seldo

"It would make sense that an employer would try to offer a lower salary to an employee it helped move to the United States since that employee also gains the benefit of getting sponsored, but the analysis found the opposite."

This makes me want to punch the screen. It is ILLEGAL to pay an engineer on an H-1B less than the median salary for that position, precisely because people were worried that foreign labour would be used to undercut wages.

Thanks! Minor nitpicks: this would fail if the login page were itself on HTTPS (as most login pages should be). Also, Hotmail no longer exists.

The attack builds on the CRIME attack, which is discussed in more technical detail here:

http://zoompf.com/2012/09/explaining-the-crime-weakness-in-s...

That page suggests that guessing known text like an SSN or email address contained in the body would give them an opening to break the encryption entirely, but I don't know enough about crypto to know if that's actually a possibility.

I was confused about that too. They don't make the request, they force you to make the request (by putting a bunch of them as pixels in an HTML email, or by getting you to trigger some JS). I'm still not clear on how they see the traffic -- I guess the attack relies on having a packet sniffer that can see the encrypted packets go by?

I hadn't realized the line around the shutter button was supposed to change at all. That's definitely not where I'd put it.

This is neat tech and works pretty much as advertised, but man, this UI is pretty rough. The blue background and curvy borders are strangely superfluous; tapping the left-bottom corner controls pops up an intermediate selector but the right-bottom controls work in-place; taking a shot produces a big "infinity" symbol that fades in and out of view -- I don't know what it means.

Good work on tech, please hire a UX specialist :-)

That's still more instances of IIS than I was expecting. Who uses it? Is it still as awful as it was the last time I fought with it 5 years ago?

Yes, but Google Finance is on google.com/finance (for some reason; I'm sure it used to be finance.google.com at some point...).

The importance of httpOnly had somehow escaped me until today :-)

Does anyone else feel that XSS on google.com is probably worth a bit more to the wrong people than $5k? Arbitrary-eval is pretty much the worst. Unless I'm missing something, somebody could steal a user's cookie strings and post them to an arbitrary endpoint, which could then use them to log into, e.g. GMail, which an attacker could then use to trigger and retrieve password-reset links for all sorts of other sites.

When I worked at Yahoo, an XSS on yahoo.com (which almost never happened) was a code-red, drop-everything, holy-shit event. If I were at Google I'd probably give this guy a bonus.

The first thing we do, let's kill all the lawyers.

http://shakespeare.mit.edu/2henryvi/2henryvi.4.2.html

Are these syndicates only now possible because of the crowdfunding provisions in last year's JOBS act, or is it just that nobody thought of doing things this way before?

I am absolutely saying to legalize all drugs, even the incredibly addictive ones. Spend a fraction of the money you spend now on locking up drug users to treatment of addicts.

If drugs were all legal tomorrow, would you run out and try heroin? No. Most people don't want hard drugs, and the people who do can already get them, and those people aren't all becoming drug addicts, otherwise Burning Man would be a city of 50,000 hopeless junkies every year.

Drug addiction -- like alcoholism -- happens only to a fraction of users, and in both cases factors like poverty, genetics and bad home situations are contributing factors.

Drug addiction absolutely does affect more than just the user, but the effect of legalizing drugs (again, not hypothetically, see Portugal) is less addiction, not more, and better treatment for those who do become addicted.

"$100/gram" was just a random number; I have absolutely no idea what any drugs cost. But yes, I was referring to cocaine, which is the one that causes the most trouble for my country. You guys grow your own weed.

I for one will weep no tears whatsoever if the ending of easy money for people dealing drugs causes the end of hippy culture. The cost-benefit analysis of "worldwide drug war" versus "some chilled-out kids living in SF" is pretty simple.

I didn't take the article as tongue-in-cheek, I took it as a serious list of the positive benefits of legalizing weed, and took it as an opportunity to soapbox for the benefits of legalizing everything else.

Legalizing drugs cuts crime in two ways. Directly, by reclassifying a bunch of formerly criminal drug users as just drug users. But also indirectly: it makes them cheap, which makes them unattractive targets for organized crime. If western politicians could just get over their taboos about drug use and let idiots stuff themselves with whatever drugs they like, not just nicotine and alcohol, we would make the US richer and safer.

