jasonkeene

This is the meetup page in case you are curious what the talks will be: https://www.meetup.com/Denver-Go-Language-User-Group/events/...

  • 6:50 - 7:20 - Ryan Djurovich: Idiomatic Design Patterns in Go
  • 7:20 - 7:50 - Vasko Zdravevski: Security in Go
  • 7:20 - 7:50 - Peter P. Gengler: gRPC Queue
  • 7:50 - 8:20 - Florin Pățan: Build a Go micro-service with net/http
  • 8:20 - 8:35 - Saurabh Sethi: Fair Scheduling in Go
  • 8:35 - 8:50 - Steven Bogacz: Go Serverless

* Everyone who clones the git repo either forgets or doesn't know that they have to do 'git submodule init' (and maybe update too? even I'm forgetting ...)...

‘git clone --recursive’ Add that to your README’s getting started section. Sounds a bit like you aren’t providing a good onramp for contributors.

* You cannot add downstream patches to Linux this way...

* The link is to a non-fast-forward branch of Linux, so the commit hash sometimes becomes invalid... You'd think that because both the module and submodule are hosted on github, that github wouldn't garbage collect the old commit hash, but that's apparently not how it works.

Commits will not get GCed if you have a ref pointing at them. Relying on commits that do not have a ref means they are not part of the official history of that project. You should fork linux and have a branch where you land your custom changes. You can track whatever upstream you want, third party or mainline linux, and rebase your changes on top of them.

This can give you the characters but not their ordering or frequency. Still, it's a nice information leak. Yet another reason to disable custom fonts.

Does anyone have any links describing the new CSRF for JS GET requests? Also they misspelled CSRF in the blog post title :/

You don't get it. Emails were encrypted at rest with the user's password. This was publicly disclosed by lavabit on their site. With the SSL key material the state could decrypt the user's password from network traffic. The encrypted emails and SSL key material are obtained through the courts, SSL encrypted passwords via surveillance, bob's your uncle they can read a user's email. Lavabit wouldn't need to "build" anything and couldn't argue they didn't have the technical capability to turn over SSL keys and encrypted email data. This is why he shut down, so that user's wouldn't continue to submit their passwords over the wire using a compromised SSL key.

Yeah, I was thinking the same thing. The only downside is that it isn't generic for variable length chunks.

Simulacra.. not simulacrums.. http://en.m.wikipedia.org/wiki/Simulacra_and_Simulation

Github already offers free micro plan (5 private repos) for verified students. Unlimited private repos is a rather big hammer and might attract abuse.

edit for link: https://github.com/edu

It is intended to be connected to a television set via Composite or HDMI. I'd assume most families in the UK already have a television set so really the only additional cost is the keyboard+mouse.

CMD+click WFM

In order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.

Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).

If I'm blocking cookies/referer by default then the onus is upon me to enable them for sites that require them for stuff like this. I wouldn't worry about users who have this issue. Maybe customize django's CSRF failure page to say they need to enable both to use your service and call it a day.

Yeah this is something I run into often as I don't accept cookies from sites by default and don't send Referer header (both are required for django's CSRF middleware if over https). This is a good read if you are interested in the rational behind these decisions -> https://code.djangoproject.com/wiki/CsrfProtection

As far as a solution for your users, I'd just let them know that you require cookies to login (obviously) and if you are posting over https make sure they have the Referer header which can be forged to just be the domain and not the entire URL if they prefer. I use https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ set to forge for django sites.

So web2py introduces new members to __builtins__? Coming from a general Python programmer with no "vested interest" I have to say that isn't the best of ideas. len/dict/list are builtins because they are part of the language. They can be assumed to be present in any Python program. Teaching people that these web2py objects are available globally w/o importing them is setting a false expectation. This is pretty much monkey patching even if you aren't overriding stuff. Generally a no-no in the Python community.

With great power comes great responsibility.

> Toss me that 100k you're bandying about so easily and I'll have it done by May :)

Considering merge with trunk will probably be done shortly after 1.4 I don't think he'll be getting his money's worth ;)

perhaps this? http://htsql.org/

https://www.youtube.com/watch?v=P9M__yYbsZ4&t=1h42m05s

(skip to 1:42:05)

Thorium comes up with rare earth minerals.. we can use it as a sustainable source of energy.

I so LOL'd when someone in the webinar pointed out that their measurement wasn't a vector so their paper should be titled neutrino speed not velocity. http://arxiv.org/abs/1109.4897

Yeah, noticed this too. http://www.whyprime.com/temp/yipit-key.png Whoops!

Yeah, Apple has used EFI for quite a while. My laptop still doesn't boot that fast.

"EDIT: I'm getting down voted for doing the math! Seriously?"

"35,000 miles per hour / 60 = 583 miles per second."

I stopped reading right there, please actually do the math if you do the math.

If you use a mac check out http://macfreedom.com/ or http://anti-social.cc/ I use freedom every time I have work in front of me that I want solid time to complete and I can't trust myself not to get distracted down some rabbit hole. It sounds stupid at first but two things it does for you over just unplugging from the network is that 1) you can still communicate with your local network/VPN and 2) you can't get back online without restarting your machine.

Hah exactly my thoughts!

Yes these are the raw interviews filmed for the making of "The Genius of Charles Darwin" by the BBC. Not really just a hand-held camera, more the style of the production. I find it very interesting, giving a behind the scenes view of the documentary. Exposes a lot of the personal exchanges that normally get left on the cutting room floor. Check out the Dannett interview for some good bits around 37:00

http://www.youtube.com/watch?v=5lfTPTFN94o#t=37m10s

Also I would recommend checking out Craig Venter's interview, was probably the best out of the bunch.

http://www.youtube.com/watch?v=3E25jgPgmzk

On the 25th of May 2008 the Phoenix safely landed upon Mars. It carried with it a DVD made of silica glass, designed to last the tens, hundreds or thousands of years it may take for humans to visit Mars and to rediscover it. It contained messages and artworks chosen for future visitors to discover when humans eventually travel to the planet. Among them was a message from the late Carl Sagan.

Thought it was worth sharing. :)