heartsucker
Re:Telegram founder: US intelligence tried to bribe us to weaken encry...
on Thursday June 15, 2017 @10:43AM (#14560829)
Funded by the government != The government has their hands all over it
Re:Ask HN: How can I experience SF and Silicon Valley in two weeks?
on Friday June 09, 2017 @12:06PM (#14522335)
Berlin was calling to me. There were somethings about SF I didn't like, but it wasn't so much "I moved out of SF" as "I moved in to a new city."
Re:Ask HN: How can I experience SF and Silicon Valley in two weeks?
on Friday June 09, 2017 @12:04PM (#14522328)
Philz and Skeggs are both in SV, and I was contributing what I could because OP said "SF and SV."
Re:Electric Cars Soon Will Cost Less Than Gas Cars, Research Suggests
on Wednesday May 31, 2017 @07:11AM (#14451587)
Don't let perfect be the enemy of good. Some people can't not own a car and just bike everywhere or take public transit.
Re:GitHub announcements: Marketplace, Apps and GraphQL API
on Monday May 22, 2017 @10:35AM (#14393884)
Poor documentation is a bug in itself.
Re:Air carriers are still failing people with disabilities
on Thursday May 11, 2017 @11:25AM (#14316719)
Slightly off topic, but this is hardly the biggest blunder of the airline industry. A company I worked for last year absolutely tore them apart in a talk at 33c3.
In short, information like your address or passport number is easily accessible, and while it wasn't in the talk (I think), we were able to recover plaintext credit card numbers during the research.
https://media.ccc.de/v/33c3-7964-where_in_the_world_is_carme...
Re:'Fight Inequality' Is a Poor Rallying Cry
on Friday April 21, 2017 @11:41AM (#14166534)
Because the children have no control over who their parents are, and we shouldn't punish with a lifetime of diminished opportunities because their parents aren't as "good" as others.
Re:Ghost in the Shell
on Wednesday April 05, 2017 @10:31AM (#14042313)
> A theatre in New York was showing the 1995 film, so I watched it for first time on big screen on Wednesday, then saw the live action on Friday
> Did you ... even see the '95 movie recently?
Dude...
Re:Ask HN: What are you working on?
on Tuesday April 04, 2017 @06:10AM (#14031038)
I maintain a Debian packager for nodejs [0] & two Rust libs for CSRF protection [1] [2], and contribute to SecureDrop [3].
[0] - https://github.com/heartsucker/node-deb
[1] - https://github.com/heartsucker/rust-csrf
Re:Linus' reply on Git and SHA-1 collision
on Friday February 24, 2017 @06:19AM (#13722678)
git checkout 0.1.0
git tag -v 0.1.0
Re:Awless: A Mighty CLI for AWS
on Friday February 17, 2017 @04:15AM (#13666969)
Sure, and if we imagine a hypothetical entity that has 10 products with security holes and then releases and 11th, it might be worth looking at the 11th more suspiciously. Things don't happen in a vacuum.
Re:Awless: A Mighty CLI for AWS
on Thursday February 16, 2017 @02:27PM (#13662787)
The tool phones home. Their website doesn't have HTTPS. It's plausible that the tools phones home over an unencrypted channel (I didn't look, so I could be wrong).
My overall impression is that they don't do security very well.
Re:Awless: A Mighty CLI for AWS
on Thursday February 16, 2017 @12:26PM (#13661767)
Wow, and your website isn't even HTTPS for what appears to be a security company. Get it together.
Re:Awless: A Mighty CLI for AWS
on Thursday February 16, 2017 @12:24PM (#13661742)
> We also collect a few anonymous data (CLI errors, most frequently used commands and count of resources).
Looks cool, but this is an instant no for me. Sorry guys.
Re:Signal and Giphy
on Wednesday November 02, 2016 @07:52AM (#12853773)
> you can’t compile your own client from source
According to the docs in the git repo, you can do a `./gradlew build` and there you have it.
> you can’t verify anything
They have docs on reproducible builds[0].
Anyway, I'd say Signal does have more security than WhatsApp because I trust OWS more than I trust WhatsApp/Facebook.
[0] https://github.com/WhisperSystems/Signal-Android/wiki/Reprod...
Re:We Got Phished
on Tuesday October 25, 2016 @01:52AM (#12785620)
Yes, but in theory some sort of MAC could stop it from accessing important files, or anti-virus could detect it and stop it too. But once the password leaves the computer, it's going to take a lot more effort to mitigate the damage. Also, your browser is on your side for protecting against malware, so for example if you have Flash disable, that's a whole vector you can just ignore.
Re:We Got Phished
on Monday October 24, 2016 @06:12PM (#12783376)
> What makes an attack like this so effective is that you never expect to see something as convincing as this
I've been working on phishing and counter-phishing recently, and if someone is actually putting any effort in, you have to expect something like this. Very legitimate looking email, the correct signature (complete with up to date font/logo), and a virtually perfect copy of the login page to whatever service they're using. All of this, even just to target a single person, is under 8 hours of work, which is to say, it's a simple task for someone who really wants to phish you.
