liyanchang

Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html

Major points:

- You register for which browser + os combination[0]. Then they randomly order the contestants.

- When you are called, you have 30 minutes.

- The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2]

- The prize money goes to the first successful exploit. Money differs by browser.

[0] Chrome, Firefox, IE, Adobe Reader in IE, Adobe Flash in IE. Safari on OSX. Fully patched OS.

[1] How does one get to specify the content? What if I have a http header that downloads a file?

[2] I remember back in the day, they used to have a fully no interactive version? Like the user was just on the same wireless network?

I've always advised other startups using AWS to begin on us-west-2 as it has a couple key pros:

1. Lower latency to SF/Bay Area

2. Cheaper then US-West-1 (California).

3. Updated and cared for. West-2 is sometimes behind East-1 on some features - things like govcloud, some instance types etc rolled out on East-1 first - However, unlike US-West-1, it eventually gets updated. [0]

4. Until now, it hasn't had a single incident. I knew this would never last, but given that it's smaller and simpler (less legacy hardware), I still think that Oregon will have better uptime then VA.

This advice doesn't changes at all, even with this most recent blip. I'm just sad that I can't say "US-West-2. Closer and never had an incident"

[0] Given how US-West-1 (CA) often falls behind on features, it will not surprise me if AWS announces that they're going to deprecate that region.

Disclosure - I met David Recordon via Healthcare.gov

It's a true statement that he is facing an uphill battle. However, it's heartening to hear that he's making the move because he's been doing this job already for the last couple months - just as a individual contractor on loan to the government. The fact that he's willing to keep doing the admittedly difficult but critically important work of securing White House IT speaks volumes.

It's clear that people like David are needed inside the government and you've identified the key issue - how can you retain talent in an organization that moves slower and more cautiously (and yes, sometimes a bit obtusely[0])? That's in my opinion, the beauty of USDS, 18F, the other healthcare.gov tech surge spinoff companies[1] - by concentrating enough technical talent in one place, you give everyone a place to talk shop, share strategies, and yes, vent frustrations.

USDS and others are not guaranteed success - by no means. However, they have a minuscule but non-zero chance and a little hope goes a long way. I look forward to cheering for each tiny little win they get, no matter how trivial (for instance WhiteHouse.gov is now https[2]). I want the government to do big things and watching it do simple things is the first step on a long long journey.

[0] Though most of the time, there is some rationality to how decisions get made - just sometimes not the rationale you were hoping for. Often it's because it doesn't exactly match a checkbox on a security checklist and you have to explain to them how SSH keys are pretty much like 2048 character long passwords.

[1] p.s. I hear they are all hiring. https://www.whitehouse.gov/digital/united-states-digital-ser... https://18f.gsa.gov/ http://www.va.gov/ds/ http://adhocteam.us/

[2] Just as of a couple weeks ago, it was http only with https erroring with domain mismatch to an akamai cert. It now gets an A on ssllabs.com.

The best interface is indeed no interface and it's the end goal of a long design and product process.

There's probably some Maslow's hierarchy for design that looks like (designer friends - please let me what wheel I'm reinventing please):

1. The system has to be told exactly how to perform a task. 2. The system has reasonable defaults on how to do it. You push execute. 3. The system knows what you want and just does it.

The car key app requiring 13 steps means we're still in phase 1. The fact that it works at all is forward progress because before you couldn't do it at all! (One might argue that it's right now not useful and I would probably agree with that.[0][1])

The next step forward is probably to geofence your car and when you're near, a push notification asks you if you'd like to open your car door.

Finally, we get to the two step walk to door, open door.

We've got a long way to go and I applaud Mr. Krishna for pushing us further along. It does seem therefore that we should encourage app designers to continue to make apps with clunky interfaces so that we can begin the journey towards the goal - no interface at all.

I'd actually love to hear examples of systems that leapfrog from nonexistence to it's final evolution without intermediate steps. That would be really fascinating.

[0] Unrelated - rented a car once with remote keyless entry and keyless start - it is indeed a magical experience when the key never has to leave your pocket.

[1] Having gone through winter on the East Coast recently, I do think phone remote start might singlehandedly make the app worth it.

For those of you on OS X, I had to modify the command to the following:

> sudo tcpdump -l -e -I -i en0 | grep 'Probe Request ([^)]'

Not at all a tcpdump expert - fuddled around with manpages to make it work so others should please chime in with improvements.

