HN user

pgraf

136 karma

long time lurker

Posts5
Comments47
View on HN

Really interesting, but I would love to be able to express honestly when I just guessed. This way the result would be much more scientifically sound. Four answers have a 25% chance of random correctness, which is a bit high in my opinion. I think either adding a "I don't know" or a confidence level (Known/educated guess/wild guess) would help.

This problem really bothers me as well. I think that ultimately this problem boils down to reducing search cost[0], which the internet has already partially done. I think AI will reduce them further if it is not captured by the advertisement industry for the average user. However, we cannot assume a fully rational customer in the real world. Especially in software, the customer does not know what they are looking for most of the time. Further they cannot evaluate how good your offering is vs competitors without investing a significant amount of time, which in turn increases search cost.

[0] https://en.wikipedia.org/wiki/Search_cost

Sorry if that came around as rude. From personal experience I have not met any professor in my life who could lead such a project, let alone with students that don’t have any work experience… And you imply there should be multiple of them for the project to succeed

I get that there would be risk, but if it was under the supervision of professors (who hopefully are good at building, not just lecturing theory) […]

Good joke here! If you are actually serious, please tell us which university you encountered where the majority of professors actually did something productive in computer science

The US government is so powerful, they are the only country that enforces a draconian global taxation scheme on any citizen or person who has ever held a US green card […]

While it may be true that they are the only ones able to do it effectively, there are some other countries with citizenship-based taxation. According to Wikipedia[0] these currently are: Hungary, Eritrea, Myanmar and Tajikistan

Some other countries have similar policies for tax heavens.

[0] https://en.wikipedia.org/wiki/International_taxation#Citizen...

One quote that I find funny from today’s point of view:

As we approach the present, corresponding to a personal computer, the graph really should become more complicated since one consequence of computers becoming super-cheap is that increasingly, they are being embedded in other equipment. The modern automobile is but one example. And it remains to be seen how general-purpose the current wave of palm-sized computers will be with their stylus inputs.

Sounds like a problem that should be (rather easily) fixable in the Operating System, no?

If the emergency call doesn’t go through, try the call over a different network. This would also mitigate problems we see from time to time where emergency calls don’t work because the uplink to the emergency call center was impacted either physically or by a bad software update.

Just be aware that with your strategy “blocking 50% of unwanted traffic” means blocking non-attack traffic, as these Internet security companies are mostly legitimate. The automated attack traffic that you actually want to block is in the other half and will frequently change IPs.

Imagine a major bridge that was built by a contractor. A internal safety inspector repeatedly warned his supervisors of structural deficiencies that could lead to the collapse of the bridge. Furthermore, in the pass of time two external sources publicly warned about the issue, but the company downplayed the importance. Finally, the bridge collapses. It becomes evident that the company did nothing about the issue because it didn‘t want to loose contracts selling more flawed bridges. The public would justifiably go nuts, and there would be legal consequences for everyone involved.

What is different in our industry that companies (and managers) get away with such malice?

It is true that nothing is 100% secure. Sitting on a major security vulnerability internally with a motivated employee pushing to fix it and doing nothing for business reasons is not negligence, but malice. People in the chain of command need to be held accountable for this.

TLDR: A Denial-of-Service vulnerability triggered via cache poisoning on registry.npmjs.org which can render individual packages inaccessible

I don't see the big security impact that the headline suggests, as active big-scale exploitation would likely be quickly noticed and fixed. The most interesting attack vector IMHO would be to block individual security fixes to packages on a small scale.