HNHacker News
TopNewBestAskShowJobs

neoCrimeLabs

626 karma · joined March 5, 2014

Security engineer; Boldly striving toward mediocrity, and beyond.
submissionscomments
neoCrimeLabs··on ReiserFS is now “obsolete” in the Linux kernel and should be gone by 2025
I don't remember specifics any more and don't have enough time to research at this moment - maybe later tonight.

Around the time when ReiserFS v4 came out I remember there being a lot of strife around performance numbers - specifically that nobody could replicate anything even close to the performance numbers that the ReiserFS team was claiming.

Between that and other interactions, there was an increasing divide between the ReiserFS team and the kernel community at large. I believe (but never confirmed) there was also a concern that the filesystem may go commercial which did not help matters.

While the murder didn't help matters, by time news broke there was already very little interest in ongoing community support. I suspect that even if Hans didn't murder his wife and merely abandoned ReiserFS, it would have suffered the same fate.

I didn't have much experience with ReiserFS 4, but had good experiences with ResierFS 3 on many devices over several years before moving on to better supported file systems.

neoCrimeLabs··on Get a cable modem, go to jail (1999)
"26 April 1999: I've been "slashdotted". " [1]

Wow, that brings back memories! I remember reading this article when it was posted to Slashdot because I had /just/ ordered @Home service.

Instead I went with DSL service with the phone company (forgetting the Ma' Bell branch at the time). The service never worked, it took 30 days of calling support, going through the script to get past Tier 1 (remove software, install software...etc), only to be put on hold for 30 minutes before getting dropped.

I finally went with @Home, which worked without going to jail.

The early days of broadband were an interesting time. It was a nice upgrade from ISDN or Dial-Up, though.

[1] - https://yro.slashdot.org/story/99/04/26/1229227/get-a-cable-...

neoCrimeLabs··on Ask HN: How to handle Asian-style “Family name first” when designing interfaces?
This was also educational, thank you!
neoCrimeLabs··on Ask HN: How to handle Asian-style “Family name first” when designing interfaces?
Thank you for reminding me of this article!

More people designing applications need to read it.

neoCrimeLabs··on Godly – Astronomically good web design inspiration
What was the criteria used to determine these were good web design?

Also, how is a website that only provides links/QR code to the mobile app store a good web design?

That is the antithesis of good web design as it literally tells all users to not use their web site without providing any information what so ever.

neoCrimeLabs··on When will Apple ship other M2 Macs?
I do not see their sales numbers, but based upon their actions it's pretty clear where their top sellers are.

That and Apple has a notable history of dropping standards they no longer feel are current to push new standards. Even if those changes very clearly abandon current and active users.

neoCrimeLabs··on When will Apple ship other M2 Macs?
I'll be curious when we can expect a Mac Pro Tower on apple silicon. I know one person whose high-end music studio revolves around his tower and low latency multi-channel audio cards. He's starting to have concern they will be abandoned.

For apple it's a small niche.

neoCrimeLabs··on FIDO Alliance
My first thought was "Is FIDOnet still relevant after all these decades?" then remembered FIDO U2F
neoCrimeLabs··on Robocode Tank Royale
This reminds me of Omega [1] from 1989. One of the more fun games I've played. I was thinking about giving it a go again and seeing how well I do.

[1] - https://en.wikipedia.org/wiki/Omega_(video_game) - https://corewar.co.uk/omega/files/misc/omegamanual.pdf

neoCrimeLabs··on Ask HN: What to do about ‘Good at programming Bad at Leetcode’
The problem isn't leetcode so much as how it's interpreted.

Goodhart's Law: “When a measure becomes a target, it ceases to be a good measure.”

Leetcode questions are a useful measurement in the interview process

What they are not is a useful goal to hire someone by.

neoCrimeLabs··on OP-1 field
The newly announced Polyend Play and Teenage Engineering OP-1 Field are great examples of very different UX and very different workflows to solve a similar problem - making music without a computer, creatively, ideally with a flow state.

It's very interesting just looking at how they do it.

Dunno if I will get either one, or both. Either way, I do appreciate the direction they are going in. :-)

neoCrimeLabs··on Turing Pi 2
This will be fun to play with, even if I'm not entirely convinced of its practicality.

It does make me wonder, if I will receive the Turing Pi2 or 4x compute modules first.

neoCrimeLabs··on Please stop disabling zoom
Rather than trying to convince web developers, how possible is this to get the feature depreciated in browsers?
neoCrimeLabs··on Fourth-generation programming language
A friend asked me offline to elaborate on my scenario, answering publicly.

We had a gap of about 12 capabilities in our environment. The capabilities were in the same family, but functionally different. To make matters more complicated, different teams/leaders only required 1-3 of the capabilities and did not know about or care about the others.

So senior leadership (about 4vp, and a dozen or so directors) saw this as 12 problems that can be solved with 12 solutions.

The problem is solving it as 12 solutions required 12x the engineering to implement, 12x to operate, and 12x user support -- actually I'm simplifying, it was worse in reality. The financial cost was also higher but more like 4x.

