DonaldFoss

There are valid uses for some of these. Imagine where online User eXperience and User Interfaces would be without services that help tell someone what is working and what is not.

Fortunately, many US companies are starting to consider a GUID and your IP address to be PII, and no longer allow that information to be stored.

I sympathize. It's terrible when a computer thinks you must not be human because you're not slow and don't make enough mistakes.

I've been accused of being a bot before also.

Don't discount Warren Buffet's mantra. When people are scared, he buys. When stockholders feel great, he sells. So fear=buy if fundamentals are good, exhuburence = sell and make profit.

--Donald

This applies to _most_ disciplines, not just math or math related fields.

The real definition of distributed systems is endlessly challenging as you are always balancing trade-offs.

The CAP theorem still holds, so we pick which 2 out 3 to be strength​s and where to compromise as little as possible. It's a guaranteed 87.3% effective hair loss formula. I find Quiet Riot helps.

Much more than 12 days. Below is a copy/paste of a recent security vulnerability timeline:

2015-12-14 | me > dotCMS | 8 SQL injection vulnerabilities

2015-12-14 | dotCMS > me | they were planning fixes in upcoming release, estimated to beginning of 2016

2016-03-16 | dotCMS | dotCMS version 3.3.1 release (CVE-2016-4040 still not fixed)

2016-04-07 | me > dotCMS | what is the situation with reported vulnerabilities?

2016-04-07 | dotCMS > me | CVE-2016-4040 will be fixed in 3.5, which is estimated to be out in mid-April

2016-04-19 | dotCMS | dotCMS version 3.5 release

2016-05-10 | dotCMS | dotCMS version 3.3.2 release

2016-10-31 | me | Full Disclosure on http://security.elarlang.eu

Source: http://seclists.org/fulldisclosure/2016/Nov/0

This timeline from first report to full disclosure was 10.5 months. Note that I did not go looking for a long timeline, this was the first item when I Googled "CVE disclosure timeline."

--Donald

I've worked with the McDonald's web team before. They do care about performance and security. I reverse engineered an undocumented (to them) protocol for a game system in order to write tests for it--which was really, super fun to watch run.

McDonald's uses 3rd parties for most of their main development work. In the case above, the developers were in Australia, while McDonald's is in US Central Time and I was in US Eastern time. When I reported problems and provided suggestions, they usually had a conference call with McDonald's, the Aussie devs, and my team within 12 hours. If it was a weekend, it was Monday night. McDonald's core team takes this very seriously.

The difference here was that I had all the right phone numbers and am known to them. I was working for a well known publically traded company, which carried weight by itself. I don't know that if I didn't have the right contacts, hadn't been to their HQ and met with the VP/IT and Director of Online, would they have taken what I said seriously?

Secondly, this was the US Christmas and New Year's holidays. They were running a skeleton crew. As Adrian Cockcroft, former lead cloud architect at Netflix, once said, the time Netflix is the most stable is Christmas and New Year's because there aren't any engineers around.

With all that, they need to take this as a wake-up call and have a security response system, even if they contract a 3rd party for that also. There must exist, or this is a nifty startup idea, 3rd party firms that go through [email protected] emails, including the reams of spam, and there should be an optionally anonymous security problem reporting form with a captcha to get information such as this to the right people.

Lastly, 12 days is extremely short under any circumstance. While I'll admit that it can be extremely frustrating to not get a response, I believe 30-days should be the minimum time before first notification and publication with details. If a security firm wants PR for finding the problem, the post that there IS a problem first and wait the full 30-days from initial contact attempts before disclosing the details.

--Donald

It seems we revisit this topic or a branch of it often enough that it's almost becoming a meme.

Here is a 2-page, 7.4K security checklist. If you verify and check each box, your application won't be bulletproof (it is software and you have 3rd party libraries), but it will be close to air tight. --Disclaimer: I have nothing to do with this security checklist or its authors, except appreciation and respect.

Security Guide For Developers - Latest: https://github.com/FallibleInc/security-guide-for-developers...

--Donald

Assuming a web page, does the page reload in less than 1 second?

On a full sized keyboard, the normal rate is 3.3 key presses per second. On a mobile device, I'm sure an 8 character password will take far more than 1 second.

For brute force attack defense, rate limiting a single account globally to 1/sec, i.e. independent of source IP address, should be sufficient and prevent parallel attacks by bots, but this still makes DOS attacks on a particular account easy, but not the entire system except traditional overload.

