Hacker News Reader

seldoon The Absurdity of LinkedIn

As a hiring manager, I expect candidates to have a LinkedIn profile that is up to date. A LinkedIn profile is a public copy of your resume; other people can see it and flag if you make inaccurate claims. I can also see how you're connected to me (it's a very rare web developer who isn't a few degrees away from me, mostly because of my time at Yahoo) and use those people to work out where you are in the industry, and get background information from them. Public recommendations are good (the skills endorsements list much less so).

If you don't have a LinkedIn profile, I assume you're either very junior, shady, or clueless, and none of those is good. [Edit: per comments below, you might have some deep principled reason for not using social networks. In this case my metric is wrong, but I'm okay with having a false negative once in a while.]

Expecting everyone to have and maintain their own domain probably isn't practical, but even for those that do, the discoverability of that domain is low: I don't search google to find developers, I search LinkedIn. That's what it's for, and it's really pretty good at it.

They do some really dumb UI stuff around privacy that is trivially worked around using Incognito. I wish they didn't, but it's not dumb enough to make me abandon the giant utility of the network as a whole.

[Update: I took this thread to Twitter and got a bunch of really cogent arguments, including that LinkedIn enables harrassment/stalking of marginalized groups. That's more than a few isolated people who don't like social networks or object to the dark pattern UI, that's a systemic flaw. So I'm going to change my hiring practices to take that into account. Thanks, everybody!]

seldoon OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products

Can somebody more familiar with Cisco products look at the list and break this down a bit? Are these mostly edge-of-network devices, or are these big switches that tons of traffic run through?

Does being vulnerable to Heartbleed necessarily mean traffic through these boxes is vulnerable?

seldoon Amazon EC2 Pricing Changes Effective April 1, 2014

http://blog.awe.sm/2012/12/18/aws-the-good-the-bad-and-the-u...

TLDR: it's okay for backups, but in critical path it's a world of sadness. Failure modes are too painful.

seldoon Amazon EC2 Pricing Changes Effective April 1, 2014

DO's "internal" networking/security group support is still immature. I use DO for personal stuff, but at work we use AWS.

Just never EBS. Ever.

seldoon Npm security post-mortem

Update: I was in fact incorrect about the severity of the rubygems.org incident; their issue was a disclosure without a breach, exactly like ours. I've updated the original post and also issued a correction:

http://blog.npmjs.org/post/78165272245/more-help-with-self-s...

seldoon Npm security post-mortem

The original abandoning of the self-signed cert was because self-signed certs were a bad idea.

The issue that post refers to (it is a little unclear, because we ourselves were a little unclear what had gone wrong at that point) is when we broke older clients by moving to a non-GlobalSign cert. We cleared that up here: http://blog.npmjs.org/post/78165272245/more-help-with-self-s...

We had already planned to move to a new cert before the security disclosure, and hadn't anticipated the size of the problem with a non-GlobalSign cert, so although the two happened pretty much simultaneously, they weren't really related.

seldoon Npm security post-mortem

It turns out we were incorrect about the scope of the Rubygems incident, and have issued a correction:

http://blog.npmjs.org/post/80307645782/correction-to-previou...

seldoon Npm security post-mortem

I'm sorry you took it that way. The scope of our security hole was exactly as big as the Rubygems vulnerability. If I'd omitted that comparison, I was sure somebody would say "these guys were just as bad as ruby but they're covering that up!" At the same time, I wanted to make it clear that the only reason this wasn't a game-over disaster for us is because we were lucky. We weren't any smarter, or better designed. Just luckier.

seldoon Npm security post-mortem

As a point of honor, I feel obligated to mention that @rockbot and I are very aware of these hazards, but our website was put together in somebody's spare time when Node had like 100 users in total :-)

seldoon Npm security post-mortem

That was certainly the intention.

seldoon Npm security post-mortem

We told them as soon as we found out, because we needed them to go looking for the same hole in all of our code bases :-)

As part of the audit, ^Lift audited a lot of the third-party modules we use, and notified the authors of those packages separately (I'm not aware of the details, but I don't think there was anything major).

seldoon Ask HN: Who is hiring? (March 2014)

npm, Inc. - Oakland, CA

We run The npm Registry and are the stewards of the open-source npm client and related open-source projects. We want to make Node.js awesome for everybody. You may have heard of us, particularly yesterday, when we broke something important and a lot of people got mad.

We are interested in hiring all sorts of people this year, but our priority right now is a DevOps engineer -- we already have a couple, but we are growing fast and need to improve our reliability, so we need more. (This was already our priority before yesterday, I promise)

We like working on npm because JavaScript is fun, and solving problems that lots of people have -- about how to share code, deploy it, and scale it -- are really rewarding. We are not interested in working long, life-destroying hours. We are interested in working with people who are sane, fun, and friendly. We have a strict no-assholes policy.

We are also accepting applicants for a summer internship. There's more details on both jobs here:

http://www.npmjs.com/jobs/

seldoon More help with SELF_SIGNED_CERT_IN_CHAIN and npm

That is pretty much exactly correct.

seldoon More help with SELF_SIGNED_CERT_IN_CHAIN and npm

Any npm downloaded after ~August of 2012, which is when the GlobalSign CA was added to the client:

https://github.com/npm/npmconf/commit/d7ef61c8d9ae87f39482c5...

I believe we considered adding the npmCA and dismissed it, but it has been a long week and I can no longer recall why. I will bring it up and post an update here next week.

seldoon More help with SELF_SIGNED_CERT_IN_CHAIN and npm

Correct. It is a GlobalSign cert that was donated to the Node.js project. Once we became a company we had to stop using it, both from an abundance of caution, security wise, since we were not the only ones who had the cert, but also because it wasn't right to be using a free cert for our new, for-profit entity.

