Hacker News Reader

jackalopeon Surveillance and the Internet of Things

Be careful when doing this. Some systems require an email address and employees will make one up to get to the next screen. If that address is valid (or not bounced), someone can get control of your account with something as simple as a password reset.

jackalopeon A Modest Proposal for Improving Website Authentication

There's HTML's rel="next" & rel="prev"[1], but that doesn't help if you want pagination on non-HTML resources (like a slideshow of raw images, or an audio/video playlist).

There's an interesting article on Technical Taco, "Range header, I choose you (for pagination)!" The author makes a good case.

[1] http://www.w3.org/TR/html4/struct/links.html#h-12.1.2

[2] http://otac0n.com/blog/2012/11/21/range-header-i-choose-you....

jackalopeon A Modest Proposal for Improving Website Authentication

I also considered using a DNS resource record (like SPF and DKIM), but HTTPS is more secure.

What is the reasoning behind this statement? Resolving the hostname for the HTTPS site still requires DNS. Is it because DNS isn't encrypted, so a MITM could change the POST URL? That's an issue with unencrypted HTTP, also, so you couldn't safely send this header on non-SSL pages. You'd need a login link that goes to an SSL-protected page first, in which case this just adds an extra (no longer useful) step.

jackalopeon Https URLs posted in private Skype chats visited by Microsoft

Another possibility was that the hostnames were leaked via the SSL certificate. I've seen evidence of spiders using this for discovery, including Google. Your best protection in that case is to use a wildcard certificate, if you want it to validate.

jackalopeon Collection of the best fonts for programming

They're not. That comparison was taken from the Inconsolata-g page and is either outdated or inaccurate. Visit the Inconsolata page to see the actual font (which hasn't changed since 2009, I believe): http://levien.com/type/myfonts/inconsolata.html

jackalopeon Immutable URLs

Once upon a time, I drank this koolaid, but no more. Many things in life are ephemeral, including information. To suggest that a webmaster's responsibility is to hoard data for eternity is both scatological and counterproductive. As the Web matures, it is threatened far more by the growing mountain of obsolete information that must be ignored in order to find anything timely and relevant. I would much rather see these pages deleted if they aren't going to be updated, even if it means broken URIs, which will eventually fade away.

jackalopeon Trojita: an IMAP mail client

I use mutt's built-in IMAP, POP3 and SMTP. It works flawlessly for me (Mutt 1.5.21).

jackalopeon How to implement HTTPS in an insufficient manner

I could cite multiple reasons, but the main one I see is that the people who pay for and specify the requirements of a project are often nontechnical and don't delegate any decision making authority to technical personnel, no matter how much talent is in the pool. Repeated attempts to bring up issues are met with blank stares, as if a foreign language is being used (and to nontechnical people, it is). I've gotten calls at 5 PM on a Friday that "Our new site (hosted on a third party server) is going live on Monday! We need a domain and an SSL certificate." In a corporate or institutional environment, bureaucratic obstacles can make such a request impossible. Throw in a VIP who won't budge, and you're about to ruin the weekend for multiple employees who will remain gun-shy about disclosing any problems in the future.

jackalopeon Appeals court upholds legality of Aereo’s “tiny antennas” scheme

"...it was fair use because the ads were preserved..."

Since when does fair use require the preservation of ads or any specific portion of the content? Your argument dilutes the meaning and intent of fair use. Even the matter of being free or not has no bearing. The majority wisely avoided this area and fundamentally upheld the fair use rights of the users. The dissenting opinion confuses the issue by discussing licensing agreements, even going so far as to suggest fair use is somehow illegal.

jackalopeon Global Internet slows after 'biggest attack in history'

It's extremely unlikely that spoofed headers or the lack of an SPF record would get you listed on an RBL, especially Spamhaus. I can't guess what happened in your case, but somehow your IP address obtained a bad reputation or was unlucky enough to be in a tainted block. FWIW, the very first thing I do after getting an IP allocation is run an RBL check on it and demand a replacement if it's listed anywhere.

jackalopeon Persona is distributed. Today.

Even worse, Persona promises that "Developers get a verified email address for all of their users," which might be mistakenly construed as some degree of identity assurance, which can't be guaranteed by this system at all, especially when a fallback is involved.

jackalopeon Persona is distributed. Today.

But requesting a resource without knowing it exists is abusive, and the fact that more and more developers think it's an appropriate means of discovery is becoming a serious problem. It saps resources, fills logs with noise, and can trigger intrusion detection systems.

I don't think the Persona project recognizes what a barrier to entry the lack of a reasonable discovery method really is. There are a host of potential issues:

1. For the alice@example.com identifier, it assumes that example.com has an A record. Many, many organizations choose not to have an A record at the top level, while still publishing an MX record to support email addresses.

2. If there is an A record, it assumes that there is a web server listening on port 443. If there isn't, /.well-known/browserid can't be retrieved. What is the fallback mechanism, and how does it affect our users if we adopt Persona in the future? What if this probe is flagged by an IDS, blacklisting the source IP?

