mryan

It might be similar to the difference between burglary and aggravated burglary - the method used to commit the crime has a bearing on how seriously it is punished.

I imagine it could have some implications when discussing the level of pre-mediatation as well. For example, if you were doing the tech equivalent of a 'crime of passion', then having set up multiple layers of proxy servers will undo your 'spur of the moment' defense.

Hmm, that's interesting, thanks - ages ago, I used to work for an MSP in the SME sector, and I had not really thought of these two as equivalent. I suppose what I am thinking about could be considered a subset of MSP, with additional project work.

Interesting feedback, thanks. It sounds like that company could have benefited from caps on the amount of support per client or (perhaps better) caps on the client:staff ratio.

You are not the first to point out this perceived problem: http://wiki.nasa.gov/cm/blog/nasadotgov/posts/post_130686081...

Short version: They have decided the cost of doing so is not worth it. I could not agree more - sure, redirecting example.com -> www.example.com is technically straightforward, but setting up a highly-available cluster (which NASA would certainly require) is not free.

I certainly won't. Thank you for the reminder though :)

Thanks for the feedback. That's a good point about the hosting industry. I suppose the support/project side of the business should work well enough when disconnected from the hosting - having worked at a hosting company previously, that's definitely not a market I want to be in right now! :)

Thanks for the link, there is quite a lot of overlap between that company and the service I would like to offer.

Neat solution, thanks for sharing.

Seconding the recommendation for PAM/Google Authenticator.

Off-topic: Has anyone ever managed to get PAM/Google Authenticator working with RADIUS? I spent a while messing about with this last year, and never got it working exactly as I had hoped. I'm no longer working with RADIUS, but this post reminded me I never finished scratching that geeky itch.

Although I'm sure the guidelines did not specifically state the antenna should be made from Ikea straws, this line made me smile:

    So in keeping with the guidelines I've made a new antenna
    of the same 1/4 wave design out of Ikea drinking straws
    and copper wire salvaged from this project.

GAGA-1 was great, I'm looking forward to seeing how GAGA-2 fails.

Would you mind sharing approximately how much GAGA-2 has/will cost?

You appear to be asking:

"I am unable to remember the address of a website I visit five times per day. How can I fix this problem?"

You have three options:

) Remember the address of the site. Or just remember that it begins with 'n' and, as Stratoscope says, Chrome will do the rest

) Set up a local DNS server so that www.hackernews.com -> news.ycombinator.com

) Ask pg to buy hackernews.com

I would strongly recommend the first option.

This is very interesting - I have been planning on implementing this in exactly the "wrong" way the article describes:

    Even if I was interested, sending a notification to me when they have
    joined is a pointless milestone. All you are telling me is that if I click,
    I get to see an empty profile.

So, are there any actions that make sense for the "FB friend joined" milestone? Prompting the user to message their friend in welcome seems artificial and annoying.

It looks like you get your own Pinterest-like board aggregating your social accounts? Interesting idea, I like the layout.

When you are ready to launch it would be nice to have a public demo account, linked from the front page, that shows an example of a populated board. The screenshot gives you an idea of the layout, but a full demo would encourage more signups I think.

Are you sure about that URL? Using a TLD and path component pretty much guarantees no-one will remember your URL. connectsocial.me perhaps?

But in another post, you say that you are planning to add a second factor to Rublon, so that the user must enter a PIN when scanning the Rublon code. So it doesn't appear to be any more convenient that Google Authenticator, which is widely-supported, produced by someone I trust, and open source.

The idea of using QR codes for authentication is interesting, but I would be very careful in selling this as a highly-secure system that is capable of replacing two-factor auth.

To me, this appears no more secure than leaving a copy of your password in plain text on the phone - if someone gets access to your phone, they have access to all of your Rublon accounts. Compare this to Google Authenticator - in the same scenario, the attacker would still need to know my password as well as the token.

When I first used Authenticator I had this problem, because the clock on my phone was a couple of minutes out of sync.

There is room for some error but it is worth making sure the time on your phone is correct.

How much would you pay for a Github backup service?

Something similar to this is on my list of potential ideas, but I am not sure enough people would use it.

