HNHacker News
TopNewBestAskShowJobs

timsally

1,456 karma · joined March 18, 2011

Tim Middleton-Sally

tss@hey.com

I am interested in reverse engineering, operating systems, and compilers. Always happy to chat.

submissionscomments
timsally··on Steve Yegge: Follow Up to His Accidentally Public Rant
Notes have been around for 5+ years and I've never seen them linked as news stories. In contrast, I've seen Google+ updates consistently submitted as news to HN and other sources. There is a significant difference between Google+ updates and Facebook Notes and it's worth thinking about why. I suspect it has to do with the fact that status updates and public posting in Google+ are the same interface. For Facebook, status updates are character limited and you have to click into the Notes tab in order to write something longer.
timsally··on MIT can now see through concrete walls
The above is correct. The lab is an FFRDC managed by MIT. It's a really great place to work! I'm in the computer security group and we're hiring for full time and summer internships. There's a description of my typical day in my profile. I'd love to chat with anyone that is interested at tsally@mit.edu.
timsally··on Google not acquiring Akamai
> I'd like to see Journalists get a degree and a license just like a lawyer or a doctor, then maybe we'll get some integrity

Ignoring for a moment the fact that you want to license speech, what reason do you have to believe that licensing has anything to do with integrity?

timsally··on Why you should have a long commute - The opportunity of commuting
I agree that the commute situation in the article is negative. However, it's possible to have a discussion on a deeper level that what's being presented here. For example, each way my commute is 50 minutes by bus or 25 minutes by car. I can see people falling on either side of that tradeoff.

+ Car gives me 1 hour of extra time at home and 1 hour in the car, per day. High in cost, high in stress (for me), high in freedom.

+ Bus gives me 2 hours on the bus, per day. Low in cost, medium in stress, low in freedom.

On a personal level I can't utilize the hour each day driving very well. So if I drive I think I get an effective 1.5 hours of work out of it (50% utilization while driving, 1 hour at home). Whereas with the bus I get 2 hours of work pretty reliably. As a recent college graduate, the additional hours of work and savings fit me perfectly. This is a time period where it's smart to rapidly increase your technical competency and savings. As I grow older and have a family, the tradeoff looks different. I think then it would make more sense to spend the money and lose a bit of work time, but have a lot more time at home and a lot more freedom.

timsally··on Is Junk Food Really Cheaper?
Here is McKinnon's flyer: http://mckinnonsmeatmarket.homestead.com/Menu.html. I'm not sure on ground chicken price, but you can see the prices for chicken breast on there. I've never personally been there, but there is a Yelp review from July that confirms buying split Chicken breast at $0.99/lb.
timsally··on Is Junk Food Really Cheaper?
A brief anecdote. McKinnon's meat market in Cambridge sells boneless chicken breasts for $2/lb and split chicken breasts for $1/lb. I'm not an expert and can't speak to the quality, but it's really popular among residents here. I have no idea whether this is an "unrepresentative price sample", but it's a meat market in Boston a few blocks away from the red line. It's not exactly an obscure shop. I've never been there, but I'm thinking about checking it out this week as people keep telling me to go.
timsally··on The Costs of Bookmarking
Take note. This is actually a useful response that people benefit from reading. As opposed to the several one liners already posted that all say variants of "your hosting is expensive". Thanks for taking the time to write this response up.
timsally··on Deft -- easy note taking for Emacs
Available via Marmalade as well: http://marmalade-repo.org/packages/deft

Just spent a few minutes playing around with it. I like the simplicity, nice work. One thought I had is that you could enter Deft mode whenever you cd into a directory with a .deft configuration file. This file could have a title for the top of the Deft view and perhaps the ability to specify what columns you want displayed. In this way you can have different directories for notes about different topics.

timsally··on Introducing Bitcoinica API (The first RESTful Bitcoin Trading API)
I agree with everything that has been said so far, with the exception of the conclusion. I don't have a problem with zhoutong taking money. People putting their money in Bitcoin are investing in a currency that is two years old. Said another way, a currency that is younger than a $15 bottle of wine. All players in such a market by definition lack reputation, lack experience in handling currency, and lack experience in running a financial institution. Yes, zhoutong doesn't understand security and yes he is hand-waving. Yes, he needs to do his best to secure his app. Yes, he should invest money in an audit when it can afford it (if only because a security audit maps directly to better business for a financial institution). But do I feel bad for users who are putting their money into Bitcoinica? Not really. Trading in a currency that is only two years old is the NFL. Dealing with young and inexperienced financial institutions is part of the game if you chose to enter such a risky market.
timsally··on Grouper Sets You Up With Three Facebook Strangers, But ‘It’s Not a Date’
I have no idea whether gay people prefer a gender balanced group and didn't mean to speak for them in my original comment. I was commenting on the average social event; the gay population, while sizable, does not represent the average case. Of course this means there is an opportunity for arbitrage if a main player neglects the gay community, and Grouper may well be doing just that.
timsally··on Grouper Sets You Up With Three Facebook Strangers, But ‘It’s Not a Date’
So it's not a date, but you do have to have 3 men and 3 women? If it's not a date, then why the gender requirement? And why match on attractiveness?

Because when the average person wants to have fun, he or she usually is looking for a gender balanced group with attractiveness levels similar to him/her. Even a tangential experience with greek life or the party scene while in college gives you a pretty good feel for why this is the case. There's actually significant strategy and human capital that gets devoted to achieving a gender balance for your average college event.

timsally··on The problem with -2147483648 in C.
How often are you interviewing C programmers for project work? Genuinely curious.
timsally··on Giving away my Rails 3.0 book. Code examples also available on Github.
You're reading way too much into molecule's comment. He's merely commenting on the fact that the chosen hosting platform is explicitly designed for purposes that are counter to the chosen license. I see no judgements on the choice of the license itself. Can you explain how the comment implies that "everything needs to be on [programmers'] terms"?
timsally··on Ask HN: Who is Hiring? (September 2011)
Lexington/Boston/Cambridge, MA. Full time and summer internships.

