SpikeGronim

As an industry, we're leaving about half the talent lying on the floor in the form of women who aren't inclined to study computer science. Carnegie Mellon has had a lot of success recruiting talented women [1]. In order to recruit talented women you can't alienate them. If I were a woman I wouldn't want to associate with the men in a typical high school or college computer science environment. I could give you a bunch of personal anecdotes, but the stories from [2] are typical of my experience. Why should bright women develop computer science talent when they're being harassed by their male peers? They go into another technical field, to the detriment of our industry.

1. http://www.post-gazette.com/regionstate/19990820compwomen4.a...

2. http://www.networkworld.com/community/blog/there-sexual-hara...

You need to be prepared for halting failures and variable performance. Moving from higher end, dedicated hardware to lower end, shared hardware means an increase the failure rate and in the variance of your latencies. In exchange you get elastic scaling, you convert capital costs to operational costs (no more building datacenters), and you hand the "undifferentiated heavy lifting" to AWS. The posts aren't, IMO, understating problems but demonstrating the tradeoffs that come with AWS' core value proposition.

Unit tests and fault injection tests catch a different but overlapping set of errors. Chaos Monkey is a terrific idea and I commend Netflix for implementing it early on. If you're not willing to randomly kill hosts then you're not confident that your distributed system really works.

This excellent paper[1] by James Hamilton (then MS, now AWS) recommends never doing clean shutdowns on applications - just kill them. Unless you have a lot of persistent state to manage this is a great idea. If it takes hours to migrate multiple TB off your storage host, maybe not such a good idea.

1. http://www.usenix.org/event/lisa07/tech/full_papers/hamilton...

So far, I have seen no evidence for a 'BGP thing'.

Their most public attack tool, 'LOIC' [1], uses HTTP requests to try and exhaust a target website's connection capacity. It's a simple attack and the tool is flawed [2]. They're not trying to deny service at layer 3, they're attacking the layer 7 web app. It's relatively easy to detect these requests and shrug them off.

1. http://en.wikipedia.org/wiki/LOIC 2. http://news.ycombinator.com/item?id=1988045

Practically every commercial SQL database prohibits publishing profiling data. It's customer hostile and it sucks but there you go. Use a free software licensed SQL database if you want to publish perf numbers.

I was proposing two hypotheses. First, TSA knows exactly what is going on and they are lying about it. Second, TSA's testing procedure is flawed so they don't know what is going on, but they may think that they do. So if they are using a flawed test without being aware of the flaws, 'stupid'. If they are using a flawed test and they know it, 'lying'.

I completely agree. I'm questioning whether TSA knows that or not.

You can't use dogs for static defense because they can only stay on task for so long. After 10-15 minutes of bomb sniffing the dog needs to take a break. You would need several dogs (and handlers) per checkpoint, which is cost ineffective.

I'm really curious about this. People on HN are saying "oh it's just security theater" as if the TSA purchasing officials are knowingly disingenuous. I suspect the testing procedures are badly flawed and the TSA has no clue whether the devices that they buy work. Right now I don't haven enough data to say either way - lying or stupid. Both hypotheses fit the facts.

To track a remote SVN repository. To edit commits earlier in history when you need to correct minor bugs/CR comments/commit descriptions. Edited to add: squashing lots of tiny safety commits into a commit with an entire feature in it.

I'm curious why you want interfaces in languages with duck typing.

I think that he claimed that the code was open source, but in fact it was proprietary.

HMTL5

"right to be pissed" and "right to attack 3rd parties illegally" are two very different things.

Gosh, how does attacking 3rd parties advance the cause of free speech? Will the payment processors suddenly see the error of their ways? Will the U.S. State Department accept WikiLeaks as a legitimate news organization? No, DDoS will not solve your problems. It will just piss people off and conflate WikiLeaks' questionable behavior with blatantly illegal behavior.

What's interesting to me is that they're selling this as an appliance, and a high end one at that. They're using Infiniband networking and seven SSDs per appliance. That's some serious cost. Their overall software design as described in the white paper isn't that new or interesting IMO. Teradata and others have been doing very similar things for a long time.

Agreed, finally a use for TPM that isn't customer hostile.

Note that though it is now possible to be PCIDSS certified on AWS it doesn't mean that every AWS app is certified. You need to get your own software audited regularly.

"That was a big success to our current security systems."

No, it wasn't. Saudi intelligence provided the tracking numbers for the parcel bombs[1]. All the billions of dollars that we've spent on airport security did absolutely nothing. As Schneier as argued before, if you secure the one route the attack just comes from another route.

1. http://www.nytimes.com/2010/11/06/world/middleeast/06terror....

Senator Lieberman called for an independent counsel to be appointed to avoid interference into the investigation by "the people under suspicion"[1]. I disagree with him about the Iraq war and censoring video games but let's avoid the ad hominem attacks.

1. http://www.slate.com/id/2089079/

Making the message IDs equal to the byte offset of the message in the history of all messages for the topic/partition is a neat trick to avoid indexing overhead.

"Any software problem can be solved by adding another layer of indirection. Except, of course, the problem of too much indirection." - Steve Bellovin of AT&T Labs

The Java update system prompts me to install the Yahoo! toolbar each and every time. You can click "no" but you need to be diligent. It's infuriating - I don't want the toolbar!

Agreed, the article makes too many conclusions from too few studies without sufficiently many independently reproduced results. Yet again I am happy that I've read http://norvig.com/experiment-design.html .

The two main points of the cluster compute instance were 10 GBit/s full bisection bandwidth networking and high end hardware. Now you can add GPUs as the third reason to use cluster compute instances.

I'm curious, what should they be using? The "Accept" HTTP header?

yes, 'UAW' are the United Auto Workers.

You may like it but it really reduces the security. A man in the middle can make it look like you don't speak Tcpcrypt by manipulating the first few packets of a connection. It's the same issue as mixing HTTP/HTTPS - the HTTP parts leave you vulnerable. If encryption is not mandatory then it might as well not be there.

"All they have to do" is take a hardware accelerated Vista/Windows 7 application (IE9) designed for mice and port it to much weaker hardware with a different OS and multi-touch. That's not easy.

"There is no way to remove the BSD layer without removing the entire OS"

Yup, that's the joke I was making... grandparent comment would have us remove all our software...