Hacker News Reader

jasonkeeneon Gophercon 2018 Meetup Stream

This is the meetup page in case you are curious what the talks will be: https://www.meetup.com/Denver-Go-Language-User-Group/events/...

  • 6:50 - 7:20 - Ryan Djurovich: Idiomatic Design Patterns in Go
  • 7:20 - 7:50 - Vasko Zdravevski: Security in Go
  • 7:20 - 7:50 - Peter P. Gengler: gRPC Queue
  • 7:50 - 8:20 - Florin Pățan: Build a Go micro-service with net/http
  • 8:20 - 8:35 - Saurabh Sethi: Fair Scheduling in Go
  • 8:35 - 8:50 - Steven Bogacz: Go Serverless

jasonkeeneon Git submodules revisited

> * Everyone who clones the git repo either forgets or doesn't know that they have to do 'git submodule init' (and maybe update too? even I'm forgetting ...)...

‘git clone --recursive’ Add that to your README’s getting started section. Sounds a bit like you aren’t providing a good onramp for contributors.

> * You cannot add downstream patches to Linux this way...

> * The link is to a non-fast-forward branch of Linux, so the commit hash sometimes becomes invalid... You'd think that because both the module and submodule are hosted on github, that github wouldn't garbage collect the old commit hash, but that's apparently not how it works.

Commits will not get GCed if you have a ref pointing at them. Relying on commits that do not have a ref means they are not part of the official history of that project. You should fork linux and have a branch where you land your custom changes. You can track whatever upstream you want, third party or mainline linux, and rebase your changes on top of them.

jasonkeeneon CSS Based Attack fontface

This can give you the characters but not their ordering or frequency. Still, it's a nice information leak. Yet another reason to disable custom fonts.

jasonkeeneon Rails 4.1.0 beta1 released

Does anyone have any links describing the new CSRF for JS GET requests? Also they misspelled CSRF in the blog post title :/

jasonkeeneon Lavabit founder turned over the private SSL keys as an 11 page printout

You don't get it. Emails were encrypted at rest with the user's password. This was publicly disclosed by lavabit on their site. With the SSL key material the state could decrypt the user's password from network traffic. The encrypted emails and SSL key material are obtained through the courts, SSL encrypted passwords via surveillance, bob's your uncle they can read a user's email. Lavabit wouldn't need to "build" anything and couldn't argue they didn't have the technical capability to turn over SSL keys and encrypted email data. This is why he shut down, so that user's wouldn't continue to submit their passwords over the wire using a compromised SSL key.

jasonkeeneon Brilliant or insane code?

Yeah, I was thinking the same thing. The only downside is that it isn't generic for variable length chunks.

jasonkeeneon Red Pill, Blue Pill: Is the Universe Just a Giant Computer Simulation?

Simulacra.. not simulacrums.. http://en.m.wikipedia.org/wiki/Simulacra_and_Simulation

jasonkeeneon Coursera's Functional Programming - Cheating Discovered

Github already offers free micro plan (5 private repos) for verified students. Unlimited private repos is a rather big hammer and might attract abuse.

edit for link: https://github.com/edu

jasonkeeneon Raspberry Pi computer in action

It is intended to be connected to a television set via Composite or HDMI. I'd assume most families in the UK already have a television set so really the only additional cost is the keyboard+mouse.

jasonkeeneon Try right clicking GitHub's logo

CMD+click WFM

jasonkeeneon #1 CSRF Is A Vulnerability In All Browsers

In order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.

jasonkeeneon #1 CSRF Is A Vulnerability In All Browsers

Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).

jasonkeeneon #1 CSRF Is A Vulnerability In All Browsers

If I'm blocking cookies/referer by default then the onus is upon me to enable them for sites that require them for stuff like this. I wouldn't worry about users who have this issue. Maybe customize django's CSRF failure page to say they need to enable both to use your service and call it a day.

