rilita

Location: Baltimore, MD

Remote: Yes/only

Willing to relocate: Remote work only

Technologies: Perl, C, C++, Java, PHP, Python, Coldfusion

Email: work@rilita.com

Payment accepted: Bitcoin only

Reading through this article I am unclear on why anti-virus is now supposedly dead.

It reads as though anti-virus is being shifted to the endpoints. That is, viruses are detected right on the network rather than on end-user machines. Is this accurate?

It's really unclear to me what anti-virus is being replaced with exactly.

What kind of security experts are they talking to... My personal list of most important things to do:

1. Run a version of Linux ( Windows is simply insecure )

2. Use Firefox + NoScript and only ever temporarilly allow JS to run as needed. ( JS is -not- safe and at any point in time there are at least a handful of zero day exploits )

3. Use an offline password manager ( KeePass )

4. Use a secure anonymous non-logging VPN for all internet use

5. Use a paid private email account, not some free one

6. Use VMs for running software that may not be safe

Whether you like it or not, the description of being nice has a connotation of being clueless. Obviously the word can be applied to people who are not clueless, but it still has that vibe about it.

I didn't make up that the definition is as such. Go find a dictionary that has not been revised to "match" the way people tend to use the word lately. ( such as a dictionary made 10 years ago ) You will find that is the actual definition.

Respect is a two way street. Those deserving of respect also need to give it and treat the people "beneath" them well. I do not give respect to people who are abusive to everyone around them.

You state that people who write articles are trying to bring benefit into the world, but that is really wishful thinking. If you look clearly at the motivations of the people crafting articles and the actual quality of the content they have created, you will find that the motivations are quite a bit less wonderful. The most common motivation is to get attention.

I am unsure why I should be offended if you state that people attending church on a regular basis tend to be arrogant and narrow minded. I should say that is simply a true statement. If people are offended by that then fuck them. If you stated "People who attend church are a bunch of dumb hicks" then that would be offensive. You didn't state it that way. You just made a rather defensible observation; a controversial one obviously, but I think it has weight.

I don't even follow your second example statement. It doesn't make sense.

You still haven't responded to the actual point of the observation heard in church. You seem to be deliberately ignoring the idea.

I think the focus was on the fact that it is arbitrary. The person you are interviewing may not even know nor want to care what a Fibonacci sequence is. He is saying the goal is to understand the candidate and the way they think, not to trivia them about random stuff ( since it will put them down if they don't know it )

I've seen a lot of writeups about interviewing here on hacker news. Things I liked in this particular one:

- Admission that arbitrary coding challenges that are unrealistic to the applied job are ridiculous

- Recognition that you need to understand the engineer and approach things from their point of view, not from your own selfish view as the interviewer

- Urging that being polite and humble is important. Even if you don't like the candidate, there is no need to attack or diminish them.

One question I have: What is wrong with copying and pasting solutions to issues that have been solved before by others? I tend to do this all the time myself ( albeit I often end up rewriting the solutions to tailor them more to the problem )

Overall decent suggestions for interviewing.

I'll give you an example by posting in exactly the same way I always do.

When I was in church I heard a sermon that stated that teachers are held to a high accountability level than others, because their words have a great affect on all the people listening to them.

I agree with that notion and think that authors of content should be especially careful not to give out misinformation, and more deeply that they should not spin information to such an extent that it is attempting to manipulate the feelings of others to some end ( often personal ).

I react to articles I see to have a counterpoint to whatever spin exists. The point is to bring some semblance of balance to the discussion rather than having it be one sided.

Another thing is the word 'nice'. The definition of the word 'nice' is basically to be ignorant. It is pleasing to people if you are ignorant and just accept whatever they say. I don't believe in being nice; I think it is detrimental to the community and society in the long run.

If people cannot take the heat of criticism then I don't think they should be spending hours creating articles aimed at a group that contains people who do not agree with what they have to say.

It's not useless because until you hit a certain karma value you cannot downvote. I encounter obnoxious people and attempt to respond reasonably to them; they downvote every single post I make but I obviously cannot do the same to the comments they make that are bad for the community. As a result those people gain karma for trashing whatever I say and no one else gets involved because they do not want to get involved in downvotes imo.

A warning for people who value their time.

jQuery provides bind. That and related code is what I am referring to in that case, hence my insistence on the importance of closures. I have revised my comment to mention this as well as the fact the John Resig himself reccomends the Prototype way of doing Class.create(). By the way, Class.create() itself is implemented as a closure.