3. If there is a web server listening on port 443, it assumes that it will serve resources for example.com. What if it doesn't and gets the /.well-known/browserid from the default host, which is an entirely different domain? What if this probe for an unsupported host is flagged by an IDS, blacklisting the source IP? What if example.com isn't the CN or a SubjectAltName in the SSL certificate? Is the certificate validated? Do I now have to purchase a commercial certificate for a domain that I never intended to be a web site?

4. When a user first enters an identifier, such as alice@example.com, it assumes this is not only a valid email address, but a valid login. What happens if a user has used an email alias in the fallback that cannot be used to authenticate in our system when we adopt Persona? What if the organization doesn't support Persona, and doesn't want its domain used in the fallback mechanism? Is there an inherent identity theft risk in using a fallback system? Can a rogue web developer create a temporary /.well-known/browserid and backend that will allow them to authenticate as anyone at the organization, then cover their tracks by removing the file?

All of these issues can be neatly solved with DNS discovery. If an organization wants to support Persona, let it publish an SRV record. If one doesn't exist, Persona should tell the user, "Your domain does not support Persona."

jackalopeon Moving your Contacts and Calendar Away from Google

Data corruption is unforgivable. My bank might have have better accountants, stronger safes, great hours, terrific customer service and round-the-clock security, but you can bet that if they randomly lost my money on a regular basis (or even once?) that I'd withdraw it and stuff it in my mattress until I found a better alternative.

jackalopeon A story about Vienna. (an interactive narrative infographic)

Wow. When I ran OS X Leopard on this 17" MacBook Pro w/4GB RAM, all the fancy pages posted on HN used to peg my cores at 100% and made the fans roar like jet engines. Now I'm running Slackware Linux (64 bit) on it, and this page is running as smooth as butter in Firefox 19.0.2. It's nice to be at the other end of the spectrum, for once. It runs almost as smoothly in Chrome, but with a little more jitter during the transitions and a bit more CPU usage. Not so nice in Opera, which is struggling to get all the pieces working and kind of ruins the experience.

jackalopeon If A Driverless Car Crashes, Who's Liable?

Yes. If self-driving cars significantly reduce accidents, insurance companies can use it as incentive to lower rates. The rates for cars that can only be driven manually might even skyrocket.

jackalopeon Could the eagles have flown Frodo into Mordor? (2000)

Are we to believe that these are some sort of magic eagles to which the laws of physics do not apply?

jackalopeon Not convinced by rolling releases

From the same article:

RHEL trees are forked off the Fedora repository, and released after a substantial stabilization and quality assurance effort.

Which adds a quote from the Fedora Project:

Red Hat Enterprise Linux is a commercial enterprise operating system and has its own set of test phases including alpha and beta releases which are separate and distinct from Fedora development.

And on that page[1] it states that RHEL6 is based on a "Mix of Fedora 12 Fedora 13 and several modifications".

Sorry to be pedantic, but that's significantly different than the Slackware model. Maybe it's just PTSD; I fled from RH in the old days onto the path that led to Slackware, so any comparison makes me touchy.

[1] https://fedoraproject.org/wiki/Red_Hat_Enterprise_Linux?rd=R...

jackalopeon Not convinced by rolling releases

I'm not sure I agree with that comparison. Slackware-current will become the next stable release once all of the kinks have been worked out. Is RHEL ever really a snapshot of Fedora?

jackalopeon Unix tricks

The ServerAliveInterval option might also help with another issue mentioned in the post:

'sshfs_mount' is not really stable, any network failure will be troublesome'

To avoid trouble with remote backups and other long running processes, I always add the following to the end of ~/.ssh/config or /etc/ssh_config:

    Host *
        ServerAliveInterval 300

jackalopeon Unix tricks

I use agent forwarding often, but you still need to be careful, especially if you forward your agent to a machine not under your control. From the ssh man page:

Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.

Consider using a dedicated key for each of those circumstances, set sane defaults in your ~/.ssh/config on all machines, and be very careful about what ends up in any of your ~/.ssh/known_hosts files, as they provide a road map to other destinations.

jackalopeon Could the eagles have flown Frodo into Mordor? (2000)

One merely has to refer to RFC 1149[1] to determine why this solution is obviously unacceptable:

"Avian carriers can provide high delay, low throughput, and low altitude service."

"...only guarantees best effort delivery, loss of a carrier can be tolerated."

"...storms can cause data loss."

"Audit trails are automatically generated, and can often be found on logs and cable trays."

And probably most important:

"Security is not generally a problem in normal operation, but special measures must be taken (such as data encryption) when avian carriers are used in a tactical environment."

The only encryption method available is for the bearer to wear the ring, and Sauron has already cracked the key.

Avian carriers are only appropriate when it is feasible to have "persistent delivery retry, until the carrier drops." They're ruled out for this mission simply because there are no second chances.

