Hacker News Reader

jackalopeon SanDisk announces 4TB SSD, hopes for 8TB next year.

These days, I get most of my entertainment online and store my code repositories and other permanent data on a home server. I wouldn't know how to fill 128GB on a laptop.

jackalopeon The Internet Is Being Protected By Two Guys Named Steve

IMHO, the original title reflects the tone and content of the article. I didn't feel cheated when I clicked on it, so I don't really consider it linkbait.

jackalopeon Why USB sucks (2005)

I agree. Micro USB was not an improvement over Mini USB. I've never had a Mini USB cable go bad, but easily a third or more of Micro USB cables I've owned are faulty, with barely any stress. Also, Mini USB cables were a huge improvement over standard USB, because I could orient them by feel alone. I've lost that ability with Micro USB, where it often takes three tries to plug it in.

jackalopeon Nokia phones to be renamed Microsoft Mobile

I was trying to put my purchase in context. At that time, I had been locked in a 2 year contract that only got me as far as Android 2.1, which was already obsolete by the time the carrier (AT&T) finally allowed me to update from 1.6. So my options were Android 4.x (fool me twice?), iOS 6 (hated the UI) or Windows Phone (loved the UI and updates weren't being significantly delayed or blocked).

And your analogy is apt. Imagine walking into a computer store today and they're selling PCs with Windows 98 preinstalled with the promise you can upgrade to Vista as "soon" as the manufacturer allows it (currently delayed until they rewrite some incompatible adware). That's what the US smartphone market feels like (or did then), especially with Android.

jackalopeon Nokia phones to be renamed Microsoft Mobile

Because that's what I was using (and leaving) at the time. The Galaxy S III was the leading contender, in fact, but my negative experiences with Android 1.6 and 2.1 (from bad to worse) factored against it. I later supported an S3 for a few months that was buggy and unreliable, so I was happy I didn't get it instead.

jackalopeon Nokia phones to be renamed Microsoft Mobile

At least in the US, consumer choice is significantly limited by the carriers, so I'm not convinced that sales are very brand-driven. Even the same model might use completely different hardware in the US than the rest of the world.

I bought my Windows Phone as an alternative to Android and iOS. The fact that it was a well-made Nokia was a certainly a bonus and an influencing factor, but I had no brand loyalty at the time. I always call it my "Windows Phone" in conversation and never mention Nokia or Microsoft, so it's possible the hardware rebranding will go unnoticed by the average consumer, as well.

jackalopeon Nokia phones to be renamed Microsoft Mobile

I can afford any phone I want, but I hated my (2.1) Android and couldn't read any text on the (iOS 6) iPhone even with my glasses on, so I bought a Nokia Lumia 920 with WP8. So far, I have no regrets, although the decision might have been harder if iOS 7 had been released at the time, with its flat UI.

I support Android, iOS and WP8 phones in my household and the Nokia/Windows Phone 8 is by far the most problem-free, which is ironic because I won't let anyone in the house near a Windows computer without supervision; I normally use Linux and switched the rest of my family to Macs.

jackalopeon Home entertainment implementations are pretty appalling

This software has been written without any concern for security, and it listens on the network by default.

This dawned on me when I intended to switch over to FIOS due to problems with my cable internet connection. I moved all of my media and gaming devices first, then abruptly stopped, wondering why I would want to share a network with a bunch of devices I had no reason to trust. I know I can isolate them on my home network, and may eventually get around to it, but in the meantime, I'm using separate connections to different ISPs (which provides other benefits, as well).

jackalopeon No, don't enable revocation checking

From the article:

Certificates bind a public key and an identity (commonly a DNS name) together.

...when issuing certificates a CA validates ownership of a domain by sending an email, or looking for a specially formed page on the site.

So, if "DNSSEC secures DNS," as you say, why do we need certificates at all? Considering that the CA already depends on DNS to issue (many) certificates, why not cut out the middle man and simply publish the domain's public key in a DNS record? What actual value does a certificate offer other than that? I'm genuinely asking, because I'm curious if DNSSEC provides a way for a domain owner to establish trust in the domain's DNS records, that cannot be tampered with by the domain's registrar.

jackalopeon The rise of functional programming in Banks

The space bar also can't be used to advance the content (in the three browsers I tried). I've been seeing this a lot lately in blogs and it's quite frustrating!

jackalopeon Willem Pinckaers on Akamai's flawed OpenSSL allocator patch

It's a smokescreen. If you were running a version of OpenSSL that supported the HEARTBEAT extension (patched or not) it's easy enough to determine whether or not it was vulnerable, simply by running the exploit code. Any theoretical discussion of how your patch made it invulnerable is pure speculation. They can release packet captures that prove they were invulnerable without releasing any code at all. At this stage, it's all PR.

