HNHacker News
TopNewBestAskShowJobs

davis_m

794 karma · joined November 5, 2010

[ my public key: https://keybase.io/mpdavis; my proof: https://keybase.io/mpdavis/sigs/-CxQ66zUGNW2NjKgbiWPpcP6fQ7YmrU8sej6-MUiChw ]
submissionscomments
davis_m··on US Senate votes unanimously to make daylight savings time permanent
> if you're dying because the clocks changed and it was too much of a burden for you to re-adjust (like literally everyone else does) then oh well.

It's a good thing everyone's actions take place in a bubble and have no effect on others.

davis_m··on US Senate votes unanimously to make daylight savings time permanent
There is no "implementation date" in the current text of the bill. As written, it would take effect immediately.
davis_m··on US Senate votes unanimously to make daylight savings time permanent
The time most people wake up is dictated by when they need to be at work. They can't simply "get up later".
davis_m··on A recruiter lined me up an interview. With the employer that just fired me
Names aren't unique. I have a pretty common name, I even have the same name as someone else at my current (not very large) company.

Should I be blocked from everywhere that has fired someone with the same name?

davis_m··on JWT Tokens are NOT safe
Holy hyperbole, Batman.

This is just a straight marketing post for Redis.

davis_m··on Dropbox to cut 11% of its global workforce
> "The move will affect 315 people, who will be notified by the end of the business day."

I'm guessing more than a few found out from this article directly. What a rough way to find out you were laid off.

davis_m··on Giving Americans Money to Offset Coronavirus Impact Gains Support in Congress
Does it have to be one or the other?
davis_m··on A Peek Into Graviton2
What sort of testing would you need to do in order to make purchasing physical machines simply for testing financially beneficial?

Not to mention the environmental impact of doing so.

davis_m··on Trading halted as U.S. stocks plummet
Would you want to get into the market if it wasn't a system built around increasing market value?
davis_m··on A History of Pizza
How does one eat that?
davis_m··on Tesla’s Summon-Your-Car Feature Spurs U.S. Safety Inquiry
All of the videos I have seen of the summon feature have been pretty bad. A lot of time the vehicle can't seem to figure out what to do. I imagine that will get better with time, but if I had a Tesla I wouldn't be using it now.

I'm surprised they released the feature as-is.

davis_m··on Cadence: Uber's Workflow Orchestration Engine
> Obviously it is also a good fit for low scale use cases.

Is this a given? Just because something is necessary at scale doesn't mean it is a good fit for low scale use cases. I would expect the opposite is actually true.

davis_m··on Are Mail-Order Meal Kits Doomed?
I have long thought that there is an opening for local grocery stores to take a lot of this market. Many of my local supermarkets (HyVee, Walmart) allow for online ordering, but they all require the user to input items one-by-one. If they added a feature to add entire recipes in a single click, I think they would do very well for themselves. The additional cost of adding a recipe card would be negligible.

The customer's cost isn't increased over regular online ordering, and there isn't the issue of increased packaging. The food is fresh from the local supermarket and doesn't have to be shipped, beyond at most a local delivery.

davis_m··on Are Mail-Order Meal Kits Doomed?
Does the group of people who meal prep line up with those that don't want to think about meal prep? One of the benefits of these meal prep kits is that you end up with a freshly cooked meal. If you are going to be eating a prepared meal, why not just let the service send it fully ready to go?
davis_m··on Interview with Mr. Money Mustache
You are forgetting taxes (FICA, state and federal income taxes, etc), which would eat up a significant portion of those savings.
davis_m··on The Equifax breach may be the worst leak of personal info ever
Would it?

I can imagine at least some companies would stop worrying about security since they are insured if something goes wrong.

davis_m··on Supreme Court asked to nullify the Google trademark
"There is no single word other than google that conveys the action of searching the Internet using any search engine,"

How does "search" not convey searching the internet using any search engine?

davis_m··on Timing attacks and usernames (2012)
Remember that many services are running in a cloud computing environment. Attackers can spin up machines right next to those that they are attacking and bypass much of the network related variables.

