In this line;

Tell a story. It might be "unrelated" to thd topic at hand (I based one on Shackleton's expedition, and another on a Robert Frost poem (two roads diverged.) Or it might be related, a "my journey" type, or it might be about the experience seen through the eyes of a customer. But a story helps the audience relate, and keeps a thread through it all.

If you can, be funny. Frankly this is hard if you're not a 'funny' person. Delivering a good joke, or line, well can be learned but if it's not your thing steer clear. Bad funny is worse than not funny.

If you're not funny naturally then get a funny person to help you script in "dry" humor lines. You can deliver them dry, in fact often the dryer the better.

"We founded our business in Jan 2020. Nothing could possibly go wrong".

But good funny is great. Learning while laughing really keeps the audience engaged.

Reacting to the audience engagement is also a skill worth developing. When they're bored, move on. When they hiss or boo or laugh or leave, these are all valuable feedback.

Enjoy yourself. If you're having fun, they will too.

I'd also argue, very necessary.

A lot of thd new APIs have to do with accessing hardware. Camera, Microphone, Serial ports (currently experimental) etc.

Given how easy a MITM attack to injection JavaScript or HTML into insecure pages is, a world where insecure pages had access to hardware makes that hardware very vulnerable.

Even though all you'd be doing is reading some random blog etc.

To those who still think serving HTTP is some sort of principled stand, just be aware that injecting malware onto your page at delivery time is pretty trivial. Quite honestly, and I mean this in a constructive way, it doesn't signal "principles" it signals "incompetence".

I think the best analogy for this are scams. Once a scammer finds a mark they'll pay, there's a desire to soak them for as much as they'll bear.

EVs are not a scam per-se, but they also don't add any value. 80% of the world already figured that out, do by definition if you are asking you are in the bottom 20%.

Now I get you were in the process of migration, but that's an edge case. In a normal case if you go around asking to buy a wildcard EV, you basically have a sign saying "fleece me".

So yeah, there's still a market for people wanting to throw money at CAs, even in these comments you'll see some. And management types are especially prone to "sounds expensive, must be good" logic when spending other people's money.

I think you've left out the ecosystem of semi-scam, without that the decisions look less logical.. If you go and add a private rootCA to all your servers there are risks. You can convince yourself the risks are covered, you can convince a highly qualified security analyst. Can you convince a business intern with a checklist hired by a certification firm that underbid the one with specialists? 30K to engage with no one on the topic starts to look ideal.

I'm not sure the alternative is sef-created RootCA. (But perhaps I don't understand the underlying case.)

To me, the alternative is just a LE cert. Can do wildcards via DNS challenge.

I was replying in the context of what you were replying to where they either could spend 30k or make a private root. I'm not sure they were actually using EV but for it to cost $30k and given the topic of the thread it seems plausible they were using some technicality on EV or similar to reduce public domain validation requirements.

I think the rebuttal to the CEO today is really very simple.

a) How many of the sites you visit everyday have DV and how many have EV certificates?

b) Name any site at all, that you have visited, where your behavior or opinion has changed because of the certificate?

In truth the green-bar thing disappeared on mobile long before desktop (and in some cases it was never present.)

In truth if you polled all the company staff, or crumbs just the people round the boardroom table (probably including the person complaining) a rounding error from 0 could show you how to even determine if a cert was DV or EV.

EV could have an inspector literally visit your place of business, and it would still have no value because EVs are invisible to site visitors.

it used to be that EV certs had higher insurance if there was a leak of the intermediate private keys and lost data.

Since nobody ever actually leaked an intermediate private key for a CA, people don't recognise the value.

If we had lost payment card information through MITM, we would have been liable for a lot more money.

That was the business justification for EV back when I was doing major ecommerce stuff.

Your analogy is apt, but can be extended a bit further to show why MS is so successful.

Imagine organizing a meal out for 5 people. Easy. Despite the vegan, gluten free, kosher, high protein, lactose intolerant, no-fish, only fish, carb free dietary requirements there are lots of places to choose from. You can even order from 5 places and get 5 meals delivered.

Now do that for 50. Or 500. Or 50 000. Sooner or later you start going to buffets. Sooner or later the food becomes very bland.

You judge your software purchase for yourself based on features and moral principles and likely price.

Business doesn't really care about features. It does care about suppliers. It does care about the reliability of the supply chain. It doesn't care about price (at least not at the Windows / Office price point.)

I've been a supplier to corporates. The paperwork (and commitment) is substantial. Insurances, liabilities, support levels, release procedures, accountability,,,, it goes on for days.

The moat MS has, has nothing to do with software. Which is why that "better software" fails - because it is optimizing for one kind of "better" and business defines "better" another way.

