SpikeGronim

First, Apple isn't removing Java from OS X. They will stop shipping their customized version of Java in several years.

Second, every popular piece of software has vulnerabilities. So if this warrants the removal of Java, you should remove Safari and the BSD kernel from OS X as well.

My question to you is, could you do better and how much would it cost? If you didn't use Heroku or another cloud provider you would pay a lot more up front to get your applications running. When things go wrong you would have to fix it, which means paying technical staff to be on call. Since you and your company are likely experts in your domain and not in infrastructure then any infrastructure that you built would likely have more downtime than Heroku. You have to debit the cost of Heroku's downtime from the cost of building your own infrastructure.

Disclaimer: I'm not affiliated with Heroku and I don't use their service.

Without more context, I find your statement that "Some of them probably even deserve it" offensive. If I had enough karma I would down vote you for that. Which human beings are you saying deserve to die? What facts and which code of ethics did you use to conclude that some people that you've never met deserve to die? If I am misinterpreting your statement, please correct me.

Update: email jobs@wavii.com please.

I think systems like this use a lot of RAM. You can afford it when you're a stock exchange. You can get high availability from a RAM store if you replicate it over multiple machines and react quickly to machine failures. Then you keep a commit log on disk that's append only and avoids seeking.

It is important to normalize those numbers by accounting for steal time.

http://3spoken.wordpress.com/2006/12/10/cpu-steal-time-the-n...

Lots of people have run benchmarks that show exactly that - non-paging, in memory working set Varnish clobbers Squid. The difference is even more noticeable when the working set is larger than memory. Most of those benchmarks are micro-benchmarks that can be criticized. To the extent that we have data, Varnish is much faster than Squid. It's not just PHK's reputation.

I wish that content aggregators could use something like Kerberos tickets to delegate authentication. That way Mint could have a read-only ticket to access my bank that didn't require my password.

I still use Mint though. I asked them about their security measures in this thread: http://satisfaction.mint.com/mint/topics/can_i_trust_the_sec... . Their response was that you're not liable for fraud if you report it to your bank promptly, and Mint's reporting features make it more likely that you catch the fraud early enough to report it. It seems like a good security tradeoff to me.

Wavii is hiring in Seattle, WA. Remote is an option.

Wavii automatically creates social content in real-time from news across the web.

http://techcrunch.com/2010/07/21/time-to-meet-wavii-the-supe...

Email me at <my-first-name>@wavii.com for more information.

If they were really dangerous, Al Qaeda would be using them to bring down planes.

I appreciate the concern re:Rapportive, but I love it! Particularly when it tells me about the authors when I am reading a technical list. Let's hope they don't get hacked and disclose all of our emails...

You can register for free and use a fake email address. Your browser gets a cookie and you never have to deal with it again.

I agree that the signup wall on nyt is hella annoying. I'd love to see the results of an A/B test on disabling it.

When they do go fully paywall [1] I'll likely stop visiting their site.

1. http://www.nytimes.com/2010/01/21/business/media/21times.htm...

Even if you implemented these controls it wouldn't matter. The tracking software would use other information channels available intrinsically in HTTP to assign your browser a GUID.

There are so many ways to coerce a GUID out of a browser: single pixel images, cache headers[1], etc. It's not feasible to implement disclosure control[2] retroactively in web standards.

1. http://sourcefrog.net/projects/meantime/ 2. http://groups.csail.mit.edu/mac/classes/6.805/articles/priva...

I agree with the overall sentiment that this is a relatively minor vulnerability.

It could be put to malicious use by phishers. If I know your full name I can make more realistic phishing emails.

Cool site but I was expecting to see a screenshot of my page in each browser. Besides validation errors I also care about layout.

http://www.webpagetest.org/ provides that feature (for IE 7/8), I have been using it frequently.

EDIT: Found the right link, sorry for the confusion.

Agreed that shared secrets are not really that secret.

"it would have been very easy to address by just using Diffie Hellman when determining the session key"

Since WPA is implemented in hardware you must add gates to support Diffie Helman. This adds cost, resulting in a cost/security trade off.