codelitt

I disagree as well. As the owner of a company who has had to lay people off in the past, I would love this thread to try to raise awareness of some talented people that are now on the market for new work.

Password strength checkers when signing up to a websitr don't send anything over the wire. They generally just analyze the entropy of a password and give live feedback to improve password strength. Why do they make your nervous?

Slack only provides a bit of history unless it's a paid account. What open source community could support that many paid users on Slack?

I really like Fail2ban for SSH lockdowns, but I worry about using it for repeat login attempts on an application. Depending on the application, this could possibly lock out everyone in an office, campus, etc. For certain critical services being used by everyone, this could cause a fair amount of headache.

My only qualm with recommending iPhone only is it doesn't take into account other countries where it's unaffordable for a journalist to own one. I know a group of journalists in Venezuela for whom an iPhone is simply far too expensive. Import controls in many countries make it this way. I know another group in another country where the exchange rate and low wages make even a $50/year VPN is unaffordable.

Would be great to see some good guides that take into account the challenges that others outside of the states will face. Perhaps these guides may not have that audience in mind though. Maybe if these guides had a link to a good guide for securing your Android device the best you can, it would serve help those who are financially restrained.

Interesting, thanks for the insight.

That makes sense. Just out of curiosity, to my point above, how much cooperation from the manufacturer of different systems (Hololens/Xbox/Playstation) do you need to be able to target builds for them?

I sure hope so. I think one of the barriers may be the compatibility with a lot of the devices coming out in VR. For example, to build something for the Hololens, Unity3D is the only option. IIRC, for Oculus, the only OSS game engine that targets it is Torque3D. I'm not sure how much cooperation these engines need from the manufacturers to begin targeting them, but that can be hard for OSS projects to do.

IIRC the console for S3 is global and not region specific even though buckets are.

One of our guys started a tutorial series on writing an AI to play the game, DOOM. It assumes very little knowledge and is a fun exercise to do when taking a break from some of the great courses posted here. It's no replacement for the excellent course work, but it is fun.: https://www.codelitt.com/blog/doom-ai/

My favourite course for grasping the foundations of the concepts was Andrew NG's course (although it seems like you're beyond this now): https://www.coursera.org/learn/machine-learning

I think the best way to learn, is to build things though. Have you checked out the Kaggle challenges? https://www.kaggle.com/ Those will give you great practical skills.

Of course. I am just using it as a yardstick for security strength.

Easily was, perhaps, not the correct adverb, but the linked article above as well as this one below go into it more. It does not appear to be false.

http://www.theverge.com/2014/12/28/7458159/encryption-standa...

Bruce Schneier has said while large government actors may be able to exploit it, it's still recommended: https://www.theguardian.com/world/2013/sep/05/nsa-how-to-rem...

PGP isn't user friendly, but from the Snowden leaks we learned it is one of the few encryption standards the NSA hasn't been able to break. TLS and most configs of VPN protocols were shown to be easily compromised. PGP was basically shown to be a show stopper.

1. http://m.spiegel.de/international/germany/a-1010361.html

Can you remember where this was discussed? I was under the impression that JWT was becoming a new standard for many people. I guess that's not mutually exclusive to it being bad, but I would like to read more.

One of the best things that can happen to an open source project is support from companies that use those projects. For example, Red Hat contributing upstream to Linux. We have a dedicated 20% time that employees can work on whatever they desire. I'd love to someday be able to fund a full time engineer that is able to contribute to projects we benefit from.

Wow! Just took a look at the pricing page[^1]. This seems like a very expensive service. What makes it cost so much in comparison to what we see in the private sector? There's some info here[^2], but it's pretty general.

[1]: https://cloud.gov/overview/pricing/rates/

[2]: https://cloud.gov/overview/pricing/pricing-model/

Thanks for the reply. Just noticed this now. Would you say development time is slower? Faster? About the same? How is performance benchmarking against your old JSON apis?

Exactly. DHH quite famously argues this point.

https://m.signalvnoise.com/reconsider-41adf356857f#.9npvz09a...

Good point. That part doesn't make any sense. I guess what lenders we're doing before the recession in the housing market didn't make sense either though.

Debt financing is usually massively cheaper than equity financing. If you need working capital and can pay back loans with decent terms, then you should almost always prefer debt. I could be wrong, but I get the impression startups either don't understand how to leverage debt or it's just not sexy. No one gets a TechCrunch article written about their new 500k loan from Wells Fargo that they need for working capital. VCs aren't exactly keen on revenue producing startups going to a bank instead of them either.

Another possibility could be they are no where near to producing the revenue needed to make payments or pay off a loan and equity has no hard deadline or immediate revenue requirements. Unfortunately, that's kind of a terrible cycle as a company with cheap debt and revenue is likely to be built on better fundamentals than one that has no idea when it will have revenue.

Here is a much better (and the original source) article: https://www.theinformation.com/the-reality-behind-magic-leap

The article posted literally says: the Verge says that The Information says...

>"The Verge, which quotes an exclusive article from The Information, reports that..."

