achew22

The article you linked to is kind of confused and I'm not sure I blame them. This stuff is really complex!

According to the proposal[0], leaf certificates are prohibited from being signed with a validity window of more than 397 days by a CA/B[1] compliant Certificate authority. This is very VERY different from the cert not being valid. It means that a CA could absolutely make you a certificate that violated these rules. If a CA signed a certificate with a longer window, they would risk having their root CA removed from the CA/B trust store which would make their root certificate pretty much worthless.

To validate this, you can look at the CA certificates that Google has[2] that are set to expire in 2036 (scroll down to "Download CA certificates" and expand the "Root CAs" section) several of which have been issued since that CA/B governance change.

As of right now, as far as I know, Chrome will continue to trust certificates that are signed with a larger window. I've not heard anything about browsers enforcing validity windows or anything like that, but would be delighted to find out the ways that I'm wrong if you can point me to a link.

Further, your home made root certificate will almost certainly not be accepted by CA/B into their trust store (and it sounds like you wouldn't want that) which means you're not bound by their governance. Feel free to issue yourself a certificate that lasts 1000 years and certifies that you're made out of marshmallows or whatever you want. As long as you install the public part of the CA into your devices it'll work great and your phone/laptop/whatever will be 100% sure you're made out of puffed sugar.

I guess I have to disclose that I'm an xoogler who worked on certificate issuance infrastructure and that this is my opinion, that my opinons are bad and I should feel bad :zoidberg:.

[0] https://github.com/cabforum/servercert/pull/138/commits/2b06... [1] https://en.wikipedia.org/wiki/CA/Browser_Forum [2] https://pki.goog/repository/

By being better than the competition. That is the answer.

It is really not a good idea to let your naked record go to a 3rd party. If you need your root to be an A name, go with a DNS provider that will do URL redirects. If you trust them with DNS resolution of your domain you can trust them to not go crazy with your root record.

EDIT: If you are looking for a host that will do this, http://NameCheap.com is how I do it but I understand GoDaddy and Hover does it too. Seriously... go with a reputable registrar that has these simple features it will pay off in the end.

I don't know specifically about the `crashme` tool but I can say that fuzzing is not a technique that has gone out of vogue. In fact it is standard security practice for finding ill defined behavior in programs for buffer overflows and other nasties. When you read the exacerbated cries of the security researchers who have been sitting on a critical IE/Firefox/Whatever bug they almost always scream something to the effect of "Why didn't they just use a fuzzer, it's easy to find these problems that way -- that's how I did it." I would like to give props to Google, their security teams have been diligent in running static analysis and fuzzing tools against their code (white box[1][2]/black box testing[3])

As always, Wikipedia is a great source for information on this one[4] and I can personally testify to OWASP's fuzzer if you're going after webpages (my last local OWASP that I went to was on fuzzing and was REALLY interesting)

[1] http://en.wikipedia.org/wiki/White-box_testing

[2] http://en.wikipedia.org/wiki/Static_code_analysis

[3] http://en.wikipedia.org/wiki/Black-box_testing

[4] http://en.wikipedia.org/wiki/Fuzz_testing

EDIT: Fixing formatting

Here comes the flame war about how our educational system has declined in the past hundred years. In an attempt to head that off at the pass (Hey, if you're going to have a cliché argument I get to use a cliché) here is the problem with that. This is a test designed to review the material deemed important by one person in 1895 (If it is really from then). The class would have gone over what "epochs into which U.S. History is divided". This is the same thing with the stupid joke that I always heard when I was doing calculus and adults were around "When I was growing up, you didn't have to spell out your math homework". That is code for "I have no idea what's going on here" and let's be honest, that is fine.

I would bet that most people who read this could have answered almost all of these questions at some point in their life. We have to remember that the purpose of education is to teach you how to learn and how to adjust to your current situations. You learn what you need to get the job done and you relearn what you can't remember to complete the job.

EDIT: It's good to see that Snopes already did this. Thank you Snopes and thanks glhaynes for pointing us to it.

