reduxredacted

The qualities that make a great developer and a great professional security researcher are about the same.

Both involve taking hardware, a programming language, an API, an application or something else that someone in the computing industry had one purpose for, and bending it in a way to produce a rather unexpected, very unique result.

A great developer builds Web 2.0 with something as novel and limited as JavaScript and HTML.

A great security researcher made your toaster catch fire from a different continent (didn't they always say our toasters would be internet connected?).

I, personally, think the latter is more fun provided it doesn't cause any actual damage (and I think that was demonstrated ... a whitehat makes his own toaster catch fire and sometimes tells everyone who has that model of toaster how to fix it).

Nicely done.

I'm a strong believer that any system that contains anything meaningful to a user should incorporate reasonable two-factor authentication.

The problem is that folks in security tend to forget that they have to pay attention to the business side of things. It's e-mail.

A certificate plus pass-phrase, and a three attempt fall-back to mandatory phone authentication would be way more than enough assuming that everything under the hood was sound (DNS, SSL, etc ... which have all been shown to have weaknesses recently). Why hammer your way through a steel door when you break open the single pane window in the basement.

While I agree with your point, it gets lost when applied to Starbucks. There seems to be a groundswell of people who have suddenly realised that it's totally unreasonable to charge what they charge for a cup of coffee. The sheer ubiquity of Starbucks has also reduced their luxury allure. Might be nice to have a pretty receipt, but as far as Starbucks is concerned, they might want to reduce the font of the price and ensure it smudges easily.

That's a good point, really. I mean, look at all the comments his work has gotten here on HN. That seems like one of those rather obvious details that was "intentionally" overlooked.

It depends on the update . . .

I'm currently hosting a series of meetings where we are certifying all of our existing IE 6 and IE 7 based applications for IE 8. Much is broken because of hacks necessary to make these sites work properly in older versions of the browser.

While I'll be the first to say that we apply the IE Cumulative Updates the day after release ... silently ... to every PC in our company, we wouldn't dream of deploying a major browser update without reviewing it. Anymore, 99% most of our applications are browser based. A major browser update (Firefox 2.0 -> 3.0 or IE x.0 to IE x+1.0) can be as impacting as upgrading the operating system silently.

Yes, yes, I know. We standardized on IE, bad us. It wasn't my call :o).

Maybe off topic on the ridiculousness of this patent, the headline after "IBM patent for" should be taken seriously.

The standard for me used to be one hour long meetings.

About this time last year I read a chapter in a management book (name escapes me, and it would probably be great Prior Art) that suggested never scheduling meetings longer than 30 minutes. So I set some rules for myself based on the meeting type.

Brainstorming meetings/topical discussions: 30 minutes, max. Never recurring. I start the meeting on time with a simple statement: "I value the time you've given me here, so I want to get this going. If we tear apart <topic> we can probably be done in twenty." I get consistent, on-time attendance (from people who do not report to me) and consistent participation (on conference calls people are taking from in front of an internet connected PC).

Status Meetings: I rarely schedule these, but when I have to, they're set to 15 minutes and very structured. My daily status meeting lasts between five and seven minutes.

I have a totally unscientific theory as to why I insist on shorter meetings work (based solely on how I behave):

1) I don't have an hour to kill in a conference call being hosted by someone other than my boss or in my reporting chain. So I work during those meetings. I do have twenty minutes assuming that the problem attempting to be solved hasn't already been solved by the organizer and my attendance is simply ceremonial.

2) Half hour meetings may mean having to have two instead of one, but that may also be a benefit in that it gives people time to think more deeply about the problem at hand and be prepared for the next meeting.

3) Status meetings suck, especially if they are simply a formality or legal requirement. I see them for what they are (a necessary evil) and try not to waste anyone's valuable time. When I host them, they have a strict agenda and are very short.

When I participate in "manager status meetings" (sometimes called "What did you work on this week?"), I come prepared with a list and put it through a filter: "Is this item something that anyone on this call will find useful or care about". My responses are short and to the point. I regularly receive follow-up questions targeted at a specific bullet point. Maybe that's bad, but I'd rather provide a little less than is necessary and have someone ask me for specific information that's important to them, than provide so much information that everyone's eyes glaze over and they stop paying attention.