jasonkeeneon #1 CSRF Is A Vulnerability In All Browsers

Yeah this is something I run into often as I don't accept cookies from sites by default and don't send Referer header (both are required for django's CSRF middleware if over https). This is a good read if you are interested in the rational behind these decisions -> https://code.djangoproject.com/wiki/CsrfProtection

As far as a solution for your users, I'd just let them know that you require cookies to login (obviously) and if you are posting over https make sure they have the Referer header which can be forged to just be the domain and not the entire URL if they prefer. I use https://addons.mozilla.org/en-US/firefox/addon/refcontrol/ set to forge for django sites.

jasonkeeneon Ask HN: Best Python web framework

So web2py introduces new members to __builtins__? Coming from a general Python programmer with no "vested interest" I have to say that isn't the best of ideas. len/dict/list are builtins because they are part of the language. They can be assumed to be present in any Python program. Teaching people that these web2py objects are available globally w/o importing them is setting a false expectation. This is pretty much monkey patching even if you aren't overriding stuff. Generally a no-no in the Python community.

With great power comes great responsibility.

jasonkeeneon What’s New In Python 3.3

> Toss me that 100k you're bandying about so easily and I'll have it done by May :)

Considering merge with trunk will probably be done shortly after 1.4 I don't think he'll be getting his money's worth ;)

jasonkeeneon Heroku makes sharing SQL data as easy as URL

perhaps this? http://htsql.org/

jasonkeeneon Rare earth crisis: Innovate, or be crushed by China

https://www.youtube.com/watch?v=P9M__yYbsZ4&t=1h42m05s

(skip to 1:42:05)

Thorium comes up with rare earth minerals.. we can use it as a sustainable source of energy.

jasonkeeneon CERN press release regarding neutrino experiment

I so LOL'd when someone in the webinar pointed out that their measurement wasn't a vector so their paper should be titled neutrino speed not velocity. http://arxiv.org/abs/1109.4897

jasonkeeneon How Our Startup Got Featured on CNN

Yeah, noticed this too. http://www.whyprime.com/temp/yipit-key.png Whoops!

jasonkeeneon Change to Bios will make for PCs that boot in seconds

Yeah, Apple has used EFI for quite a while. My laptop still doesn't boot that fast.

jasonkeeneon US scientists find potentially habitable planet near Earth

"EDIT: I'm getting down voted for doing the math! Seriously?"

"35,000 miles per hour / 60 = 583 miles per second."

I stopped reading right there, please actually do the math if you do the math.

jasonkeeneon Ask HN: My brain refuses to think, what should I do?

If you use a mac check out http://macfreedom.com/ or http://anti-social.cc/ I use freedom every time I have work in front of me that I want solid time to complete and I can't trust myself not to get distracted down some rabbit hole. It sounds stupid at first but two things it does for you over just unplugging from the network is that 1) you can still communicate with your local network/VPN and 2) you can't get back online without restarting your machine.

jasonkeeneon Pi is Wrong

Hah exactly my thoughts!

jasonkeeneon Richard Dawkins interviews Steven Pinker

Yes these are the raw interviews filmed for the making of "The Genius of Charles Darwin" by the BBC. Not really just a hand-held camera, more the style of the production. I find it very interesting, giving a behind the scenes view of the documentary. Exposes a lot of the personal exchanges that normally get left on the cutting room floor. Check out the Dannett interview for some good bits around 37:00

http://www.youtube.com/watch?v=5lfTPTFN94o#t=37m10s

Also I would recommend checking out Craig Venter's interview, was probably the best out of the bunch.

http://www.youtube.com/watch?v=3E25jgPgmzk

jasonkeeneon Tens, hundreds or thousands? - Sagan's message for Mars

On the 25th of May 2008 the Phoenix safely landed upon Mars. It carried with it a DVD made of silica glass, designed to last the tens, hundreds or thousands of years it may take for humans to visit Mars and to rediscover it. It contained messages and artworks chosen for future visitors to discover when humans eventually travel to the planet. Among them was a message from the late Carl Sagan.

Thought it was worth sharing. :)