HN user

AppSec

9 karma
Posts1
Comments45
View on HN
Banned for Life 12 years ago

Googles' model is to allow apps without pre-screening. This model (trust but verify) lends itself to having more spammy apps submitted to it (no proof, just an educated guess). Google is providing a gateway for others to generate income.

The OP stated: 1) They had a disclaimer in multiple places. 2) They reached out explicitly because they weren't sure where the real problem existed. 3) Only one app was notified at a time when multiple apps had been following the same style and none were notified until later. Surely Google would want to investigate whether the developer posted any other apps which might be in violation? 4) Was not trying to nor had any interest in making any money off of this set of apps.

It has been said, the OP was naive and should have pulled the apps after the first notice since they were just beta. But any corporation that is providing business support services really needs to fund a customer service desk with real people. The fact that people use google for businesses like this knowing this situation is really surprising.

Banned for Life 12 years ago

This even includes some bad police work. Because since the developer didn't post a single app of this type after the initial suspension google could have easily identified all apps and found them all and notified the developer that all apps must be dealt with.

This would be akin to the police having 10 open murders with the same exact weapon, charging the assailant with one and not looking for any other open murders on file.

Comparing streaming of books to streaming of music or streaming of TV/Movies is comparing apples and oranges. I don't think any past data will prove very relevant. For one, the context is completely different with regards to time for a read. I'm not just committing a couple of hours like a show, movie, or music. I need to commit longer. I'm less likely to just pick up a book on a whim, like I will a song, TV show or movie. The commitment is just not there.

If anything, the book streaming service will be more like a gaming streaming service than anything. I actually think this would benefit a lot of the smaller writers who might not get as much due to the "no harm no foul" of streaming a book I don't like.

There should be only one question from the rep: Is there anything we can do to change your mind? If the customer responds with anything indicating a willingness to discuss rates or packages, then by all means continue. If the customer says: No, I just want to cancel. Then turn it off.

This is really dependent on how much of the "developer" role is developing and how much is software engineering. Are the developers literally taking design documents (UML diagrams, use cases,etc) and just typing in the code or are they actually doing some analysis.

There is also the domain knowledge acquired by the developers over the course of time. I will tell you that I was part of a transition to an outside contracting company for a legacy site. The business knowledge gained and the ability to deliver solutions as a result of that enabled a much faster time to market than these guys could ever provide.

Keeping it cash? No. Putting it in a 401K, IRA, or market based account certainly does have much greater benefits. And of course, once that grows you can most certainly retire after 15 years. Or at least be financially independent and choose your working environment.

Luck is the combination of preparation and opportunity.

You may find the best job for you when you aren't looking if someone reaches out to you. Kind of hard if you don't know they are actually looking.

I know this is picking nits, but that just simply isn't true. There isn't always the same output for every single input. That's why there's race condition errors. AI Systems will also alter outputs based on the same input (unless you assume that the knowledge base is constant).

Besides that, there is very good reason for justice to have the ability to change course. While humans are writing it, judging it, and punishing it -- they are also committing the crimes which means their actions might not be all that clear cut.

of course the irony to this quote is to look at the number of companies which were bought out by Walt Disney, HP, Intel, and Apple...

Not saying he's wrong.. just that those purchases helped make them those strong companies.

First and foremost, I think this is a good cause,so please don't take this as a negative against the goal.

Second, I have not read the rules for donating/being on the reigstry so I may be jumping the gun and having a preconceived notion that doesn't hold true.

But there's assumption of the number of people who would help someone else if they were found a match as opposed to simply helping out Amit. If they are on the registry and do match someone else are they required to do the donation at that point? Unlike blood donation, the bone marrow is a just in time donation (if I understand it correctly). This puts it in a different category.

Again, I think this is a good idea and I hope those that are putting their names on the registry are doing so for the belief of doing good for all, not just for one.

Then it gets worse... Then it gets better.. Then it gets worse.. Then it gets better... I'm not sure how long that loop lasts.. But dealing with teething, sickness, going from crib to bed, etc.

The hours of sleep change from time to time. But there is nothing quite like seeing your child look at you with a grin from ear to ear when you come home and they come running up to you saying "DADDY!" (or "MOMMY" -- but I'm not a mother ;) ).

Even though I never give references until an offer has been agreed to, I generally will not give my current manager for various reasons -- first it is just way too awkward.

I would be careful with that question. I worked at one company where they were very much against re-hiring anyone that left based on where they went/were going.

Another factor is personal differences can lead to that same false positives (negatives?) about that person.

I guess I'm simply trying to say: that question is not always answered based on work ethic or product.

Depends on what process you are talking about. If you are trying to improve a process which will hurt the time to deliver of a major project costing a company money, then is it really right to call the company a failure?

Every company/division/organization has priorities and while there maybe inefficiencies in their processes, they maybe a minor cost in relation to the other priorities. (I can't believe I actually just played devils advocate/defended this).

