dmboyd

Does anyone have any idea on the background on who's behind this?

The fact that there are no names doesn't exactly instill trust or confidence.

Closest I could get to info would be that the Southern Payment Systems Pty Ltd resolves on a google search to: http://www.southernpaymentsystems.com/ which seems to share the street address of a Designer(http://speakinteractive.com/), a real estate agency(http://www.eftosestates.com.au/) and a ruby on rails developer(http://brownbeagle.com.au)

[update: never mind, found one of the co founders, http://dompym.com/ pretty impressive, he's ex SAP and ex Clear Interactive, acquired by the NZ exchange]

Well... No, it'd be like if ubuntu required you to sign up to corporate licensing in order to use Ubuntu. Then handing out misconfigured keys to corporate customers which could also be used to sign repos as an unfortunate side effect.

Most info I can get on this is through a reverse engineer done in 2004 of the RDP (http://efod.se/media/thesis.pdf), it was established that when terminal services set up in Application Server Mode(i.e. corporate environments) its configured to sign requests using the x509 protocol. Wouldn't be much of a stretch to extract the certificates used if they were configured incorrectly. My guess is that due to this being engineered as a licensing issue (i.e. DRM added after the fact and not as a trust issue) corporates weren't issued with specific certs, theres very little that could be done to trace down the point where this leaked.

Funny that this and this: http://news.ycombinator.com/item?id=4062134 are front page.

Out of the fortune 500, only 320 were there five years ago.

If you invest in the broad market with silly things like gross revenue, or current market cap deciding your portfolio make up, you'll loose money in real terms in the long run. I'm not saying you should pick stocks, but you can easily go through a list of the top 50, and exclude those who are either overvalued on a P/E basis with regards to their growth prospects, and invest on that basis.

Am I reading it wrong or did someone spoof a request to the terminal server licensing service? Or was it because they were relying on old compromised SHA1 algorithms?

100%? so now instead of taking X amount of time to do something, it takes 0 time (X-X*100) to do something? Or have I completely misunderstood what a % performance improvement is?

Considering that in this case the "public end users" are the ones who are most at risk due to this vulnerability, I think its fair game that this be a public disclosure. i.e. people should delete this browser add on (and anything signable with the same key) as its been compromised.

Probably the obvious fix is for them to change the auto update path to https rather than http on a subsequent update. Are there any good reasons why this wouldn't have been done in the first place?

Aside from the NIH'ism which undoubtedly started this, This looks pretty nice and its very well documented.

> Hahaha, where do you come from that you think a janitor gets payed $20/hr?

This is the case in Australia

Isn't the hardest aspect always going to be getting browser support for NAT PMP?

My only exposure to digital river has been attempting to purchase windows anytime upgrades. I say attempt, as the process just doesn't work.

Its pretty surprising that Microsoft (who run a reasonably functional store on xbox) cant figure out how to run their own online store.

Has there been any talk about which company received the subordinated cert? The excuse for it being used in an internal network only doesn't really hold any weight due to the ability to install custom certs on all web browsers.

While obviously based around the live linux distros, windows to go does sound pretty amazing.

It doesn't sound too difficult to extend this and use a phone capable of mounting as mass storage and boot your desktop off of your phone. A Windows Windows Phone anyone?

Depending on what you're after, there's either the native app lookalike : http://www.chocolatechip-ui.com/

or you could go with a collapsible column grid along the lines of http://fluidbaselinegrid.com/ where by you have the one code base for mobile and desktop browsers.

> We support the bills’ stated goals "providing additional enforcement tools to combat foreign "rogue" websites that are dedicated to copyright infringement or counterfeiting"...

Why doesn't anyone just call bullshit on the whole concept of the US extending its law to apply to the rest of the world?

Yea I've heard that the Microsoft stores sell everything crapware-free, but this doesnt help me as Microsoft stores are a US only thing

> It's loaded with junkware, because paying two grand for a laptop doesn't get you a system that hasn't been sold to someone else.

On this topic, does anyone know of any major manufacturers who dont do this with their consumer machines? I have had really bad experiences of late with Dell, Toshiba and HP, to the point where they come with what is essentially malware built in. As one example, our latest dell purchase redirects search queries, puts a link to ebay on the desktop which comes back once deleted, and prevents you from adding an alternative search provider to IE.

Congrats to designcrowd on the funding, however it seems like a clone of 99designs. IMHO I'd think there's a market for a different take on crowd sourced design, especially seeing as though there's such a huge backlash from the anti-spec work front. Something like a sortfolio for general design work perhaps?

Youtube (http://i.imgur.com/VIwYx.png) doesn't fare too well. It's like they've never heard of the law of diminishing returns. Which is surprising seeing as though Google adwords was launched and is heavily based around an unobtrusive targeted ad-mix as opposed to the flashing GIF / "punch the monkey" style of ads which were prevalent before adwords.

It's like a variation of "fight or flight" instinct. You encounter a boundary and you either "Push through and solve it" or "throw a tantrum and blame other people".

This is a non-starter, you don't really deserve a job if you cant see what is wrong with the following:

1) The web service storing usernames and passwords in an unencrypted or easily reversed encrypted format. (which it must be, since you are able to send an email with these details).(Hint: see the gawker media password leak)

2) Your email address being sent in plain text over an unencrypted mail service with untrusted intermediaries.

These arguments seem to largely revolve around the significance of versioning. Ie. "is it really 8, is it a new product?" It seems that versioning as a method of driving sales of new copies of windows hasnt really worked since windows 98, as every iteration since has required a hardware upgrade to use. And when you buy a new computer it tends to include a licence for windows, and at least in the last few years PC sellers even tend to be very slow to include new versions of windows on new pcs (for example, dell still advertise models with XP included, an OS which is over 10 years old at this stage), so there's evidence for the argument that new releases of windows have a negative effect on sales.

Always looking to self promote

  > "what about Ruby!"

Arguably one of the most powerful force multipliers inherent in ruby is the object order, which is definatively derived from the Japanese language subject-object-verb syntax (http://en.wikipedia.org/wiki/Subject%E2%80%93object%E2%80%93...).

I like where this is going, ie. Hardware becomes just another software component.

The key item thats left is some sort of standard interface to port programs to a FPGA style processor, i.e. a way of interfacing between a language compiler and HDL.

I like the look of the Reduceron (http://www.cs.york.ac.uk/fp/reduceron/) which looks to be funded by Xilinx and Lava( by Satnam Singh, who works for Microsoft Research), purely because I think its easier to visualise a functional language translating into circuitry.

Although I do wonder whether it will take a start-up to be able to successfully merge both the software and the hardware components into a workable model.

Having an exit, I think in this context is more about having an appropriate platform to pivot. I mean, no person or product lasts forever.

Mavis beacon teaches typing.. Seriously?

Native extension seems like a great way of them inadvertently killing off the platform. I mean they can't market it as being a run-time for a cross platform app ecosystem if they allow/encourage platform specific code can they? Or am I missing something?

Awesome, now to think of a small project to try it out.