TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Zed Shaw - The ACL is Dead - CUSEC 2008

123 点作者 edwardog超过 16 年前
Recorded almost a year ago (before the bank busts, and shortly after Zed’s first famous rant), this presentation was given to about 400 Canadian undergraduate software engineers and computer scientists. Zed talks about management and his ACL-killer at a bank job accompanied by Factor-powered slideware. Also: steaks, strippers, and statistics.<p>N.B. This video might damage your vision of Zed swearing all the time and may make it seem like the last year of ranting was a terrible joke gone wrong. Oops.<p>P.S. - Check out this year’s lineup (Ingalls, Stallman, Bryant, Culver, Hwang, and Bowkett are just the keynotes). This is one of Canada's best kept secrets, and tickets are super cheap.

10 条评论

bprater超过 16 年前
Wow, the guy doesn't have horns!<p>He's actually really entertaining to listen to. I like his real-world examples of problems.<p>Steak will never be the same.
sspencer超过 16 年前
Zed is probably the only blog author I would really like to meet in real life. And this video seems pretty close to what I imagined he'd be like.
评论 #421091 未加载
markessien超过 16 年前
Zed is going to become important. It's easy to write, but it's not easy to look good on video, as well as have good video timing. He's not perfect, but he's good.<p>If he sticks to his rant-personality, he will sooner or later become on of the stars of the internet.
评论 #421655 未加载
stcredzero超过 16 年前
I love that he's saying "The ACL is Dead." This should be said loudly and often. Maybe it'll get through the heads of management out there. Heck, it needs to get through the heads of a lot of programmers.<p>Modern security and access controls need functionality like capabilities.
评论 #421185 未加载
davi超过 16 年前
Notes from lunchtime viewing of first 40 min<p>------------------------------------<p>~9:29: "law is actually kind of a turing complete language"<p>Law is fuzzy; ACLs are fuzzy. ACLs can't handle real law because they're not Turing complete.<p>~11:20: had a business manager learn Ruby, had him implement poorly specified/tough features --&#62; result: he modified/eliminated requirement<p>~12:20: a bunch of if statements are easier &#38; better than an ACL<p>~13:50: in one case, 1000 users and 1000 containers would have required 270,000 ACL entries to implement one compliance rules; and 5 minute polling updates, because rule was time-based; --&#62; couldn't audit, handle real-time changes; would've required 12 beefy boxes to execute.<p>14:40: Instead, re-write all rules in 400 lines of Ruby; analysts could read the code and say if implementation was right.<p>15:45: So a language wins, right? No -- "this is where the Suck begins" -- where management comes and crushes your soul. Bad product was substrate for document management system.<p>17:50: How do they sell this stuff? Connections, subterfuge? No.... "Steak and strippers, baby."<p>19:00: "This is one reason I want <i>women</i> to be in charge."<p>20:00: "What happens when they give you an MBA is they give you a lobotomy... and you walk out going 'Synergy! Synergy! Synergy!'"<p>21:00: MBAs are trained in <i>manufacturing</i> -- programming is <i>not</i> manufacturing -- you're going to work in an environment where they think you're worker bees on an assembly line.<p>22:00: So what to do about it?<p>1) Managers see people sitting there, they think nothing is going on. If management says "I demand all of your creativity but trust none of your judgement," you have to gather evidence that makes you more credible. You have to be objective. Try out whatever crappy technology that they're proposing.<p>2) Develop alternatives: if their crappy technology is good enough, stop; but if not, try out alternatives before suggesting.<p>3) Statistics; develop some pretty graphs. E.g., Zed's team built a demo server, showing slow performance. Without those, he would've had no evidence to contradict the sysadmin who was saying his tweaks had helped. Be prepared for intensely technical arguments, too.<p>4) Admit technical deficiencies.<p>~29:30: If none of this works, and they won't take it, build it anyway and then sell it to them or their competitors. The client can be your first customer. Good way to start a company.<p>~30:00: our doc management system is very simple, 4400 lines of Ruby plus some Samba modifications, and better than anything else out there.<p>Drools -- JBOSS rules engine -- "blows ass" -- just use Ruby instead.<p>~31:30: Figure out Roles first, with a Role Resolver -- draws on LDAP etc. -- 30 lines of Ruby -- now, ~200 lines of Ruby, covers all bizarre corner cases, easy to add new rules, easy to fix existing rules.<p>~33:30: And they <i>still</i> wanted the crappy older thing. At this point, it's <i>all</i> the social problem. What <i>mattered</i> was the old product had the same name. "Document Store 2000" vs. "Document Store New Gen" -- completely different, but easier to get through manager's manager's procurement process -- "that's the stupidity you deal with in the real world".<p>35:15: How do we win? We kept hammering. They sent out their best guy. I had him implement the toughest rule, the one requiring 200,000 ACL entries. Then had him explain to his managers why it wouldn't work. Had nothing to do with tech.<p>36:15: This stuff will kill you. How do you keep your soul through all of this? [Poll audience for years of education] -- "It don't matter" -- you're a factory worker.<p>37:30: "Business leaders don't really like you, because they need you, and they don't understand anything you do. ... And the sales people know this; they know if they go to your boss, and give them steak and strippers...."<p>~38:40: Fight your hardest not to be a corporate coder: your life as a geek or a coder should be all about exploring some new domain that no one else gets -- you can only go to conferences and talk to other geeks about what you do. A corporate coder works only on the stuff he's supposed to on one language, and never touches code otherwise. You should go home and do something <i>fun</i> with technology.<p>40:00: how to avoid not getting burnt out by day job? I.e., how to avoid losing your soul?<p>[40:30 stopped watching, back to work.]<p>------------------------------------
评论 #421159 未加载
评论 #421155 未加载
评论 #421113 未加载
评论 #422193 未加载
allertonm超过 16 年前
Lots of stuff here that resonates with this some-time CMS architect and soulless corporate wage slave, but I missed the part where Zed was able to provide an easy-to-use UI to allow non-programming sysadmins to change the security rules. That must have been so simple he didn't need to mention it, right... right?
评论 #421349 未加载
nirmal超过 16 年前
I wish I could see his slides.
评论 #421170 未加载
thenduks超过 16 年前
This whole "must follow speaker with camera" thing has _got_ to stop. Just stick the camera on the slides and leave it there. _At least_ get both in the frame. This is pushing unwatchable with him pointing to the slides all the time, the audience laughing at the slides, he's referring to code on the slides... Kill me :/
评论 #424343 未加载
shaunxcode超过 16 年前
Zed Shaw: Joe Hill of programming. Though rather than organizing workers into unions/factions of the IWW he is advocating people reserve their "real" programming/creativity for themselves unless they stand to make a profit (which they would if labor conditions were equitable). I can totally get behind that.
thomasfl超过 16 年前
fucking awesome