HNHacker News
TopNewBestAskShowJobs

danjoc

2,643 karma · joined January 10, 2016

submissionscomments
danjoc··on Pi-Hole: Why You Need a Network-Wide Ad-Blocker
Ultimately, this is going to end badly for advertisers. All ISPs block port 25. In < 5 years, all ISPs will provide PiHole functionality on their networks. "Net Neutrality" is gone. This is going to be glorious. Thank goodness for the FCC making this protection available to the masses.
danjoc··on Scientists present concept for the elimination of traffic jams
>The important thing about congestion pricing is that it makes mass transit competitive.

The other important thing about congestion pricing (as described in the article) is that it completely destroys privacy.

danjoc··on Apple Reports Third Quarter Results
>That's impossible. Everyone keeps telling me that Apple is dying.

It's the reverse of a pump and dump scam. It has happened every quarter for the last 21 years. I honestly think it was something SJ cooked up. It started happening just after he returned. My guess, he got John Dvorak in on the scam. That guy's 'beleaguered Apple' PCMag trolling was instrumental in driving the price down for years. Everyone would parrot it. Then, "bam" Apple produces a great quarter. I wonder if JD still does that schtick... You can make money without fail by buying on the dip before earnings announcements and selling on the news.

danjoc··on Bay Area cities are cracking down on free food at tech companies
Suddenly everyone cares about their dear Facebook cafeteria workers?

https://www.sfgate.com/news/article/Facebook-cafeteria-worke...

People cheating on their income taxes to the tune of thousands of dollars a year each in free lunches are now more likely to comply with the law. This seems like a step in the right direction.

danjoc··on Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
Buyers may not know or care, but retailers do. Anyone can report that Amazon link shared earlier and Amazon will remove it as it is not spec compliant. Those type adapters are also non-existent at basically every electronics brick-and-mortar store I've visited.

https://www.androidpolice.com/2016/03/29/amazon-updates-its-...

danjoc··on Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
>Chrome has banned WebUSB from claiming Security Keys

Since when? Is this extension now broken?

https://chrome.google.com/webstore/detail/smart-card-connect...

danjoc··on Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
>Wrong!

No, sorry, you are wrong.

https://plus.google.com/+BensonLeung/posts/UFCHbSDRa2o

danjoc··on Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
>But we're implementing the W3C Web Authentication (webauthn) spec and you can already use it in Chrome in place of U2F.

How are users going to differentiate between a webauthn permission request and a webusb permission request? The later can be used for phishing attacks, which appears to defeat the entire purpose of having a U2F key.

https://www.wired.com/story/chrome-yubikey-phishing-webusb/

danjoc··on Google Unveils Titan Security Key, a Yubico-Like Phishing Resistant 2FA Device
USB-C is not backward compatible to USB-A. There's no way to plug a USB-C key into a computer with only USB-A ports. If you need to work with both ports, USB-A is the only game in town. The C to A adapters are not compliant with USB-C spec (see Benson Leung) and are dangerous to use with your USB-C devices.
danjoc··on Cloudflare, Mozilla, Fastly, and Apple Working on Encrypted SNI
>The situation is likely worse on mobile.

You might think so, but not really. Any app you install on Android can watch what you do online in any other app, with no permissions at all.

https://hackernoon.com/android-gives-apps-full-access-to-you...

danjoc··on Postmortem for Malicious Packages Published on July 12th, 2018
That's from the maintainer of pypi. Pypi shipped SSH Decorator with malware that stole SSH keys. Another case that would have been entirely preventable with package signing. I've concluded they don't know what they're doing either.

I'm not surprised if you don't know about it, because it was [dead] on HN as soon as it was posted... which should tell you a bit about the echo chamber you're in here.

https://imgur.com/gdUFToP

danjoc··on Postmortem for Malicious Packages Published on July 12th, 2018
org.simplify4u.plugins:pgpverify-maven-plugin works well for me. But here we are. There's multiple ways to verify package authenticity with maven. There isn't even signatures in NPM. NPM is belligerently against end user security. They won't even accept a pull request if you do the work for them.

https://github.com/npm/npm/pull/4016

danjoc··on Apple Plans to Use Its Own Chips in Macs from 2020, Replacing Intel
https://news.ycombinator.com/item?id=12924051
danjoc··on [dead]
Well regulated means regulation size rounds. Obvious bias is obvious.
danjoc··on Fast, Safe, and Complete(ish) Web Service in Rust
>Having written services professionally in Java I have seen performance scale linearly with connections, until one day it suddenly spikes massively - why?

I'm going to guess: lack of load testing. Something I imagine you still need to do in Rust too.

danjoc··on Oracle Wins Revival of Billion-Dollar Case Against Google
>are we no violating their copyright just by implementing their API?