To be solved as a single solution required a far longer ramp up time to a functional solution, but would take significantly less engineering resources at every step. To boot, it would also scale far far better - requiring far less people to operate and scale.

So two problems needed to be overcome is convincing leadership that it was not merely a problem of solving their perceived problem of 1-3 capabilities, but 12, and that if we had to support all 12 capabilities we'd need a significantly larger team.

Adding to that was the upfront financial cost for a unified solution was more expensive than solving the perceived 1-3 capabilities any leader knew or cared about.

The solution was shot down 3 times with me being directly told "This is the wrong solution, please have someone else propose a better solution."

And to be very clear, this company actually had good leadership. But with such a large environment they all had their priorities and limited people/budgets to get them addressed with.

The problem was they needed to understand a problem existed outside of their domain, a domain they didn't see as as affecting them very much, so they didn't want to dedicate time to learn it.

The solution was to convince their trusted advisors. Principle and senior engineers, senior program managers, etc.

Politics suck, but they affect any organization with people. The more people you have, the more politics. The more people you affect, the more politics. If your company becomes successful, you will have to ultimately have increased politics. Period.

neoCrimeLabs··on Fourth-generation programming language
Even if you had presented, there was a big chance that SQL Windows would have been chosen anyway. The risk calculation senior leadership would have considered delivering anything sooner with iterative improvement versus a long ramp up but with more efficiency. While the first may end up being more expensive, it's less risky and more likely to pay off. The longer and more complicated ramp up a project has higher risk, the more likely it will fail before it even delivers.

Leadership is FAR more likely to lean on a sure thing than higher risk/reward. To bypass that you need a proven strong leader and team who delivers big complicated projects and a VERY strong presentation to show the problem was thought out.

Even then, competing priorities and other factors may come into the decision making process.

And I am not saying I agree with the decision making much of the time, but this is what I have experienced.

To be very honest, the only time I managed to get a project like this approved is when I proved with 100% certainty that all the alternatives would fail, why, and how. Even then it took me 1.5 years and significant buy-in from principle engineers to convince senior leadership the it was the only path forward.

neoCrimeLabs··on Raspberry Pi just made a big change to boost security
The first thing that crossed my brain after reading the title was:

"It's almost impossible to buy a new one. How you improve the security of something you can never get access to?"

Didn't realize how frustrated I was with their perpetual lack of stock for Pi4 until now. Wow!

On topic: I am really happy they are taking security seriously. That is a genuine improvement, and a trend that I wish more vendors took seriously.

neoCrimeLabs··on Pushing back against contract demands is scary but please try anyway
In 2000/2001 I was offered a position at a startup who was looking to make it big in the intrusion detection and prevention space.

They handed me a contract with an IP clause that summed up to their owned any idea I came up with. This wasn't uncommon at the time, but it was more aggressive than I was used to. I made it clear to the HR person that I was actively contributing to open source tools at the time, such as snort, nessus, and also had ideas of my own that I was already working on.

The HR person made it clear that if I were to continue working on these ideas it would become property of the company -- Even if performed during my free time.

I don't remember the specifics any more, but after some discussion and escalations we came to the agreement that since my hobbies were so close to my work function that any new ideas I came up with were property of the company, so I was asked to provide a list of what I was working on and it would be amended to the contract. I provided a 4 page outline of the 4 projects I was working on and their what intellectual property they involved.

The the next day they rescinded the offer. At the time I had assumed it was because their ideas were not that novel and they wanted fresh ideas to take and profit off of. Will never know for sure, but they went out of business between 2001/2002.

Regardless how right I was, since then I was always a lot more aware of IP clauses in contracts and how they were phrased. I also try not to work for companies who sell security software.

neoCrimeLabs··on Ask HN: People who use different emails everywhere, who sold you to spammers?
These days I mostly use unique addresses, unique passwords, and where possible MFA to secure my accounts. Reduces the risk of brute force attacks and other weak account compromises.

Historically though my intention was to track who sold my email address and combat spam. It worked great.

The most notable one was the address I registered with ISC2 when signing up to take (and pass) the CISSP in 2002. The unique address I gave ISC2 and only ISC2 in 2002 was used to send spam and scam email not long after.

It was a fairly common occurance in the early/mid-2000's to receive spam where I registered addresses. These days it seems to happen much less.

neoCrimeLabs··on I'm a security engineer and I still almost got scammed
It's true, being a successful information security engineer requires a very diverse understanding of technology and psychology.

Not one person understands all the technology in existence, and no one person ever will.

Also engineers come in different levels of experience. Just because someone doesn't have experience in specific technology doesn't exclude them from being an engineer in a specific field.

neoCrimeLabs··on Ask HN: Website with worst UX or Registration experience
I wanted to say LinkedIn, but realized registering was easy. Avoiding the dark patterns claiming to be "verification" is what takes time and effort. :-)

Thanks for asking about this, never ran across userinyerface before.

neoCrimeLabs··on Stop Validating Email Addresses with Regex (2012)
2012? And it seems so little has changed. Several times per month I am told by websites that my supplied email isn't valid even though it can receive email. All because it is using one of the "new" top level domains ".email" and has been for 6+ years now.