Many API systems work this way and it's proven effective.

Peer review feedback loops do tend to make one carefully consider what one says, however if the peers are too homogeneous, you may not get challenged on many things outside the bubble of their collective belief system. Heterogeneous peer systems, that is diversity, are more likely to keep you honest.

Try TheHill.com and AllSides.com. I find AllSides.com useful for presenting the same story from multiple sides and biases. The Hill aims to be apolitical and center biased, and does a fair job.

Disclaimer: I have no affiliation with either site, and I do not endorse either site. My opinions are my own.

Not a downvoter-the opposite in face.

From a rational, logical, and chemistry point of view, one cannot have a balanced view or understanding without positives and negatives.

The only thing that makes it work is critical thinking; or at least rational thinking, though rational thinking is easy enough to manipulate by any sophist. Recognizing the forms leads to recognizing the art of sophistry as it occurs. However, emotion is even easier to manipulate and inflame, ridding one of the possibilities of rational thought.

Those biases were on full display this year, not even bothering with the normal veneer.

Very nice. I saw the word "Zeitsouveränität" and knew the literal meaning but didn't realize it's modern usage.

In reality, time sovereignty is the only worthwhile thing wealth gets us, because time is our most valuable resource, a non-renewable one at that.

Try learning foreign languages. To understand a language, one must possess a level of understanding of the underlying culture and history.

Then one discovers that dialects arise from a common language with differences in geographic or societal culture and history.

Linguistics and etymology are fascinating topics, _almost_ as much fun as building (and test breaking) fault tolerant distributed systems.

After being married over 20 years, which I still find shocking that anyone has put up with me for so long, I find that "to let her be as emotional as she wants but stay rational and prudent" frequently backfires because she wants emotional _involvement_ and support. Being rational doesn't meet her needs, even though as a man, a geek HFA man at that, I'd rather stay in the safe, predictable, rational realm. Staying married and supporting my wife is more important to me than my comfort zone, just like apologizing means you value the other person more than your own ego.

Mad props for the _ Ein Heldenleben_ reference. Richard Strauss was a genius, following in the footsteps and improving on Wagner.

Side note: I'm continuously amazed at the breadth of knowledge and reference on HN. Is it perfect? No. It is, however, frequently a breath of fresh air. It reminds me that polymaths still abound, and fondly reminiscent of the old /.

With 1 daughter in university and 2 in high school, I do something similar, adding in listening to their viewpoints, and asking them critical thinking questions about their views without necessarily disagreeing with them. It doesn't matter whether I agree or disagree, I simply ask them to think for themselves and question the reason they feel the way they do. It's often quite interesting to go into a direction which I had not considered. I've also found flaws in my own views from the exercise.

As may be expected, they also get tired of this sometimes, and they know it's coming, so I try to pick and choose items at random and just let others go. I believe--well hope really, that this encourages them to think and ask questions themselves and not dread another dinner with dad :)

Tribal instincts, competing for scarce resources?

I believe the parent poster is saying that fake news isn't a new phenomena; I don't believe it was condemnation of any specific news outlet.

Any search of history can find fake news going way back; the difference today is the ease of producing it and how easy it is to spread rapidly.

You hit the proverbial "nail on the head." Before 24/7 news channels and online access, the rush to "scoop" another newspaper still had a 16-hour cycle due to daily print runs. The infamous incorrect front page presidential election result made editors back up and double check things before rushing a story, but it didn't last long. Many years later, Dan Rather lost his job for not fact checking before reporting something he wanted to believe.

When television news first appeared in the US, some claimed the death unfiltered information, which was already filtered, while others claimed the death of newspapers. The first didn't change much and the second barely changed.

24/7 cable news was already in vogue before Dan Rather's incident, who I believe claimed the high road, which helped remove Dan Rather. All that changed when the revenue sources changed.

What I personally find hypocritical is the different standard for "breaking" news versus "regularly scheduled" news. Bryan Williams was excoriated for honoring veterans and having a normal, human memory. Breaking news and special updates are blatantly suspect and misleading, feeling line "spray and pray", with minimal or no fact or source checking, and there appears to be no consequence. I believe the Rather case was egregious and the Williams case trivial.

I have a link to a study I need to find and post relating to the amount of international news viewing by country. More international news generally means more sources, purportedly meaning more viewpoints and balance.