Messages: This is the implementation issue and one of rights anyway. If I send a message to a friend, what right do I have to delete it from their in-box or sent items if they save a copy of it? The deletion is a view deletion, not a physical deletion. A large number of deletes work this way (at least initially they go to an archive and then are either time removed or can be manually removed).

Data Security: Anyone who says your data secure is bluffing. Your data is never secure, and people need to stop thinking it is. It's out there. Backups, in transit, in DB, on file system. There is going to be whole. Think about it. Encrypted backups - they are never updated and eventually that encryption is going to be easy to crack. FB could be taking the answer to the extreme, but it is actually a smart answer.

Applications: FB doesn't develop them. It would be similar to MS guaranteeing apps written by third parties. It can't do it. Apple can't even do it. Linux doesn't do it.

FB has it's issues. It's constant update of privacy and not letting the user to choose to expose what data they want. But this is no different than any other system thrown out there.

FB isn't the only one creating shadow profiles (how many tracking websites are out there that companies use to determine site usage). Do you think they are really being transparent? Don't you think the shadow companies could build a shadow profile if they wanted to?

My issues with FB is that when they release new features or alter settings ability they make it the least secure possible.

If they are violating the laws, then they need to be reprimanded for it. But this just has the feel of the MS monopoly issue. Where people are only going after them because they are so big when others are out there doing it as well.

I really wonder how much of that is because the EU is made up of many countries and these countries want to protect their own. It's kind of similar to how the breach disclosure rules are significantly different from state to state.

The other thing that I wonder is how much of the US not having the strict laws is due to Corporate Personhood. I honestly don't know, I'm just throwing it out there.

You definitely MUST have that heart to heart conversation with him. You should also spell out what is expected over that 60 day time frame. Make sure that the goals are well defined and can be checked off. You both need to agree on what is reasonable.

I'm hesitant to agree with throwing him in to the fire, because if you put him in a position to fail, that's going to hurt him and your friendship.

I believe that 60 (or 90) day checklist is where you can come to an agreement on what a reasonable "trial by fire" is.

Seems to counter itself with a statement like: "Parents still report feeling a greater sense of purpose and meaning in their lives than those who've never had kids."

Obviously if one equates happiness to lower amounts of worries and responsibilities than sure.. But that seems kind of.... superficial?

Note: I am not in anyway saying that those who choose to not have kids are superficial, it is their choice -- just as it was mine to have a kid.

This isn't meant to be sarcastic or condescending, but isn't programming at it's fundamentals math and logic? Those are taught early on.

I mean, I worked with Logo in 6th grade. So I'm really not sure what else you would teach that is different.

I'd certainly like to think I'm an ethical developer, and I always implement the delete as a flag.

I, however, do not implement an easy way to retrieve deleted data without going into the database or through an administrative interface with heavy auditing.

It isn't just about data mining for customer data -- it's about data mining for site usage and user activity. Using metrics off of visited web pages or tracking that way can be too convoluted when the KISS method is: flag it on the data side and you can interpret flow.

I like the concept, but there needs to be some validation check (I clicked on Preview Map without entering any details and got a "NOT FOUND" message in a popup -- using chrome).

I didn't want to register, just wanted to see what you were doing, but how are you creating the URL to pass around? Are you having an "owner" of the group? How do you plan on doing a search?

I'd be interested in helping out (evanos at yahoo).

Good luck!

The question is: Why doesn't Yelp have a flag for someone whom is posting a significant number of negative replies and one positive reply for the same business category?

Would make me question whether or not the owner of the business receiving a positive reply is trying to game Yelp's system.

Are jobs obsolete? 15 years ago

This can be taken to an extreme.

How many corporations make/made printing presses? How many corps make/made network devices, monitors, keyboards, mice, smartphones.

You can go third to fourth order all day long and you'll end up with the same statement:

The only thing that is constant is change. People have to be willing to change and willing to learn or they will be left behind.

H-P's One-Year Plan 15 years ago

And a counter argument could be that given time, HP could have done something productive with WebOS -- the TouchPad, Pre, etc.

WebOS was/is thought by many to be the best mobile OS without a company big enough to push it. HP could have been that company. Especially with the PC business providing some buffer for profit loss while issues with the other hardware were worked out.

Serious question, not meant to infer anything --

but if you used a centralized server for your blog, wouldn't the date/time stamp of that server provide the same information as a mail server would?

In other words: wouldn't that file/database entry timestamp (ie: wordpress' time -- just an example/name of a blog not necessarily available at that time) serve the same purpose?

I have a hard time with the WebOS failed to get a foothold under two separate companies.

HP never really tried. $1.2B and then trashing it so quickly? That's not trying.

This was a perfect opportunity to take the time and do it right. A company that was/is good with hardware, now has a great mobile OS. It had some time to take the loss financially with success of other areas (laptops, enterprise software, etc).