I have thought about doing something like this - providing a sysadmin service to companies who don't necessarily need a full-time sysadmin, but do need e.g. emergency response to system failures. I see two main challenges to making this profitable:

) Knowledge of client applications. To fix something in a timely manner, you need to know the application/architecture. If the client does not have documentation (or, as is more likely, they have outdated documentation), learning the architecture could mean a large upfront time investment.

) Bursty nature of support requests. This could be mitigated by doing consultancy/project work in the same market.

Particularly in early startups, the infrastructure tends to grow organically. Having an outsider help document the infrastructure and processes could be quite useful.

If anyone wants to discuss this idea more, my email is in my profile. I think there is a market out there for such a service - I'd love to hear from anyone who thinks it might be useful to them.

Because the ability for JS to 'interfere' with the keyboard input enables some very useful features. e.g. using keyboard navigation in web apps.

It is indeed similar in the UK:

"You do not have to say anything, but it may harm your defence if you do not mention, when questioned, something which you later rely on in court. Anything you do say may be given in evidence."

Uncertainty kills morale very quickly. I think the most important thing is to be clear about why they were fired, so your well-performing employees know they are safe.

Of course, if you tell everyone you fired someone because of X, anyone else who does X will be worried. That may or may not be a good thing.

That was my first thought on reading the description, but the screenshots give a very different impression.

It seems as though any game with crafting in it will bring on a Minecraft comparison.

The homepage is worth checking out for the Annoying Cockroach Edition - good way of potentially turning some pirates in to customers.

I think calling this an open letter is a bit misleading, as it makes me expect some kind of useful content or opinion. This would be better described as "An Open Sales Pitch To Tesco UK", as it can be summarised as:

Para 1: "Tesco has security problems, as noted on Twitter"

Para 2: "Tesco should pay for our security classes"

Para 3: "Tesco should pay for our security classes"

Re: "We just wanted to help out and had no direct way of contacting you." - given that a large part of security awareness is information gathering, I would be surprised if this is the case. It took me thirty seconds to find a way of contacting the IT Director for Tesco.com (well, I found his contact details - he might have a gatekeeper to keep sales pitches away).

I applaud your sense of timely marketing, I hope it works out. Your ad certainly raised my interest in learning about V-SAT vulnerabilities.

I can strongly recommend Dennis Covent - http://denniscovent.com/

He recently designed a site for me, and I was really impressed with the quality of his work, and his responsiveness and attitude throughout the project.

I am going to be rebuilding our EC2-hosted PostgreSQL cluster soon, and will try out the provisioned IOPS feature (both with and without RAID) - happy to post benchmarks once I have some useful data.

One example of a baffling mistake from Tesco - "spend £1.17 on bananas, get £1.25 worth of reward points": http://www.independent.co.uk/news/banana-economics-buy-942lb...

I imagine there is some overlap in parts of the logic for Sentinel and repmgr (a similar tool for PostgreSQL). For example, checking to see if members of the cluster are in-service, and choosing a new master in the event of a failover.

I would love to see a generic tool for handing the clustering/failover problem.

> Calling .get() on a dead server returns None on failure, the same thing that is returned when there’s no value.

I suppose they were doing a .get() to check if the server was still up, and assuming None meant "there are no values to get, but the server is up". If .set() works in the same way (silently failing) they were essentially using /dev/null as their task queue. :)

I use a similar process to this in my infrastructure - I use Puppet to configure instances, then a Fabric command to create new AMIs based on these Puppet configurations.

This gives the best of both worlds - version controlled configuration files, and an automated process for making new AMIs. Instances also boot quickly, as nearly all of the configuration is baked-in to the image.

Using EC2 tags gives you even more room for automation here.

In the UK, "fixed penalty notices" (parking tickets) cost e.g. £35 if you pay them within 14 days, or £70 if you pay them later. This is spun as an "early payment discount", but can also be viewed as a "late payment punishment".

A surprising number of people seem to think that they are getting a bargain if they pay early. I appreciate "a surprising number" is not a highly accurate data point :) I am currently reading Cialdini's Influence - some of the research suggests this method of offering the carrot before the stick do work.

Getting off-topic here, but would you mind sharing what happened in your case, when the court was shown the picture of the officer/solicitor as drinking buddies?