jackalopeon Why cul-de-sacs are bad for your health

I don't buy it. Cul-de-sacs experience less crime, fewer traffic accidents and are very conducive to taking safe leisurely walks. The problem is that some neighborhoods don't provide efficient pathways for practical pedestrian traffic between major destinations, which isn't caused by cul-de-sacs, but poor planning. Communities that provide pathways between cul-de-sacs away from traffic that connect such points have the best of both worlds. I envy them, because I live in a cul-de-sac that is about a mile from our schools as the crow flies, but the only available route adds 2 miles, driving or walking.

jackalopeon Have I been pwned? Check if your email has been compromised in a data breach

I use this for a little more entropy:

    LANG=C tr -dc "[:print:]" < /dev/urandom | fold -w 32 | head -n 1

jackalopeon Websmart, Inc. and 100,000 Vulnerable Websites

Now imagine that the local news outlet displayed a list of addresses of the homes than can be easily opened without a key. That's closer to what happened here. The disclosure was irresponsible. He could have contacted each site owner individually with information limited to their site. Instead, he sent a mass email to total strangers, putting some of them at risk, then blogged about it. That's stupid and inconsiderate.

jackalopeon Duplicity + S3: Easy, cheap, encrypted, automated full-disk backups

You might want to reconsider this approach. I do something similar, but my remote backup also uses rdiff-backup. While it's awfully tempting to rsync the local backup to a remote location, it puts your entire backup at risk because rsync doesn't care about maintaining the state that rdiff-backup depends on. If your local disk is failing with transient errors, or your local /backup mount point disappears, the next rsync could mirror the corruption, leaving you without any backup at all. It's not worth the time savings and after the initial full backup the network overhead is negligible, even over ssh.

jackalopeon Namecheap now offer .io domains

I moved all of my domains from GoDaddy to Namecheap. I host my own DNS. Recently, I decided to take a stab at implementing DNSSEC, but one condition is that your registrar must support it[1], and Namecheap doesn't[2]. I'm in no rush, but it's a little disappointing. I have no idea if DNSSEC is an option when Namecheap hosts your DNS. They've also only recently added support for IPv6 glue records. Nonetheless, I'm happy to be rid of GoDaddy and find the Namecheap interface to be much simpler and easier to use (concise email notifications of logins and account changes are also nice, and readable in more email clients than the noisy upselling HTML garbage that GoDaddy spews out).

[1] http://www.internetsociety.org/deploy360/resources/dnssec-re...

[2] http://www.icann.org/en/news/in-focus/dnssec/deployment

jackalopeon Encrypted, deduplicated remote backups

EncFS in reverse mode with rdiff-backup would pretty much be ideal, but EncFS currently has two bugs that prevent this from working.

Does anyone know what this refers to? It sounds like a winning combination to me.

jackalopeon Mod_python - the long story

Priority should be given to making mod_python compile for Apache httpd 2.4, so applications stuck on httpd 2.2/Python 2 can be migrated. This is likely to generate the strongest initial interest. Dropping support for Python 2 would interfere, especially where libraries are used that haven't been updated to work with Python 3.

jackalopeon Hostnames

I (somewhat) disagree. Every machine should have a unique hostname that has nothing to do with its function. It should be in DNS and should be the name you use to remotely manage it. Descriptive names should also be assigned in DNS as functions are assigned to the device (either as additional A/AAAA records or CNAMEs). This is flexible and scales well.

Many years ago, I originally assigned descriptive names to machines as I deployed them, but this didn't scale well as we wanted to move services (and their related hostames) to other machines. So I started assigning unique names to machines, using famous figures born on the day of configuration (as in http://en.wikipedia.org/wiki/October_12#Births). That was 'cute' for a while, but now I just generate random 4-letter words and pick the ones I like. The namespace is large enough for my purposes, the names are short enough for easy typing (ssh fang), and everything aligns nicely in text (zone files, inventory, etc.). In some cases, I've even replaced descriptive names with TXT records in DNS associated with the unique name.

jackalopeon The copyright cartel's plot to indoctrinate California kindergartens

And that's just the tip of the iceberg. I blew my stack when my child was assigned this worksheet from the the RIAA's Music Rules! program as homework:

http://www.music-rules.com/pdf/MusicRulesElemActivities.pdf

Part 2 is particularly egregious: "Now find out if songlifting is a real problem in your community. Use this chart to interview family members and friends about where they get their music. Bring your findings back to class and combine them with those of your classmates."

