we were able to do to correct many providers by changing their pay to a value based model, so providers would get paid more for better outcomes (and sometimes only paid when patients improve). It would increase pay a lot over standard rates. But providers fought that big time. They just wanted to do things their way and cash a check of a set amount with little or no oversight.

Better help is used by providers as a way to supplement their income, and they typically pay a bit less than conventional appointments because of the digital channels. However, Ive heard they have some issues with data security on their platform and their matching system is pretty flawed due to their network being somewhat ephemeral.

If you do want to seek therapy, remember you have multiple ways to get it covered. Your health insurance probably has some coverage, and your employer (in the US) likely has an EAP program which will have coverage for therapy for at least a few sessions (typically 3-12) sessions. It's worth looking into that before paying out of pocket.

One example that comes to mind is Better Help

During the pandemic, this company was heavily advertised across Twitch. Not surprised they pay shit wages. Wonder if they originally paid 2-3X market rate during the hype, but slowly clawed back the teaser rates in favor of the dog shit rates.

I have lifelong major depression, and got myself integrated into the mental health system of San Francisco (one of the better municipal systems available in the States). Since my insurance was government or state, it typically meant that I'd see interns for a year before they graduated and started their own practice. A friend of mine and I would joke that we were trainers in that our life drama was severe enough to convey to our trainees that life shit is real and that sometimes there are real risks (suicide, stalkers, toxic violent parents, etc.) but we personally were not likely to become a danger to ourselves or others short of natural disasters.

I also got to crush egos because it's not like the movies where the patient has a good cry and then is better. I've done a lot of crying and I'm still depressed as ever (more so as the world is literally burning, which limits my hope for a better future). I can manage my symptoms more or less, but I'm never going to be a happy self-sustaining good little citizen. And curiously, some of them see that as an end goal: You get Will Hunting to have a good cry and he's fixed. Not so much.

I eventually got lucky, and was able to find one of my old interns and resume with her while she was working on her PHD. I was a case in her thesis and got an ASD diagnosis out of it in my late forties (it's not helpful yet for navigating benefits, but is useful regarding directing my own symptom management). But most of my career as a patient is spending more than half a year getting my therapist familiar with my case and then the remaining months squeezing a bit of process out of it...

...Or just goofing off, since I absolutely have personal demons that don't want to be closely scrutinized, so it becomes too tempting to let my therapist get distracted by details that are entertaining to them. (My history in the BDSM and my burgeoning queerness are fun topics, as are my awareness of issues like the climate crisis, the plastic crisis, the police state, the surveillance state, the transnational white power movement and its uprising and takeover -- all of which were still commonly regarded as conspiracy theories / fringe hypotheses when I was in session.) Sometimes, we patients are so terrified of what our closeted shit says about us that we're not ready to open those doors. And sometimes the therapist doesn't want to look either, so we negotiate a diversion we can agree to distract us until later.

I stopped going to therapy shortly before the COVID-19 epidemic outbreak and lockdown so I get to start all over again in Sacramento. Hopefully, I'll find a permanent therapist (and a good match) early, but I suspect I'll be back to seeing interns again.

You nailed it. 💯

This is why I hate that "get therapy" has become a common meme. Most therapy is a scam in the US.