3,065 karma · joined March 12, 2007
http://www.underengineering.com
[ my public key: https://keybase.io/ntoshev; my proof: https://keybase.io/ntoshev/sigs/-piodh_N3Iz_KHRDy9q8DwzUm8hyzhfGYMQHzguhJhI ]
The lack of bcc leads to different usage patterns and can be thought of as a feature itself. It leads to more explicit communication. It means the recipients are exactly the ones who are clearly listed.
More generally, Facebook is bigger than the sum of its parts because of the social behavior that emerges there. Enabling this is what makes Facebook special.
In practice everyone uses plain Tornado with callbacks. The problem with generators as coroutines to me is that you can't compose them nicely: you can't call a subroutine that yields, you must yield only from your top level. This and the fact that it's another layer of leaky abstraction.
I can think of a possible answer but I'm not sure this is what other people think.
I wonder if RescueTime data contain really important insights on productivity. They should try to mine them, probably Netflix-prize style would work well.
Because this is what your comment suggests, and that's a rather unprincipled statement in my book, whatever your principles are. For example, if Paypal acted by this statement, they would allow payment for porn as long as it was profitable for them.
That's what I meant by broader and deeper impact. If service is impaired for merchants, a fraction of them will switch their payment provider.
I am not arguing this is the right thing to do from moral standpoint btw. This just got me thinking about DDoSes for the first time. Would be interesting to hear what the security experts think.
What is the retain stack typically used for?
If I were attacking them, I would target the APIs that merchants use instead of the main site. The main site has probably been DDoSed before, APIs are a subtler target. I imagine a successful attack there would have a broader and deeper impact.
Also, have browsers been used for DDoS before? I imagine with the popularity Wikileaks has, you can ask people to keep a page open if they want to participate, and share that page on Twitter/Reddit/Facebook. The page would repeatedly create requests loading the target urls in an iframe or as a script tag.
In this approach one would have to get rid of the referrer header, I guess. So open the urls using SSL. The SSL handshake would cause additional load.
Not sure how effective would that be compared to a traditional botnet that can delay TCP and SSL handshakes; things browsers can't do.