HNHacker News
TopNewBestAskShowJobs

dyu

121 karma · joined April 16, 2007

submissionscomments
dyu··on How Zillow's homebuying scheme lost $881M
While it is true cash offers in the strict sense mean real cash, it may also mean no-contingency offers. You can go through mortgage underwriting first and commit to pay the gap between appraised value and deal value, and can make a no-contingency offer with minimum risk. Or, if you are willing to lose your deposit (usually 3-5%) you can also make a no-contingency offer to be more attractive.
dyu··on Executive Order on Improving the Nation’s Cybersecurity
US federal gov has their own PIV/CAC
dyu··on Robinhood Files Confidentially for U.S. IPO
A short is not an option contract
dyu··on They want us to be compliant, not secure
I've had luck showing that the cloud provider fulfills the 'local backup' requirement as part of their compliance (provided they do meet the same framework that you're trying to meet), and us inheriting the control from the cloud provider.
dyu··on They want us to be compliant, not secure
They could be referring to the list of FIPS-validated crypto modules.
dyu··on Ask HN: What's your quarantine side project?
clquery, a SQL interface to cloud resources. Using SQL and tables to interact with AWS (and eventually others) makes it easier to quickly query and join across various resources and services without needing to remember how to make and parse the underlying API.

`pip install clquery` or https://github.com/dongting/clquery

dyu··on Show HN: Insomnia Designer – Open-source collaborative editor for API design
Can it use an exportable/importable file as source of truth which you can then check into git?
dyu··on Launch HN: Castodia (YC W20) – Populate Google Sheets from databases
Also worth looking into using ALB instead of API Gateway, and have ALB call Lambda (I think this is possible).
dyu··on Cambridge University Press make their books free until May
To be fair, this is exactly CUP's intent.
dyu··on Text Processing in the Shell
It appears sort has a --stable flag for order preservation. I actually thought sort was stable by default already, but now I know.
dyu··on Hacking GitHub's Auth with Unicode's Turkish Dotless 'I'
I believe you are correct. However, this particular example may not be the best one, see: https://en.wikipedia.org/wiki/Capital_%E1%BA%9E#Current_situ...
dyu··on Airbus hit by series of cyber attacks on suppliers
ISO27001 (the main security one) has annual reviews which are more lightweight. After two years, the three-year cycle restarts.
dyu··on Cybersecurity Pros Name Their Price as Hacker Attacks Swell
from your website: HIPPA should be HIPAA
dyu··on How many kinds of USB-C to USB-C cables are there?
Sounds like the Boeing 737 MAX problem (without the killing part).
dyu··on AWS Control Tower
You can also check out https://divvycloud.com/, which is similar and supports a few other clouds.
dyu··on Why people confess to crimes they didn’t commit
I am not well-informed, but according to https://en.wikipedia.org/wiki/Miranda_warning :

>If you cannot afford a lawyer, one will be appointed for you before any questioning if you wish.

dyu··on Google Cloud Is Down
Different locations see different counts because of aggregation/de-aggregation.
dyu··on SaaS CTO Security Checklist
the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.
dyu··on Ask HN: Why are phone numbers considered a secure personal identifier?
Also a nasty surprise when you travel to another country and realize your mobile plan cannot have roaming, and you have no service at all.
dyu··on Design Patterns for Managing Up
Also used in research grant proposals
dyu··on The Chinese scientist who allegedly created CRISPR babies is being detained
It's like editing a piece of code without fully understanding what it does, without unit tests, and your text editor may be buggy.
dyu··on Gravitee: Open-Source API Gateway
I'd say it's lower in the stack, and probably for a different audience. If you really wanted to, you can probably implement BeyondCorp using (but not only using) this or one of its competitors mentioned in this thread; but it's only part of the equation and leaves out the authorization logic of BeyondCorp.
dyu··on Quora User Data Compromised
As an example, consider an army attacking a defending army. The defending side is as good as the weakest member, because you can presume the attacking side to be looking for the weakest part and attacking that. On the other hand, the attacking side is as good as the strongest member, and having a few weaker members is ok. It is generally harder to make sure you have uniformly good defense, than getting a few really good people to spend dedicated time attacking.

Of course, this model assumes that as soon as you have penetrated the perimeter, the rest becomes easy. This is the more traditional model. People are increasingly adopting a you-are-already-hacked approach, which makes it harder to move laterally once someone gets in. However, the general challenge still applies.

dyu··on Ansel Adams’ pictures of LA recall an era of war factories and 10-cent hot dogs
I think they provide the machines as an incentive, and in turn it can only dispense their brands.
dyu··on XSStrike: XSS detection suite
Interestingly, as of last year Azure no longer requires advance notice: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engage...
dyu··on Google's interview system: it's not about solving the problem
If you are in California, the employer is now required by law to disclose salary range.
dyu··on Tesla Faces U.S. Criminal Probe Over Musk Statements
You can do a straddle and get the best of both sides.
dyu··on The Secret API of Banks
FYI if they enter the final amount incorrectly you can dispute the charge with your credit card provider. It's probably a stronger case if you kept your own copy with the final amount that you wrote down.
dyu··on PIN number analysis (2012)
If you are interested in this sort of analysis, I recommend reading into works by Joseph Bonneau: http://jbonneau.com/publications.html
dyu··on Let's code a TCP/IP stack, 1: Ethernet & ARP (2016)
It might not be the author's intention, but I think there is now a push for MAC addresses to be 64 bits instead of 48.
Page 1 of 3Next →