mSparks

How does not defining the security protocols of your authentication protocol not count as a flaw in the core logic?

An entry security product that doesnt define any security on entering...

Pure Genius.

actually. imho. the most important thing you need is the motivation to just keep on going with the plan even when you only have $50 left in the bank and everyone thinks you are crazy.

Pure cash isnt enough of a motivation for those kind of hurdles. And they will come.

I dont think they forgot it.

Just never something they considered.

"My app is to small and insignificant and not doing anything of much importance to be targeted by a nation state so I don't need to care about security"

That pervades the developer scene.

Blended with a spice of nothing to hide nothing to fear.

This isn't an "implimentation flaw". Its a fundamental flaw in the core logic.

->the attacker would then sign in, via OAuth 2.0, with their own credentials. The proxy would capture the outbound exchange and the attacker could then substitute their user ID with a victim’s (this would be obtained from public information).

Fwiw, this is pretty much exactly the situation we had from the very start, since the early days before "big data" was even a thing people talked about, and why I went "bare metal" from the beginning.

At the time (about 2005 iirc) I was read/writing between 500GB and 2TB a day, with heavy calculations across two high performance desktops. Then as I came to scale up AWS was announced, but when I priced it, just what was running already on those desktops came to more for the first month than buying 6 heavy duty dual CPU Dell servers with tons of storage.

So that's exactly how we started.

The only "shock" I got was how much of a b!tch keeping all that cool is, and that took a year or two to get that "just right".

In London, yeah.

Prices today 3 times what they were in 2004. Well above inflation.

Rest of the country, that doesn't attract the "need to hide my money from a foreign tax man" crowd, not so much.

Actually, it mostly not about yield or appreciation.

Its about having more money than you know what to do with.

start at java (the most commonly used language, making up most of google - gmail - for example) and work your way down the list, to php right at the bottom. php is fabulous for quick and cheap web dev when it doesnt matter if all your users data gets sent to haveibeenpwned.com and not much else.

nonesense. its only in America you cant talk about the difference between boys and girls. I dont care how much you homos, bisexuals and metrosexuals whine and moan, i am not required to respect your life choices. Sexisim isnt a bad thing, its as natural as sexual preference, whichever way you swing.

https://pics.onsizzle.com/something-went-terribly-wrong-fwd-...

And you know a secret? Women really do prefer men over whiney little girls.

So what exactly is your beef with describing the web as insecure as an ugly girl on prom night?

Its not exactly scarface high on coke. is it.

possible i guess

do we see something similar with .onion addresses?

ive found it much more reliable and secure to give devices i want access to from anywhere a .onion address rather than a ipv6 one.

secure by design rather than plaintext insecure and only works on some internet connections occasionally by design nightmare that is ipv6.

I discounted that at the time by playing a muted YouTube video and using keyboard shortcut forward back.

It only altered in any meaningful way to trackpad movements and clicks.

However, most audio output (at least back in the nineties and naughties) is not capable or creating sounds reliably above 16khz. They almost always have a low pass filter on which cuts it out. Apparently most dell laptop speakers cant even manage above 10khz

"You can't hear" doesn't have to be high frequencies though.

It can be more subtle like phase shifts and other "in audible range" fingerprinting.

While I've not used it for getting on 20 years now, I did do a lot of software audio engineering back in the day, everything from RF to DSP.

It may have just been electrical interferance.

But electrical interfance from a trackpad? - made me suspicious at the time.

And one way or another, a proof of concept is only a few lines of javascript.

A very very easy way to link people in a room together.

And it would explain why the facebook app wants mic permissions when afaik it offers no audio features. it doesn't even need to be audio the maker of the app controls - just "fingerprint" sounds and report them back to facebook (or whoever).

sounded like "coil wine".

doesnt stop a phone app decoding it though. it was only when i moved the mouse. and came then went.

And i definately still have reasonable high frequency hearing. for example filing a complaint with Morisons in the UK for those high frequency speakers aimed at stoppping kids loitering. Don't know if they got rid of them or not because i stopped shopping there.

anyone know of an app that can detect these signals?

Maybe decode them.

easiest way to block them is to know they are there in the first place.

i am suspicious that occasionally my laptop makes high pitch noise correlated to mouse movements when its running windows 10.

edit:Thinking about it. seems possible that might actually be facebook. never installed their phone app untill i had android 6 because it wants mic permissions (disabled) and facebook and reading hn is about all i use win 10 on the laptop for.

