HN user

davis_m

794 karma

[ my public key: https://keybase.io/mpdavis; my proof: https://keybase.io/mpdavis/sigs/-CxQ66zUGNW2NjKgbiWPpcP6fQ7YmrU8sej6-MUiChw ]

Posts8
Comments116
View on HN

"The move will affect 315 people, who will be notified by the end of the business day."

I'm guessing more than a few found out from this article directly. What a rough way to find out you were laid off.

What sort of testing would you need to do in order to make purchasing physical machines simply for testing financially beneficial?

Not to mention the environmental impact of doing so.

All of the videos I have seen of the summon feature have been pretty bad. A lot of time the vehicle can't seem to figure out what to do. I imagine that will get better with time, but if I had a Tesla I wouldn't be using it now.

I'm surprised they released the feature as-is.

Obviously it is also a good fit for low scale use cases.

Is this a given? Just because something is necessary at scale doesn't mean it is a good fit for low scale use cases. I would expect the opposite is actually true.

I have long thought that there is an opening for local grocery stores to take a lot of this market. Many of my local supermarkets (HyVee, Walmart) allow for online ordering, but they all require the user to input items one-by-one. If they added a feature to add entire recipes in a single click, I think they would do very well for themselves. The additional cost of adding a recipe card would be negligible.

The customer's cost isn't increased over regular online ordering, and there isn't the issue of increased packaging. The food is fresh from the local supermarket and doesn't have to be shipped, beyond at most a local delivery.

Does the group of people who meal prep line up with those that don't want to think about meal prep? One of the benefits of these meal prep kits is that you end up with a freshly cooked meal. If you are going to be eating a prepared meal, why not just let the service send it fully ready to go?

Remember that many services are running in a cloud computing environment. Attackers can spin up machines right next to those that they are attacking and bypass much of the network related variables.

Timing attacks aren't as simple as often presented. Writers often give a set time for checking each character and ignore all other operations in order to make the issue easy to understand, but most people use this to write off the attack altogether. Surely it can't be that simple.

It isn't trivial to take advantage of timing attacks remotely, but researchers have shown that they are definitely exploitable. [1][2]

[1] https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf [2] https://www.blackhat.com/docs/us-15/materials/us-15-Morgan-W...

You can run into issues with headerless JWTs when you can't (or don't) guarantee the order of the header. Since the header is included in the signature of JWS objects, you must reattach a header that is exactly the same, and not just equivalent.

For example, both of these decoded headers are equivalent:

{ "alg": "HS256", "typ": "JWT" }

{ "typ": "JWT", "alg": "HS256" }

Obviously, these encode to two different values. If you reattach the wrong one, signature verification will fail.

Disclaimer: I maintain a Python JOSE library and have had to answer questions related to this on more than one occasion.

This looks like a great idea. There were a few times I got in trouble at work in high school because I didn't see updates my boss had made after I checked the schedule. This would avoid any of the he said/she said BS.

Can this be used for covering shifts. When I worked in a job like this, we were allowed to get shifts covered, as long as we found someone to cover it. It would be neat if this service could be used to text everyone that is eligible to cover a shift for the opportunity for extra time.

"Your coworker is looking for someone to cover their front desk shift, Fri 12/9 from 3:00 PM to 11:00 PM. Would you like to cover it?"

Very true. The HN title mislead me and I thought there was no way it was true (which it isn't)

Even the "quickest" is up for debate since this only measures 0-60 time, but I think it is leaps and bounds more accurate than "fastest".

I would hope not. If Github could generate valid SSL certs for random domains, something would be very broken.

It means updating infrastructure by making changes to a versioned service definition instead of on running instances.

Would you fix a software bug by editing the code on a running server and tell yourself that you will add it to the repository later? Of course not. You would end up with a running instance of the code that is impossible to replicate.

Immutable infrastructure applies that same idea to running services.

Amazon Echo Dot 10 years ago

I would be super interested in Echo in my car, but mostly because I don't have one of the fancy new cars that connects to my phone over bluetooth for that sort of stuff.

Amazon Echo Dot 10 years ago

Echo Dot is available in limited quantities and exclusively for Prime members through Alexa Voice Shopping. To order your Echo Dot, use your Amazon Echo or Amazon Fire TV and just ask:

I guess technically you don't have to already have an Echo, but it is only available through voice shopping.

Amazon Echo Dot 10 years ago

Ah, I didn't notice that it hooks up to existing speakers. I'm curious how many people will use that however. My anecdotal experience is that most of the people that actually own an Echo are fairly tech illiterate and benefit from it being an self contained package, but that may change if the Echo API is extended.