The breakdown of websites this happens most on are large corporate websites or very small online shops using some no-name shopping cart software.

neoCrimeLabs··on How Rainy Is Seattle? It's Not Even in the Top of Major U.S. Cities (2019)
In hind sight I explained that poorly, but I'm also distracted in a meeting, so should probably be focusing on that. :-D
neoCrimeLabs··on How Rainy Is Seattle? It's Not Even in the Top of Major U.S. Cities (2019)
In my experience most weather is reported with relative humidity, but dew point is also important. When the dew point reaches a certain level it is described by some as feeling "muggy". There is a feeling that your skin is wet because moisture on your skin has slowed (or stopped) evaporating because the air has saturated with moisture.

https://www.weather.gov/arx/why_dewpoint_vs_humidity

neoCrimeLabs··on How Rainy Is Seattle? It's Not Even in the Top of Major U.S. Cities (2019)
Something else I noticed while living in Seattle. Compared to the US East coast and much of the mid-west it's FAR less muggy year-round in spite of constant overcast, rain, or mist for most of the year.

I remember flying from Seattle to London a few years back and was surprised that in spite of the same weather, London was almost unbearably muggy -- it felt like I stepped into a swimming pool my skin felt so moist.

neoCrimeLabs··on People who press on cookie banners anything except “agree” – why do you do that?
It's your assumption that I don't do anything else.

Imagine it like this: DNT is a "No Trespassing" sign.

Do no trespassing signs actually stop anyone from trespassing? No.

In this case, I use it as a tool to judge who clearly rejects my request to not be tracked, not stop them from tracking me.

neoCrimeLabs··on People who press on cookie banners anything except “agree” – why do you do that?
I set Do Not Track (DNT) header on my browser. That is my answer, and any company who asks my consent for tracking cookies anyway is /already/ violating my consent by ignoring my my clear and standard communication.

Anyone who repeatedly askes for consent when boundaries have clearly been established should never be trusted.

So I ask, why would I ever accept?

To get them to stop asking is never the right answer.

neoCrimeLabs··on Ask HN: Why are there no easy-to-use highly-available open source databases?
You are missing something.

You list several completely different types of databases and then mention you are looking for a "general purpose database".

This tells me you do not understand the problem you are trying to solve, therefore do not know how to define the requirements nor features you require to solve it.

It also tells me you do not understand the difference between different types of databases, nor the niche they fill, let alone why their HA functions very differently.

neoCrimeLabs··on Tortured phrases: A dubious writing style emerging in science
I'm very tempted to introduce tortured phrases at work for occasional humor. For example, who needs "continuous integration" when you have "ceaseless incorporation"? Sometimes it's nice to see if anyone reads my notes.

In all seriousness though, I've experienced something similar before at a Japanese run American corporation as far back as the 90's. The problem was Japanese executives and executive assistants who didn't know American tech-jargon often resulted in accepting mangled suggestions by the spell-checker. A notorious example was the "Data Whorehousing" presentation, which somehow made it through several reviews and rehearsals before being presented to the entire American IT department at an all-hands meeting.

Clearly this made an impact as I remember it 23(ish) years later!

neoCrimeLabs··on Facebook users said no to tracking, and now advertisers are panicking
Now if only there was a way to force the IOS Facebook app to use an external browser for links clicked within the app.

Yeah sure, they can still track the click, but would lose visibility beyond that.

neoCrimeLabs··on Apache Heron: A realtime, distributed, fault-tolerant stream processing engine
> I can't wait for my next startup interview. We have a requirement of 25 messages per hour, with 10KB per message, you think you can build the ingestion pipeline using Kafka and MongoDB on a 10 node M5d.24xlarge cluster?

This reminds me of something I experienced

Back in 2000 I worked at a company that hired me to take over their brand new fully redundant web infrastructure. that was architected and built by a firm on a $10,000,000+ contract.

They couldn't understand why the site only served 1 page every 2 seconds. To be very clear: _1_ page every _2_ seconds.

The short story was the development company didn't have anyone who understood databases. So they were using the oracle cluster as a key-value store, and then parsing/sorting XML files on the application servers on demand.

This was a $500,000/yr oracle license, on redundant dedicated $(million) Sun hardware, with huge high speed disk arrays. They were almost sitting idle at peak load... of 1 page every 2 second.

Bonus story: The developer's didn't understand why their dynamic uploading of files to their app servers only worked 1/x of the time where X was the number of app servers in the cluster. They were dropping the files locally on the app-servers and wondering why the other app-servers didn't know about them.

It took a dry erase board and about 30 minutes before they truly understood that the filesystems on those devices were not shared and why. (note, it was never part of the design specification their own team created)

I'm happy that I didn't have to explain ephemeral containers to them.

← PreviousPage 3 of 6Next →