Really?!! You want our children to compile a list of family and friends (identified by age only, but still...) that you believe are breaking the law and hand it in as signed homework? I complained immediately about this not-so-subtle indoctrination and provided the teacher with a link to the EFF's more balanced and accurate Teaching Copyright site at http://www.teachingcopyright.org/.

Songlifting. Give me a break...

jackalopeon Switch to HTTPS Now, For Free

SSL/TLS is entirely a server/client exchange that has absolutely nothing to do with IP addresses. If you get the wrong certificate, you have either a crappy client, a crappy server, a misconfigured client, or a misconfigured server. For each case, there is a workaround, and that is where the inconvenience lies.

jackalopeon He got 1%, we can't hire him

Why start with the interview? Try to find the job listing and submit a resume. Then ask yourself if that was a good use of your time. This part of the process is horribly broken for a lot of employers and they don't even know it.

jackalopeon The story of a little DNS easter egg

One of the reasons they originally chose PowerDNS was that "it seamlessly allowed us to add new records without rebooting."

Can someone explain? What DNS server requires a reboot (or even restart) instead of a simple reload?

jackalopeon Finn – A mount for every smartphone and bicycle

I have several, but I didn't know Androids had offline Maps capability. Also, is it possible to use GPS without an active cellphone account with a carrier?

jackalopeon Do Not Track is not respected on mozilla.org

People get way too offended by analytics tracking when it's there for their benefit.

While I agree with the rest of your comment, isn't it possible that analytics is just snake oil for webmasters? The third party services like GA collect a staggering amount of real-time aggregate data in return for sharing a sliver of it with webmasters in the form of pretty graphs. I'm not saying this information isn't useful, but can webmasters reconcile the results against their own logs? Can they submit sanitized logs for analysis instead of including code in web pages, so they can proactively protect user privacy while sharing only the minimum data necessary for their needs? In any case, analytics services aren't motivated purely by altruism and their business model plausibly extends beyond purely providing a service to webmasters.

jackalopeon Identical Droplets in the DigitalOcean: Regenerate your Ubuntu SSH Host Keys now

I've used iptables as a lightweight IDS for years without incident, so I've found the benefits to outweigh any known risks.

The most dramatic example I have is that I manage a very heavy database-driven web application from an outside vendor that must be public to the entire world. Even a simple request of the home page results in dozens of queries, and users that are logged in put an additional load on resources. I've addressed performance with other optimizations, but since we have no need to generate additional traffic, I have iptables rules to detect unwanted crawlers or pen-testers and block them (based on probes to unused ports/IP addresses, user-agent strings, etc.). When we originally deployed the application, crashes were routine during peak cycles. Now, the server barely breaks a sweat. The ability to implement simple logic in a robust, time-tested software firewall plays an important role.

Other examples include mitigating SSH brute force attacks, port knocking, forensic logging and honeypots. My honeypots protect me from many undisclosed vulnerabilities, simply because attackers are poking around in places they shouldn't be and are automatically blocked. It's much nicer to review a simple report of blocked attacks than it is to troubleshoot a compromised server.

jackalopeon Identical Droplets in the DigitalOcean: Regenerate your Ubuntu SSH Host Keys now

You don't even have to compare the keys. If they exist at all, they are probably copied from the image itself. The first time you start up sshd, it will create new keys. If you are unable to witness this, assume that they are not trustworthy, delete them and restart sshd (or replace them with keys you've generated locally).

The common problem is that sshd was started before creating the final image, so it has keys that are duplicated by provisioning. Always delete the keys before committing the final image, so that sshd will create new keys the first time it runs.

jackalopeon Your iPhone and iPad Are Limited. T-Mobile is the Exception

I just added two iPhone 5s to my AT&T family plan, and I regret it. They use up their data allotment in about 4 days, even if they never leave the home wifi, so I insist that the cellular data is kept off and only enabled when needed. Meanwhile, the WP8 and Android devices on our plan use only a fraction of their data allotment each month. Is it possible that Apple is responsible for this problem, and should do something about their devices being such data hogs?

jackalopeon The house I was born in sold for $4000

If you do your homework, a house can be:

- A big piggybank.

- A safe, stable living environment for your family.

- A way to get a quality education for your children at a bargain price.

- Tweakable in a way no rental can ever be.

Home ownership isn't necessarily a burden. It can be a liberating experience in many ways.

jackalopeon Stop Using Arial & Helvetica

Personally, I'd rather see content delivered in a sane standard format and let users apply stylesheets that match their own preferences or needs.