Hacker News Reader

Comment by rmrfstar | Hacker News Reader

The diffusion of technical expertise is an unalloyed good, but the article does not spend enough time exploring the interaction between dispersed expertise and concentrated market power.

There are two very problematic phenomena: (1) plagiarism, and (2) quasi-legal corporate espionage.

In (1) large companies just rip off FOSS code and call it a trade secret, as Goldman seems to have done. [1]

In (2) companies that operate information infrastructure use it to surveill and preempt dispersed talent (as Amazon is alleged to have done with its market data, and Facebook is alleged to have done with its VPN app) [2].

The net effect of all this is suboptimal investment in new tools, techniques, procedures, and business models. You can't invest if you can't profit. A clear market failure demanding public intervention.

[1] https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...

[2] https://www.bbc.co.uk/news/technology-47281906

View on HN

Interesting point. Capital (still) trumps knowledge. There is a pop meme that tries to sell "information as the new oil", but your post reminds us that the 'value' of information is akin to 'weight' of a 'mass'. The gravitational field in question is centralized power, market or otherwise.

[personal meta-aside: Did you know that JFK gave that speech to persuade American press to self-censor? That pull quote has been misused rather egregiously.]

Don't they usually mean data when they say information? And data is hardly freely available.

I don’t know.

Frankly it’s a bit of semantic muddle in my own head. For example, is my browsing history “data” or “information”? So for my own personal dictionary, “data” means basically ‘measure’, and “information” is ‘processed data’.

Thomas Jefferson drafted the US Declaration of Independence, and was a particularly violent "slave owner" [1]. While context is important, it doesn't mean that a document with an unsavory origin story should be ignored for that reason alone.

[1] scare quotes indicate that I reject the assertion that anyone was ever "owned" by anyone else. Some people were violently imprisoned against their will, but never owned.

No issue with the content, just a meta fyi/?.

I had not heard that Thomas Jefferson was particularly violent in his slave holding vs other slave holders. A quick google search isn't informative either, do you have any source for that claim?

Henry Wiencek wrote a book about it. That particular work received intense criticism from other respected Jefferson scholars. It's a debate worth reading.

I don't think it is just the authors of the US Declaration of Independence who were unsavoury, but also some of the things in the text itself. The most well-known aspect of its unpleasantness is the part about "merciless Indian Savages"; less well-known is its opposition to cultural rights for French Canadians ("For abolishing the free System of English Laws in a neighbouring Province...")

When Britain conquered New France, Britain promised that French Canadians would retain cultural rights, including the freedom to practice the Catholic religion, protection of the French language, and the continued use of aspects of French civil law in the legal system. It is that last aspect of Britain's commitment which the authors of the US Declaration of Independence found so offensive.

(Strangely, when the US agreed to buy Louisiana from France 27 years later, the American objection to the French legal system appeared to have vanished, and Louisiana still partially uses French civil law to this day.)

> https://www.vanityfair.com/news/2013/09/michael-lewis-goldma...

Great article. One part that confused me was how he said he deleted his bash history because he didn't want people to see the password he typed in.

Surely that's a crock of BS? In what situation do bash histories contain typed passwords in plaintext?

It could be:

1) a journalist failing to capture the precise technical details

2) or this guy used commands that passed the password as an argument (for example "curl -u username:password" maybe svn has something similar?)

> 2) or this guy used commands that passed the password as an argument (for example "curl -u username:password" maybe svn has something similar?)

Other commands that take password arguments include ldapsearch/ldapmodify/etc (-w argument), mysql (-p/--password option), and Oracle sqlplus (sqlplus user/password@db)

Best practice is that you don't put passwords in command line arguments, and find an alternative method of supplying the password to the utility (such as reading it from a password file, or using non-password-based authentication mechanisms such as Kerberos). Despite that best practice, I'm sure plenty of people still do it.

People also sometimes accidentally paste passwords from a password manager into their shell and they end up in their shell history. This can easily happen if you are meaning to paste it into some kind of interactive command such as ssh or su and the command doesn't execute the way you expected.

If you discover you have passwords in your bash history, editing it to remove them (or even deleting it entirely) is a sensible thing to do.

Shell history was never meant to be an auditing measure. There are products out there that will record SSH sessions (by acting as a recording proxy between the client and the server); if you need a list of commands executed for auditing purposes, those sort of products are the proper answer, not expecting people's shell history to be left intact.

> People also sometimes accidentally paste passwords from a password manager into their shell and they end up in their shell history. This can easily happen if you are meaning to paste it into some kind of interactive command such as ssh or su and the command doesn't execute the way you expected.

That doesn't seem to be case from the article:

> The entire process took about eight seconds. And then he did what he had always done since he first started programming computers: he deleted his bash history. To access the computer he was required to type his password. If he didn’t delete his bash history, his password would be there to see, for anyone who had access to the system.

It seems that deleting his bash history was something _routine_ that he did every time, not some one-off thing to fix an occasional mistake.

> Surely that's a crock of BS? In what situation do bash histories contain typed passwords in plaintext?

When you mistakenly typed it at the shell prompt instead of the sudo prompt, for example. Speaking from actual experience.

That doesn't seem to be case from the article:

It seems that deleting his bash history was something _routine_ that he did every time, not some one-off thing to fix an occasional mistake.

This definitely happens! As a non-specific example, there's often an extra step to avoid this by making a "credentials" file with restricted permissions. If you don't do that, you're often stuck passing the password as a commandline argument.

Command line Wifi config comes to mind, but I've encountered this situation in other contexts before. It happens also when you want to connect internet-facing servers. Usually when you're forced to enter the pw via commandline argument.

Reply on news.ycombinator.com