Are you claiming that CoffeeScript is cross browser compatible? If so you are just going further down the rabbit hole. To my knowledge there is not a single browser than itself is capable of parsing CoffeeScript without a helper library that doesn't come installed by default. ( Firebug comes to mind, and if I recall correctly there is a helper tool for that. I'm also aware of source mapping for debugging things such as JS in both Firebug and Chrome )

Have you looked at the implementations of classes in jQuery, Prototype, Mootools, Dojo, etc? I have. I've used thousands of lines of codes from these libraries and fixed numerous bugs in them. ( Note I'm referring to the 'bind' function specifically in the case of jQuery as it doesn't even provide an equivalent to Class.create(). That said, John Resig himself wrote an article about this and ported out the core of Prototype [ same as I have done ] http://ejohn.org/blog/simple-javascript-inheritance/ )

Using the prototype may be the way that things get copied from the base definition to an instance, but generally closures are what allow things to have the proper scope. Arguably the scope is far more important for using something like a class than the copying. Additionally, without closures there is no way to pass of anonymous function pointers calling back into the class.

If you think you are demonstrating that I have a lack of knowledge of how this shit works, you are mistaken. But by all means, continue disregarding my points and nitpicking details instead.

You will note that here on hacker news I don't really give a shit about my credibility; I care about providing the most accurate information I can to the benefit of others.

You haven't invalidated my statement about translators at all. ES5, ES6, etc are not cross-browser compatible. Using a translator to "make it work" doesn't count. If you wish to say that C++ is cross browser compatible too then fine, but it is obscuring the root issue that those features do not exist in all the browsers, nor even the whole set of them in any one browser. This is misinformation and will mislead developers.

My last paragraph is in reference to the fact that JS/Ecmascript have never truly been "fixed". It is just a constant hodgepodge of whatever vendors decides to add on to the language.

There is a difference between the internal vibe of the company and statements by the current CEO. One has to say things that make the company money; the other is the true reality of what drives it.

The "free speech platform" notion is alive and well with Reddit, both in the community and in the people working to support it.

Alexis may not be calling the shots, but you can be sure that people are still keeping his vision alive.

Are you kidding here? In ES6 classes provide nothing more additional than the closures already in use via a bit of extra utility code. Doubters should click the link here provided by Luke. It is filled with "To Be Determined" for all details of anything useful.

Do you know what classes actually do in a real OO language, or are you just a fanboy of JS?

Also, using shims or translators proves nothing. I can write in C++ and use translators to convert that to JS. What is the point here exactly?

Adding extra confusing junk onto a weak language does not make the language "better", especially when the standards you are recommending people to learn aren't even finalized.

Where is the Acid test for ES5, ES6, and ES7 features? Hell where is the Acid test for HTML5?

Oh that's right; all of this is just a pile of nonstandard junk that people are begging for and isn't really implemented.

tldr:

- Books written for "beginners" target people who already know how to code

- Author's book targets people before that

- Most programmers are bad at teaching people how to code

- Recommends some arbitrary phraseology to differentiate levels of ability

- Until someone learns the basics of 4 languages they don't really know how to code

- Demands people only use the term "beginner" for people who can't code, and "early" for those who can.

This is great and all, but it comes off mostly like a whiny complaint about how most development books are aimed at a group of people who already have a basic knowledge of coding.

The has already been addressed by the so called "dummy" series of books. They were aimed directly at the audience the author is saying are being left behind.

I'm not sure I am seeing a real issue here. Go to the bookstore, browse through the books, pick the one you can comprehend and seems to be aimed at whatever your level is. Done.

tldr: ( my own, not the authors in the article itself )

- Read books

- Learn libraries ( author seems to like node.js and recommends libraries associated with that )

- Do exercises

- Learn how classes work in JS ( Note this is amusing to me since JS does not have classes in the typical sense [ they are implemented via libraries with prototypes and closures ] )

- Learn what Es5, Es6, ES7 are ( There are good things here, but be aware that most of these features are not implemented in most browsers and will requires shims and/or translators to even function. Be careful as they may work in your browser but not others. Test! )

- Read JS blogs and watch JS educational videos

- Practice

It's an okay article. If you are clueless how to start learning seriously this should help. Some decent books and websites are mentioned by name.

I think the "every JS developer needs to learn XYZ" is a bit off though. This is one man's perspective.

Of note related to this are the following:

* There is an email going around supposedly from an insider saying reddit intends to sue voat.co http://cityworldnews.com/reddit-plans-lawsuit-against-voat-c...

* Voat.co ( when accessible ) was mirroring some content from Reddit ( copyright infringement? ... )

* Voat.co seems to be crushed and possibly being DDOSed

* Last I heard when I was at a speech by Alexis Ohanian himself, he is for free speech to a rather extreme level. I did not get the impression he would ban any content besides what is absolutely necessary to keep the business running.