Timing attacks aren't as simple as often presented. Writers often give a set time for checking each character and ignore all other operations in order to make the issue easy to understand, but most people use this to write off the attack altogether. Surely it can't be that simple.

It isn't trivial to take advantage of timing attacks remotely, but researchers have shown that they are definitely exploitable. [1][2]

[1] https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf [2] https://www.blackhat.com/docs/us-15/materials/us-15-Morgan-W...

davis_m··on A Tech Lead’s New Project Checklist
I think it is possible to have a successful team of one. Customers aren't usually included as part of the team.
davis_m··on Things to Use Instead of JSON Web Tokens
You can run into issues with headerless JWTs when you can't (or don't) guarantee the order of the header. Since the header is included in the signature of JWS objects, you must reattach a header that is exactly the same, and not just equivalent.

For example, both of these decoded headers are equivalent:

{ "alg": "HS256", "typ": "JWT" }

{ "typ": "JWT", "alg": "HS256" }

Obviously, these encode to two different values. If you reattach the wrong one, signature verification will fail.

Disclaimer: I maintain a Python JOSE library and have had to answer questions related to this on more than one occasion.

davis_m··on Facebook accepts slightly mis-typed passwords
The only people that can positively rule out plaintext storage are Facebook engineers, which are generally competent, especially with something as simple as storing password hashes.
davis_m··on Show HN: Staffjoy V2 – Text message-based employee scheduling app
This looks like a great idea. There were a few times I got in trouble at work in high school because I didn't see updates my boss had made after I checked the schedule. This would avoid any of the he said/she said BS.

Can this be used for covering shifts. When I worked in a job like this, we were allowed to get shifts covered, as long as we found someone to cover it. It would be neat if this service could be used to text everyone that is eligible to cover a shift for the opportunity for extra time.

"Your coworker is looking for someone to cover their front desk shift, Fri 12/9 from 3:00 PM to 11:00 PM. Would you like to cover it?"

davis_m··on New Tesla Model S Now the Quickest Production Car
2.5 seconds to 0-60 and only 2.7 seconds 0-100?

That would be a pretty scary 0.2 seconds. Some back of a napkin math puts that at around 32,000 g.

(I assume that was a typo)

davis_m··on New Tesla Model S Now the Quickest Production Car
The announcement is for a 100 kWh battery, which will extend the range.
davis_m··on New Tesla Model S Now the Quickest Production Car
Very true. The HN title mislead me and I thought there was no way it was true (which it isn't)

Even the "quickest" is up for debate since this only measures 0-60 time, but I think it is leaps and bounds more accurate than "fastest".

davis_m··on HTTPS for GitHub Pages
I would hope not. If Github could generate valid SSL certs for random domains, something would be very broken.
davis_m··on How We Build Code at Netflix
It means updating infrastructure by making changes to a versioned service definition instead of on running instances.

Would you fix a software bug by editing the code on a running server and tell yourself that you will add it to the repository later? Of course not. You would end up with a running instance of the code that is impossible to replicate.

Immutable infrastructure applies that same idea to running services.

davis_m··on Amazon Echo Dot
I would be super interested in Echo in my car, but mostly because I don't have one of the fancy new cars that connects to my phone over bluetooth for that sort of stuff.
davis_m··on Amazon Echo Dot
> Echo Dot is available in limited quantities and exclusively for Prime members through Alexa Voice Shopping. To order your Echo Dot, use your Amazon Echo or Amazon Fire TV and just ask:

I guess technically you don't have to already have an Echo, but it is only available through voice shopping.

davis_m··on Amazon Echo Dot
Ah, I didn't notice that it hooks up to existing speakers. I'm curious how many people will use that however. My anecdotal experience is that most of the people that actually own an Echo are fairly tech illiterate and benefit from it being an self contained package, but that may change if the Echo API is extended.
Page 1 of 4Next →