Llevel

This is the trouble with web dev. There are a million factors in play, and it's very tough to create tests for them all, not to mention potentially financially restrictive with the need for multiple browser testing VMs. You have to test cross-browser, make sure all the versions of IE you want to support play nicely with your JavaScript and CSS. The site also needs to be responsive and handle resizing gracefully. Then how about making your site accessible, making sure all the aria tags are where they should be, and that screen readers will read, or not read, your content properly. When there is time to polish, it's often in the form of CSS transitions or animations.

Making my site fallback to no-js gracefully affects so few people, that it falls by the wayside since there's so many other higher priorities that affect a lot more people.

I chose to get 4 ST4000DM000 drives based on previous reports. Sure HGST drives never die, but it's cheaper to RMA or buy a single new drive if one fails, than the added cost of 4 reliable drives. Assuming only one fails, which is a risk I'm willing to take with my very non-mission-critical data.

I don't read this as 'which drive to buy' but more as 'which drive not to buy'.

Here is the correct link to the full text of that blog post.

http://blog.elementary.io/post/110645528530/payments

Isn't that along the lines of System 76 [1]? I haven't tried any of their machines, and they aren't exactly trying to compete with Apple, but they are Linux first.

[1] https://system76.com/

My mistake, I didn't see it on the official Bolt website, so I assumed it wasn't included.

40km per hour of charge time, 9 hours for a full charge.[1] It doesn't look like it has the ability to use superchargers, or charge quickly in any way.

[1] http://www.chevrolet.ca/bolt-ev-electric-vehicle.html

edit: I am wrong, the article mentions quick charging, but the official website doesn't.

The biggest drawback for me would be the inability to charge quickly.

With a Tesla you can take it on a road trip, as long you plan it around hitting supercharging stations. In the bolt, you can go 200 miles, but have to stop for the night to grab a full charge.

But if you aren't the type of person to drive more than 4 hours a day, or have an alternative vehicle for longer trips, this could be a great choice.

This post didn't gain much traction, but XSS attacks are still pretty popular and Google awards up to $7500 for XSS attacks[1]. React and Angular may help prevent XSS attacks, and while I don't know specifics, they likely do have some ingrained tools to prevent it occurring. I wouldn't be surprised if a XSS exploit could find a way around client-size sanitization though. In a perfect world, all strings coming from your server would be pre-escaped.

Rails is 'immune' in the sense that it doesn't let you directly drop HTML onto pages from strings without escaping it first, and if you would like to do so, you have to explicitly mark the string as safe[2]. This isn't to say that XSS is no longer an issue though, Rails and other frameworks help prevent these occurrences in many cases in simple applications, but larger scale applications have a lot more code and a lot more ways to punch holes in that protection. In fact using Express with with Node.js doesn't sanitize your strings by default (as far as my quick research has shown), which leaves a potential attack vector.

While XSS is a very well known vector, XSS attacks are not uncommon in non-boilerplate web applications. Fortunately sanitization is easy and bugs can often be fixed quickly.

Browsers can prevent some methods of XSS, such as by preventing loading JS from a remote untrusted source. If you find a way to drop JS directly onto a page that the browser can't catch (such as the entire JS source being delivered by the server), there's still vulnerability.

OWASP tends to be the place to go to learn about web security[3]. They have lots of examples of potential exploits.

[1] https://www.google.ca/about/appsecurity/reward-program/ [2] http://stackoverflow.com/a/3932440 [3] https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Their store looks like they only have volume encryption on Windows, and container encryption for Mac, Linux and Windows, unless I'm mistaken.

https://www.jetico.com/online-shop/shop/index/all-products

> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database.

[1] https://security.stackexchange.com/questions/23241/how-are-t...

He was a ThoughtWorks employee, it only makes sense they made a statement. I work there and they sent a company-wide email saying that they're having a remembrance day for Aaron on the 15th and they're taking time in every office to remember Aaron by discussing his work, his impact on the world, and who he is. This isn't a shameless promotion, this is showing respect for him and honoring his legacy.