The thing that we now call Firefox has gone through many revisions, going back nearly to the beginning of the internet. A lot of that code has been shared by many browsers.

The code is composed of 4 parts imo:

1. The rendering / layout engine

2. The scripting engine

3. The UI

4. Other junk/addons

#1 and #2 are both tremendous and do amazing things. Passing the latest ACID tests is wonderful. #3 and #4 are unfortunately what many people think of when they think of Firefox.

Really, #3 and #4 are irrelevant in the long run. Mozilla itself is irrelevant in the long run imo. The only thing that is important is the existence of good rendering and scripting engines that are open source.

So long as those things exist, all the rest can be changed. Other organizations could take the place of Mozilla and it wouldn't really matter overall, because the code that matters will continue to live on so long as hackers exist to continue putting it to newer better uses.

Look at Chrome. What is Chrome really? To me it's just Webkit with a minimalistic UI wrapped around it. ( and later a new scripting engine also ). Does Chrome matter? No, not really. Webkit matters.

Clicked on this article hoping for closure on Google issues that lasted for 5 wholes years.

Thought to myself "Now that is something I can related to. Having issues with Google for years on end and wanting closure. Maybe I can get some closure too by reading this article."

Was severely disappointed. Google, the type of closure you provide is not the type I need.

Imagine that this article read as follows: "I used to have a great job working at Yelp. I was paid highly for it and accomplished a lot. I even got stock options. I've made it now though. Screw working hard, I'm through with that. I'm paying off my mortgage and gonna live the easy life now. Good luck to all you suckers still in the software industry. Bwwuahaha."

Somehow I don't feel much sympathy for this person. Many of us have been working miserable software jobs for years, but we still give it our all and don't throw in the towel.

Yeah it's great that this person made it through, but it's a crappy example for the rest of us.

As fweespeech says here also, criminals will encrypt regardless of what is going on. The people the FBI is "after" are going to encrpyt, so fighting to make public systems store data and hand to the FBI when desired is pointless.

If the FBI isn't mining normal citizens data for loose connections to stuff that is none of their business, then their is no need for them to have access to the systems they want.

The only argument that could be made is that criminals are stupid and may not use proper encryption on their own, therefore we should watch what everyone is doing so that we can catch these particularly dumb criminals.

The goal of the FBI in all their statements is to try and convince the public that "only criminals need encryption; everyone else should let us watch everything they do." 1984 anyone?

I agree completely that many aspects are covered by existing technology. The difficulty is in making it such that all of this can exist as a simple set of open source binaries regular people can run ( not computer experts )

The system has to be brainless to use if it is going to succeed at all, and it has to have enough initial buy in to be worth bothering with initially.

Wikipedia as you have pointed out has arcane crazy policies that restrict it from having user generated content. It claims to only be a replication of printed articles. That is lies, but it is a pain in the butt to actually get valuable content into it and not have it removed.

Usenet suffers from not having structured data, being just chunks of text.

Github suffers from refusing to host binaries except for in weird cases ( there is a binary build hosting I think?? )

Bittorrent suffers from still being attached to hostnames for the most part ( I'm aware of the distributed system it has too but you typically can't get many seeds through it )

Most systems that allow content suffer from having copyrighted data on them. The goal of this would be for it to be publicly known that there is no copyrighted data, such that universities and such would be willing to run the distributed server, and censorship could be stopped by enough people running it globally.

I'm not focusing on funding of libraries so much as the fact that they have an established set of categories to put information into. There is no such standardized list of categories for websites to go into, and the creation of such is important to the future of the internet.

There is a way to fix the problem that you are observing:

1. Create a "subweb". It is composed of the following

1A. A new specification for the publishing of information in complete form ( read structured content published together with templates to present them )

1B. Both server and client systems that implement the new specification over some sort of modified http but without using current DNS

1C. A free distributed un-filtered un-policed distributed DNS alternative

1D. A complete hierarchical index of all content existing in the new system

1E. A free distributed search engine allowing submission of content within the new system.

2. Make it clear the new system is for free content only

3. Disallow advertisements on it entirely

4. Tie in accurate hashing and allow people to dedicate as much hosting power as they are willing ( either to the content itself or index data to what hashes represent what )

5. Make it entirely secure with a public/private key system allowing people to establish meaningful identities within a system where their content is copied eternally.

6. Use the new system yourself to publish meaningful non-shit information and encourage your friends to do the same

By the way I really like your article and I think you are pointing out a crucial problem spot on that most people are oblivious to.

