elliotz

> That's why we ask the question about 3 people in broadly different areas. Frankly, if you don't recognize at least one of those names and understand the foundational contributions they made, then yeah I'd call that a kind of incurious.

Well that's a lot more reasonable! Your original comment left no ambiguity that candidates insufficiently knowledgeable about Tanenbaum would be shunted over to devops.

> As to devops, you may think whatever you want. I give them shit about the "all the worlds Linux" attitude, they give me shit about "fucking research projects" (e.g. anything that isn't Linux). We understand our respective views, and it works.

That could be the basis of some good-natured ribbing, which would be OK. What's not OK for a healthy company culture is the suggestion that devops people are inherently incurious, and the strong whiff of intellectual elitism which came across in your original comment.

> If all they can come up with is "Minix" and "that pissing contest with Linus", then I might see if the Linux devops guys have an opening. If they're that incurious, they'll do fine there; those guys think the world begins and ends with Linux, too.

Do you actually believe that someone is incurious simply because they don't share your own interest in Tanenbaum? Perhaps they've focused their curiosity on one of the many other luminaries in CS, or perhaps they're more interested in the topics themselves than the personalities behind them.

Your contempt for your own devops team is also disquieting. Based on your comment your company sounds like a toxic place to work.

> Since the article doesn't really endorse XTS in any context, I'm not sure your proposed title is accurate.

But it's also not saying that you shouldn't use XTS for full disk encryption. In fact it seems to say it's probably OK for full disk encryption: "It’s certainly better than ECB, CBC, and CTR for FDE. For the crappy job we ask it to do, XTS is probably up to the task."

> I didn't write the article for the front page of HN. I wrote it so that the next time someone says "we're going to switch from CBC to something more advanced like XTS", I can point them at the article instead of writing a long comment.

Understood. Unfortunately it's on the front page of HN now and I think it (the HN article) needs a better title considering the audience.

I agree. Although the article content is good and reaches a good, nuanced conclusion, the title is going to confuse people. Many people will only ever encounter XTS when setting up full disk encryption with dm-crypt, where they'll be presented with the choice between XTS and CBC-ESSIV. This is already a confusing choice with no good context to help a user make a decision. Remembering this headline, I bet some people are going to pick CBC-ESSIV over XTS, which is wrong.

The title is also somewhat link-baity, since I clicked expecting bombshell revelations about XTS. I suggest the mods to change it to "You don't want XTS (except for full disk encryption)."

The public standard shouldn't include the secret values, but rather identify the (verifiable) process for generating the public values, in order to assure people that they were not created from secret values.

See: https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number

(Or, of course, you could just not publish RNG standards based on public-key crypto ;-)

It's a great policy. Stripe was doing this 2 years ago: http://blog.alexmaccaw.com/stripes-culture Anyone know if they still do it, even after growing?

With emphasis on experienced - Levison was represented for a bit by a business attorney. He may have passed the bar, but he was completely inexperienced in federal criminal cases.

Even law enforcement characters were upright:

http://www.youtube.com/watch?v=0wL9Li0f1Po

Except that the Linux ISO is not called "Firefox." It would be OK for the Linux distribution to use the Firefox trademark descriptively to say that it includes Firefox, but that's not what these adware vendors are doing. They're calling their "Firefox bundled with some adware" Firefox.

> Keurig is free to do what they want, just as a consumer is free to choose whichever coffee maker they want.

The issue isn't whether Keurig should be free to add DRM to their product or not. The issue is whether they should be able to use the law to prevent competitors from circumventing that DRM. Printer manufacturers tried a similar stunt with adding DRM to printer cartridges and suing the makers of after-market cartridges for DMCA violations.

I wonder why Mozilla doesn't go after these sites for trademark infringement. Mozilla made Debian change the name of their Firefox package to Iceweasel because they made modifications; surely bundling in adware also violates Mozilla's trademark policy?

Robert Graham (ErrataRob) pointed out some problems with this study: http://blog.erratasec.com/2014/02/that-trollers-are-sadists-...