jwarkentin

Being aware of exploits and protecting against them comes with the territory. Luckily there are things like owasp.org to help developers keep up on web security. However, security is hard and it can't be done absent mindedly. There is no getting around that.

"If this was such a beneficial mutation, why isn’t it more common?"

Based on natural selection it would only necessarily be more common if it affected reproduction. It may begin to affect reproduction now that people are sleeping less and those that don't cope well (like those that don't have the gene) may die before they reproduce; but until recently when sleep deprivation has become a larger issue, I doubt it ever affected reproduction enough for natural selection to do its job.

I don't know the history but if that were the case then the non-compete should be between the owner and buyer, not employer and employee. It makes no sense to go after the employees to prevent former owner competition.

Haha, indeed. Who would ever have thought to put a picture on a white background? Gotta protect that IP!

You're correct about the forward secrecy. That's what I get for commenting at 2am. I was thinking about TLS where there can be a frequently rotating asymmetric key pair. The symmetric key in TLS isn't used for PFS, only for performance. In practice those keys don't actually get rotated almost ever though.

If you're not bothering with the HTTP protocol then you don't even need a certificate at all. You just need to have something like SSH's 'known_hosts' file. All you need to know when initiating communication over a secure channel is that the key the server sent you is in fact the key for the server. In fact, if you're including something with the app, just include the servers public key directly. Forget the whole key exchange process. Then use the server's public key to send a symmetric key generated by the app itself (sort of like TLS does) for the duration of the connection. This provides forward secrecy as well. Simple. Elegant. Secure.

The only catch is that if you change the server's key it will break all clients. However, you could always hard code a second public key that isn't even contained on your servers that is used as a fallback for catastrophic incidents where your private key gets exposed. Once you fix your security hole you swap out your key to your fallback and clients are secure again.

> mixing of HTTP/HTTPS content

This is ALWAYS a bad idea. A few points:

- The only purpose of HTTPS and encrypting communications in general is to prevent MITM attacks.

- If your server is even willing to serve unencrypted requests it exposes your users to sslstrip attacks (http://www.thoughtcrime.org/software/sslstrip/). In reality you still should serve HTTP requests but only to force a redirect to HTTPS. In addition you should use the 'Strict-Transport-Security' header. It's the ONLY way to prevent future sslstrip attacks.

- Even worse, if you don't set the 'secure' flag on session cookies at a minimum (thus forcing logged in users to HTTPS only) you expose your users to session hijacking without even putting up a fight.

- If you aren't going to bother with forcing HTTPS all the time then there's not much point as you've opened up your users to simple sslstrip attacks followed by session hijacking or even worse, script injection or redirects.

One fundamental concept many people seem to forget as well is that the dangers of not encrypting communications extends beyond snooping. Attackers can actually modify the data stream to inject and/or replace content or even redirect users entirely.

Also, even if you only serve secure content yourself but you include insecure content on your page it exposes security vulnerabilities. Let's say you include unencrypted images on your site and you have users that are using a client with an image rendering engine vulnerability that allows remote code execution (this has happened in about every browser). All a MITM has to do is replace the requested image with different content that exploits the vulnerability. Now imagine if you included unencrypted JavaScript that actually does execute on your site (like from a CDN). The possibilities are endless.

It's not necessarily "advanced", but it is unexpected behavior I think. I've run into this same sort of issue myself. It didn't take ages to figure out, but it was annoying. It's one of those things that separates an experienced JavaScript dev from the rest.

I never stated whether I believe in a creator being or not, nor will I since it is not relevant to this conversation. The belief that a creator is orchestrating things is what's known in science as a theory. The point I was making is that neither theory is mutually exclusive. It does not follow that if one is true, then the other is not.

Also, if you are indeed scientifically minded then you must be open minded to all theories that explain the state of things unless there is sufficient evidence to the contrary. It is not enough to say that there isn't sufficient evidence. Remember, the absence of evidence is not the evidence of absence. To rule out a theory that could explain our observations without evidence is not scientifically minded at all.

To have a productive conversation, if you believe that the two theories are mutually exclusive then please explain what about one of them being true, means the other cannot be. If you don't believe they are mutually exclusive then my original point stands that the statement by 'spiritplumber' is a non sequitur.

See, this is what bothers me. Too many people seem to think that there is a conflict between evolution and creationism. The thing is, both can in fact be true. Who's to say that there isn't a creator orchestrating processes? Such a being wouldn't work by magic, but by a profound understanding of natural processes. How would this be any different from us discovering how life was created and then using that understanding to create it ourselves? The whole back and forth over evolution between religious and non-religious folk is ridiculous. Neither side will ever get anywhere because the whole premise of the debate is a non sequitur.

So if I believe I have the right to drive really fast and I think the laws need to be changed; but you believe I shouldn't have the right to go fast, does that mean that you believe I'm a second class citizen for believing I shouldn't have a right that I believe I should? Seems a bit like a logical fallacy and a strawman. Regardless of where you or anyone stands, let's at least frame the debate right. No one thinks that LGBT people are second-class citizens. To frame the debate like that is an appeal to emotion (also a logical fallacy) and ultimately fruitless, as it avoids the real debate.

Given your analogy, it seems to me that if one wants to work for a start-up it would be wise to vet the CEO as much as they should vet any engineer. Naturally, not all CEO's are created equally and not all of them are bound to succeed. However, if one can determine which CEO's are good at problem solving and making good architecture decisions (maybe based on existing business design patterns?), then it is possible to at least narrow down which ones are likely to be more successful, and thus leave you less frustrated.

