HNHacker News
TopNewBestAskShowJobs

talklittle

316 karma · joined October 16, 2009

[ my public key: https://keybase.io/talklittle; my proof: https://keybase.io/talklittle/sigs/irMqDQP7g42TuSoIY-9P6kh-Ub29pcxKBaRu8aE_57w ]
submissionscomments
talklittle··on VLC maintainer has refused “several tens of millions of Euro”
> You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail.

Neat idea, but wouldn't this still be exposed to ISP-level attacks? Since the user is still loading the page initially in plain HTTP, so the ISP could still inject code, remove the JS redirect, etc.

talklittle··on Hacktoberfest: A month-long celebration of open source software
For one, GitHub and DigitalOcean both had Series A investments led by the same partner at Andreessen Horowitz.

https://www.crunchbase.com/organization/digitalocean/investo...

https://www.crunchbase.com/organization/github/investors

talklittle··on iPhone X
https://en.wikipedia.org/wiki/Surgical_stainless_steel

> There is no formal definition on what constitutes a "surgical stainless steel", so product manufacturers and distributors apply the term to refer to any grade of corrosion resistant steel.

talklittle··on Laverna – A Markdown note-taking app focused on privacy
A bit misleading. The maintainers have been working on large experimental features like a self-hosted "signaling server" which helps sync notes without storing any note data on it, and without relying on third-party hosting like Dropbox [1].

Also if you look at the dev branch [2], they have been making sweeping changes to the codebase; most recently it appears they have been removing "old" JavaScript libraries like Bower, presumably to move everything to an NPM setup.

[1]: https://github.com/Laverna/laverna/issues/778

[2]: https://github.com/Laverna/laverna/commits/dev

talklittle··on Mozilla’s Send makes it easy to send a file from one person to another
How is expiration of files achieved with IPFS? I thought files stored on IPFS were available forever.

If my impression was correct, then Firefox Send supports different use cases than IPFS.

talklittle··on A startup’s Firebase bill suddenly increased from $25 to $1750 per month
Not really. "Introduced a bug" is fairly common (just do a Google search and see), and clearly does not suggest intention.
talklittle··on International Travel Guide for Basecamp employees
The work vs. business question is simpler than that. Business = working in US for a foreign company. Work = working in US for a US company.

Presumably Basecamp has set up business entities abroad.

https://travel.stackexchange.com/questions/2272/about-differ...

talklittle··on Exercise 'keeps the mind sharp' in over-50s, study finds
Sounds like dehydration. Do you always drink enough water before and after exercise sessions?
talklittle··on Vivaldi browser v1.8 released, with calendar-style browsing history
Firefox Test Pilot [1] is a more recent approach to testing new UI in Firefox. It's entirely extension based. I think this is a smart approach because it lets Mozilla quickly test new UI features without building it into the core browser before it's been vetted.

However its full potential is not ready yet, since Firefox has been migrating to WebExtensions, and this has not fully stabilized yet. Long term I think the WebExtensions move also makes sense, since it gives extension authors a stable API to work with, instead of XUL which can break with each Firefox update. And the architecture makes it easier to optimize threading performance and some form of security sandboxing.

So the point is, I think more UI experimentation is on Firefox's horizon, but they have to first stabilize the technical architecture before they can go full throttle on that.

[1]: https://testpilot.firefox.com/

talklittle··on Trolling the Entire Internet
Interesting. I wonder how many self-driving car researchers incorporate car crash videos into their AI (anti-)learning datasets?
talklittle··on Mozilla Acquires Pocket
IMO the simple reality is they need to diversify their income sources to avoid putting all their eggs in one basket, and they decided Pocket makes sense. I'm still a huge Mozilla fan, the whole Pocket episode is not a big deal to me.
talklittle··on Mozilla Acquires Pocket
That much is unclear. http://www.ghacks.net/2015/12/05/mozilla-has-a-revenue-share...
talklittle··on Cloudflare data still in Bing caches
> by visiting one of the vulnerable sites repeatedly

I mean, how could CloudFlare, or anyone, possibly differentiate this from normal scraping/polling/ manual F5 refresh behavior? This sounds like a PhD thesis.

I guess you are asking CloudFlare to quantify the amount of distinct bytes of unauthorized data sent to any particular user agent? But then, any sophisticated attacker would rotate IPs, UA identifiers, and probably even between vulnerable websites, if they had known about this vulnerability.

I don't think it's reasonably possible to rule this out, even with a massive dedication of investigative resources. Like the other commenter said, it's wisest to assume it happened.

talklittle··on Trump's visa plan leaks: American techies first
> 2. I agree $60,000 is a very low minimum. But how is $130,000 reasonable? Even in this industry that's a significant salary.

The current administration is businesspeople. They know $130k sounds too high, it's anchoring for negotiations. It'll go lower.

But also it's kind of the point of the reform being pushed, right? If somehow $130k is passed, it will obviously disqualify most foreign workers from acquiring these visas, and maybe the current quota of visas wouldn't be met. Then the quota may be lowered in the future, further limiting the visa program.

talklittle··on Tesla factory worker calls for a union: “We need to stand up for ourselves”
You're misinterpreting cjensen's comments. This is Hacker News, where people like to use an engineering mindset to find smaller faults in arguments, even when they may agree with the overall argument. I believe cjensen's purpose in commenting was to constructively criticize the author's complaints. He's saying this one specific complaint, about regional wages, is flawed because Tesla could theoretically solve that one specific complaint in a way that hurts those workers, by moving the jobs away to a cheaper cost-of-living region.