The easiest way to think of what must be done is just to look at what libraries are. Organizing information has been done by libraries for thousands of years and has a fairly established sensible process. ( which is being ignored by the internet )

Seems kind of doubtful they would be willing. The way his description reads it's like he is nervous that he created a gun. Why not keep it? He owned it... just lock it up?

Plus that is in San Francisco. I live on the opposite coast. I won't be over there for a while.

I was searching online to see if renting one of these things is legal. I found at least one person stating that it has been said officially by the feds that renting one of these would be considering "manufacturing". I can't see how, but that is what was said.

I doubt Wired wants to get into the middle of that. Perhaps the NRA might, or the ACLU, but not Wired.

Really both the NRA and ACLU should both buy like 50 of these things and rent them out. That would be interesting.

My focus here is really on highly critical vulnerabilities that affect the public in a negative way by existing. I agree completely that reporting smaller bugs, or possibly large bugs with no hugely negative effects, tends to get you respect and thanks.

Reporting critical ones that results in major changes tends to win hatred and negative attention overall. There is positive mixed in but it does not outweigh the negative.

Possible ways to handle critical vulnerabilities:

1. Sell them to the highest bidder. Typically that bidder is the government. There is an open legal market for this. Result: You make some money, the government uses bugs against people, and you are viewed as a traitor by the software community.

2. Sell them to the black market. This is criminal behavior. Figure this one out for yourself.

3. Do nothing. This is what most people do. Result: You are normal.

4. Use them in some illegal fashion for yourself. ( See #2 )

5. Tell your boss. Result: If you were told to be looking at it, you will get kudos. If you were not, you will get yelled at for wasting time, and told to do #3.

6. Tell the company who makes the software. Result: If there is a bug bounty program and you report it through that, you get a small bit of money ( not worth it ), and it gets fixed. If there is not, your message will likely be ignored.

7. Tell the public. Result: You will be ignored.

8. Tell the public loudly. Result: You will be mocked.

9. Tell the publicly loudly and demonstrate the problem. Result: Everyone will attack you for making it possible for people to abuse the problem.

10. Demonstrate the problem for yourself. Notify the company first anonymously. If they don't listen or do anything notify the public, including documentation of your attempting to notify the company. If the public still ignores you also publish the demonstration. At no point let on who you are; it is just not worth it.

Only #10 is a solution that works in all scenarios, and it brings little reward for the person finding and reporting the issue.

I am obviously ignoring the case where you are hired as a pentester. That is a whole different story.

There was a lot of hoopla from the community right when it happened. The head of forge quite, leaving the guy under him to make the next forge version. The one guy in bukkit sunk the whole project due to it also.

I would like to know what if anything Microsoft has done to help Forge to keep the community strong. My guess: nothing as you say. If they have done something that would be news.

There is speculation that nearly all Minecraft mods right now are illegal due to reverse engineering of the obfuscated core.

All of that is rampant personal speculation. You are saying I am reading into your statements... but you are reading into what will happen way more so. Kettle calling the pot black is kind of lame.

It's hardly untraceable. There are only 1000 ghost gunner mills in the country. It is feasible that they are all being tracked by the USPS. Fedex and UPS refuse to mail them... That means the government likely knows where each was sent, and has a name too to go with the location.

There is a paper trail associated with being able to receive such a heavy thing in the mail ( you'd have to send it to a location you control / own / rent etc )

Suppose you buy the machine, build your own gun, use it for some bad purpose. If the gun was ever found, it could likely be traced back to you. How many people have guns created with the ghost gunner machine? Not many. Can you tell a ghost gunner cut lower from other methods? Yes.

The whole thing is just a publicity stunt. When there is a local shop in a major city where I can go in and rent a ghost gunner machine for a day, in cash, providing nothing but a large deposit to guarantee I bring it back, then and only then can such things really be untraceable.

We could already run OpenSSH on Windows. I typically do via cygwin.

It appears people are building it against MinGW? ( https://www.nomachine.com/AR05H00563 )

If we can already build Windows binaries of OpenSSH, why does it matter if Microsoft begins to offer that also? Is Microsoft going to provide full source for their build process? If they don't, would it be a good idea to even use it?

Summary of your position:

1. If the details are published, minority won't like it and will complain loudly.

2. Those vocal groups will sway people to oppose it

3. Opposition would destroy it

4. We should instead keep it secret and trust that the vocal minority groups will be fairly represented.

Personally, if opposition can destroy it, I think it should.

Interesting, but this is just a huge advertisement for a book. Also; it says nothing about what Microsoft is doing with Minecraft in the last year. There is no new news here in this blurb as far as I can tell. Move along.