It feels like P. T. Barnum is running much of today's media outlets. Sensationalism combined with instant gratification gets more views = more ad revenue. "Always follow the money." as told to Bob Woodward in _All The President's Men_.

Mad props for extending the analogy to make our point. Nice job!

Now I need to find language to complement someone without it sounding like OO programming style.

HN, may I please have a simple +1 or upvote button? Needs to be usable on my smallish screen too.

This alien concept (to many engineers) of beauty is a large part of makes new apps, especially web applications and SaaS startups, win or lose. Good design elements are the norm now, and expected. Gone are the days where someone would accept an ugly piece of solid software as a MVP. If it doesn't visually look as good as others in the ecosystem, your application is toast no matter how good it is otherwise.

Vi (or gvim) is too easy by comparison. Making them use emacs would be a whole different story.

Visual cohesion makes my day more productive because I spend less time mentally context switching between app philosophies.

Mental context switching is just like high CPU system time, with the same results. I/O is slower, user time processing is slower and much less gets done.

+1 here.

Ubuntu or a desktop that only uses Plasma apps may fit the bill. Plasma looks great but has a limited ecosystem. Ubuntu looks ok, but has a wider ecosystem.

What's most amusing to me is that I spend a considerable amount of time with Homebrew and others trying to make my MBP more Linux-like besides running Linux under Parallels. Getting Mac GUI binaries to run on [insert god-like desktop of your choice] would be very nice for the required closed course apps I must use. Developing for iOS (because I must) in Linux would be great. Otherwise, this feels like a step backwards.

-Mr. Fully Open Source Software

Top end macs? Based on the latest MBP offerings, I think Apple has forgotten what that is.

Unless your senior exec is carrying around his Mac Pro from his desk. That's a nice piece of hardware--without even needing USB-C and new dongles.

While I knew a few who successfully worked full time at large legal firms, I once worked full time for a smaller firm (about 60 staff). Never again. I left after 6 months and vowed to never work for a law firm again. Life is too short and there is plenty of opportunity out there for talented people.

The ironic thing is that my experience was nearly 20 years ago. While so much has changed in the last 20 years (in Internet time, that's like 400 years, and I have more RAM in my phone than the Unix server supporting 40 users on serial terminals), some things haven't, especially where humans and the legal profession are concerned.

I don't intend to paint all attorneys with the same brush--I now have good relationships with several attorneys that I use for businesses; I still would seriously question any job working for a legal firm.

As of 2016-10-21T09:20:19Z, it's doing better: -------------------------------------------------------------------- <Commodore Pet 16 Unix>:$ dig +trace github.com

; <<>> DiG 9.8.3-P1 <<>> +trace github.com ;; global options: +cmd . 17430 IN NS i.root-servers.net. . 17430 IN NS a.root-servers.net. . 17430 IN NS b.root-servers.net. . 17430 IN NS l.root-servers.net. . 17430 IN NS d.root-servers.net. . 17430 IN NS g.root-servers.net. . 17430 IN NS h.root-servers.net. . 17430 IN NS c.root-servers.net. . 17430 IN NS e.root-servers.net. . 17430 IN NS j.root-servers.net. . 17430 IN NS k.root-servers.net. . 17430 IN NS m.root-servers.net. . 17430 IN NS f.root-servers.net. ;; Received 228 bytes from 8.8.8.8#53(8.8.8.8) in 382 ms

com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. ;; Received 488 bytes from 192.228.79.201#53(192.228.79.201) in 363 ms

github.com. 172800 IN NS ns1.p16.dynect.net. github.com. 172800 IN NS ns3.p16.dynect.net. github.com. 172800 IN NS ns2.p16.dynect.net. github.com. 172800 IN NS ns4.p16.dynect.net. ;; Received 178 bytes from 192.42.93.30#53(192.42.93.30) in 134 ms

github.com. 300 IN A 192.30.253.113 github.com. 86400 IN NS ns4.p16.dynect.net. github.com. 86400 IN NS ns3.p16.dynect.net. github.com. 86400 IN NS ns1.p16.dynect.net. github.com. 86400 IN NS ns2.p16.dynect.net. ;; Received 130 bytes from 2001:500:90:1::16#53(2001:500:90:1::16) in 25 ms

I ended up sending all my developers a patch to their hosts file... Hopefully they'll roll it back shortly.

--Donald

This is a massive design flaw, not a logic error. While I applaud the use of API's for modular design and communication, this is the wrong place for it.