News for hackers. Stuff that matters.

Gasparila

Gasparila on Hacker News

Re:Amazon knew seller data was used to boost company sales on Monday May 03, 2021 @10:54AM (#27025819)
Thought exercise because I legitimately struggle with this. Is this fundamentally different than Costco using sales data to choose which Kirkland products to launch/sell? If so, how? If not, then why do we not pursue Costco with the same gusto as Amazon? To me this behavior by Amazon seems worse, but I can't figure out why.
Re:Scaling Etsy on Sunday December 22, 2019 @11:47AM (#21858158)
The author has a long-form blog going into much of a similar topic: http://boringtechnology.club/. Very nice read
Re:JIT and Ruby's MJIT on Saturday December 07, 2019 @12:11AM (#21728607)
Matz (Ruby lead maintainer/original author) has said that Ruby 2.7 (coming out this Christmas) has JIT improments that make JIT neutral for Rails. The goal is to have it be net positive by Ruby 3.0 (Christmas 2020)
Re:Stripe to move to South San Francisco on Thursday October 24, 2019 @01:44AM (#21341951)
The law has you pay taxes of 1% of gross revenue * percentage of global employees working in an SF office. Even if the headquarters moved (and I'd guess it is already a Delaware registered company legally), they'd still have to pay.
Re:ORMs Are Backwards on Wednesday September 04, 2019 @01:31AM (#20874276)
There's a .size that works for pretty much everything: if the relation isn't loaded then it will do select count(*), but for arrays and loaded associations it does length of an array
Re:Amazon S3 will no longer support path-style API requests on Friday May 03, 2019 @06:13PM (#19822740)
One big reason to me: cookie security

Currently all buckets share a domain and therefore share cookies. I've seen attacks (search for cookie bomb + fallback manifest) that leverage shared cookies to allow an attacker to exfiltrate data from other buckets

Re:United Airlines’ so-called online security (2016) on Monday March 04, 2019 @04:50AM (#19300034)
I had one experience reporting a security vulnerability to United's bug bounty program and never want to do it again. I reported an issue to that I could reset anybody's MileagePlus number by only guessing a multiple choice security question ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android update that patched the issue. I was then told "It turns out this fix was pushed by the QA team and was actually unrelated to your Bug Bounty submission" and that my submission was ineligible. At least they have a program I guess?
Re:How long will a 64 bit Transaction-ID last in PostgreSQL? on Tuesday February 05, 2019 @01:26AM (#19083385)
Back of the envelope math for birthday paradox is root n. So in this case with ~50% probability you'll get a collision after 2^32 IDs (or after 4 seconds of 1 billion writes a second)
Re:Life as a bug bounty hunter on Thursday August 23, 2018 @03:42PM (#17830091)
I had one experience reporting a security vulnerability to a bug bounty program and never want to do it again. I reported an issue to United Airlines that I could reset anybody's MileagePlus number by only guessing their Security Questions ("what is your favorite sport", etc), bypassing any email confirmation or anything like that. After 3 months of back and forth with their security team, they released an Android update that patched the issue. I was then told "It turns out this fix was pushed by the QA team and was actually unrelated to your Bug Bounty submission" and that my submission was ineligible.

Your mileage may vary, but the headache for me is not worth the payout

Re:DoorDash raises $535M, now valued at $1.4B on Thursday March 01, 2018 @10:45AM (#16492843)
Wow that's a lot of dilution for a late stage round. I feel bad for the employees that suddenly have their equity cut by 60%. If I'm doing my math right, ($865 MM pre-money) then it means even with the higher valuation preferred price goes down
Re:I'm giving up on HPKP on Thursday August 24, 2017 @10:54AM (#15090563)
This article (and others I have read disliking HPKP) generally take an all or nothing approach. That is to say, they see HPKP as either "pin the key of my certificate" or "don't use HPKP at all"

In reality, you can have a valid HPKP setup as long as any keys in your certificate chain match the key in the HPKP header. This means that you can pin the intermediate certificate (or even the root CA if you want) key. By doing so, you are no longer vulnerable to losing your SSL keys, but now other CAs cannot issue certificates for your site

Re:Comma Separated Vulnerabilities on Monday June 05, 2017 @10:44PM (#14494309)
They still exist and (as far as I know) there are no plans to do anything about them. We (thankfully) were alerted to this issue by HackerOne before it was an issue, but this remains an absurdly easy attack vector...
Re:Reed-Solomon coder computing one million ECC blocks at 1 GB/s on Monday May 08, 2017 @10:41AM (#14291875)
https://suclass.stanford.edu/courses/course-v1:Engineering+C...

Free videos/slides for Stanford's introductory networking class (linked the Reed-Solomon video)

Re:Bitcoin block reward is halving in less than 2 hours on Saturday July 09, 2016 @12:48PM (#12062134)
Each bitcoin can be theoretically split into 100 million Satoshis (the bitcoin equivalent of a penny I guess). The maximum number of bitcoin that can exist given the current system 21 million. Those multiplied together seem to me sufficient for any economy (about 12x the total amount of US currency in circulation if you count a satoshi as a penny), but someone who knows more about economics would have to chime in for sure