bqe

I remember being asked this during my interview at Google. It was the first time I heard it and I gave an answer that iterated over the list twice. The interviewer said that it wasn't good enough and I am only allowed to iterate over it once. He didn't let me write my O(2n) solution down so he returned a strong no as feedback.

Why this is interesting: a major defense against mass account takeovers (ATOs) at large scale companies has been fingerprinting browsers. You as a normal user see this most when you use something like reCaptcha, but it's actually happening on nearly every login flow for major websites. By blocking automation like evilginx, you stop a lot of phishing and credential stuffing attacks against your users.

Using VNC here is super clever. This means that the "automation" part of the phishing attack is actually a browser just like the user is using, so you can't fingerprint it. In fact, the victim is really typing in their password into a real Google login page, but the attacker is logging everything through VNC. It's going to be very hard for Google (or anyone else) to detect this.

The solution to this (like all phishing attacks), is still WebAuthn. However, many of us in security were hoping we could get by with bandaids like fingerprinting until WebAuthn was more widespread.

I haven't tried it yet, but if it does what you say it does, I honestly think you underpriced this.

Awhile ago I wrote a Python library called LiveStats[1] that computed any percentile for any amount of data using a fixed amount of memory per percentile. It uses an algorithm I found in an old paper[2] called P^2. It uses a polynomial to find good approximations.

The reason I made this was an old Amazon interview question. The question was basically, "Find the median of a huge data set without sorting it," and the "correct" answer was to have a fixed size sorted buffer and randomly evict items from it and then use the median of the buffer. However, a candidate I was interviewing had a really brilliant insight: if we estimate the median and move it a small amount for each new data point, it would be pretty close. I ended up doing some research on this and found P^2, which is a more sophisticated version of that insight.

[1]: https://github.com/cxxr/LiveStats

[2]: https://www.cs.wustl.edu/~jain/papers/ftp/psqr.pdf

I think the simplest solution to this would be to simply hide comment/retweet/like counts. It will be possible to sort of figure this out from the engagement, but it won't be easy to figure out if a tweet is popular or wildly popular.

Spiritless Kentucky 74: https://spiritless.com/products/kentucky-74

It's pretty good!

That website is not a quality source of information. Media Bias/Fact Check rates it as questionable, low quality, and far to the right: https://mediabiasfactcheck.com/here-is-the-evidence/

> They pay for expensive ($$$$$$) cloud anti-bot/anti-scraping, captcha you after a few requests if you run adblock, they pay for extensive browser/device (attempting to reidentify a user across multiple devices/multiple browsers) fingerprinting services and Fastly.

This sounds like a great anti-account takeover program. I imagine with all of the various compliance programs they have to deal with and the legal risk, these are prudent measures.

The parent commenter was discussing revenue and not profit. If they were aggressively expanding, I would expect that profits to remain small or negative, but I'd expect revenue to grow as a result.

It's important to know the limits of your knowledge and reasoning capabilities and defer to relevant experts, which is known as epistemic learned helplessness[1]. This is also much faster, as a lot of bullshit sounds like truth if you're unfamiliar with the field.

[1]: https://web.archive.org/web/20180416171148/http://squid314.l...

Yes! https://github.com/signalapp/Signal-Server

NIST 800-63b actually recommends against character class requirements[1] in favor of minimum length requirement and blacklists of breached passwords and other obvious passwords. Sites that require special characters are not following the current best practice.

[1]: https://pages.nist.gov/800-63-3/sp800-63b.html

The thing is running a marathon isn't that hard and there's little to no luck involved. By following a rigid plan most people can do it in about a year. Millions of people do it every year.

However if you followed all of Sam's advice to the letter you could remain relatively unsuccessful despite all that advice. That's what survivorship bias is about: there's a significant luck component to success.

This phenomenon is called cost disease and it's really hard to figure out why exactly it's happening.

https://slatestarcodex.com/2017/02/09/considerations-on-cost...

I think you underestimate how many people blindly copy examples without understanding them. Safe example code results in more correct programs.

Websites that want to prevent automated bots from attacking them benefit immensely.

A good SIEM can search terabytes of logs quickly and aggregate interesting things like least common values. Good luck doing that with grep.

Whenever free will comes up I like to bring up Conway's Free Will Theorem[1].

If you define free will as future choices cannot be predicted based on history, then it turns out that if humans have free will, so do elementary particles. To me, this doesn't mean we don't have free will, but instead the linear, deterministic model that's often used to discount free will is just not how the universe works.

Note that this result does not depend on statistical randomness like some of quantum mechanics, but just three simple axioms. I highly recommend reading the full paper, especially the end, "Free Will Versus Determinism".

[1]: http://www.ams.org/notices/200902/rtx090200226p.pdf

MarkMonitor is what Facebook, Google, Apple, Microsoft and other huge companies use. They don't take small accounts, though.

Don't let it discourage you. It was a really cool finding. I've done everything right before when it comes to disclosing bugs, and I've still had people dumping on me.

You should consider security as a second career if you ever get bored with marketing.

This is valid C and C++.

Backslashes are valid characters in a POSIX filesystem, but they don't indicate a directory.

> Again, this is an entirely subjective form of criticism. I haven't had any issues with keeping my virtualenvs up to date.

What tools do you use keep all of your virtualenvs up to date?

Rents in Seattle have stayed relatively constant over the past several years despite adding tens of thousands of residents because many new apartment buildings have been built.

However, home prices (including condos) have risen drastically because of the limited supply. There's no new space for single family homes, and because of a Washington law which increases liability for developers, few new condominium buildings are built.