HN user

kurtsiegfried

162 karma

Low latency trading, and distributed systems.

C++, Rust, Java, Python

Email: HN username @gmail

Posts4
Comments21
View on HN

Location: Chicago now, Denver in April

Remote: Yes, up to 40% hybrid

Willing to Relocate: If the location is Denver. Willing to travel up to 20%

Technologies: C++, Rust, Java, Python. Low latency trading focused.

Résumé/CV: On Request

Email: HN Username at Gmail

Experienced trading systems developer, I love PCAPs.

WSJ Terms about Confidentiality:

3. Request Confidentiality: If you would like us to consider treating your submission as confidential before providing any materials, please make this request through this online submission form. Please note that until we mutually decide to enter into a confidential relationship, any information you send to us (including contact information) can be used for any purpose, as outlined in point 1 above, and described more fully below in the Limitations section). If we enter into a confidential relationship, Dow Jones will take all available measures to protect your identity while remaining in compliance with all applicable laws.

Wikileaks version:

2.3 Protection for you

Wikileaks does not record any source-identifying information and there are a number of mechanisms in place to protect even the most sensitive submitted documents from being sourced. We do not keep any logs. We can not comply with requests for information on sources because we simply do not have the information to begin with. Similarly we can not see your real identity in any anonymised chat sessions with us. Our only knowledge of you as a source is if you provide a coded name to us. A lot of careful thought by world experts in security technologies has gone into the design of these systems to provide the maximum protection to you. Wikileaks has never revealed a source.

[dead] 15 years ago

When the author starts by describing his local network as a /8 network, I instantly lowered my expectations for the rest of the article.

Verizon iPhone 4 16 years ago

No, SMS is different, you can receive a text during a phone call, or during a data session.

Version control like Git or other would be best for your Rails stuff. The apps should contain your DB schema. As far as your MySQL, you should be able to configure it to dump its backups into your Dropbox if you have enough space.

When you get your imaging set up, it will let you roll back to a point in time, so the server should come back.

First, before you start, take a backup of the laptop. If you make a mistake during your rebuild, you could lose your drive contents.

For Windows, the best way is to have an image based backup solution like Acronis, Symantec Backup Exec System Recovery, or just the Windows Backup built into Windows Vista, or Windows 7. This will restore a working copy of the OS from a time when it was previously working. If this is not possible, you'll most likely be in for a reinstall.

When you've reinstalled your OS, make sure you implement an automatic backup solution, so that you don't have to think about doing that backup each day. For your files, consider a solution like Dropbox, this will keep a version tracked copy of your files off your computer that will be easy to restore. Depending on your choice of dev tools, and how much you've customized them, it may be worth exporting a copy of the settings to your Dropbox.

This may not all help for this particular rebuild, but it can significantly lessen the pain if you ever have to do this again. Good luck!

@Thomas, thanks for the clarification, I guess I'm just used to companies with more authoritarian policies. Something along the lines of: "If it connects to our infrastructure, it gets policies enforced" (similar to what WMF said).

Nice work on taking apart the app though.

The main issue I have with this article is that it describes a very implausible circumstance in my opinion. If you have an application with such sensitive information on the phone to warrant this kind of testing, why would you not take advantage of the device administration policies to enforce a password policy and a password timeout policy?

http://developer.android.com/reference/android/app/admin/Dev...

There doesn't seem to be a policy in the current API docs to prevent a user from enabling USB debugging, but there is a rather large warning when that option is selected.

Without USB debugging and using a password policy, the author's strategy would not have worked. With the current strategy, this has nothing to do with Android, and everything to do with having poorly designed and poorly implemented security on the part of the application author.

Could this be a case for stripping the: X-Confirm-Reading-To: Disposition-Notification-To: or Return-Receipt-To:, lines out of the message header? It seems like this is something a SPAM gateway could handle.