OpenJDK is GPL. If you comply with GPL, no. This is the problem, Google copied and did not comply with the GPL. Their other option was to pay Oracle/Sun a licensing fee for a commercial license. This is exactly the business model many GPL users follow. Ruling otherwise makes this business model invalid, but it also creates a double standard.

Consider a programming language where you program in types, like Idris. The case is more obvious here. The API is a program. The same applies to Java too, but that seems less obvious. The API is the program that produces compiler output.

danjoc··on Oracle Wins Revival of Billion-Dollar Case Against Google
Good. Initially, I thought the API decision was a bad one, but now I think the courts got it right.

If you've ever wrestled long with getting a program to compile, you realize it's non-trivial to wrap your brain around complex types. The API is a language and the compiler is a runtime producing output. I can design my API in something like Java and return null from all the methods while I do it. The compiler will still produce expected results when I try to string bits of it together.

For most languages, this work is hard, because everything is a runtime error from the compiler. There are elegant and inelegant ways to solve certain problems. The API determines that. It is itself a creative endeavor.

Google was given the opportunity to license the API. They still can under GPL, but that means complying with GPL, which they evidently did not want to do. Ruling in favor of fair use here creates a vague double standard. Business models like that of MongoDB, who releases their code under GPL for open source projects and charges a license fee for private projects, would become questionable. "Well, you give it away already, so it's fair use to use it any way we like without paying you!"

danjoc··on How a Political Engineering Firm Exposed Their Code Base
>the issue would be if it were provided by a foreign entity without compensation so that it is essentially a campaign donation

Have you ever tried to write off open source work as a donation? I don't think this works the way you want it to. Software isn't a donation. Software is speech. Phil Zimmerman proved that rather nicely when he printed PGP as a book.

danjoc··on How a Political Engineering Firm Exposed Their Code Base
"There is no serious person out there who would suggest somehow that you could even rig America's elections" --Barrack Obama

https://www.youtube.com/watch?v=y7F7eRM1oiU

danjoc··on Linus Torvalds Remembers the Days Before ‘Open Source’
I can always tell who doesn't understand software total cost of ownership. They always think the great cost is in creation. Long term maintainers are much harder to come by than short term job hoppers. As Linus said, BSD is great for code you don't care about.
danjoc··on Facebook scraped call, text message data for years from Android phones
Vacuuming up your data is intentional. Google Android. Don't like it? Use/build AOSP derivatives.
danjoc··on Section 230: A Key Legal Shield for Facebook, Google Is About to Change
Snapchat should be on notice. They're in the same business.

https://www.huffingtonpost.com/eric-yaverbaum/is-snapchat-pe...

danjoc··on Section 230: A Key Legal Shield for Facebook, Google Is About to Change
>This law is not good for the internet.

It's not bad or good. It's new rules, and people will figure out how to play by them. If hosts become more liable for what people say, maybe we all go back to self hosting. In my opinion, that would be a net positive, if you can excuse the pun. Right now, the rules allow corporations to control speech. I think less of that is a good idea.

danjoc··on Users Abandon Facebook After Cambridge Analytica Findings
Manufactured outrage. Nobody is leaving Facebook. They're too vain. Even Brian Acton was saying #DeleteFacebook from his Facebook.

https://news.ycombinator.com/item?id=16633630

danjoc··on N?A
>You must log in to continue.

#createFacebook before you can read #deleteFacebook

danjoc··on What Happens When Millennials Grow Up? (2016)
You grow older. You marry late if at all. You have pets, because biology didn't wait for you. I can't tell you much beyond that. I haven't gotten there yet.
danjoc··on The Geeks Who Put a Stop to Pennsylvania's Partisan Gerrymandering
Republican presidential candidate wins for the first time since 1988 in critical swing state. Time to redraw the districts!

Gerrymandering indeed.

https://en.wikipedia.org/wiki/Elections_in_Pennsylvania

danjoc··on Face-verify.js: Monitoring who is physically looking at a website
Coursera required face verification recently. Once I found out, I had my course fee refunded and have not signed up for another course.
danjoc··on Preventative care doesn't save money
>These included immunizations, counseling, and screening for disease. Researchers modeled what would happen if up to 90 percent of these services were used

The science is settled. We have a model for proof.

danjoc··on An American served a year in prison for copyright conduct that is legal in EU
The Berne convention came from Europe, not the other way round. Thank goodness Trump killed TPP or even longer terms would be enshrined in international treaty. I hope that Trump will see through this and not let Hollywood/Tech push him around in NAFTA renegotiation.
← PreviousPage 3 of 27Next →