The point is that by removing the flawed argument, and keeping the legitimate arguments, the overall message becomes stronger.

Your accusation "But you don't care the workers are being abused and working in unsafe conditions." is inventing and attacking something that cjensen never said or implied.

talklittle··on Snap Inc. S-1
Come on, HN. How can nobody be mentioning some of the much cooler stuff available on Google Cloud?

https://cloud.google.com/products/machine-learning/

It's a mistake to just compare Google with AWS, thinking in terms of basic storage and computing. That's boring and obviously there are tons of alternatives, including Snap Inc. building it themselves, for the amount of money cited.

When it comes to cutting edge AI and related, Google's offerings clearly stand out among other cloud services.

talklittle··on Scott Kelly's DNA shows unexpected telomere lengthening after year in space
> There is also one sure-fire way to increase telomere length : get cancer.

This badly needs a source.

This article from 2013 [1] says the opposite, that shorter telomeres are associated with cancer:

In recent years, shorter telomeres have become associated with a broad range of aging-related diseases, including many forms of cancer, stroke, vascular dementia, cardiovascular disease, obesity, osteoporosis and diabetes.

And another [2]:

"Telomere shortening is common in cancer, but the degree of shortening varies from one cancer cell to another within each patient, and this variability may give us a better idea of how prostate cancers behave."

[1]: https://www.ucsf.edu/news/2013/09/108886/lifestyle-changes-m...

[2]: http://www.hopkinsmedicine.org/news/media/releases/in_prosta...

talklittle··on Virtual reality: a billion dollar niche
archive.org's first scrape of the article was January 14, 2016.

https://web.archive.org/web/*/https://www2.deloitte.com/glob...

talklittle··on Show HN: Tesseract.js – Pure JavaScript OCR for 60 Languages
Apache-2.0

They've added https://github.com/naptha/tesseract.js/blob/c26cae7ee956c399...

talklittle··on Show HN: In-view.js – Get notified when DOM elements enter or exit the viewport
Yes, lazy loading is a good use case.

Echo.js (https://github.com/toddmotto/echo) is another small no-dependency library (1.89 KB minified), which detects elements appearing on screen, and goes a step further to swap the "src" attribute with a placeholder for lazy loading and unloading.

Disclosure: I've submitted a pull request to it.

talklittle··on What Happens When You Install the Top Download.com Apps
Relevant discussion about YC-funded "InstallMonetizer" from 2 years ago: https://news.ycombinator.com/item?id=5092711
talklittle··on OAuth 2.0 and OpenID Redirect Vulnerability
Not sure if this is news. The lead author of OAuth 2 resigned from the OAuth working group 2 years ago, citing all the security flaws inherent in the OAuth 2 spec.

http://www.cnet.com/news/oauth-2-0-leader-resigns-says-stand...

OP just spells out one way to take advantage of OAuth 2, and tacks on a sensational title.

talklittle··on Don’t Add Features to Make Customers Happy (2011)
YeahKIA: You appear to be hellbanned, FYI.

YeahKIA's comment: Plugins is an interesting approach. But I wonder how friendly it is to non expert users. Same with the writing your own part.

talklittle··on Reddit uses Adzerk API to improve native ad system
Where's this entitlement coming from? From the sound of it, your account was serving zero ads at the beginning of 2014. You were clearly not a "customer" of theirs. There's no reason for them to offer you a free 100 million impressions on a service you weren't even using.
talklittle··on Ubuntu 14.04 LTS
Ok, but what about Lubuntu 14.04 compared to Lubuntu 12.04?

Your comment is only comparing LXDE with other desktop managers, instead of comparing different versions of Lubuntu.

EDIT: It occurs to me you may have mistaken "LTS" for the desktop manager name (LXDE) when you replied. LTS means "Long Term Support".

talklittle··on Another Big Milestone for Servo: Acid2
Previous discussion: https://news.ycombinator.com/item?id=7483729
talklittle··on “In a typical year the OpenSSL project receives about US $2000 in donations”
This sounds like it would introduce a massive conflict of interest.

Also it assumes the OpenSSL team are the first to know about vulnerabilities. Heartbleed has shown that's not always the case.

talklittle··on Erlang/OTP 17.0 has been released
Reference manual for Maps: http://www.erlang.org/doc/reference_manual/maps.html

Manpage for Maps: http://www.erlang.org/doc/man/maps.html

Older documentation for Maps (EEP): http://www.erlang.org/eeps/eep-0043.html

Important note found on the reference manual page:

Maps are considered experimental during OTP 17 and may be subject to change.

The documentation below describes it being possible to use arbitrary expressions or variables as keys, this is NOT implemented in the current version of Erlang/OTP.

Exceptions returns badarg instead of badmap, this will change in the future releases.

talklittle··on This Little-Known iOS Feature Will Change the Way We Connect
Mattt Thompson expands on the topic, and suggests this and similar technologies will be a game changer for privacy and security, including impositions by governments and ISPs: https://gist.github.com/mattt/9836041#file-multipeer-connect...
talklittle··on This Little-Known iOS Feature Will Change the Way We Connect
Stackoverflow question comparing Multipeer with WiFi Direct: http://stackoverflow.com/questions/19067794/ios-7-multipeer-...

Multipeer and WiFi Direct are not compatible. Stackoverflow user @barbazoo hypothesizes Multipeer is using Bluetooth Classic.

iOS Bluetooth Classic is known the be under the Apple MFA Accessory API tight control and lockdown, including the MFA authentication challenge-reposne. Apple controls the MFA encryption keys (either in software or by the accessory authentication chips). It makes it inaccessible to other platforms.

Page 1 of 3Next →