People high up in the government agree with you! From the aftermath of healthcare.gov, two US government entities were created:

1. 18F - An pool of in-house developers working with agencies to build (or rebuild) services. https://18f.gsa.gov/

2. US Digital Service - A group of technologists quietly trying to rescue projects (like healthcare.gov, the VA) and change policy. http://www.whitehouse.gov/digital/united-states-digital-serv...

Plenty of roadblocks and difficult times ahead for both groups - but unlike before when failure was guaranteed, they've already had some wins and have a non-zero chance of success.

Looks really great. Have you thought about submitting to CocoaControls? (https://www.cocoacontrols.com/) It's the second place that I look for iOS components (after a simple Google search, that is).

Agreed. No one is doubting his ability to form sentences. Rather, he packs so much into each sentence that I question my ability to keep up.

Every sentence he said (as well as his responses in the AMA) was a a complete idea, full of insight and depth. Mere mortals, like yours truly, need to take a couple minutes to process examples and counterexamples, to define the assumptions made, to wonder at the implications. You want him to speak more on the subject.

Instead, it's so obvious to him that he continues speaking and you've just missed 3 more profound statements. Makes him fascinating to listen to.

Just met him once or twice, but my impression is this is how he talks in real life as well.

Very similar, but not exactly: Cloudflare. Takes over your dns routes and will detect when you are down and tries to continue serving.

The difference here is that they had a very public deadline.

Congrats to Benchling! They're a phenomenal group of guys who are really going to do great things.

I would encourage you to write the entire thing, frontend, backend, content, PR releases, etc.

Two reasons:

1. You're young and still figuring out what you love doing; no better time to experiment and learn. I still have fond memories over the php site I wrote in high school. You could visible tell which functions were written at the beginning of the project versus the end because you'll improve drastically. [1]

2. The project will be more successful with someone who cares for it. Hiring a contractor will make it difficult for you to maintain and improve. Contractors will also expect a specification with penalties if you need to change it. My guess is that you're still experimenting with what can best serve the community so this probably isn't a good fit for contracting as well.

[1] Recommended tech stack (optimizing for documentation and availability of help). Ruby, MongoDB, Heroku (or if ambitious, Linux on Amazon EC2 + nginx). Everything else is pretty similar so once you learn these, the concepts apply reasonably well.

p.s. If money is a concern, you should look into contacting some companies PR/DevRel people and see if they are willing to donate some compute time or services to your cause. (It's probably doing this after launch and getting a better sense of usage and will be easier to convince them that you're legit).

Alternate question:

Is there room for a 3rd-party Gmail web client, in the same way that Mailbox is a 3rd-party Gmail iOS client?

Technology, just like fashion, is cyclical. There are only so many configurations of communication patterns so technological constraints dictate usefulness.

The two being contrasted here are the one centralized database (w/ master/slave, replica sets, etc of course) versus a peer-to-peer configuration.

We've been in a centralized hub and spoke model as cloud servers have taken off. As clients get more powerful and network links slow[1], we're going to move more to peer-to-peer models.

The concept described by the author is right in the middle: hub and spoke, but keep all the data on the spokes. Of course, the comments (EGreg) points out that this has a disadvantage of difficult access if the spoke is storing another spokes information.

Adding a couple peer-to-peer connections can help with this and WebRTC is a good technology for doing it. Once you connect peers, you can move data from peer-to-peer without hitting a central server again. Now, the central server is merely orchestrating rather then dictating.

The author (author of flask, werkzeug, ...) is probably on the forefront of things, so while you may not find that this model is useful yet, it's prudent to watch as it will become more prominent in the next couple years.

[1] Phones are getting more powerful and computers/laptops already feel like overkill for the youtube/redditing etc that we do. Networks are not slowing so much as wireless connections are getting clogged as more people are overloading cell providers.

Summary for those of you on text-based or js-free browsers:

It's a sphere, subdivided into squares. Everyone shares the same space, so you can draw in a random square (if you login) or browse other peoples marks.

Scaling an education venture is a hard problem. You work really hard to figure out how to distribute quality content cheaply to lots of people and it turns out that, at the end of the day, it seems that we still rely on labor/cost intensive methods to teach. [1]

Clearly, Udacity, edX, Khan, etc are successfully solving many problems (quality content, automated grading, gamification, etc) and that we're moving in the right direction.

I've very much looking forward to the day were we start to see education costs decline because we've gotten so much better at mass producing knowledge/love for learning/reasoning skills/etc.

