_hyn3

I agree. DNS is its own bundle of insecurity.

This seems to have been public for quite a while. It's also how Userify.com imports public keys from Github.com for years (and also imports from Gitlab.com, which copied Github's approach.) For some reason, Userify itself doesn't also allow easy export of its users' public keys.

OP said, "let's force everyone to use https."

My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.

This is not historically accurate.

I quite like Redis as a cache or as an ad hoc locking mechanism accessible from across a cluster, but as a database I will never fully trust it. RDB and AOF seem far too fragile to trust in production, especially in a distributed setting.

Goes right along with "Bugs allowed hackers to dox John Deere tractor owners" https://news.ycombinator.com/item?id=26903482

If that was what the OP had said, I would agree, but I don't interpret that as being what they actually said (although I may have misinterpreted):

"However, those actions were later decided to be made illegal" (emphasis added)

I interpret this as saying that they believe retroactively applying enforcement would be moral, just, and legal.

As someone who has studied this fairly extensively, I believe this comment to be factually correct.

It also didn't hurt Rockefeller in the slightest. To the contrary, he actually became far wealthier post-breakup, possibly because all former business units became more efficient in the light of open competition.

Many of them live on today, such as Texaco, Chevron, and Mobil.

https://historyincharts.com/the-legacy-of-the-breakup-of-sta...

https://www.britannica.com/topic/Standard-Oil

In general, trustbusting almost never actually works as planned, but it always seems like a good idea -- a desperate solution, perhaps the only possible solution -- at the time.

The only thing that tends to work is upstart competition driven by new technology that blindsides the older company.

When it comes to a monopolist, the one thing that we can say historically is that, "This too shall pass."

There's no such thing as "legal fraud". Fraud is always illegal.

> a lot of companies have done things in the past that were not illegal at the time of action. However, those actions were later decided to be made illegal because the behavior was deemed to be antithetical to our values.

What you are saying is literally the opposite of hundreds of years of the rule of law.

If FB did break the law as written, then prosecute them for that in a fair trial by a jury of their peers, but yours (or anyone else's) personal feelings about "our values" should never be able to override the plain language of the law, especially retroactively.

Exactly. You absolutely must have the rsync binary installed locally. The rsync "server" should only actually be run if you know you need it (that is, only if you are providing rsync services to other people).

The average adult in the United States watches more than 4 hours of television per day, proving that most have both free time and a television.

https://www.statista.com/chart/15224/daily-tv-consumption-by...

The decrease in television watching is actually among the more technically literate, not illiterate; according to Nielsen, younger people are watching streaming services instead of television.

> even porting from python 2.x->3.x takes a lot of effort...

> ...and perl? Just works!

Agreed! And, if anything, you might be understating it. We went through a Python 2 -> 3 migration recently and it required a massive effort across the entire company; ultimately, we decided to shelve it and port most of our code to Go; this effort has been ongoing to this day.

This choice to not offer backwards compatibility left a very, very bad taste in our mouths, and we'll probably never go back to Python. It's astonishing that the PSF just decided that probably trillions of lines of working, production-quality code at companies around the world would need to be re-written. Perhaps it's "their" code, so it's their prerogative, but Go's backwards-compatibility pledge was a huge factor in our decision to move toward it.

For those of us on the team who are old enough (honestly) to know Perl (as much as anyone can?), well, there are still some very large companies that have massive Perl codebases and they seem to be happy with them.

It's a good point that the cost could (would always?) be high, because you could probably just park a van outside the target's wifi network, given the sad state of wireless crypto.

However, ZeroTier is designed to provide encryption on top of an existing network, so by targeting ZT, you gain access to everything within that network, even in other locations.

Is the ZeroTier root code open source? Can someone run their own root servers?

If you have access to the victim's ZeroTier dashboard (or API calls), that's trivial to get. Even if there are currently no disclosed vulns in the dashboard, that doesn't mean that none exist.

Slack's Nebula: https://github.com/slackhq/nebula

This is just shocking. They gave the Taliban a list of the people who had been literally fighting against them for the last 20 years. And the Afghans, too. Who will protect them? No one. They are walking dead. They will be tortured and killed.