There are a lot of problems with HFT (high-frequency trading) that basically boil down to proximity to the exchange. If you haven't paid for a colo inside their datacenters you can't well expect to use the usual HFT tricks of putting in requests for things you don't want and then never making actions on them because your 40ms latency to the exchange will mean that the guys in the colo have acted on your move. I heard someone say that they got a colo for 10,000 a month (sorry, I don't have a source for that) so that kind of edges you out of really good HFT. Another thing to know is that you are running around like a chicken with your head cut off trying to grab pennies off a railroad track that is running bullet trains (I love that analogy). i.e. very dangerous. Slight mistakes can cost you hundreds of dollars ever 20ms until you hit ctrl+C in your script! I do wish you the best of luck and I hope you will write about your progress/experience in HFT on HN in the future.

Does anyone know what this is? Does anyone have any more info on where the colors come from?

No

I will add a little more detail. When Netflix starts sending enough data through standard connections that they start to cripple the internet, they will set up peering agreements and run direct line to the front door of every ISP. If you don't think that is possible look at Google who has peering agreements with everyone except tier 1. We will be fine, the sky isn't falling and no, this is not the end of the world. Not even close.

In June, RadioLab (The NPR show), did a show called "Oops" that had a section on this. It was a REALLY interesting episode and continues to be a spectacular podcast.

If you're interested in the Oops episode, check out. http://www.radiolab.org/2010/jun/28/

EDIT: I looked, the section I'm referring starts around 4:30

I'm far from impressed with this. How is ?? any different from a guard ( || )? I use that all the freaking time in every language. I've never written a line of C# and even I know about the parallel module, how didn't that make the cut?

Really not that funny and worse it gratifies no intellectual curiosity. (Not to mention that it is a repost from an earlier link to their homepage)

First, let me say that I really like the idea of this site. You already have the tools built to scrape HN every 5 min so why not expand on this idea. It would be very interesting to create something that scrapes HN and then provides the N most popular articles (by vote) for the day where N is defined in the URL. It would also be interesting to scrape the "New" section and then have a special section that has more stringent than the HN front page. A sort of "HN Plus" (forgive my reference to Hulu). Personally I like that HN trickles (sometimes torrentially) in through the day. I will admit that sometimes I feel overwhelmed by the content but it is always a good break from whatever I'm doing. Maybe that should be an "Ask PG" of my own but the idea has been rolling around in my head for some time to do something similar. I'm glad you're a lot less lazy than me and doing something about it. Is there any way you would be willing to put the source up on GitHub?

For the majority of people I don't think that it is the language that makes it fun. I think that finding a project that makes you want to wake up at 4am and go to sleep at 2am because it is so interesting is what makes it fun. Yes, I am a coder but ultimately I think of myself as a puzzle solver. When you approach the problem from the right direction you're already much better off than you would've been before. Try a bunch of languages out for a month, that's what I'm doing (OCaml starts tomorrow), and figure out which language works with you, not against you (Java!), to help you solve your puzzle.

PS: There were articles on HN in January about the 12 languages in 12 months but I don't want to look them up so I will provide you with the link I saved from them http://www.coderholic.com/12-new-programming-languages-in-12...

It is obvious that you care about the series. Contact the publisher and let them make the first move. If they want to be jerks about it then be jerks back but at least give them the chance to make it right.

As a side note, you countered their rip off by taking a whole page out of their book and putting it on your website. Just saying.

From the article: "Additionally, the Python SDK has a new experimental feature that gives you the option to use SQLite as the datastore stub backend." The stub backend is where the development server stores the Google datastore information. That is very different from Google saying they will provide a SQL interface.

I've seen reports of the attack vector being IE and Acrobat, Flash player and (IIRC) Windows XP. It doesn't matter what the actual product was, it only matters that people aren't patching well known vulnerabilities. The vector is not a particular program it is a lack of attention to detail when it comes to patches.

FTA: "Adobe may not spring to mind when you think of open source"

Damn straight. Lets move along.

Has anyone reported this to the school? I would be willing to bet your school's paper would LOVE to do an expose on this. He donated the funds to the school and while that may give him some authority in the program that shouldn't give him the rights to attempt to subliminally message students. Academic halls exist for freedom of information and that information shouldn't be pay to play. Talk to a department chair who works in that building and see what the deal really is.

I can't agree with this more, I walked into a rock gym a couple of years ago and picked a wall and said "I want to be able to climb that." I defined a goal and then I set a time frame for it. Admittedly I didn't make that goal but you better believe that I did achieve it a few weeks later and I was even more motivated for the next wall. The neat thing about rock gyms is that there are a lot of people who come in frequently (read: friends with active lifestyles) and they have to change the walls to keep everyone coming back. I'm sure there are many other activities like this but the rock wall was what did it for me.