Dru89

This was what originally led me to do some research on the topic. I really thought the podcast was well done.

There may be a bit of both at work here, because I remember seeing a lot of issues with hacking the Prius at Defcon[0], but I vaguely recall the SUA incidents being mostly related to as pedal misapplication.

I know Wikipedia isn't exactly a great primary source here, but:

> From 2002 to 2009 there were many defect petitions made to the NHTSA regarding unintended acceleration in Toyota and Lexus vehicles, but many of them were determined to be caused by pedal misapplication, and the NHTSA noted that there was no statistical significance showing that Toyota vehicles had more SUA incidents than other manufacturers.

— https://en.wikipedia.org/wiki/Sudden_unintended_acceleration...

In any case, I believe companies can definitely be guilty of criminal negligence (and Toyota did a lot of bad things during their SUA crisis). But I think the use of SUA in the comment I originally responded to sort of misrepresents the situation and mostly spreads a lot of FUD around self-driving cars.

[0]: https://www.engadget.com/2013/07/28/auto-hacked-ford-toyota-...

I thought the unintended acceleration issues had been largely disproven as user error.

That is, many other brands of cars had been reported to have the same issues by drivers. And basically a driver was put into a stressful situation, thought they were hitting the brakes, but were actually hitting the gas. Then, panicking that they can't stop the car, hit the "brakes" harder, exacerbating the problem.

The "Reader View" available in at least Firefox and Safari fixed this for me.

The idea of exclusively using only a few applications definitely seems limiting. I understand in this case it's probably because of licensing and morals, but I can't imagine many businesses caring much about your principles on software licenses when everyone's passing around their ".sketch" files.

From what I can tell, this is a useful first step towards credential stuffing.

Requests against endpoints like this are going to be unauthenticated, since by their very nature they happen before the user is actually authenticated against the system. So you can burn through a few thousand (or hundred thousand) possibles and find out which ones actually have accounts.

From there, you can use one of many other email/password dumps and try authenticating. Hitting an endpoint where you can use an email and password is (hopefully) going to be much more guarded and will start blocking IPs when the rate or variance is too high.

That being said, I don't really know how you can stop the first step. There are plenty of answers here that say you should just let them "sign up" and then send them an email if they already have an account. But what happens if your signup process includes something like accepting payment? Obviously you don't want the user filling out all of that information again.

With as many accounts on these services that actually exist, it still doesn't answer the question of whether or not the person actually owns the email.

A corporation has no freedom of speech rights. It's important to remember that a corporation is not considered to the same rights as a person in these cases, nor should they ever be allowed to be.

He's referring to the dereference of a null object. For instance, calling "foo.bar" when foo is null (or potentially undefined).

Sorry, is it not handy because it's inaccurate? Or simply because it's so lengthy?

A bit unrelated, but it's weird that Medium doesn't seem to support embedded code, and instead only seems to work with gists.

It made the mobile experience pretty bad (all I get are links to the gists) and it would definitely "pollute" my gist history with a lot of little code snippets.

On the note of the topic itself, though, this was a fun read for building fractals in JavaScript!

Instead of two things, you just need one. They're saying that instead of a USB-A-to-Lightning cable and a USB-A-to-USB-C adapter, you can just use the one cable.

You don't even need to rebind the escape key. I've been using ^[ for years, and it works in basically all standard terminals and vims as the escape key.

This is less safe than the branching alternatives. Instead of "moving" the original commit, this copies the original commit to a new one and leaves the original one dangling and waiting to be garbage collected.

Also, if you have more than one commit before you noticed you were on the wrong branch, this only grabs the one commit.

I'm unhappy with the approval process being a simple search for "LGTM". I wish GitHub pull requests had actual support for a review process, e.g.:

* open issues to address

* review state, such as "changes requested" or "approved" (along with users that are in each state).

We've been using Phabricator's[1] Differential tool for code reviews and it feels superior to this process, but it would certainly be nice to have an all-encompassing solution for this.

[1] http://phabricator.org

Came here to say exactly this. Most stats should probably either treat 3XX as "success" or follow the link to figure out what the next location's status is.

What is the correct way to force a link to open in a new tab, then?

Unfortunately "let the user decide" is not the best answer if you want to link to something like "terms and conditions" in the middle of a sign up flow or something. If the user doesn't know how to open it in a new tab on their own, this can be extremely frustrating I'd imagine.

This actually left me more curious than any of the rules in the style guide.

This looks pretty interesting. It does require the structure of the HTML to be very similar to the object, though. And I'm not thrilled that is uses the class name for a DOM node in the key/value pair. Why not define some "data-" attribute to read from?

EDIT: Looks like I posted without reading all of the comments in regards to the class name thing. I see some other people have mentioned it as well. It also looks like the author states that this isn't a hard requirement. I guess that would solve that problem at least.

Does the difference between someone thinking that I'm wrong 100% of the time vs. being wrong at one particular incident make it better? Certainly. It's still rude and childish, but I'd certainly rather have a singular incident stomped on than my entire character tarnished.

I think I recall this website at one point existing at a domain from Bell Labs. I came across it almost 8 years ago searching on Google for a particular number sequence I came across in some research. The website is fascinating and I found myself looking at sequences for hours, amazed by all of the different ones that had been posted. This website is definitely one of the great hidden gems on the Internet.

It's somewhat tangential, but I'm curious what you mean by "HTML-aware templating language".

That might be one of the scariest things I've looked at all day.

You've done an incredible job with this game. I sat down for a minute to just take a look at it, and it nearly made me late for work an hour later.

I'm a bit torn here. On the one hand, this sounds like it has a high probability of doing exactly what unit tests shouldn't do: pass on one run and fail on another.

On the other hand, the fact that it would fail at all would help you see that you have a bug. Something you might not have caught before.

Even though everyone else is talking about this as an impractical solution, I think it's clever at least.

I don't know that I would ever use it, but I like the novel concept of it. If this was just a for-fun kind of project, I'd think it was pretty awesome. If you're trying to market it as a business, you're going to run into all the problems everyone else has already mentioned.

Looks like a total of 5: https://hn.algolia.com/?q=psd#!/story/forever/prefix/0/XeePh...

But yeah, I definitely remember seeing this in the past. Feels slightly like a case of http://xkcd.com/1053/, though?

And I don't see anything in the guidelines about re-posts. (https://news.ycombinator.com/newsguidelines.html) You've got more HN experience than me, though, so I could very easily be wrong. :)

Right or wrong, many people that I've worked with view the 10-minute morning stand-up meeting as a "starting function" for their day. This would completely break that function of a stand-up.

I'm also not too fond of anything that would cause people to work later in the evening. The one problem I see this potentially fixing is the feeling of forgetting everything you did over the weekend.

In our office, we have "Quiet Rooms." Many people go there to grab a fifteen to twenty minute nap, but I find myself going there when the noise just gets to be too much.

I've found that many problems, even software problems, can be solved in a completely dark, quiet room. At the very least, it helps reduce stress levels and allows you to try to tackle the problem again when you get back with a fresh mind.

Don't get me wrong, the app is fairly ridiculous. Projects like this though help show what even the simplest of concepts can provide, though.

To be fair, I'm not sure how secure YoAuth would be, but this particular hack seems like an awesome use of it. It's simple to use and could compete alongside something like Google Authenticator as a simple way to log in to something.