HN user

trippy_biscuits

132 karma
Posts2
Comments58
View on HN
OpenSSL Audit 11 years ago

You made the point that I was trying to make: implementations are not secure. A programming language can follow a philosophy but implementations never quite line up with the theory. We only use implementations of the theory and experience shows that implementations all have vulnerabilities.

OpenSSL Audit 11 years ago

Do people really believe in more secure languages? Are they the same people that think switches make networks secure? Switches don't and neither does a given language. I recall a CTO that would not allow C++ development because he thought the language was insecure. Java was the only language allowed. Even college courses are still teaching that security is one of the benefits of the virtual machine. We only have to look at all the patches for java to see that it hasn't been secure. Then we look at every other software that has been patched to see that nothing is secure.

Please stop perpetuating the myth that security is produced by a programming language. People make security happen just like they make it not happen. Obligatory Schneier: https://www.schneier.com/blog/archives/2008/03/the_security_...

I don't have a short attention span and I'm not hyperactive. I spend a lot of time thinking about things. I deduce things noticeably faster than my peers as long as it's not socially related. I have intense focus as long as something remains stimulating. When things lose my interest or are pointless they become tedious and it's not about attention span. I cannot stop worrying about assigned tasks to the point of anxiety. There is a mental barrier and I cannot work on the task despite intentions and efforts to do so. Medications don't really help me. They do at first, then they become less effective. An interesting side note about meds: The first time on meds I finally could see social cues and body language. It was a whole new world. I still see them off the meds now that I know about them but I may have trouble understanding what they mean due to lack of experience in receiving those signals. Getting proper sleep, nutrition, and having regular, serious exercise help more than meds. The affliction is very real. Just because you can't see it or refuse to believe in it doesn't change the fact that it impacts the lives of others.

fork() can fail 12 years ago

"Unix: just enough potholes and bear traps to keep an entire valley going."

If you don't understand how to use sharp tools, you may hurt yourself and others. Documentation for fork() clearly explains why and when fork() returns -1. Those that find the man page lacking or elusive may get more out of an earnest study of W. Richard Stevens' book, Advanced Programming in the UNIX Environment. In any case, every system programmer should own a copy and understand its contents.

In the 90s I built a FreeBSD firewall using discarded PC parts. It took 10.5 hours to build world and kernel. There were 2 power outages that forced me to start over each time. I bought my first personal UPS to fix that problem. I would learn how to cross compile instead of waiting 12 hours.

When I think of all the money spent in the name of improving and enriching the lives of human beings, it troubles me that we don't have a reliable solution for ending DUI. I know many companies fund research to end cancer or improve the quality of life for those with various diseases. While this research may help save or improve lives, it's motivated in part by a potential return on investment. Why can't we do something to prevent self-inflicted suffering? Those people did not need to die. While I don't consume alcohol I don't see why a person that has consumed alcohol should be transformed into a homicidal idiot after getting into the driver's seat. Since we can't seem to limit DUI, perhaps we can we make a car that won't operate when the driver is incapacitated? Although, I would oppose any legislation that forces such technology on everyone. To be sure, this remains a tough problem to solve (1). Rather than working around the problem (removing drivers or reducing the need to drive, limiting/controlling alcohol, etc) how should we address the issue? If we could stop alcohol-impaired driving the United States could save USD$51 billion per year and prevent over 10,000 deaths annually.

1. http://www.cdc.gov/motorvehiclesafety/impaired_driving/impai...

It's interesting to watch ordinary people attempt to dabble in currency. How many criminal organizations, governments, and financial institutions (redundant?) the world over have people who wake up everyday just to manipulate the value of currency? For example, a common criticism of China is that they purposely manipulate their currency to devalue the US dollar. In which ways could such organizations impact a new currency like bitcoin? Simple theft doesn't work very well unless immediately converted to cash, just like tangible goods being fenced, often below true value. Was it really just theft?

Project Tango 12 years ago

So how long will it be before someone can take a picture of a person and find all the similar matches on Tinder modulo any profile preferences and desired attributes? Maybe save it for later and use it in a completely different location? In other words, take a picture and then have an app that finds as many matches for that person all while applying any filter preferences the user has in his or her own profile. One person may see exciting matching opportunities. Others may use these modern technology aids in becoming the ultimate modern predator. It's one thing when you want to find a great date. It's quite another when someone uses it to find your son or daughter.