And this isn't a hypothetical: more than 12 years ago, Portugal decriminalized possession of all drugs -- from marijuana to heroin -- and plowed the money saved by no longer jailing addicts into treating them. The result has been lower rates of addiction and HIV infection, and higher rates of treatment:

http://www.alternet.org/story/151635/ten_years_ago_portugal_...

Now possession is a misdemeanor, like a traffic violation, punishable by a fine or community service, and accompanied by a screening for risk factors of addiction, with encouragement to enter treatment programs:

http://www.spiegel.de/international/europe/evaluating-drug-d...

It hasn't been a magic bullet, but nor has it been a disaster. And what is a disaster is the current policy: drug money fuels endless violence and murder inside the US and across central and southern America.

The social fabric of my home country (Trinidad & Tobago) is being torn apart by violence from drug trafficking, and there's nothing we can do about it as long as the amount of money to be made by risking the drug trade is so enormous. We can't lower the price, because we are not the market: the US is.

I wish more people in the US were aware that their paying $100/gram for the occasional fun evening is paying for murder on the streets of my home town. And I wish more people realized they don't have to stop taking cocaine; they just have to lower the damn price.

The thing about RabbitMQ is that it's so powerful and configurable that it scares a lot of people, but for trivial use-cases it is incredibly easy to get running. If you're using it as a message queue within your LAN (i.e. no direct external interface) then even the HTTPS configuration can be skipped, and all you need to do is create a user and an exchange and have at it.

As a former Yahoo, I can certainly think of a number of former colleagues whose function was unclear and possibly nonexistent but continued to be paid for years.

You are absolutely correct. In the same way, in 2012, half of IBM's profits were from the sales and servicing of mainframes[1]. IBM is not dead, it's just irrelevant. And that's where Microsoft is apparently unstoppably heading.

[1] http://www.economist.com/blogs/schumpeter/2012/09/ibms-mainf...

Holy cow, the background of this website is an animation! That is really hard to read.

Without details of some kind, juicy or otherwise, this will get flagged.

I understand how prior disclosure works, my confusion is that nothing like that seems to have happened here. The patent was invalidated on the basis of documentation of a different piece of software with the same features released 5 years prior (albeit by the same company).

However, having read the ruling, I see it explicitly cites the prior-disclosure rule. So the bad patent system has invalidated a bad patent, but in a bad way.

I'm not sure I understand what you mean by "prior disclosure" here. They filed a patent application: those are supposed to be public. The prior art Joel used was the documentation of the Win32 API from 5 years previously (and I'm pretty sure we've been using variable-resolution apps since earlier than 2008, and not just in Windows -- this was just an example). Could you clarify what the problem is?

Headline: "the anti-virus age is over"

Final line of article: "Now don’t get me wrong, AV still has its place in the security world ... However, it’s no longer much more than a filter for the most basic attacks."

So... not really over at all. In fact, escalated.

...what the hell are all these 10-and-under kids doing here?

This is a really, really, really great idea that I've been thinking should be practical for a couple of months now. I wish these guys the best of luck. I even started work on a (not yet even vaguely functional) prototype of an open-source version of pretty much the same idea ( https://github.com/seldo/makomi )

Yeah, I'm not sure speed was the metric I needed improved when it comes to domain search, though it's a nice demo project.

My biggest problem with 2FA that relies on a phone is that I can lose my phone. If I do, the system can then do one of two things:

a) it locks me out forever. I'm screwed.

b) it has a way to reset my auth. Meaning an attacker doesn't actually need my phone.

So getting the phone involved is either a huge risk or a pointless feel-good factor that can be bypassed. Either way, I'm not on board.

None of the online-only sources are yet at a level of quality where I, wearing my hiring-manager hat, would take them seriously enough to justify the money spent. They'll get there eventually, but they're not there now.

Is there any reason you can't/don't want to attend a physical university?

Though by no means essential for a career in computing, a computer science degree is incredibly useful. At the very least, at the end of your course the skills you have now will have been given a stamp of authenticity by the accreditation, but in the best case the high-level tour of computing provided by a good degree course will have introduced you to concepts that will make you a better developer, and possibly sparked a deeper interest in some part of the field you're currently unfamiliar with, that will help guide you in picking the next stage of your career.

Choose wisely though: all degrees are not equal, and depending on the expense involved (I don't know what tertiary education costs are like in Oz) they may not be a net win.