I'm always in the same situation. I have only driven manual transmission cars and trucks my entire life. I grew up in the mountains and with a lot of snow, so it was the preferred transmission for almost everyone. Now I live in sunny Florida, but I still prefer it for the feeling of being more connected to the car, more control, more enjoyable for me, and just really as a car guy I'm a bit of a purist.

What I've resorted to now that I don't live in a state where they're as common, is to buy all my cars via Autotrader/similar. It opens the market up to much more variety and choice as well as I usually find a better deal than I would locally.

Give it a try. It's scary to buy a vehicle long distance, but even with the cost of flying out and driving it back, I usually save money and always get exactly what I want. Just make sure before you go out yourself to ask a ton of questions and get a local mechanic to go take a look.

I'm in the same boat, however, I've always dual-booted Linux using OSx for casual use and Linux for work. I'm not sure what I'll do hardware wise, because the terrible keyboard, lack of: function keys, esc key, and lack of magsafe make it unusable for my workflow. However, I've recently moved from awesomeWM to KDE Plasma as a DE with the Arc Dark theme. I have to say, I finally don't miss OSx with this setup.

Very useful, intuitive UX, Alfred like functionality out of the box, very nice UI (not just for linux, for anything!), productive workflow, and gets out of your way when you need to get things done.

I still have to find a hardware replacement with a great keyboard, solid trackpad, killer battery, and great display, but my OS concerns are finally resolved.

Edit: Repo with screenshots: https://github.com/varlesh/Arc-Dark-KDE

Codelitt Incubator | Miami | 3 Month Contract w/ option to extend | ONSITE / REMOTE

Position: Designer with web + mobile experience

You'll be working with a team developing the design language and systems, UX, and UI for a software platform used by tenants worldwide. You'll also be tackling some other POCs and R&D projects.

Full job info: https://angel.co/l/UBBCf

Contact: vincent@codelitt.com

People keep saying mobile is the future, however, I just can't imagine desktops leaving us anytime soon. If I'm on the go, then sure I want it on my mobile device, but 99% of the time when I'm at work I want quick and easy access either through an app or the browser on my desktop. If a service I use doesn't have a desktop app, then it likely won't receive any of my attention until I'm out of the office.

I've been volunteering teaching Latin American journalists how to research, communicate, and store data privately to protect themselves and their sources against attackers. The threat against freedom of expression there is just as real as it is with oppressive regimes in other parts of the world although they don't get nearly as much attention as the Middle East. This article doesn't highlight enough the need for volunteers and professionals to lend a hand. Most recently I've been working with journalists in Venezuela. If you know anything about Venezuela you should know that they have an incredibly oppressive government and they also have had massive inflation further eliminating their buying power. Things like a $3 (USD) a month VPN are hard for a middle class citizen to afford.

I'm trying to remember where I saw it, but there was a journalist who showed over the past year how much food 1000 bolivars bought. At the beginning of the photo essay, she could have fed a family for a week. By the end, it was barely enough for 1 person for a meal.

Anyone can really help out and make a difference too. Not just in LATAM, but around the world. The amount of knowledge about cybersecurity, threat models, and risks associated with electronic communications spans a wide range. Of course you have civil society groups who know how to use PGP, but there are others who still rely on Facebook Messenger to communicate with sources and keep passwords sticky noted to their computer screen.

Edit: Also wanted to note that it's pretty great what Citizen Labs is doing. Other great resources for learning/teaching/staying updated ( in both English and Spanish and several others) can be found on the EFF's website - https://ssd.eff.org/en/playlist/journalist-move

Codelitt Incubator | Miami | Full-time | ONSITE / REMOTE

Position: Software Engineer with Game Dev/3D Experience - Mobile experience a bonus

Product: Interactive Virtual and Altered Reality and data viz for Hololens.

You'll help a team of talented designers and other engineers build an interactive data visualization experience for the Hololens. You'll also be tackling some other POCs and R&D projects. Preferably you're also interested in learning new technology.

We look for smart people who solve problems regardless of background/education. We prefer teams who can pick up new technologies quickly and solve problems over monolithic experts.

Contact: halisson@codelitt.com and vincent@codelitt.com

Job description and more about the company here: https://angel.co/l/PWitt

We build a ton of products and use a ton of technology across the web, mobile, machine learning, robotics, VR/AR and AI. We have a great team, a profitable company, a great culture, and we'd love to hear from you.

Thanks man! I'll take a look.

You're right. Took mwpmaybe's suggestion for the time being and only will accept IPv4 from ssh for now till that's fixed.

Nothing! (Except I doubt I can manually get it all done in 5 minutes =) ) Thanks for your great article.

We just ended up adapting your approach with a couple modifications (like 2FA) and extending it to be more of a primer and explain the steps a bit more so that the younger engineers understood what each step performed was doing. I found myself pointing them to your article, but then having to explain what was being performed and it's purpose (not a bad thing - just different audience).

As has been mentioned, in the real world, an Ansible Playbook should be performing these, but teach a man to fish, etc...