There has to be a name for that condition. I've had it as well, though it started in me in my early teen years practicing piano and got progressively worse throughout my 20s (marathon coding sessions...and I never did give up piano) The exercise you mentioned was the fix. In my case, my Chiropractor was the one who recommended it.

I'm not a big Chiropractic fan, I went to various practitioners and have received various pieces of advice ranging from "non-exercises" to goofy expensive vitimins. I started getting regular adjustments with this guy only after I noticed the pain in my neck was going away due to the exercises he recommended.

He's since also helped me with wrist and finger pain not uncommon to those in my profession.

The only thing I'd add to your recommendations (haven't tried the standing desk) is to take "second hand smoke breaks". I get up from my desk twice a day and walk around the building outside when the weather is tolerable. That tends to get the blood flowing. I've also found when debugging or troubleshooting a problem, stepping away and getting some fresh air tends to result in better solutions.

I've been doing this for a really long time ... it started when I was asked to research a piece of malware we were fighting at work and discovered that our proxy filtered every useful site on the subject.

Nice recommendation, though, change the port you expose to the outside world to something other than 22 and you'll see a lot fewer attempts to brute force your ssh server.

Kinda reminds me of a fax joke a friend of mine had on his cube wall. "How much money did you make?" "Give it to us."

Simplest tax code ever.

No based on how the question was framed. If a response is "questionable" then I have to question whether or not I should make that questionable response.

Most of the time I post under my real name (actually, I don't know why I'm using a pseudonym on HN, frankly, just reflex when I first joined).

The exceptions are: Discussions on Politics or Religion. I don't want my name associated with any religious (or atheist) group nor do I want it associated with any particular political party. I have worked for people that once they discovered my political views, I was treated differently because we either agreed or disagreed. I know that my name is going to be googled the next time I apply for a job and could run into someone who will toss out my resume simply because I'm conservative, liberal or other.

If a site is overly political, or it's associated with a political cause, I will always keep only one ID on that site. If the site allows anonymous posting, I'll use my real name and post anonymously when broaching a subject that is controversial. If the site does not allow anonymous posting, I'll keep two IDs handy for when I want to join into discussions that would identify my political or (non/religious) affiliation.

A REAL sequel to Star Control 2 (a.k.a. Ur-Quan Masters)

I'll settle for an inexpensive minivan that I can buy new. Seems like it's a dying breed but when you have kids it's a necessity.

Agreed ... Foxit's e-book reader "appears as though" it's getting a little closer. For me it's not about page size but price. It seems like there'd be a market for a "light on features" ebook reader for those of us who don't care about whispernet, touch screens or wifi.

Though I don't know that I would be willing to skimp on everything (like a reader with just forward and backward buttons). When I read PDF files on my screen, I regularly use the search features to zero in on things.

Your statement of "as if it had been printed" is intriguing. So the device would have to have something that you can at least plug a page number into (kinda like thumbing to somewhere that you think might be the location you're looking for). At the right price, I'd give up search if it had this as a minimum.

A small business server appliance for non-IT based small businesses. I'm thinking: Network attached storage with a built in Samba NT compatible domain controller/windows file/print sharing capabilities. RAID-1 plus an automated backup mechanism ... maybe, attach an external USB drive and it automatically does Sunday fulls and daily differentials keeping as many as it can store. Bonus points if it can take extra SATA hard drives / external drives for expansion without adding a huge cost.

Why I'd buy it? My dad's company is running a (very nice in its day) server on Windows NT with "redundant everything" that is starting to fail something fierce. It's 13 years old but it meets the needs of him and his ten employees and at the time there wasn't much of a better choice. Since they don't do anything locally but file/print sharing it seems like such a waste to have a power hungry box with a monitor on it for such a simple set of requirements. Also, if something like this were available, I'd replace my existing home-brew NAS ... based on openSuSE with it in a second if it'd lower my electricity bill.