HN user
I read this as: a group of professional engineers dedicated to hosting/scaling a platform designed for hosting blogs will perform better than a single random person managing a personal blog in their spare time. I generally think that's accurate.
There's an HTTPS version too: https://dspace.mit.edu/handle/1721.1/97690
For anyone who is curious about this line of thinking, I'd recommend reading a little bit of Neil Gorsuch's "A Republic, If You Can Keep It." The book covers these ideas very well.
On the other hand it's dry, repetitive, and has really poor flow, so I'm struggling to finish it myself.
Anyone know what malware was served?
removing a 'create file' clause does not cause that file to be removed on subsequent runs, as the tool has no concept of ownership
Terraform on the other hand does have a concept of ownership, diff-ing, and applying changes. It takes some work as you now need to track state, but I've been very happy with Terraform.
More info about the issue here:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-0...
I think it's worth recognizing that this is a good first step in a hard problem. Hosting many TB of data for free isn't easy. Building an index on top of that data isn't easy either, and it looks like no such index exists today, but if someone decided to build that index they wouldn't need to worry about the hosting portion of the problem. That's a great starting point.
https://academictorrents.com/about.php#mirroring
Using RSS to allow mirrors to host different subjects is really clever, although some of the categories seem quite large (>5TB). It may be worth breaking up each category (sharding) to keep each to 100GB or less so a volunteer can pick a couple and not worry about running out of disk when a category grows.
Then it would be good to track how many seeds each category-shard has so volunteers can help where it's most needed.
Is Samsung Internet better than Chrome? I've always assumed it was bloatware since it's preinstalled and I haven't heard of people using it. I personally use the Firefox mobile browser, which I think works great.
just put a different joke in
I wonder how often you get a different joke on the translated audio and yet another different joke in translated sub titles. Kind of wild.
FWIW subtitles for the original language will also sometimes vary from the original audio as well. I tend to re-watch shows on low volume with subtitles on so I've caught this a number of times, but it's fairly rare.
Usually I've seen the subtitles shorten the words in the audio. "You must come with me now" -> "Come now" or similar. I've been assuming it's to help the reader keep up with some quick exchanges.
Imagine someone in a domestic abuse situation
Depending on how abusive you are thinking, that sounds like rubber hose cryptanalysis. That's a hugely powerful approach and I think all 2FA can be bypassed with that, if not most of modern cryptography.
https://en.m.wikipedia.org/wiki/Rubber-hose_cryptanalysis
having their phone taken
Keep in mind that other 2FA methods also are phone based, like TOTP / Google Authenticator. Those also fail if your unlocked phone is taken. SMS is even weaker than those, but still better as a second factor versus nothing.
Edit: looking again, I see what I missed.
The only real defense is to never associate your phone number with personal accounts which even then is often not possible.
Yes that's exactly right. If I don't trust a website to not use my phone number as the sole factor for recovery, then I should not use SMS 2FA on that site and I should not add my phone number to any part of my profile. If I know (how?) that the website won't use SMS for recovery, then SMS 2FA is better than nothing.
As a website owner, if I offer SMS 2FA auth and use SMS in isolation for recovery, then I'd want to stop using SMS for recovery. After that, removing SMS 2FA and not offering any second factor would weaken my security. I.E. SMS 2FA is weak but better than nothing. SMS single factor recovery is terrible, fix that ASAP.
You're talking about account recovery, not 2FA. A website can use my phone number for account recovery even if I'm not using SMS as 2FA.
I agree with everything you said about SMS for account recovery.
Account recovery that uses a phone number is weak. There was a paper on HN this week that detailed this.
However, if we are going to compare SMS 2FA (I.E. password plus code sent over SMS) against just password, SMS 2FA wins. In both cases I need to steal your password, the SMS part is an added challenge although it's easier to bypass than many people want.
Given SMS 2FA and any other 2FA option, SMS 2FA loses.
Sure, everything that has a backdoor is bad. But what does that have to do with SMS 2FA?
Surely SMS 2FA (without a backdoor) is better than nothing. Sites should still offer something better than SMS for 2FA as it has widely documented issues. But as an end user presented with SMS 2FA or no 2FA; SMS 2FA is the safer option.
Is there a reason to assume an arbitrary SMS 2FA implementation would have a back door? That would be news to me.
Why? It's not "secure" but it's more secure than nothing.
The paper mentions some websites that claim to use SMS 2FA, but actually use SMS as a single factor for password resey. While that's really bad I think the solution is to fix those broken implementations not to stop using SMS 2FA everywhere in favor of using nothing.
This is really a criticism that Google called their system 2FA but actually was using it as a sole factor. That's bad security and bad naming. Had they actually used it as a second factor, then you would have seen a security benefit.
For anyone who doesn't detect the sarcasm or is unfamiliar: https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...
Most any language's built in psuedorandom number generator is going to be sufficiently random that you will have no trouble.
I once collected a $3k bug bounty over this. Python's use of Mersenne Twister in the lib/random module should not be used for token generation. Mersenne twister uses a relatively small state space and is fully deterministic (it never re-seeds or mixes in new entropy). If you get a couple sequential random values you can reconstruct that state space and predict all future values. I.E. request a password reset 10x in a row and examine the tokens in the emails.
Please only use secure random number generators when creating security related tokens.
Example blog post: https://know.bishopfox.com/blog/2014/08/untwisting-mersenne-...
Agreed. I found this project helpful for automating dependency checks: https://github.com/pivotal/LicenseFinder
I actually played around with turning it into a GitHub action for further usability improvement, although it needs more work: https://github.com/ralexander-phi/license_approval
For changes that are a pure file rename 'git mv' tracks those pretty cleanly. Anything beyond that... I don't know of any good tooling either.
Most TV I watch is shows I've already seen. It's background.
Why is the website background slowly changing from light to dark pink? That's distracting from the text in front of it.
Streamline Audits with Release Evidence
I've seen companies with overly painful audit requirements, and making the process of generating artifacts for audit as easy as possible is a great way forward. Box ticking exercises should take minimal engineering time.
My current project doesn't use gitlab, but I love the constant innovation Gitlab pushes out.
"Today's news in 5 minutes - China and its artificial sun"
Which language?
The little demos are fantastic!
All the examples include a flight, is there support for local driving trips? Driving an hour is faster/cheaper than plane fare.
Finding files seems like we'd have found a good solution by now. What software do you use?
How often is Jira up to date for you? I've often seen that standup can be a chance for folks to realize they didn't update a task. We'd have Jira open and just do live updates to sync it.