heartsucker

Funded by the government != The government has their hands all over it

Berlin was calling to me. There were somethings about SF I didn't like, but it wasn't so much "I moved out of SF" as "I moved in to a new city."

Philz and Skeggs are both in SV, and I was contributing what I could because OP said "SF and SV."

Don't let perfect be the enemy of good. Some people can't not own a car and just bike everywhere or take public transit.

Poor documentation is a bug in itself.

Slightly off topic, but this is hardly the biggest blunder of the airline industry. A company I worked for last year absolutely tore them apart in a talk at 33c3.

In short, information like your address or passport number is easily accessible, and while it wasn't in the talk (I think), we were able to recover plaintext credit card numbers during the research.

https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...

Because the children have no control over who their parents are, and we shouldn't punish with a lifetime of diminished opportunities because their parents aren't as "good" as others.

A theatre in New York was showing the 1995 film, so I watched it for first time on big screen on Wednesday, then saw the live action on Friday

Did you ... even see the '95 movie recently?

Dude...

I maintain a Debian packager for nodejs [0] & two Rust libs for CSRF protection [1] [2], and contribute to SecureDrop [3].

[0] https://github.com/heartsucker/node-deb

[1] https://github.com/heartsucker/rust-csrf

[2] https://github.com/heartsucker/iron-csrf

[3] https://github.com/freedomofpress/securedrop

    git checkout 0.1.0
    git tag -v 0.1.0

Sure, and if we imagine a hypothetical entity that has 10 products with security holes and then releases and 11th, it might be worth looking at the 11th more suspiciously. Things don't happen in a vacuum.

The tool phones home. Their website doesn't have HTTPS. It's plausible that the tools phones home over an unencrypted channel (I didn't look, so I could be wrong).

My overall impression is that they don't do security very well.

Wow, and your website isn't even HTTPS for what appears to be a security company. Get it together.

We also collect a few anonymous data (CLI errors, most frequently used commands and count of resources).

Looks cool, but this is an instant no for me. Sorry guys.

you can’t compile your own client from source

According to the docs in the git repo, you can do a `./gradlew build` and there you have it.

you can’t verify anything

They have docs on reproducible builds[0].

Anyway, I'd say Signal does have more security than WhatsApp because I trust OWS more than I trust WhatsApp/Facebook.

[0] https://github.com/WhisperSystems/Signal-Android/wiki/Reprod...

Yes, but in theory some sort of MAC could stop it from accessing important files, or anti-virus could detect it and stop it too. But once the password leaves the computer, it's going to take a lot more effort to mitigate the damage. Also, your browser is on your side for protecting against malware, so for example if you have Flash disable, that's a whole vector you can just ignore.

What makes an attack like this so effective is that you never expect to see something as convincing as this

I've been working on phishing and counter-phishing recently, and if someone is actually putting any effort in, you have to expect something like this. Very legitimate looking email, the correct signature (complete with up to date font/logo), and a virtually perfect copy of the login page to whatever service they're using. All of this, even just to target a single person, is under 8 hours of work, which is to say, it's a simple task for someone who really wants to phish you.

The article mentions having an IDS and disaster recovery plans, and this is the best you can hope for as pretty much everyone is susceptible to this, and AI still can be beaten.

Source: I've done this, beaten Gmail's anti-scam filters, and phished CTOs.

F.B.I. agents on the case, advised by N.S.A. technical experts, do not believe Mr. Martin is fully cooperating, the officials say. He has spoken mainly through his lawyers, James Wyda and Deborah Boardman of the federal public defender’s office in Baltimore.

It sounds like they're just mad that he didn't confess immediately, instead of doing the smart thing of having professional handle everything. Do they really expect someone to cooperate gladly when repercussions could be severe?

Since this is all about docs, having gone from Java/Scala to Rust, I cannot emphasize enough how much better Rust is at this. With `cargo doc` I get a local set of static files for the exact version of the libraries I'm using. Why can't everything be this easy?

It certainly worked, whether or not it worked "well" is up for debate.

Those seem to be legitimate complaints that seem to be "take something specialized that caters to a small crowd, then water it down so it appeals to everyone."

That said, sometimes such complaints are clearly a bit whiny, but then again, sometimes they are warranted critiques.

The post seemed to claim that because each small change didn't ruin it, it's not ruined. I'm saying that it's ruined to some because it's no longer the thing they fell in love with.

I feel like this takes the term "ruining" too literally. Yes, clearly nothing was completely ruined with each subsequent change, but the current incantation is certainly not the same as the first, and people are right to criticize the change (just as people are right to defend it). No one change might have been the death, but all together, it is very understandable that some people might call it "dead" and have moved on.

Yes, because this gives them the chance to say no and pretend to walk through it slowly showing how "smart" they are.

When we used this, we used the first directory to be the env, so it looked like.

    /prod/...
    /stage/...
    /dev/...
    /feature-xyz/...

And of course, each service per env had different access tokens so apps in the stage env couldn't read prod keys.

I think the author meant packages output of pip, like this issue:

I want to install the pip package cryptography. I need to make sure Python.h is available. I need to make sure (on Debian) that lib-ffidev and lib-ssldev are available. This isn't said anywhere by pip (except Python.h, probably), and it's not the same on every system, let alone every Debian based system.

Replying to this again. Using Scala and Scalding or Spark makes it super simple to do algorithmic stuff. I haven't used Pregel/Giraph ever, so I can't say how it stacks up.

And OP, if you see this, using raw M/R to do things like graph processing is going to be a HUGE pain in comparison to all the libraries built around it.

I read the O'Reilly books on Hadoop and Hvae in 2013. That was helpful, but I still think Hive is a good place to start. If you know how a join and an aggregate work, you can see how Hadoop turns those into into M/R operations.

If you really have to learn how Hadoop works, you'll probably have to look at the source. Write the Hello World program and get it to run on AWS EMR (as others have suggested). Then clone the source to Hadoop and open it in your favorite editor. If you have to understand the nuts and bolts, the source code is the way to go. If you only have to know how to use it, then a book + online tutorial + simple project will get you up to speed within a week or two.

I would second this. I've used Hadoop at two jobs, and both times the added overhead in terms of operational and programming complexity wasn't worth it. Most everything could have been done on a beefy machine with the most basic knowledge of parallel programming.

I started with Hive and worked backwards. It gives you a nice SQL interface and allows you to do M/R operations on CSV files easily. Once you get the hang of it, going back towards raw M/R or even something like Cascading/Scalding might be less of a shock.

If you know Cassandra or other NoSQL, you can try your hand at Hbase. To do anything with it beyond adding or removing data from a key, you'll need to write an application of some sort. Cataloging tweets is a decently simple exercise.

In my work, the only time I accessed the HDFS directly was doing a put/delete of a flat file CSV that I was going to load into Hive. I'm not saying there's not use cases for using HDFS, just that in the set ups I've used, I've never seen it.