The article mentions having an IDS and disaster recovery plans, and this is the best you can hope for as pretty much everyone is susceptible to this, and AI still can be beaten.
Source: I've done this, beaten Gmail's anti-scam filters, and phished CTOs.
Re:Trove of Stolen Data Is Said to Include Top-Secret U.S. Hacking Tools
on Thursday October 20, 2016 @06:07AM (#12751003)
> F.B.I. agents on the case, advised by N.S.A. technical experts, do not believe Mr. Martin is fully cooperating, the officials say. He has spoken mainly through his lawyers, James Wyda and Deborah Boardman of the federal public defender’s office in Baltimore.
It sounds like they're just mad that he didn't confess immediately, instead of doing the smart thing of having professional handle everything. Do they really expect someone to cooperate gladly when repercussions could be severe?
Re:The state of the Scala website and documentation
on Monday October 17, 2016 @03:33PM (#12728636)
Since this is all about docs, having gone from Java/Scala to Rust, I cannot emphasize enough how much better Rust is at this. With `cargo doc` I get a local set of static files for the exact version of the libraries I'm using. Why can't everything be this easy?
Re:CIA ‘Siren Servers’ can predict social uprisings 3-5 days in advance
on Saturday October 08, 2016 @07:42AM (#12666585)
It certainly worked, whether or not it worked "well" is up for debate.
Re:A Brief History of Who Ruined Burning Man
on Friday October 07, 2016 @10:48AM (#12661061)
Those seem to be legitimate complaints that seem to be "take something specialized that caters to a small crowd, then water it down so it appeals to everyone."
That said, sometimes such complaints are clearly a bit whiny, but then again, sometimes they are warranted critiques.
Re:A Brief History of Who Ruined Burning Man
on Friday October 07, 2016 @10:45AM (#12661039)
The post seemed to claim that because each small change didn't ruin it, it's not ruined. I'm saying that it's ruined to some because it's no longer the thing they fell in love with.
Re:A Brief History of Who Ruined Burning Man
on Friday October 07, 2016 @10:35AM (#12660962)
I feel like this takes the term "ruining" too literally. Yes, clearly nothing was completely ruined with each subsequent change, but the current incantation is certainly not the same as the first, and people are right to criticize the change (just as people are right to defend it). No one change might have been the death, but all together, it is very understandable that some people might call it "dead" and have moved on.
Re:Old Geek Jobs: fighting against ageism in the industry
on Thursday September 15, 2016 @04:17PM (#12509476)
Yes, because this gives them the chance to say no and pretend to walk through it slowly showing how "smart" they are.
Re:Consul 0.7
on Thursday September 15, 2016 @06:19AM (#12504728)
When we used this, we used the first directory to be the env, so it looked like.
/prod/...
/stage/...
/dev/...
/feature-xyz/...
And of course, each service per env had different access tokens so apps in the stage env couldn't read prod keys.
Re:This Is What Python Beginners Have to Deal With
on Thursday September 08, 2016 @05:57AM (#12451604)
I think the author meant packages output of pip, like this issue:
I want to install the pip package cryptography. I need to make sure Python.h is available. I need to make sure (on Debian) that lib-ffidev and lib-ssldev are available. This isn't said anywhere by pip (except Python.h, probably), and it's not the same on every system, let alone every Debian based system.
Re:Ask HN: Best way to start and master Hadoop?
on Tuesday August 30, 2016 @03:50PM (#12393296)
Replying to this again. Using Scala and Scalding or Spark makes it super simple to do algorithmic stuff. I haven't used Pregel/Giraph ever, so I can't say how it stacks up.
And OP, if you see this, using raw M/R to do things like graph processing is going to be a HUGE pain in comparison to all the libraries built around it.
Re:Ask HN: Best way to start and master Hadoop?
on Tuesday August 30, 2016 @11:07AM (#12390814)
I read the O'Reilly books on Hadoop and Hvae in 2013. That was helpful, but I still think Hive is a good place to start. If you know how a join and an aggregate work, you can see how Hadoop turns those into into M/R operations.
If you really have to learn how Hadoop works, you'll probably have to look at the source. Write the Hello World program and get it to run on AWS EMR (as others have suggested). Then clone the source to Hadoop and open it in your favorite editor. If you have to understand the nuts and bolts, the source code is the way to go. If you only have to know how to use it, then a book + online tutorial + simple project will get you up to speed within a week or two.
Re:Ask HN: Best way to start and master Hadoop?
on Tuesday August 30, 2016 @09:47AM (#12390021)
I would second this. I've used Hadoop at two jobs, and both times the added overhead in terms of operational and programming complexity wasn't worth it. Most everything could have been done on a beefy machine with the most basic knowledge of parallel programming.