wesleyac

Hey! I'm the person who made this — I don't believe there's an actual problem here, since login cookies are set on the top-level domain (and thus are inaccessible to content on subdomains), and are HTTPOnly as well.

I do notice that Stripe sets a tracking cookie (which only happens for people who pay for the service, since I don't load the Stripe JS elsewhere), so you could track pageviews with that or something. That's unfortunate — I'll probably try to move the stripe stuff to a subdomain to avoid it — but I don't see it as a big problem.

The HTTP security model is pretty awful, so there may be something I'm missing, but I did think quite carefully about this, and allowing people to use arbitrary HTML and JS was an intentional choice.

Is there a particular threat model you see here?

Just FYI - in many interviews, you can just say "Sorry, I'm having a panic attack. Could we do this tomorrow?". One of my friends had a panic attack during her Google interview, left came back the next day, and got the job.

So, YMMV, but people are often able to be accommodating for things like this :)

The original pens are, AFAICT, somewhat hard to come by, but we modded the pen carousel and have a 3d printed holder to put more modern pens in. With this mod, the TCO doesn't seem to high, although I didn't initially purchase/set it up, and I haven't had to do serious maintenance yet.

Not mentioned in the post, but I worked with Dan on this and I'm pretty sure he's talking about the iPad pro.

Just looked at the website, and had a very "small world" feeling:

They're located in my town O.o

Wearing bright lights next to your face with the intent of quickly flashing them in the darkness seems like a Bad Idea.

Just sayin'

Whenever people talk about new tlds, I always think mostly about names like google.con or googl.ecom. Yeah, yeah, it's cool that you can get some awesome tld, but I don't see the point. What's wrong with .com/org/net?

Upvoted just to see "And" at the top of HN :P

https://news.ycombinator.com/item?id=7405846

Currently, the "loophole" in 2FA is that almost no one enables it. Although it's great that Google offers it, it doesn't help when >95% (Just a guess off the top of my head, but seems reasonable) of people don't enable it.

I only know one person who uses 2FA, besides myself, yet almost everyone that I know uses GMail.

> Oh, you're hosting it from your home DSL line? Bandwidth is the problem. Maybe you should save everything into a Dropbox public folder and link it here.

Here you are. https://dl.dropboxusercontent.com/u/92312532/Google%20and%20...

Thanks for letting me know. Just installed A cache plugin for WP, so hopfuly it'll be working again soon.

Strange though, I only see the load at 0.75.

It's not that I am concerned about my security, as I use text message verification to recover my password. My issue with this it that people who don't give their phone number to google can be effected by this.

EDIT: Just set up 2 factor auth. Looks cool, until my phone dies and I don't have the backup codes with me.

That is true, but all of the things in that post are still true. All of the password recovery steps will work, no matter how the backend is done.

Aww, I was expecting a game of tetris in CSS.

But awesome all the same

Awesome idea. Combine with Stylish (A firefox extension) to make it even better.

Arch is the OS I use for everything, including Web Development, in the rare occasions that I do webdev.

Off the top of my head:

Make a 3d website.

Make a game (Easier then it sounds)

Make a scripting language that compiles to WebGL.

Good luck!

An old article, but good all the same.

I just started using noprocrast, and it's awesome.

If you haven't used it, start!

Yes, but that requires meeting in person. If you want to go that far, just use PGP + OCR + Air Gap.

Much simpler.