Obligatory xkcd: http://xkcd.com/463/

Why add more moving parts when they don't do anything but make more work? Scanning is a helpful idea, but not AV scanning. Regular vulnerability scanning can assess the platform security. At the very least, it can warn about potential security holes. It might also be plagued with false positives, causing more work for no added benefit. Safely running services on the internet is hard.

You are quite correct that installing from source doesn't really scale in hosting services. It does take too long and leads to incongruent deployments that may block migration. I don't believe any distribution is well suited for cloud deployment out of the box. I usually deploy from a suite of prepared images via netboot, then customers are free to compile from source or use canned packages.

Sure, I'm already using that option. I had to go and find it on my own, at the time. It wasn't as simple as updating the ports collection and installing from ports, but I suppose it's not much different than waiting for a maintainer to update a package and then installing it.

I use ports to mean compile on my own and packages to mean installing precompiled binaries. In my experience, FreeBSD seems more amenable to managing, building, and installing software from source code than a linux distribution. Perhaps I just haven't learned an efficient manner that integrates well with yum/rpm on CentOS? I've always had more dependency nightmares on a linux distro than with FreeBSD. Using FreeBSD's ports collection (single repository) has been less error prone for me than trying to manage all the different yum repos one must manually organize to get up to date software. Am I doing something wrong or is it really that clunky?

The FreeBSD ports system is wonderful because it lets me vary the version of an application without forcing me to replace world. Yum is great when you want a binary distribution that often lags the latest releases by years. What do you do when you need a more recent PostgreSQL than 8.4? Upgrade your OS? snicker Why should I be forced to disrupt my OS when all I want is an application? I develop in the CentOS environment on a daily basis. I long to return to the simplicity and elegance of FreeBSD.

Programming doesn't have to be your passion. gasp

Transition to a less demanding role, if needed, and look for other areas where you can contribute the result of your experience.

For example, if you have passion for *BSD, some linux distribution, or some other community software project you could contribute. You could start by fixing bugs and submitting patches.

OR, skip out on software development completely. Find a way to get more free time and then study a foreign language or learn how to play a musical instrument. Maybe the issue isn't what you are doing but what you aren't?

BSD vs GPL was already mentioned. Perhaps now we can discuss how DRM only hurts paying customers of protected content? Oh, you bought access to some licensed content? Great! Thank you. As a reward we will now severely limit how you consume the good or service.

I prefer a concise, short resume. I interview candidates over the phone so I keep the resume and a condensed job description on the displays in front of me. If the candidate lists something, I ask about it. Knowing what a potential hire did 10+ years ago may be interesting but it's rarely relevant. It provides color but I'm significantly more interested in what was done in the last 3-4 years. When a person hasn't exercised a technical skill for 3+ years, that skill may be obsolete and/or the candidate may prove unable to apply that skill.

I will not fly as long as they can look at or touch my genitals. Why do flyers tolerate such an invasion? I'd like to travel but I refuse to put myself or my family through this kind of treatment. Are there private flight services that allow me to skirt the TSA gestapo? Can they get me from the middle of the USA to Hawaii and Japan and back again without any invasions of privacy?

This only tells where the car went and may not implicate the real criminal. Imagine a someone borrowing a car, fleeing from the police, getting tagged, and then returning the car to its origin.

The tag may help stop the police from engaging in dangerous driving, but what about the driver of the tagged car? If the driver knows the car is tagged, perhaps the driver will still drive dangerously? I suspect the action of tagging a car still encourages the police and the accused to behave dangerously. What if an occupant of the car returns fire?

Mirra 2 13 years ago

It looks a bit like the Steelcase Leap. I spend more time in my chair than in my bed. The Leap chair cost more than my bed.

You don't really mean self-signed, do you? I'm a doctor. Here's my diploma. I created and signed it myself. But trust me, I really am a doctor. I hope you really meant that you use an internal CA that issues certs and that you trust that CA instead.