[1] http://www.ietf.org/rfc/rfc1149.txt

jackalopeon How I came to love Windows again

I haven't tried Windows 8 on a desktop, yet (I couldn't get the consumer preview to work on any of my machines or in a VM). But I did switch from an Android to a WP8 phone and couldn't be happier. In that form factor, WP8 is exactly what I want and the UI is really well designed. I haven't used Windows since XP (and keep an XP VM for any work that requires Windows), but I'm actually quite interested in trying out a touch-enabled Windows 8 laptop based on the positive experience with my phone.

Edit: I should add that my main environment is Linux running dwm in monocle mode on a 17" MacBook Pro. Noone could be more surprised than me that I would be intrigued by a new UI coming from Microsoft.

jackalopeon Show HN: QR Codify, The Most Useful Snippet I've Ever Written

You can do it locally with qrencode[1], which is available via MacPorts and Homebrew. It would probably simplify the script, too (especially if converted to bash).

On an X11 environment, I can select some text and get the same results on the command line with something like:

    xsel | qrencode -o - | feh -FZ

None of these commands are standard on any distribution, but you can easily install them or use alternatives. You can also make this an alias, hotkey, etc.

[1] http://fukuchi.org/works/qrencode/

Edit: No need for temporary file

jackalopeon The HTML A element is broken

It's a fair point, though. The href attribute tends be very long, so if your criteria is readability, do you opt for attribute soup or put it in a wrapper div or span? It's a subjective decision, and I don't think there's a right or wrong answer, but examples should reflect real world situations.

Either way, I think href should be a universal attribute (obviously, it wouldn't make sense on something like br). It offers a lot of flexibility and is probably no more subject to abuse than anything else. I don't see how browsers would have a problem implementing it. Just look at the 3D view of a complex page in the Firefox Inspector to get an idea of what they're already coping with.

jackalopeon How I spend my first 5 minutes on a server

I see, but I think the same principle applies, even in this narrow case. As a server admin guy or fellow software dev guy, I have to trust that any code you've written has been properly reviewed before checking it into a repository that I pull from. Fortunately, version control tools make this trivial, but you're right, the policy and infrastructure supporting it has to be in place, otherwise you're depending only on voluntary peer review.

Note that as an attacker, there's a high risk of exposure and identification in the scenario you describe, and that's a good thing. A well secured system shouldn't merely prevent attacks, it should also protect innocent users from suspicion (another reason why shared accounts are discouraged).

jackalopeon How I spend my first 5 minutes on a server

Maybe this is considered a preinstallation step, but the very first thing to do is set the system time on the hardware, before you even boot the OS for the first time. Then the first step after booting is to confirm the time and reset it, if necessary. This is essential for accurate and usable logs, file times, version control timestamps, etc.

It's also a good idea to ensure that sshd has fresh keys that are unique to that machine. Hopefully, your images are installed without sshd keys, otherwise you'll have multiple servers with the exact same keys, which is considered bad practice. During initial configuration before deployment, you might want to remove the keys so that sshd will create fresh ones when it starts:

    rm -rf /etc/ssh/ssh_host_*

jackalopeon How I spend my first 5 minutes on a server

Your private key should have a strong passphrase. I agree that using a passphrase-less key is bad practice. As for keyloggers, once they obtain your password, they have succeeded. But after obtaining a key's passphrase (which you normally only type in once a local session if using ssh-agent), they still need the key, which may or may not be marginally harder. It's still another step to overcome. So, even if it can be shown to be only a narrow improvement over passwords under certain circumstances, it's a big win in convenience and even security under normal circumstances if done properly. Give it a try, finetune your ~/.ssh/config and you might end up loving it.

jackalopeon How I spend my first 5 minutes on a server

Quite the contrary: You're probably going to end up with documented procedures for deploying software that are simplified, follow existing standards/best practices, and don't rely on complex stone soup build/init scripts concocted by inexperienced developers (and I've seen some doozies).

A developer is more likely to create better and more easily maintainable software if the target audience is assumed to be an ordinary user with no special system privileges. In my experience, when a developer has root and assumes everyone else does, deployment becomes a nightmare.

jackalopeon Pkgsrc on OS X

Before Software Update was integrated with the Mac App Store, Xcode was an optional install from the DVD that was also freely and anonymously updated via Software Update (beginning with Snow Leopard, I believe). It allowed me to freely and anonymously use my computer in a way that I wanted, so requiring an Apple Id makes it feel like that freedom was taken away. Everyone has a line somewhere, and that was the one I couldn't cross. Why do I need Apple's permission to install Mutt? It seems crazy and, yes, offensive to me.

jackalopeon Pkgsrc on OS X

But it still requires an Apple ID, and that's what bothers me. Xcode should be an optional install included with the OS or downloadable anonymously. After all, I need it to install free software with MacPorts/Homebrew/pkgsrc, so I don't think my position is unreasonable, even if it seems extreme or impractical. It's just the line I wouldn't cross myself. With Linux, I don't have to, so I'm enjoying the alternative while it still exists.