pizzeys

Surely it's the other way around, normal software is dining out, and SaaS is dining in?

I made a dumb thing a while ago you can play with to try and differentiate between them and real HN quotes: http://hack.pizzey.me/

It's usually pretty easy due to the predictable format of HN Onion, but when you get one that doesn't follow that form it can be amusingly difficult.

> I believe the same is true of gambling winnings (The reasoning being that you aren't given tax refunds when you lose, so it's unfair to tax when you win)

Which becomes really interesting when you consider professional poker players.

Nice try, but I'm not sure this is going to work :(

If by 'everyone' you mean 'around 25%'...

Do you think privilege escalation is unusual on Windows now, then? :)

> Or how about the common-sense idea of having two people in the cockpit at all times? Apparently new to Lufthansa.

Is this necessarily 'common sense'? If it was a flight attendant who'd downed the plane, we'd all be lamenting how it should be common sense not to let people who are not as closely vetted or scrutinised in a locked room with an axe and the pilot in command...

You've said this more than once, but you are completely wrong. 'Crystal' is Methamphetamine HCl. Desoxyn is Methamphetamine HCl. They are exactly, 100% the same chemical.

If your issue is with smoking vs. other methods of ingesting, we can talk - but that doesn't make them 'different drugs' any more than Nodoz is a different drug to Caffeine in coffee - Desoxyn being smokeable too, of course, though I'm not sure who would bother.

This is indeed an area of research, you're not unique in seeing this use (sorry! :D)

I am agoraphobic and am aware of, though have not participated in, virtual reality assisted exposure therapy programs for agoraphobics. It's early days, but there's people working on it.

It's particularly exciting for agoraphobia and certain other anxiety issues which respond very well to exposure, but exposure is expensive and difficult to do and takes a lot of work on behalf of the patient and practitioner, whereas VR obviously makes things easier if you can make it work as well.

Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com, it will redirect to https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point.

However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)

Heaven forbid you use a one-time pad...

>- On top of that, he supposedly began coding the site after SR1 was busted. How does it take over a year to set up a simple e-commerce site when almost 60 other clones were able to set up in that time? To me, that reads like it's a hobby, at best, or that he's completely incompetent, at worse. In neither case does one want to use his site.

It could also mean the opposite. You ever pentest those other markets?

Is that actually what it was, or did people just start using it after a guess that it was that? As far as I can tell, BitTorrent Sync basically accepts any arbitrary string of decent length as a key.

> IP addresses are assigned to a network provider, not a customer.

Actually, they can be assigned to either. See: http://en.wikipedia.org/wiki/Provider-independent_address_sp...

Unless of course, your domain name is in the .uk namespace, which allows you to change your registrar at any point without their involvement. I don't know of any other TLD's that operate this way, but I don't doubt that there is one.

As a stalwart defender of the WTFPL in my small circle of developer friends (who mostly think I'm crazy for it), you are now added to the list of people I can use to back up the fact that I'm not. ;)

Seriously though, awesome project, used it for a while.

I don't think this would work. The people getting caught by this would also miss the notice to take their sites down.

Many web hosts do this. At <redacted UK-based LAMP host> we do both the WAF stuff (which Cloudflare don't actually do, unless you pay them), and your latter suggestion of read-only'ing accounts on discovery of vulnerabilities.

The unfortunate reality of the latter one is that it's going to break their site, probably, since we don't know what they run, and you can't just read only an entire account blindly without breaking something. We could do better there, but it will never be perfect in this environment.

ReadProcessMemory() requires the process to have debug privileges.

(how else could you ever secure anything?)

I doubt it's from the FAA. ADS-B is trivial to monitor, there's lots of private individuals/groups grabbing this info.

Text Messages also provide no such assurance, though. Sure they 'often' are within a minute, but then so is email.

> or inspecting the game's address space which is fragile and often triggers anti-cheating or anti-botting systems

Just looking without touching rarely (never, to be honest) triggers any anti-cheating systems. It's madness enough trying to stop people touching, trying to stop them looking reliably is futile.

The graphics interception hacks are pretty neat though, but I wouldn't say it's a common method at all.

I'm not sure I can think of a single iLok protected plugin that I haven't been able to pirate successfully.

They're doing it to troll you (or others looking for keys).

I don't know about this specific bug, but there have been consumer routers bugs before (Netgear specifically) where not only were they vulnerable to CSRF, but authentication bypass at the same time if the request was crafted carefully.

Plenty of other ways to catch even the security aware. The obvious, since he knows this person, would be to tweet some 'news link' and have the code only work for Bill. You can be security aware and not be perfect 100% of the time.

A significant part of the world is dealing with depression. HN is merely a place where discussing such things, particularly in a pragmatic way, is something you can do (mostly) without ridicule or worry about stigma.

That isn't at all what he said, though.

Hm. I wonder how Amazon/other affiliates see this? I mean, it's obviously different from, but reminds me of, those malware operators/dodgy ISP's injecting their own referral id into links.

Is there any precedent of sites with user submitted content doing it on their own sites?

Haha, that is the sort of argument I'd avoid having at work because it would lead to bloodshed.