And no, nothing is "replaced easily" in the enterprise space. When 10000 people, scattered over 1000 locations, get all-new software, nothing about that is easy.

In a program I once wrote, all menu items could be added to the toolbar. The toolbar (optionally) didn't have text (other than the tool tip.)

Having the icon in the menu acted as a visual link so that the user saw it in the menu, then in the toolbar.

The icon was reinforced as part of the header on the window the user went to. In other words if they clicked a menu (or button) with that icon, then they got a window with that icon.

It helped that we used color icons, so the colors also indicated something of the nature of the task at hand.

Where I live the rule is simple, and all stores adopted it.

If something is mislabeled you get (one of) free, and all the rest at the lower price. (And you see a worker skurry off to fix it immediately.)

And here's a shock, mislabelling is vanishingly rare... seems it can be done if desired...

All the above. Plus it is absurdly simple to manipulate profit up or down.

For example, as an owner, I can be paid a bonus, or not. Crumbs, I can be paid a salary or not. If I want profits high, I simply take a low salary and no bonus. Or vice versa if I want profits low.

But that's the tip of the iceberg. Buying an asset this year, depreciated over the next 5, means higher profit this year, and 4 years of lower profit.

Marketing expenses this year, benefits next year, and so on. Drop the head count to juice profits for a couple years, raise head count to drop it, and do on.

Profits are the easiest thing to manipulate and hence the worst metric for fines. Which is why you see Europe use Revenue (not profit) as the measure for some fines.

Yep, not to mention what you can do with complex conglomerates. For example, one should take a look at the intra-company eliminations that the giant pay-viders do (e.g. UnitedHealthGroup, owner of insurer/payer UnitedHealth and healthcare provider Optum)

Insurers are margin-capped, but wouldn't you know it once you own a PBM and the providers, you can make revenue, holdings, pricing power, and market share rise arbitrarily while never producing a profit beyond the cap.

I did ceramics for a whole and noticed a common trend.

The creator judges the product compared to their imagining of what they wanted to make. Yhe piece invariably falls short (because our imagination is better than our skillset.)

Everyone else simply looked at the piece objectively. It was either beautiful or not.

I started to look at programs the same way. The criteria for judging my program differs to the criteria for judging other programs.

So for my software I care about architecture, clean code, the language I used, how clever it is.

I judge others by their UI, documentation, support, correctness, intuitiveness etc. I hate when their UI constantly changes. Even small (cosmetic) bugs turn me off.

But my stuff has no docs, the UI is butt ugly, there are some rough edges, but if you avoid the bugs it gives you the right answer (very fast) while consuming less ram, disk, or cpu. And I used new-framework or popular-new-language and runs on any OS etc.

From Ira Glass:

“Nobody tells this to people who are beginners, I wish someone told me. All of us who do creative work, we get into it because we have good taste.

But there is this gap. For the first couple years you make stuff, it’s just not that good. It’s trying to be good, it has potential, but it’s not. But your taste, the thing that got you into the game, is still killer. And your taste is why your work disappoints you.

A lot of people never get past this phase, they quit. Most people I know who do interesting, creative work went through years of this. We know our work doesn’t have this special thing that we want it to have. We all go through this. And if you are just starting out or you are still in this phase, you gotta know its normal and the most important thing you can do is do a lot of work. Put yourself on a deadline so that every week you will finish one story. It is only by going through a volume of work that you will close that gap, and your work will be as good as your ambitions.

And I took longer to figure out how to do this than anyone I’ve ever met. It’s gonna take awhile. It’s normal to take awhile. You’ve just gotta fight your way through.”

I tell this to everyone who will listen. This... paragraph? Statement? Whatever is pure gold.

Quit watching YouTube videos, quit reading tutorials, quit listening to podcasts. The only way you learn is by doing something, and by doing something I mean fucking up doing something. Over, and over, and over.

Just do the thing. That's how you learn. And after you make a whole ton of things that suck, you'll start making a few things that don't.

There's no way around it.

Agreed. Frankly test taking doesn't correlate to job performance well by any metric.

For example, get 90% on a test, that's applauded and earns a distinction. In a job context, 90% gets you fired. I don't want a worker who produces "90% well soldered boards". I don't want software that runs on "90% of our customers computers". Or a bug in every 10 lines of released code.

A test puts an arbitrary time limit on a task. In the real world time is seldom the goal. Correctness is more important. (Well, the mechanic was going to put all the wheel nuts on, but he ran out of time.)

College tests are largely a test of memory, not knowledge or understanding. "List the 7 layers of OSI in order." In the real world you can just Google it. Testing understanding is much harder to mark though, Testing memory is easy to set, easy to mark.

Some courses are moving away from timed tests, and more towards assignments through the year. That's a better measure (but alas also easier to cheat. )