[1] As a side note, it's not clear to me if actually reasoning and talking with another human is really required for learning. It certainly seems that way at the moment, but is this because the content isn't good enough or are our brains built in a way that learning requires human interaction?

That's true. Having been briefly in academia, I only evaluated algorithms based on Big-O and just a bit of practical experience taught me that there tends to be a sweet spot, where the o(n^2.7) is both much faster then your naive implementation, but simpler to code, better constants, and better cache lines then the o(n^2.7003).

> No way, substantial speedups can really only come from algorithm changes.

I've often found the reverse to be true; that implementation details matter most.

The best fixes tend to be altering my code so that the compiler/cpu can be smarter. In this case, the author hinted the cache. Other times, I've found that looping in a different order helps my cache hit rate. Other times, properly naming variables and not reusing the same name allows the compiler to do smarter things.

Other times, when I've tried a new algorithm, it's slower because of bad constants or I've accidentally messed up the implementation to negate all benefits.

As a complete side note, you need to be careful when using "older" algorithms, ie those published pre-2000. I once implemented, based on a Hoare paper, a doubly linked list for spare matrices, and it was significantly slower then the naive method, simply because CPU cache lines have gotten really good while being able to predict linked list memory locations had not.

Chase Sapphire Preferred offers EMV cards[0] and no foriegn exchange charges. Makes a good travel card.

[0] Technically: chip-and-signature rather then chip-and-pin. Also, you have to ask for the EMV but they're super friendly about it.

If you're looking to learn iOS, I'd suggest contributing to an open source application.

An app requires a bit of setup so taking someones app means that most of the minutia is set up. Therefore you can take on manageable size chunks. Also, and maybe more importantly, you'll have an experienced iOS developer review your code.

https://github.com/nothingmagical/cheddar-ios is a good one. Shameless plug: https://github.com/Ink/ThatInbox, ThatPDF, ThatPhoto, ThatCloud are ones that my company open sourced.

Related: https://learn.thoughtbot.com/ios is a good listing of iOS resources to get started.

That's awesome. Glad there are others out there as well.

Being able to resize images via url parameters is one of those great ideas, but I've always been surprised by how long it's taken to catch on.

Awesome.

Totally agree. It's definitely a "why didn't I think of that" idea.

Looking forward to the oh-my-zsh extension that puts this in my shell. Or a chrome extension that inserts it on random code snippets.

Thanks for the support. To your concern, yes. But we're also looking at how we can give not only commit rights to github but also deploy rights on the app store for frequent committers.

You're right. The Ink Mobile Framework is trying to solve the app to app communication problem on ios where apps don't work together.[1]

Because it's the pipes between apps, in order to demonstrate it, you need the source applications. Therefore, the suite of 4 apps that work well together. You'll find that most of the apps are barebones, but with ink connecting them together, you're able to do things that you can't currently do (e.g. Get an email attachment, edit the photo, save a copy to your dropbox, and then send it back as a reply.)

We have a number of partners lined up: Evernote, SignEasy, Podio, et al and we're super excited to see them go live.

[1] It's the number 2 reason why people can't get work done on an iPad, behind only the lack of a physical keyboard.

tl;dr

Forth is a programming language from the 1970s. This is the canonical book, published by someone who works at Forth Inc. (as K&R is to C)

Forth is interesting, not because of widespread usage, but because it has a different way of looking at things. Reminiscent of people who tell you that you should learn LISP because you'll never use it, but it will make you a better programmer.

The key difference is that it is stack based. (For those who are more mathy, you may have heard of RPN on the HP calculators)

e.g. 2 5 * 3 -

is take 2 and 5, multiply them. Take the result and 3, subtract them. get 7.

The wiki article has a nice picture of stacks that may help: http://en.wikipedia.org/wiki/Forth_(programming_language)

(btw, not super knowledgable about this stuff; just super confused, did some digging and figured others would be confused as well. Happy to edit.)

EDIT 1: Habits die hard. Corrected Fourth to Forth.

Hmm. Thanks for reporting. Mind creating a github issue with a screenshot? https://github.com/Filepicker/codeblock.js/issues

Or if you elaborate more here, I'll create the ticket for you.

Duplicated. Not sure why. Will have to do some more digging but created a github issue for it.

https://github.com/Filepicker/codeblock.js/issues/1

As it turns out, our friend Danielle had written about something similar two years ago. http://www.daniellemorrill.com/2010/06/how-i-built-a-multi-u...

Great minds :D