HN user

For_Iconoclasm

190 karma

I'm a software [security] engineer.

I live in New York, NY.

Posts10
Comments32
View on HN

This is false if you're only using Fios for internet service. Verizon asked me if I was providing my own router, and I said yes. The tech who "installed" and activated my ONT confirmed that I was using my own router so that he could activate the ethernet port on the device. There was nothing to bypass—it fell within their expectations.

I hear it's a challenge to avoid the standard Verizon router if you also have TV or phone service through Fios.

There is an extremely simple logical construct surrounding this: consent is not the default state of the other party.

What is not easy to understand is how people don't understand this. :\

Password Rules 14 years ago

I use LastPass, but also use generated passwords to answer security questions. For these questions, one can enable the options for only using alphanumeric, unambiguous characters.

The new Git-scm.com 14 years ago

Sorry, but it's the website for git. Things have websites. How difficult is that to reason, really? The top of the page explains what git is. Isn't it obvious that the site is git's website? It then lists things which one would expect to find on git's website, including the documentation and download sections.

Here are some other websites for things. The front pages also explain what they are and links to more information.

* Y Combinator: http://ycombinator.com/

* Ubuntu: http://www.ubuntu.com/

* Google Chrome: https://www.google.com/chrome

I will admit that some websites don't do a great job at this.

* Firefox: http://www.mozilla.org/en-US/firefox/fx/

Firefox doesn't say what it is. The other websites say that the things are.

But git-scm.com? How much more information do you need than "Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency." to realize that it's the website for git, the free and open source distributed version control system?

Your comment is not the only one in here like this, but I'm struggling to identify the reason why anybody would consider this website difficult to grok. Sure, it may not have the character of the old website with a monster eating trees, but I really feel that organization and clarity are not issues here.

Oh, it is absolutely a problem! But, having people not knowing what they're talking about has always been a problem. Nothing short of a strictly-enforced policy mandating that HR departments need to have decent knowledge in a certain area will change that.

Besides privacy, it could turn out that HR involved in other domains are broken relationships. If anybody has any examples, I'd love to hear them.

I would answer that rhetorical question with no, HR departments have not have heard of social engineering attacks in computer security. Almost any company asking for a password will have a brain-dead HR department in charge of that policy; it's not like your fellow future programmers thought that one up.

> defining "evil" would be a good start

I think the best way to tackle this would be defining specific tenets the way that the FSF does with freedoms 0-4. They don't just say "You have to be free!" ... there is the legally-binding license itself, containing some light legalese, as well as the 4 freedoms specifying the idea to the common man, despite clearly.

So, a license that comprises "We won't be evil. We promise!" wouldn't be good enough, but the some clear rules could be set. The non-evil most people would care about would probably be related to privacy.

I agree that specifying all of the business practices which many people believe are evil would be a non-trivial task dependent on the nature of the company.

> I see a lot of votes for python, but a disproportionately small representation of python fans in the comments.

This is probably because describing the virtues of Python (clean & simple syntax, one right way to do everything, easy-to-use yet comprehensive standard library) just feels like beating a dead horse. Almost everybody in this community has heard of Python. The circle-jerk factor on HN is still somewhat low when it comes to this topic.

I currently use Python personally and professionally, and I love having it as my go-to language. However, I'll be happy to add some more languages to my repertoire in the future.

I'm not going to argue with your opinion like others are doing, but I find it very interesting that you have this viewpoint. It would sort of be like a car enthusiast preferring an automatic car for its smooth, self-maintained shifting, or a skilled cook preferring a boxed meal because it is easier to make.

> programming, ultimately, is thinking.

I very rarely feel slowed down by my environment. It's possible for it to happen, but most of my time is spent thinking about a problem, not typing.

Duly noted! Although, I was not praising Jobs nor Apple in post. I was drawing a comparison (showing similarity) between the ideals of RMS and the ideals he was against. He is hypocritically fighting oppression in one field with oppression in another, and frankly I believe a person has more of a right to what goes on in their mind than what goes on in a computer.

Steve Jobs is not quite topical to what I said.

My biggest gripe with Stallman is his "I know what's best for you" mentality. His moral standards are more important than whatever you can come up with.

During a question & answer session somewhere, someone asked him a question about videogames. The questioner mentioned that the best games are just not free software. Stallman's answer was that the person should "adjust their tastes" and play free software games.

Adjust their tastes?

That is plenty more restrictive than using non-free software. I'll proudly wear "digital handcuffs" than sit in Stallman's oppressive, disrespecting, dogmatic ideological prison cell.

I appreciate what RMS has done for free software, but as soon as I learned that he thinks his interests are more important for me than my own, I decided it might be time to develop my own Stallman-libre philosophy on FOSS.

I worked on a natural language processing project as my required directed study in college. We focused on language generation and took an extremely naïve approach to the problem since it turns out that literature on alternative types of language generation (as opposed to simple generation from n-grams) is not well-proliferated.

Needless to say, it was very hard. Semantic representation by itself is very difficult to tackle; AI in general far off from simulating the wit and ingenuity of a human being's writing, though I don't believe it will be like that forever.

