News for hackers. Stuff that matters.

majelix

This article is less about specifically running 100 mile-races and more about doing something that requires self-control; and the claim is that doing so will make anyone a more successful person.
> ”Bill Gates spent thousands of hours learning to program”

Here's the full quote: "Bill Gates spent thousands of hours learning how to program computers—but he only had that opportunity because he had the good fortune of having parents who supported his education."

I think you're in violent agreement that 10,000 hours isn't sufficient.

> There is virtually zero use for this capability [running 100 mile races]

That's a major point of the article, given it's discussion of the spillover effect: "The bottom line: Practice self-control in one area of your life, and you can apply it in other parts, too."

Re:Flaws in deterministic password managers on Tuesday November 22, 2016 @03:10PM (#13017201)
> Seems like way too much work for an attacker to try to figure out.

I dunno, seems like way more work to come up with, maintain, and actually use the generator. Seems easier to just click a bunch in my vault to generate and copy, although I guess you're protected from vault-theft?

Given your example, I had already figured out all the way up to ies/otto are probably foreign numbers (more specifically, otto looks like 8 and 16 looks like double of 8) before even seeing that you just gave the answer away.

Re:How to contribute to an open source project on GitHub on Saturday November 05, 2016 @02:29PM (#12881127)
Of these, 1: Chose the project you want to contribute to (and 1.5: Choose the issue to work on) and 9: Follow up are the hard ones. Both are primarily social problems.

For 1, it's mostly about knowing yourself. What projects interest you, and where can you contribute?

For 9, it's convincing the owners that your contribution is a net positive. Start with 2: Check out how to contribute, and proactively reach out so your pull request doesn't come out of the blue.

Oh, and be willing to put your ego aside -- it can be tough to defend your work, particularly if you're a new (and thus haven't built up trust) contributor. It gets easier, both as the project learns to trust you and as you learn the work within their practices.

Re:SSL tools we wish we'd known about earlier on Wednesday July 29, 2015 @11:00AM (#9969062)
How would you go about testing your internal endpoints?
Re:Why can’t we read anymore? on Monday April 27, 2015 @03:14AM (#9444781)
> I'll have to continually go back and re-read what I feel like I've just read.

That's a feature, not a bug.

Limit your first reading to basic understanding of the plot and setting; ignore exploration of "deeper" themes until subsequent re-reads.

Spoiler alert: Your "private" network isn't.
Re:Slow is not a dirty word on Tuesday October 07, 2014 @10:54AM (#8421489)
If you're hourly, of course it's a different thing.

But if you're salaried, it's an arms race. Employees willing to work extra hours get more done (or at worst, only appear to get more done), and thus will get the rewards and promotions.

Re:Everything You Know About Fitness Is a Lie (2010) on Monday March 10, 2014 @05:49AM (#7372055)
But yet we find 3-5 hours a day for watching TV?
Re:Why not kill -9 a process? on Tuesday January 28, 2014 @10:22AM (#7137541)
It's even worse than that -- kill is just a command that sends signals to a program, some of which happen to (gracefully or not) stop the program. You can even define your own!
Re:New Year, New CEO for GitHub on Tuesday January 21, 2014 @11:01PM (#7100616)
> while the president leads the day-to-day operations.

How would you characterize the COO then?

Re:What does your ISP say about you? on Tuesday November 26, 2013 @11:08AM (#6802127)
> How does this not trigger any flags for monopoly abuse at the DoJ?

For starters, Microsoft does not have a monopoly on game consoles.

Re:Moving forward on improving HTTP's security on Wednesday November 13, 2013 @06:31AM (#6724526)
He's probably talking about client-side IDS, such as in a corporate environment.

It's worth noting that in such an environment, he likely controls the client machines themselves (ie, only corporate machines on the corporate network), so it's straightforward to just push out a trusted Certificate Authority and intercept anyways.

Re:Moving forward on improving HTTP's security on Wednesday November 13, 2013 @06:14AM (#6724471)
Snarky answer: He wants to be able to spy on his users in order to protect them from themselves.
Re:How Lavabit Melted Down on Tuesday October 08, 2013 @10:29AM (#6515176)
Why would technology be any different from anything else? The prosecution and defense are free to call on expert witnesses to explain SSL and heart surgery to the judge and jury.
Re:To-Do Lists Don't Work on Sunday September 29, 2013 @02:43PM (#6466084)
Re:Is TDD Worth It? on Saturday September 28, 2013 @09:54AM (#6461806)
> It either relies on a waterfall-like process where the full design is known before-hand and therefore what tests have to be written,

This is that fuzzy line between behavior driven development and test driven development. Sure, you may not be able to write cukes to test how that your social mortgage site is going to work, but you probably should be writing tests to ensure that your internal compound interest code is correct.

