HNHacker News
TopNewBestAskShowJobs

juliusmusseau

517 karma · joined April 28, 2016

@juliusmusseau - https://mergebase.com/ - securing the software supply chain (well, trying to!)
submissionscomments
juliusmusseau··on “Cat Person” and Me
Good fiction is not usually judged for how true it depicts a real living person.

Heck, even actual Biography (non fiction) isn't even judged that way.

Cat Person succeeds because it captures a deeper truth. And boy does that story touch a nerve - a mirror that is hard to look at because of its truth.

juliusmusseau··on “Cat Person” and Me
You're so vain You probably think this song is about you
juliusmusseau··on GPG-Tui, a Terminal User Interface for GnuPG
This reminds me of my father's advice to every client (he had a corporate litigation practice):

"When you feel the urge to write an email, pick up the f*king phone instead. When in 5 years you're being cross-examined you can say 'I don't remember saying that' and you won't be lying, because we're too old to remember things, and I won't have to bill you for the time it takes to read all the f*king emails."

juliusmusseau··on A request for Pinboard old-timers
80TB on AWS is $44K USD / year on their crappy (cheap rotational) "st1" volume.
juliusmusseau··on A request for Pinboard old-timers
Re: dogfooding - The word nice apparently comes the latin word for ignorant but do you mind if someone says you're a really nice guy?
juliusmusseau··on Ask HN: Earning 100k EUR in Berlin?
The ambulance rates where I live (Vancouver, BC, Canada) always make me blink:

Insured: $50 flat rate, ground or air.

Uninsured:

$848 flat fee (ground service)

$4,394 per hour (helicopter)

http://www.bcehs.ca/about/billing/fees

juliusmusseau··on Pedestrian Bridge Collapse over SW 8th Street in Miami [pdf]
You clearly don't study any subjects in the fine arts.

:-p

juliusmusseau··on Pedestrian Bridge Collapse over SW 8th Street in Miami [pdf]
> stakeholders wanted an over-the-top bridge design [...]

Nothing wrong with that!

> They were so focused on building a nice looking bridge — and meeting deadlines

These are also good things.

To me sounds like the civil engineers started behaving more like software engineers. The independent peer reviewer they hired was not qualified to do the review.

> Louis Berger was not qualified by the Florida Department of Transportation to conduct an independent peer review and failed to perform an adequate review of the FIGG Bridge Engineers design plans and to recognize the significant under-design of the steel reinforcement within the 11/12 node, which was unable to resist the horizontal shear between diagonal 11 and the bridge deck.

This whole business of the engineers ignoring the cracks that the contractors kept needing reassurance about is also insane.

juliusmusseau··on A cartoon intro to DNS over HTTPS (2018)
Fighting against an HTTPS endpoint on 443 returning data in response to a query is kinda futile.

Might as well argue against using windmills to grind wheat.

juliusmusseau··on Ask HN: What do you self-host?
My ssh server runs on port 443. That way I can connect to it when I'm on the Tim Hortons WIFI.
juliusmusseau··on Stripe Capital
Very neat idea.

But I worry that it's vulnerable to bad people.

Got a hefty personal bill coming up, and you're pretty confident your SaaS business will be dead within 6 months but Stripe has no way of knowing based on current numbers?

Thinking of getting a divorce (startup or marital)... maybe time to grab the largest advance possible before your soon-to-be ex(-co-founder) realises?

The problem is that even if only 1% of Stripe's customers might match these kinds of profiles, that same 1% might be taking 20% of the Stripe Capital advances.

juliusmusseau··on Linus’s rules on keeping Git history clean (2009)
Joking aside, "git pull -r" is pure magic in the face of upstream rewrites. It always does the right thing:

https://mergebase.com/doing-git-wrong/2018/03/07/fun-with-gi...

After I wrote that blog post someone told me the reason for the magic is the use of "git merge-base --fork-point" under the hood.

juliusmusseau··on Show HN: Array with Constant Time Access and Fast Insertion and Deletion
I'd like to see the performance of growing the list (a common scenario):

    ArrayList list = new ArrayList();
    for (int i = 0; i < N; i++) {
      list.add(i);
    }
(Forgive me, Java is my mother tongue).
juliusmusseau··on Show HN: Array with Constant Time Access and Fast Insertion and Deletion
I think the data-structure is careful to make sure the main array is at most SQRT(N) and all linked queues also SQRT(N).

It's a neat restructuring of the vector into a SQRT(N) * SQRT(N) arrangement.

juliusmusseau··on Debian 10 Buster: First impressions on a 2017 laptop with an M.2 NVMe SSD
Yes, I was running Windows 10 on a 7200rpm drive. Reinstalled onto a cheap $50 SATA 256GB SSD (AOPEN SU800): night and day difference. Blew me away.

Obviously M.2 or NVME or PCIE would be a lot better. But even old SATA still made a huge difference.

juliusmusseau··on AWS EC2/RDS Outage in us-east-1
Is true master-master replication across continents even possible?

I guess partitioning can help, but then isn't it just turning the DB servers into pizzas of master-slave where the Hawaiian slice is master only in Hawaii, and slave everywhere else?

juliusmusseau··on Google just deleted my nearly 10-year-old free and open-source Android app
I remember plugging my windows box directly into my internet cable modem around 1999. My printer started printing dick pics (that I had not asked it to print) -- I had not even clicked on Internet Explorer.

I wasn't a computer person back then. But I quickly learned about SMB file and printer sharing being wide open.

juliusmusseau··on Recap of the `funding` experiment
Monetizing our work is not strange. It might require some contortions compared to the most direct approach (step 1. write software. step 2. git push), but that doesn't make it a bad thing.