For the curious: we didn't get very far into the project, but our next move was going to be trying to combine WordNet, FrameNet, and VerbNet to create stories that sounded like they described something plausible. We only got a bit past "Colorless green ideas sleep furiously," though.

It's something that I say I want to hack on again someday, but I don't know if I will. The two of us have other code projects right now.

Well, it got me on the pointer arithmetic questions. I remembered that C automatically handles pointer arithmetic (multiplying by sizeof(type)), however:

Question 2: I didn't think that x+1 would be interpreted as a pointer for some reason, so I guessed 0x7fffdfbf7f01. Wrong.

Question 4: I incorrectly thought that what I remembered about pointer arithmetic would apply here. 1 * sizeof(int) = 0x04, so I guessed 0x7fffdfbf7f04. Wrong.

I don't work in C professionally, but I'd like to not forget things. My error in question 2 shows forgetfulness, and my error in question 4 is from not ever completely mastering every nook & cranny in C.

How did the rest of HN do?

That is also true. You can use that version for as long as you want! The company I work for uses a newer stable version of nginx in production, but I think I actually make use of a directive that was introduced after the 0.7 series. Even so, as a small company with only a few customers, we're okay sticking a little closer to the edge. At this point, there's no compelling reason for us to upgrade past where we are (I think 0.98) unless I want bug fixes for things bugs we haven't seen.

I feel the same way. Nginx has been the little ngin that could, supported by a bunch of talented hackers dedicated to bringing something to the table that the big-time servers, even the open source ones, couldn't. Nginx's history of being the lightweight, faster competitor to Apache (a shining example of success in the open source world) practically defines its identity.

I just hope that nginx doesn't sell out. I don't think it will, because I can't see what it has to gain for becoming exactly like its competitors when it already has a substantial user base. Of course, as you stated, dividing the userbase between enterprise edition users and free edition users could cause some software development political issues that could stifle progress.

There tends to be a lot confusion, with newcomers to any field, over which tools should be used. The truth is that 95% (made-up statistic... I mean a large majority) of the effectiveness of a tool comes from the user's proficiency, not the tool's intrinsic value. If you've heard of the language being used before being experienced and versed in the subject matter, it's probably good enough for your uses.

I touched PHP in some college classes based on web programming, and one of the projects that I made actually got me my current job as a Python programmer at a very small company. The key here is that I was able to demonstrate what I was able to do with given tools; I wasn't given a quiz on the finer details of Python iterators or Tornado (the web server we use). Even if I had told them that I was interested in learning Python, but I wasn't great at it yet, I think they may still have hired me. As it was, I already knew Python.

I really like Python. The syntax is wonderful; it's just a pleasure to work in. I once saw somebody post "If Python were any easier, it'd write itself." It's a general-purpose programming language, while PHP is mostly a domain-specific language (the domain being the web). Does that mean it's more powerful? Maybe. You probably won't get to a place in web programming where a single language will hold you back for a long time. Look at Facebook; it's written in PHP, but it's moderately complicated. Meanwhile, Hipmunk uses Python (with Tornado) on their backend. I can't think of any examples that use Ruby/On Rails because I don't really follow the language, but I know it's also wildly popular.

Your evaluation of PHP hit the nail on the head. It's really popular in the job market, along with ASP.NET. I think Ruby on Rails and Python (Django) are becoming more popular. If the job market aspect is really important to you, maybe you can try looking up local jobs to see what your area offers.

This happened to me, to a T, when I submitted a patch to cloudfiles-python. The patch was beneficial to my employer (we really wanted to use server-side copying on RackSpace Cloudfiles), but I couldn't imagine that it wouldn't be useful to other people using the Python bindings in question.

I actually ended up not implementing one suggestion (it involved project-contextual knowledge that I didn't have time to look into; I figured the maintainer could make the change if he wanted it), but the patch was pulled in anyway (after many months... apparently the service was not available to all Cloudfiles customers at the time).

So this is more anecdotal evidence. Make contributions! I also made a fix to another project which involved 2 line changes. The fix does not have to be big to be significant in some way. New social coding websites make it easy. In particular, GitHub has very easy-to-use forking and pull-request functionality which I highly recommend using if a project you like is hosted there.

Probably. As far as anybody knows, the FBI and NSA are on the same level of cryptography technology as the rest of the world is. AES and SHA-1 are currently the national standards for encryption and secure hashing. AES is what TrueCrypt uses (as do most SSL connections and WPA/WPA2 connections).

There are some things to keep in mind though:

Fine print: As others have pointed out elsewhere in the thread, it's possible to extract encryption keys from RAM even if the computer has been (very... within several minutes) recently shut down.

More fine print: Pick a weak passphrase, and you may be shit-outta-luck. Also, brute forcing for passphrases up to a certain complexity is viable.

Tin foil hat: A conspiracy theorist may assert that the feds are far ahead of academia when it comes to cryptography, as was likely the case several decades ago (see the history of DES). I'm not sure that I believe that, because cryptography has a huge place in academia now, worldwide. It's possible, but I doubt they've broken AES.

[dead] 16 years ago

Did this ever need to be proven? Were people hoping that some of their public data may actually be private?