It seems that OP thinks the asynchronous nature of JavaScript was meant as a performance optimization. Let's go back to its origins. It was originally a scripting language for the browser. If it were to be synchronous and/or allow blocking things, such as `sleep()` or whatever else, it would have created an unusable web experience. Web pages would be constantly locking up. It's only recently that it's moved to the server where the asynchronicity on I/O isn't so mandatory.

I personally still think it's a good thing, but that could definitely be debated on the server side. Unfortunately, if you want to have the advantage of writing one code base that can run on the browser or server, then it must work the same in both places.

A better solution might be to throttle multiple requests to the same domain. Also, they could prevent it from fetching the same content multiple times and use a cache instead based on ETAGs and file information.

I never got that. He wrote a great article about the issue and then ended with using UCS-2. I always wondered if there was something I missed that made him choose UCS-2 over UTF-8, since UTF-8 can represent every Unicode code point.

If your problem is the same as mine then I think I can help. I find that I often struggle to focus and be productive as well - even to the point of zero productivity. There are four things that I do that help a lot:

1) Eliminate distractions. I don't know if it's ADHD or what but I'm very easily distracted. As much as I love programming, I often find that reading HN or checking my email, browsing Amazon or any number of other things seem more interesting. It's often even just doing things I need to get done, but at a time when I should be focusing on writing code.

For me the solution is to push all my browser windows to another desktop, open only the one I need for testing/research and absolutely ban myself from doing anything else for a period of time.

2) Manage expectations. The other problem I have is that my mind doesn't like to switch focus very easily. I may have been really laser focused on a problem for a while, but then after I finish or something else comes up and it's time to focus on a new problem, my brain rebels and refuses to change focus.

The solution for me has been to manage my expectations, in a sense. I have to close my eyes and clear my mind of everything and just relax for 5 minutes, with the expectation that after that I'm going to open my eyes and focus on the new task. It helps calm my mind and since I'm now expecting to focus on the new task in 5 minutes, but I'm not forcing it immediately, my mind warms up to the idea of doing it in a bit.

3) Have a plan. I've found that when I'm faced with a difficult and vague task my brain wants to avoid focusing just because it seems hard or something.

For this I've found that if I first pause and plan out exactly where I'm going to jump in, exactly what I'm going to do to try and tackle the problem, then it's easier to focus on it. Maybe that means I'm going to sit down with a white-board and draw out the system architecture to tackle a problem or whatever else.

4) Sleep and caffeine. I've found that when I'm too tired, I really just can't focus. Often just taking a 20 minute nap (keep it to 20 minutes, set an alarm) makes a world of difference. Also, I've found that getting some caffeine helps me focus a lot. Of course, it might not be as effective if you use it all the time.

That depends on how you measure success. Those "failures" added up to your successes today. So back then you must have successfully learned something...

Regardless of how "proper" your memory is at age 5, you can still learn things and figure things out. You get better at it with practice.

It's also a well studied fact that younger minds are more impressionable and have great neuroplasticity. People who start something early in life are often much better at things, and not just because of the length of time they've been doing it. It becomes second nature. It fundamentally affects the way they learn to think.

Yes, there are plenty of great programmers and engineers who didn't start so young. Personally though, I started at the age of 9, and it's set me so much ahead of my peers. Don't underestimate the abilities of the young or the value of exploration and learning while young.

3) There's a group of people who aren't lawyers, don't give a crap and just want to enjoy life without arguing over the technicalities and legalities of everything, especially things that can't provably affect the profits of Paramount. They likely didn't give the legality much consideration.

Since I can't reply to your last two comments (too deeply nested I guess), I'll comment here.

I agree that right now it's not going to happen, no matter how many different efforts there are out there. For it to really happen I think we would have to come up with a plan that would actually work, in terms of creating a massive world-wide mesh network. There would have to be a lot of consideration for things like security, DDoS mitigation, speed, standards and upgradeability.

If developing a viable mesh network for the task weren't tough enough, there would also have to be a plan for migration which is really the hard part. Getting everybody in the world moved over to a new network would be nothing short of a miracle.

I don't think it's fair to say that as a generality. The stability and latency of the network very much depends on the routing protocol used as well as the strength of the connection between the nodes (assuming it's a wireless mesh). There are many routing protocols that are more robust. Some protocols are tolerant of devices moving, some are not. Some are self-healing, some are not. Some have to map out the full route to a device before sending data, some are only aware of the next hop.

There are a lot of options, each with their advantages in different situations. It's not so clear cut. It can be fast or it can be slow. It can be stable or not. It very much depends on the particular network protocol and setup.

Did you know that cell phone networks today are mesh networks? There is a huge amount of work going into mesh network development, though admittedly, there's still a long way to go.

Also, did you see this (one of many interesting efforts): http://openlibernet.org/faq.html

All that said, even if we just had a functioning alternative (even if it were significantly slower), it would give us options when we need uncensored, unregulated communication. It's better than having absolutely no options when your government oversteps its bounds.

A mesh network is a distributed network that removes the concept of having a single point of access as we do now.

http://en.wikipedia.org/wiki/Mesh_networking

http://en.wikipedia.org/wiki/Wireless_mesh_network

That only works in places where a free market exists. In the case of ISPs there are generally very limited options and no room for new competitors. That being the case, we don't have much of a free market or opportunity for proper capitalism to govern the entities involved. In situations such as that, unfortunately, we need a governing entity to set some ground rules to protect the consumers.

Or we can replace the internet with a mesh net and solve the problem of regulation, centralized control and ISPs altogether :)

As long as it's targeted to sites I might be interested in, I don't mind. Everyone needs revenue and I'll happily support the attempts that aren't evil. Advertising isn't going to ever end. I prefer relevant, non-invasive advertising. This seems pretty non-invasive.