Here is Charles Dickens writing about his own contortions to monetize his work:

There must be a special design to overcome that specially trying mode of publication, and I cannot better express the difficulty and labour of it than by asking you to turn over any two weekly numbers of "A Tale of Two Cities," or "Great Expectations," [...] Notice how patiently and expressly the [serialized novel] has to be planned for presentation in fragments, and yet for afterwards fusing together as an uninterrupted whole.

I think holding onto bugfixes and feature enhancements and letting Patreon subscribers have first dibs on these makes sense.

juliusmusseau··on Rich Families Are Legally Separating from Their Kids to Pay Less for College
You also probably can't be a director of a private or public company until the bankruptcy is discharged (2 years?).

If student loans became dischargeable through bankruptcy, I imagine that could put pressure on bankruptcy laws in undesirable ways (e.g., the current 7 year period might get extended to 20 years).

juliusmusseau··on Standard JS: npm install funding
> Five days to do what? Five full 8 hour days? Does it take 5 days to cut a GitHub release and push it to NPM?

I'm not OP, but I gotta say whenever I've faced questions like these in my career, I find I'm not actually being asked any questions at all, I'm being accused of lying, and it's time to walk.

juliusmusseau··on The GitHub registry public beta is live
Even bad_user's assertion that "Once a piece of software is [legitimately] released as open source, it can be freely distributed" is not 100% true. There is a mechanism in US copyright law through which copyright holders and their heirs can unilaterally retract copyright grants and licenses 56 years after the initial grant or license.

Granted this is quite the esoteric edge case... at least for now. ;-)

juliusmusseau··on The GitHub registry public beta is live
Copyright law prevents package repos from being truly immutable.

Fortunately a copyright takedown request is not a typical scenario, but it does happen, even with "immutable" repositories like maven-central.

juliusmusseau··on Yubico launches its dual USB-C and Lightning two-factor security key
Suppose the key allows mysite.com to let you see your emails, send more emails, and send money to people, etc. Basically mysite.com let's you see and do interesting things after you've authed.

Even if evil.com gets you to register and present your key, they cannot forward it to mysite.com. Even if they go to all the trouble to completely mitm you and the site looks identical to mysite.com, they cannot get the emails or get it to send money.

This is because evil.com cannot pretend to be you when they interact with mysite.com no matter what you've given them.

It's going to be hard to trick me into thinking I've logged into my gmail if none of my emails are there!

Unless they somehow convince you to put your yubikey in the mail and physically send it to them...

juliusmusseau··on Rashomon of Disclosure
What a beautifully structured, thoughtful, surprising, and helpful document!

These in particular jump out:

- Risk profiles for diverse users can be very different:

Any discussion of the pros and cons of disclosure should take into account that risk profiles vary drastically. Taking this argument to the extreme, the question arises: "Is it OK to put 100m people at risk of inconvenience if I can reduce the risk of death for 5 people?"

- Ultimately a patch must be published. If a corresponding vulnerability disclosure does not also go out this leads to information asymmetry between attackers and defenders:

People in the offensive business can build infrastructure that helps them rapidly analyze patches and get the information they need out of them. Defenders, mostly due to organizational and not technical reasons, can not do this.

- The incentives inherent to the software development lifecycle are out of alignment with the incentives of writing secure code:

By the time the security flaws in the newly-shipped features become evident, [the software manager responsible] is four steps in the career ladder and two companies away from the risk they created.

juliusmusseau··on Mistakes to Avoid When Buying a MicroSD Card (2018)
Maybe eject the card between tests?
juliusmusseau··on Parsing JSON Is a Minefield (2018)
Good point. I am presuming the test suite is comprehensive. Does it cover 100% of all JSON mines? Probably not. But it surfaced about 30 bugs in my own implementation - things I would have never dreamed of.

So it certainly helped me. And just based on how thorough and insane the test suite is, I think I'm in good hands. Not perfect hands - but definitely a million times better than anything I would have come up with on my own.

The test suite made my parser blow up many times, and for each blow up I got to make a conscious decision in my bugfix: how do I want to handle this?

(I decided to let the 10,000 depth nested {{{{{{{{{{{{{{{{{{"key","value"}}}}}}}}}}}}}}}}}}} guy blow up even though it is legal. Yes, I'm too lazy to implement my own stack.) :-)

juliusmusseau··on Parsing JSON Is a Minefield (2018)
Do you get the user to choose? Great, now the UI is 2x more complex.

Do you just go with what the browser or client locale says? (User lives in Canada but their laptop is set to Turkish locale).

Go with the locale tied to the geo location of the user instead? (User above stubbornly enters all amounts using Norwegian conventions after completing high school in Norway).

If it's important, a confirmation page presented to the user and formatted in their presumed locale can help a lot.

juliusmusseau··on WeWTF
The founder already personally owned the trademark to "We" well before they made that decision? That's lucky.

In that case wouldn't he simply have to divulge that fact early on in the decision-making process? "Guys, maybe I should recuse myself on this decision since I'm in a bit of a conflict..."

juliusmusseau··on WeWTF
This is a classic due-diligence item during early funding rounds - up there with "does the company actually own its domain name or do one of the founders own it"?

I suspect either due-diligence caught it and decided to live with it after some negotiation, or they missed it - oops!

juliusmusseau··on Parsing JSON Is a Minefield (2018)
Consider only this: "1.001"

I'll use JavaScript numeric literals here as my translation medium (ironic!):

Norway locale parses it to: 1001

USA locale parses it to: 1.001

France locale parses it to: NaN

https://docs.oracle.com/cd/E19455-01/806-0169/overview-9/ind...

Page 1 of 3Next →