Re:Is TDD Worth It? on Saturday September 28, 2013 @09:47AM (#6461796)
Yes, if you can't solve a problem, you certainly can't solve a problem in a supportable manner.

Agile has the concept of Spikes (http://www.scaledagileframework.com/spikes/) for researching new problems. The key point that code is thrown away after completion -- this gives you the freedom to ignore normal methodologies and not have to worry about technical debt.

Presumably, you then go back with this new knowledge and only now concern yourself with writing supportable code.

Re:FastMail staff purchase the business from Opera on Thursday September 26, 2013 @11:55AM (#6451597)
> However, I've used Royal Mail (postal service in UK) all my life without thinking that I needed to worry about what I said

This is true for the United States Postal Service as well. I've always thought it'd be interesting to look at what historically brought about the strong privacy expectations to postal mail when it's technically so easy to intercept.

Re:FastMail staff purchase the business from Opera on Thursday September 26, 2013 @11:50AM (#6451548)
> At the scale the US is doing it? Absolutely.

This sounds more like ability rather than choice. It seems odd to demonize the U.S. because practically all Internet data flows through their territories.

> So just stop, stop making excuses for the US or the NSA

I'm not making excuses, and of course it's a Bad Thing. But don't pretend that avoiding one actor is really a solution, any more than rebooting your computer is going to solve deeper issues.

Re:FastMail staff purchase the business from Opera on Thursday September 26, 2013 @08:25AM (#6450227)
> Er, no - the USA are the main ones wholesale intercepting everyone's shit

Why do you think this is? Do you really believe these efforts are not being taken by every major world covert agency?

Re:Switch to HTTPS Now, For Free on Thursday September 26, 2013 @08:06AM (#6450136)
> You're really just wasting your time with a "business validated" certificate. The browser doesn't treat it any differently

If your vendor doesn't do a decent job verifying who you are (and this may or may not mean EV), then browsers won't treat the certificate any differently when it's entirely replaced by someone else either.

Re:Switch to HTTPS Now, For Free on Thursday September 26, 2013 @08:03AM (#6450123)
> The CA system is totally flawed anyway

The flaw basically being that people aren't trustworthy, yes?

Do you have any alternatives? There's ssh's model, where you just hope it's the right certificate the first time; or maybe mob-source it like WoT?

Re:Switch to HTTPS Now, For Free on Thursday September 26, 2013 @08:01AM (#6450119)
> Business validation is optional and doesn't enhance the transport-layer security benefits of using SSL.

Except that SSL isn't just about transport-layer security, it's also about identity. The entire model of SSL breaks down if anyone can buy a certificate for anything.

Re:Switch to HTTPS Now, For Free on Thursday September 26, 2013 @07:55AM (#6450099)
> It really does not add anything to the equation. Just extra costs and work for you.

Of course it adds something: It makes it more difficult for someone else to go buy a SSL certificate in your name. Security isn't just about driving sales, it's also about protecting yourself and your customers.

Re:FBI Admits It Controlled Tor Servers Behind Mass Malware Attack on Saturday September 14, 2013 @08:10AM (#6385335)
Here's a list of them that use Verisign's VIP: https://idprotect.vip.symantec.com/wheretouse.v

Others may use in-house solutions. Here's Bank of America's two factor solution: https://www.bankofamerica.com/privacy/faq/safepass-faq.go

We're almost to a point where the question isn't whether or not they support it, it's finding out that they have a program, clicking through tiny text links at the bottom of pages, and figuring out how yet-another-implementation works.

Re:Judge sentences Bradley Manning to 35 years on Wednesday August 21, 2013 @11:15AM (#6250885)
> So, once you put on that uniform you have to keep your mouth shut even if you witness the worst atrocities imaginable.

Absolutely not. But you don't have to shout every secret you have access to (relevant or not) from the loudest possible podium either.

Re:Judge sentences Bradley Manning to 35 years on Wednesday August 21, 2013 @11:05AM (#6250816)
> If they show child abuse, they must break the confidentiality and call the police.

The key point here is that they call the police, not blindly dump thousands of private documents onto the internet.

Re:Kids can't use computers, and why it should worry you on Friday August 09, 2013 @04:11PM (#6188141)
> The difference here is that we're willing to pay those vehicular technicians a realistic amount of money for their expertise,

Looks like computer technicians get paid plenty well. According to at least one random google search, entry level SysAdmins make nearly $20k more than entry level auto mechanics.

Anecdotally, I don't know a single person in the IT field who isn't flooded with recruiter-spam. Meanwhile, the economy and unemployment rate remain huge political and news topics.

Sources: - http://www1.salary.com/Automotive-Mechanic-I-salary.html - http://swz.salary.com/SalaryWizard/Systems-Administrator-I-S...

Older »