Hacker News Reader

danielweberon Two Executives to Leave Uber, Adding to Departures

> if true, this is one of the dumbest long term business strategies in the history of high finance.

You speak of the first dot-com crash, but there was a lot of stupidness back then. One of my favorites is furniture.com http://www.ecommerce-digest.com/early-dot-com-failure-case-s...

danielweberon Two Executives to Leave Uber, Adding to Departures

Without saying whether I think such a thing is likely, Uber compensates significantly with stock, and they cannot retain talent if the trust in the cashout goes away.

danielweberon How Utah Reduced Chronic Homelessness

The politicians likely remember the scandal from the 1980s of Regular Joes being torn apart by aggressive IRS agents. Saying "hiring more IRS agents brings in more money than they cost" is incredibly gauche to anyone who remembers it.

danielweberon Lack of Oxford Comma Could Cost Maine Company Millions in Overtime Dispute

Muphry's Law.

danielweberon University of Tokyo Graduate School Entrance Exam – Mathematics (2016) [pdf]

What form does the answer to 3.3 look like? Would it break apart the case for abs(r-s) > 1, which is 0?

danielweberon The eigenvector of “Why we moved from language X to language Y”

I took this whole post as very tongue-in-cheek. No one should really be using this to predict the future. Instead, it was a fun data-analysis exercise.

danielweberon Keep the Internet Open

Isn't that what happened to the DSL market? No one will bother laying new infrastructure because anyone can use it.

danielweberon Why companies don't do GPL enforcement

Only in extreme situations, like when it was very clear that your case had no merit, or when explicitly called for by statute, which is a small number of situations (like SLAPP suits).

danielweberon Ask HN: How do you set prices?

Agree. My experience in pricing was that we were locked in to the initial price we set. (And the CEO did it by accident. Oops.) No one could stomach raising it.

Then again, we didn't actually try raising it and face backlash. It's possible we were just too cowardly to try and fail.

danielweberon SEC Rejects Rule Change for Bitcoin Exchange-Traded Fund [pdf]

"This is unusual" is "the 25% drop." Over the past year, it's been pretty boring.

danielweberon FBI Used Best Buy's Geek Squad to Increase Secret Public Surveillance

> It seems obvious to me that your modern "papers" are what is on your hard drive.

And they are protected in your possession. If you turn over all your papers to a third-party, though, that changes things.

eta We may need more privileged communications, but they are very rare. Creating one is probably a good idea, but this will have to happen legislatively. Geek Squad finding child porn isn't much different from the photo processors of old finding it.

danielweberon SEC Rejects Rule Change for Bitcoin Exchange-Traded Fund [pdf]

Eehhh, I've been skeptical of Bitcoin in the past because of its volatility, but this is very unusual. It's been rather stable on a week-to-week basis for a long time.

danielweberon Finding a $5,000 Google Maps XSS by fiddling with Protobuf

It seems to be the market clearing price. Lots of companies think "hey, we offer peanuts and people do all this expensive work for us."

This guy did it to land a job. Hopefully he's done with spec-work like this and his new employer makes sure to negotiate rates ahead of time for security reviews.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

Sure, they want to be a monopoly. But they're not.

Seriously, how do they get lock-in of riders or drivers? Installing a second app is a really really low bar. You can't do predatory pricing forever.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

It would be pretty stupid to make your very first use of a service an escape from a dangerous situation.

Lots of people are scared to use Uber/Lyft at first and need to be convinced to ride.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

If you want a company to cooperate, you give them a subpoena, and order them to keep quiet until arrests have been made.

When you try to play things on the sly, it's your fault if some third party thinks you're a rat.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

I simply don't see how Uber can be a monopoly. You need a critical mass of drivers, but nothing stops drivers from being on multiple networks. This isn't Microsoft doing per-CPU licensing.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

Uber isn't a monopoly. For all the scummy things that Uber has done, they have avoided the most scummy thing they could do to become a monopoly: driver lock-in, making their drivers commit to only drive for them and not for Lyft.

Susan Fowler's post has me pretty fed up with Uber, but for some reason greyballing doesn't bother me at all.

danielweberon How Uber Used Secret “Greyball” Tool to Deceive Authorities Worldwide

There's a legal requirement to comply to emissions laws.

Is there a legal requirement to make it easy for cops to use your service? Are they a protected class?

If I didn't want to sell donuts to the cops, I sure wouldn't tell them it's because they are cops. I would just be mysteriously out of donuts every time they come in.

danielweberon The Collapse of the Unix Philosophy

It's not using the command line that sucks about installing software.

It's that there are so many different standards for installing software, overlapping in sometimes conflicting ways.

danielweberon Two-part Rubik's algorithms

I now use the cube as a meditative practice

Holy cow, you've put into words what I've been thinking and practicing. Thank you.

danielweberon A Physicist Who Denies That Dark Matter Exists

Shouldn't there be a big lump of dark matter at the center of every planet, moon, and star?

If we were to hollow out an asteroid, would there still be a blob of intangible dark matter inside of it?

danielweberon SHA-1 collider: Make your own colliding PDFs

If you got two different messages to get into the same internal state with SHA-3, the same thing would apply, wouldn't it? Would that be a length extension attack on SHA-3?

This is really a terminology question. I had a clear understanding of "length extension attacks" but it seems on this comment page people are using something else now. I've been looking over crypto.stackexchance and twitter to see if I missed the memo but this looks like a new usage.

danielweberon SHA-1 collider: Make your own colliding PDFs

Damn, right, you have to get them with the same internal state.

danielweberon SHA-1 collider: Make your own colliding PDFs

Yep. With any hash function that takes input as blocks, if you were to ever get two messages to generate the same EDIT internal state, you could add the same arbitrary data to both and get those new messages to have the same hash.

danielweberon SHA-1 collider: Make your own colliding PDFs

If you were to somehow get two messages with the same SHA-3 hash, you could keep on appending the same data to both and they would keep the same SHA-3. But SHA-3 is explicitly not vulnerable to length extension attacks.

danielweberon SHA-1 collider: Make your own colliding PDFs

How do you length extension when both outputs are the same length?

danielweberon SHA-1 collider: Make your own colliding PDFs

No. The messages differ in their internals.

The length extension attack leverages the weakness that people think HASH(secret + message) is a signature only they can create as long as only they know "secret".

danielweberon SHA-1 collider: Make your own colliding PDFs

If by "secured by SHA1" you mean "someone generated a hash using SHA-1 and we use the validity of that hash to guarantee we have the right document," that's still okay. We're a long way from being able to make documents with a given SHA-1.

(Edit: Any newly signed documents, or documents signed recently, are not safe, because an nasty person could have made two, one to get signed by the system, another to do evil with.)

SHA-1 is officially deprecated for certificates, because of the example that OP shows. You can create two certificates, have the decent one get signed by a CA, and then use the evil one to intercept traffic.

danielweberon SHA-1 collider: Make your own colliding PDFs

It was known for a while to move away from SHA-1. Any TLS certificates using SHA-1 were supposed to become invalid on January 1st.

But I wasn't expecting that google's 110 GPU-year work meant that we could create colliding PDFs on demand.