But moving to our new, self-owned cert in a way that broke anything was avoidable, and a huge error on our part.

seldoon More help with SELF_SIGNED_CERT_IN_CHAIN and npm

That's not correct. The latest npm (and any npm configured with ca="") will use the CA baked into your operating system's version of OpenSSL. Our old cert, from GlobalSign, works just fine with OpenSSL.

seldoon Npmjs.org moderated one of my comments regarding their outage today

I know you don't know me, but if you ever meet anyone who does, you can ask them about my personal attitude towards censorship of any kind. The idea that I would stoop to censorship for something as petty as somebody voicing legitimate complaints about a technical screwup of mine is laughable.

(Update: I remembered I wrote http://seldo.com/weblog/2013/09/04/why_i_am_a_web_developer a while ago, which should give some indication about how I feel about censoring the web)

seldoon Npm's Self-Signed Certificate is No More

Hi! As I said in the comment's on Rob's own post: we didn't censor any comments. We did no moderation of any kind on any comments today; we were way too busy trying to fix the problem. I don't know what happened to Rob's comment, but it was nothing anyone at npm did.

seldoon Npmjs.org moderated one of my comments regarding their outage today

Hi! CTO of npm here. I haven't been reading HN today because we were trying to fix the SSL thing, so I was genuinely taken aback to see this article.

We didn't censor any comments; we did no moderation of any kind today. I have no idea what happened to his comment, but nobody at npm did anything to it.

seldoon Ask HN: Why isn't Erlang more popular?

Since you asked: I have never tried Erlang because I've heard it's like Haskell but harder to learn, and Haskell already breaks my feeble mind, so I have steered clear. This may or may not be an accurate picture, but it was my decision-making process. I have no programming problems that make me think learning a whole new language would be worth it (on top of my existng stack of 10 or so).

seldoon JavaScript Module Loaders Considered Harmful

Agreed. On the front-end, module loaders eventually come in handy but their utility isn't immediately useful. If an "anti-pattern" is something that seems useful but eventually isn't, and a "pattern" is something that seems useful and immediately is, we need a phrase for this third state, where it's a pain in the ass to start with and only becomes useful later.

seldoon Npm Raises $2.6M Seed Round

I appreciate your paranoia :-) We are wary of announcing all the stuff we're planning given that we don't know how long it will take to build yet and don't want to be accused of vaporware. However, we are planning to announce at least our initial product plans pretty soon. (Probably not in a comment on a HN thread though ;-))

seldoon Npm Raises $2.6M Seed Round

It's not accurate to say that Fastly is hosting the registry; Fastly are providing CDN services to our registry -- a globally distributed cache -- for which we're very grateful.

As of five days ago ( http://blog.npmjs.org/post/75707294465/new-npm-registry-arch... ) we are hosting the registry ourselves; it was previously hosted by Nodejitsu (who still operate a downstream mirror).

As for the download counts, per Twitter ( https://twitter.com/npmjs/status/422823647619710976 ), we removed the download counts because our original solution for those counts (keeping them in CouchDB) wasn't scaling. I am literally, as we speak, working on the replacement system to restore download counts.

And Isaac's LinkedIn title is a joke. I hope that's obvious.

seldoon Richard Lynch, an awesome PHP community guy and former colleague needs our help

> If you get sick and can't work, is the health care system supposed to pay your mortgage too?

In lots of countries, if you get too sick to work, the government will assist you in paying for housing. In lots of countries, they'll do it if you're just unemployed, too.

There's no righteousness to the fend-for-yourself ideals of the USA. It doesn't have to work that way. You can choose, as a society, to sacrifice extreme wealth for greater equality. It doesn't make those countries better, but nor does it make them worse.

The widespread and persistent belief in the USA that whatever the USA does is the best way, and all other countries are dumber and weaker, is one of the most distasteful things about living here as an immigrant. It doesn't have to work this way. The American way is not automatically the best one.

seldoon New npm Registry Architecture

No added value, just haven't got around to implementing anything cleverer, yet. There is an open issue:

https://github.com/npm/npm-www/issues/569

Feel free to chime in if you have a suggestion or even submit a patch; npm Inc only has 4 full-time engineers right now (we're hiring!) so it will be a while before we get to this otherwise :-)

seldoon Inception - Root any machine over FireWire, Thunderbolt, others

It seems like the root problem here, as in lots of security problems, is an assumption made early on is no longer valid (e.g. "this application only runs on our LAN, so no need to protect against malicious actors"). In this case, PCI was originally an internal technology -- adding a new PCI device involved opening the case and plugging in a new card. Pluggable PCIe devices changed that assumption, so things that were previously pretty safe (trusting a new piece of hardware physically installed into the box) became unsafe (trusting a random device plugged into the box).

seldoon Poll: As a founder, what is your salary?

How do you live in London on £12k?

seldoon Snapchat Phone Number Database Leaked

And while we're here, "cock sucker" is not an insult, and my fellow gay hackers and I would prefer if you didn't use it as one.

seldoon Bitcoin, Magical Thinking, and Political Ideology

So you're saying the system was greedy and corrupt, that the laws prevented those features from getting out of control, and when we took the laws away they ran wild... therefore we should take the laws away?

seldoon Bitcoin, Magical Thinking, and Political Ideology

There's definitely a chance of that, but I think the repeal of those laws then being immediately followed by a return to damaging volatility is indicative that it was more than just coincidence.