mmmooo

in case you didn't know neato is suspending operations and closing up shop

they mention servers, so possibly not jbods, but R740xd2 (or newer R760xd2). The former are 26x3.5" so would match what they describe.

yeah exactly, had to go into "installer mode" and configure the CT that's on a secondary powerwall, so it wouldn't count that value as part of the generation (forget the exact cryptically named option). Otherwise it considered energy pushed towards that powerwall as "additional energy in the system", and since the grid ct didn't show it was coming from there, it was assuming that the generation must be coming from solar. Or so it seemed.

from the looks of it, his CTs are mis-reporting/double counting. A very common problem with tesla installs. My solar roof had the same issue initially, and electricians really thought it was generating more then the rating of the inverters, until I fixed it (software controlled). With 3 inverters he can't have more than ~23kw AC (assuming each is 7.8kw, which is the largest inverters tesla had at the time). My solar roof is a bit smaller (~21kw), in a similar region, but the daily peaks are slightly less than half of what he was showing.

can use $RANDOM to get more entropy/avoid collisions, though as you said, better not to use files at all.

interestingly, when the psuedo 'irc' connection is created, the user's ip address looks to be intended to be the source address..but because someone forgot that there's an akamai proxy in the middle (and didn't adjust for X-Forwarded-For or whatever), the ip you actually get is the akamai ip (its also in the source)

   <script>
    var USER_IP = '23.62.236.92';

It's not unheard of for the fbi to operate (and pay for) the infrastructure to facilitate and even promote piracy. See "operation bandwidth" where they essentially did just that for 2+ years. Granted that effort was targeted somewhat higher up the food chain then your average home user trying to download a copy of the latest overhyped blockbuster.

Sooner or later I'm going to need to know the name of the company (unless they want to hire me sight unseen). What stops me from circumventing them then?

I think this is a ridiculous fear, and I've often told recruiters 'no thanks', because of this practice. I don't know you, you don't know me. If you don't want to trust me w/ the details which can directly impact both our lives (my potential future employer, your potential commission), why would I trust you with the details that impact just my life (my future career)?

So ~650M daily active users..4PB of data warehouse created each day, that means ~7MB of new data on each active user per day. Given that its data warehouse, I'm going to guess its not images, seems like a lot to me. I guess it shouldn't surprise anyone that every interaction on and off the site, is heavily tracked.

This sounds like arp cache. And can be "fixed" by arping (forced arp responses without a who has)

nice catch, I definitely think that would be the nail in this coffin.

Just wrote something very similar, but more targeting development sandboxes. host runs a script that uses rubydns. a zone cut to the host for dev.domain.com. rubydns then uses docker-api (with small redis cache) to respond to dns requests for *.dev.domain.com. Developers can now reference their sandboxes as foo.dev.domain.com from within the host, or anywhere else, including their own machines. More to it then this ofcourse, but thats the dns portion.

I wasn't really stating that assumption, and I agree, many will convert, but I was simply referring to what they are 'betting with'. Yes that's the most they can lose (ignoring that people pissed off at this move may leave even if they didn't use fb/g+), but its still how much you put in the pot. At least for me.

definitely a fair point, though personally, based on absolutely nothing, I don't think it is likely that 'those that login via facebook/google' have a drastically different behavior pattern (when it comes to stuff like paying or clicking). Would love to see anyone that has any such data.

That's a pretty bold move, given over 100k people a day/800k a month use the facebook auth alone[1]. and though looks like its on a bit of a decline. Maybe losing 100k users a day doesn't matter much to yahoo.

[1]https://factets.com/application/flickr-AQkvRaEJ

Though I completely agree with the intention of your point, the same sort of logic can be used to justify all sorts of dubious "three letter" activity.

By that same logic, are you still an idiot if instead of a tweet, it was a facebook public post? How about a facebook post marked only visible to your friends? Or in an email to your brother's wife's third cousin?

I'm not a big fan of slippery slopes, but this one looks a bit lubricated.

Anyone care to guesstimate how many assassination plots could have been prevented if just read the assailants public twitter feed in which he or she outlined, in plain english, his/her intentions to perform said act?

Somehow I feel like the people that are serious about this level of criminal activity, and capable of actually accomplishing it, aren't first announcing their intentions on twitter.

Yep, and/or not back-ported.

well redhat back ported it to their 2.6.x kernels, which, one could consider, can cause a giant regression due to a minor kernel patch (assuming you are using swappiness=0). As said by others, swappiness=0 isn't as great an idea as some people claim in the first place.

Some of it must have required at least some level of code review (e.g. (MACFileIO.cpp, Line 209)). Even so, between the review, and the writeup, etc, if the total 'billed hours' is really ~10, the rather large hourly rates I've seen for such audits do appear much more appetising, at least to me.

This report is the result of a paid 10-hour security audit

In just 10 hours? If really so color me impressed. I don't think I've been so productive in 10 hours, ever.

firefox doesn't allow cross domain fonts w/o allow-origin

its more about zero after trim support (dzat), and sounds like they maybe use ssd's that don't support it, and are handling it by zeroing the block device on create instead of wipe. At least that's how I read it. I suppose easy enough to check by seeing if new droplets take longer to create after this is deployed.

yep, sounded like they shared switches between public and iscsi lans, or worse.

iSCSI san, so attached via ethernet or similar, taking network devices offline would take san offline. The rest is pure magic.

This statement pretty much covers it:

https://support.google.com/nexus/answer/3468085

Somehow I thought it was a known thing, that outside of the movies, if you found a hitman, that is willing to do the deed, he's either a con artist or an officer of the law.

yah I was actually thinking of facebook ad just after I replied, with that criteria..only thing that turned me off from it what that you made it sound as highschool was a post-processor (validation) vs pre-processor (targeting)

post pic on craiglist/similar in Austin area. Say you found wallet/purse/camera/etc with her picture. Anyone that knows her please call/email w/ Name/Address for you to send back. Use highschool for validation when contacted. Might have some error.

I had a similar high school teacher, minus the brother-in-law, teaching a high school Pascal class 1-2 years out of college, being barely a chapter ahead. She would often state things like "you should always/never xxx". I happened to have been very comfortable with pascal at the time, and raised points with exceptions to the rule, and was told its "always/never". This lasted till next week when she would read the next chapter.

She also demanded that every line be commented, however would only take a small percentage away (I think 5 or so), if one or all comments were missing. As I couldn't bring myself to comment everything, I would just use inline asm, which pascal supported at the time, with absolutely no comments. Since the rest of the grade relied on the program functioning, I did well. I thought it was cool at the time. Now I realize I didn't make her life easy, and probably should have.