->Rails is banned in Canada...

wohaa. what?

wow. an opportunity for me to use google. if you are actually serious?

edit:lol my phone default searches to bing... didn't find anything about ruby on rails being banned in canada.

well. actually looks better from the start:

There is not a single malloc() call in all the library. In fact, the whole of BearSSL requires only memcpy(), memmove(), memcmp() and strlen() from the underlying C library. This makes it utterly portable even in the most special, OS-less situations. (On “big” systems, BearSSL will automatically use a couple more system calls to access the OS-provided clock and random number generator.)

On big desktop and server OS, this feature still offers an interesting characteristic: immunity to memory leaks and memory-based DoS attacks. Outsiders cannot make BearSSL allocate megabytes of RAM since BearSSL does not actually know how to allocate RAM at all.

cant be any worse than openssl.

they have all code running in constant time from the alpha version.

Next comes making sure there are no buffer overflows. the code is stable and compatible.

If everyone leaves it to someone else who does it exactly?

Obviously not ready for use in production until its been audited.

Remind me again where i can download an audited ssl implimentation?

i read the article and came away with.

dell 2016 xps13 still the best laptop in the world.

some builder called system76 thinks their blocky box can compete with it or the macbook pro.

probably not.

I'd never heard of the Apple III.

My question was where it fitted in Jobs 86 departure from apple.

from the article:

->socking it to the customer when a new product is released is a tradition in Cupertino dating back to the Apple III.

Remember the original 128K Macintosh cost more than $2400 and it was close to useless.

____ Does anyone know at what point it was that Apple blew up after firing jobs and had to call him back. was it before or after this?

the brief was to discourage use of whatsapp. they were given the title. they just didn't write exactly what the ghcq boss that gave them the story to write wanted.

Pretty much nail hit head. They even ran all the way to India to make sure the only thing most readers can associate with is the phone app.

Laced with innuendo that no one who was raped ever committed suicide.

And ignoring the general theme in the region to prosecute the woman after a rape for sex out of wedlock.

instead, lets pick on the phone app that wont let the government read your messages. That is all there is to see here.

Well, The article specifically mentions "conspiracy theories"

I quote: The lack of a definitive root cause has prompted all sorts of wild theories, including a sniper from a competitor's facilities at Cape Canaveral.

But not the central theory which notes a flying object which is unidentified (written that way for those brainwashed by CIA disinformation that "UFO" means "Alien") passing the rocket the instant it explodes in the video.

Which even Elon said they can't rule out. But yeah. An inert gas exploding spontaneously is MUCH more likely than sabotage.... yeah right... That we don't need "extraodinary evidence"

Meh, any scaly with a remote control can fly a drone. The concept that every UFO is under the control of a "powerful entity" is as absurd as theories get. No idea why you would jump to that conclusion, and there are a multitude of reasons why any number of state entities would want to interfere with an Israeli satellite. The $200m in uninsured damage that resulted is reason enough for half a dozen countries.

Yeah, even Elon said they "can't rule it out". http://www.zerohedge.com/news/2016-09-11/elon-musk-we-have-n...

And I gotta say, it still seems more likely than helium exploding. Since helium is an inert gas.

But lots of peeps on here fail the great filter part of Fermi's Theory, so you can expect the downvotes anyway.

That's the key trade of these days in software imho. What kind of memory management you need.

Sever side zero memory leaks absolute requirement and "real time" responses rarely a requirement. triggering gc during init and/or shutdown of a component often enough.

Building a CNC machine - every tick is valuable, but as long as it can run a job for 2 days before crashing no one will notice if it leaks memory like a sieve when you run a calibration routine.

Personally found Java's GC to be a little tricky but generally awesome.

However, 100, even 200ms pauses get "lost" during network coms. But users tend to notice if a page takes 30 seconds to load rather than 1 second (differences i've seen optimising Javas GC, don't know at all how Go and Java compare).

That kind of difference would be very expensive to solve using more servers.

TBH. I find package.json files to be much much much much nicer files than configure.sh or settings.txt files, even a configure.py.

And if that isn't the case for you, not like you don't have the choice.

Why would you want to do that in what is basically a human readable binary file and not in a readme?

You seemed to stop at the for who and for what purpose.

I can 'just' about see the case in something like nodeJS package.json files (that is the least of nodeJS's problems, but that's a whole other conversation). But a readme is a so much better option than having to troll through code comments.