Great job! Looks great, and smooth animation in Firefox on Linux.

"semi-illicit"? It's flat-out illegal, not semi-illicit.

Inadvertently or not, illegal imports can bring in invasive species, like the Asian carp or even less interesting things like fruit molds that threaten native species and often spread like crazy. There's a reason why imports are regulated.

And, it's potentially a felony under the Lacey Act. That's why it's secretive. This isn't sneaking out at night after your parents grounded you.. this potentially damages entire ecosystems.

This is very common. Always take the call. But be careful.

They are quite possibly scoping you out on behalf of a portfolio company and might want to make a large offer to do a merger. So, you could get rich, or they could clone all of the ideas that you let them have. Make sure that the only ideas they can clone are on your website already.

Here are a few simple rules to follow to keep yourself from slipping up:

* Do not talk about future stuff that isn't on your website, unless you're talking about things that will launch in the next week or two.

* Don't brag, especially about things that you are planning to do and aren't already in the market.

* Don't share numbers or profits that isn't on your website, although you might want to be (very slightly) flexible on this one.

* Always talk about WHAT your product(s) do, but never HOW they do it. VC's probably won't care or won't understand the how anyway.

* Try not to be overly enamored or subservient in your tone (don't be a jerk, either.)

* Always keep in mind exactly what you hope to achieve.

* Don't talk too much.

* If you get a good offer, get a strong lawyer from another town in your state (not the same city) that can advise you, and do not get into a situation where you are paying the lawyer but then change your mind. Often lawyers kill deals, so either keep the lawyer around just to paper the deal, or you can bring them in when during the whole discussion -- but only if you think you really need them. But remember this rule of thumb: if they have counsel on the call, you should too.

Remember that even if everything goes perfectly and they invest or make an offer for your whole company for one of their portfolio companies, you will have to maintain a good relationship with them for a very long time, and possibly one of your direct competitors -- and that's probably the best-case scenario. The worst case is a lot worse.

And, congratulations on attracting this attention from a power player. That means you're onto something. Sometimes, the best answer is to hear what they have to say, and then not move forward with any potential offer (have a strong BATNA).

Just use syncthing. It's open source and works great.

I remember when Apple loved its users.

Don't fix it if it ain't.

Is the project still alive? It sounds great if so, but if it's good at that, why doesn't Apple run it for iCloud instead of GCP? (Aside from the obvious massive scale issues, but it seems like Apple would be able to afford to engineer that.)

Based on sib comment, it looks like it was related to a poor name sanitation / matching function (which says, to me, that's risky if you have untrusted names), but this could also be caused by a lazy or delayed deletion strategy.

Why won't it? It's just scaling up bank air tubes. But that's almost irrelevant to my larger point:

Where would we be right now if [pick any inventor] had listened when the experts said, "it won't work"?

An inventor's job is to have a big imagination. A successful inventor usually has enough of an engineering background to test their hypothesis and refine as needed. Most of them also know how to gather highly educated minds to help them.

Many successful inventors do not have deep academic backgrounds, because often those educational backgrounds tell them only what is impossible, not what is possible.

“He’s obviously skilled at all those different functions, but certainly what really drives him and where his passion really is, is his role as CTO,” or chief technology officer, Reisman said. “Basically his role as chief designer and chief engineer. That’s the part of the job that really plays to his strengths."

From that Reddit thread: https://www.reddit.com/r/SpaceXLounge/comments/k1e0ta/eviden...

This doesn't fit with my experience at all. They were somewhat expensive, yes, but only a bit more than a nice Lego set (which I got for Christmas one year). I don't even know if there was an aviation club nearby, but there were tons of RC airplane people that would just launch from their lawns.

There's also no question or sign indicating that you have to take a drone license course, effective immediately. How would someone even find out about this new regulation? By hanging out on hacker news waiting for it?

All airspace? Not even airspace above, say, 500 feet?

Am I literally walking through federal airspace right now?

The U.S. Constitution is pretty explicit about physical space that is allocated to the federal government and the reasons (post offices and post roads, military installations, and that's about it), so laying claim to every square inch of "air" above that land seems to be quite a stretch.