I work at MIT Lincoln Laboratory (http://www.ll.mit.edu), a research and development center run by MIT that does work for the government. My group has about 20 people in it and does application security and reverse engineering. Knowledge of things like assembly, operating systems, and systems are pluses but not required. It's great if you have some experience in those things, but if you can code I want to talk to you. The pluses:

* Awesome workplace culture. We're a 9-5 shop, you pick your laptop, and you can order any books that you need.

* We provide a lot of training. We send you to conferences, including Blackhat and Defcon. We also reimburse tuition at MIT. Last semester my office mate took operating systems with Robert Morris.

* We sponsor relocation and have multiple positions we want to fill immediately.

You do need to be a US citizen and you will have to get a security clearance. I'm happy to talk to you about how the clearance process works and answer any questions you have! If you're local I'll buy you a cup of coffee while we talk it over. You really can't waste my time.

Email: tsally@mit.edu

timsally··on Applying to YC as a Single Founder
Sure, if you want to examine companies over 15 years (as in your list) you can find companies with big VC in many different geographic locations. That doesn't chance the fact that most such companies are in the valley. I find the idea that you should be in the valley if you want big VC relatively straightforward and uncontroversial.

--

Sidebar: Of course, if you're going to go for a different type of startup than YC's particular brand, you can do it from anywhere (central Japan, for instance). The article refers to such startups as a "lifestyle businesses". I find this terminology hilarious considering the most prominent example of a "lifestyle business" in our field has funded a racecar build by advanced beings for one of its founders.

timsally··on Eric Schmidt: If you can’t use your real name, don’t use Google+
Ah, thanks for the correction. I've made a note at the end of my original comment. Either way, storing some data is how Google chooses to do business. Whether legally required or not, this fact should give pause to those who need anonymity and are considering using Google's services. Google isn't trying to capture the segment of the market that requires strong privacy and anonymity. That's all Schmidt is saying.
timsally··on Eric Schmidt: If you can’t use your real name, don’t use Google+
Schmidt gets lambasted by the media every time he says something pragmatic about Google's services. I respect him for sticking to his guns. Here is a quote from Schmidt about Google Search that he got crucified for two years ago:

Judgement matters... If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place... If you really need that kind of privacy, the reality is that search engines - including Google - do retain this information for some time and it's important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.

What he said two years ago about Google Search, and what he is trying to say now about Google+, is that these services are not for those with high security and privacy needs. And he's right; they aren't. As a US company, Google must conform to US law. This means Google must store certain information and under various circumstances provide the police and the government with said information. You really think Google+ allowing you to use a pseudonym would then make it ok for use by those with strong anonymity requirements? Absolutely not.

EDIT: Please see jrockway's comment for a correction. Google is not legally required in the US to store information; still, they are in the EU. In any case, they are legally required to provide information they do have in many situations. Google chooses to retain some information in order to produce a more competitive product. This is how Google chooses to do business and it would be silly for those with strong anonymity requirements to use Google's services.

timsally··on Racket intro projects: start hacking on and with Racket
Agreed. Something I've found interesting is that such pages are a tangential benefit for any project that has participated in Google Summer of Code, as compiling project ideas is one of the first steps in participating. Although sometimes projects to err and fail to include "entry level" ideas. For reference:

FreeBSD: http://wiki.freebsd.org/IdeasPage

gcc: http://gcc.gnu.org/wiki/SummerOfCode

git: https://git.wiki.kernel.org/index.php/SoC2011Ideas

timsally··on Apple Awards Tim Cook 1,000,000 Shares of Stock as CEO Bonus to Stay Until 2021
Apple is the most valuable company in the world. Why do you find it surprising that it takes hundreds of millions of dollars to retain someone qualified to run such a company? Plus, the position of CEO is arguable the place where Apple is the weakest and companies spend to shore up their weaknesses. In contrast, they don't need to bump pay by 5% to get the best engineers and designers. It's a good use of the money that Apple has and it is amortized over a a decade.
timsally··on [dead]
Let's run through a thought experiment. How easy would it be for you to replicate the ensuing political discussion in another forum or in real life with coworkers/friends? For most people, fairly easy. I had several such discussions today alone. In contrast, the occasional valuable discussion that still takes place on HN is reasonably difficult to replicate in other online forums and has a high cost for replication in real life (time of smart people is valuable and much cheaper when done async online). Not to mention that PG essentially banned run-of-the-mill politics on HN from the start, but the guidelines are unfortunately vague and haven't withstood the test of time.

Therein lies my reasoning for my dislike of politics on HN. Thomas may have different reasoning.

timsally··on A hacker's guide to college
Ah, fair enough! Sorry for the misread.
timsally··on A hacker's guide to college
Most of the broad strokes in this post are reasonable, but the idea that you should only take a class because you want to is misguided. It seems like solid advice on its face, but there is not a always a direct mapping between enjoyment and benefit. Indeed, thinking back on my own time as an undergraduate (CS@UIUC 2011), several of the most beneficial classes for my career were ones that I did not enjoy at the time. Degree requirements are designed to capture these high pain/high reward classes. Of course that is only if you decide to go the college route. I'm all for people who want to enter industries like programming or security forgoing it. But if you are going to front the time and money, I think you should stick relatively close to the curriculum. Not only is an 18 year old freshman is unlikely to get curriculum right, but if you're going to design it all yourself you shouldn't be paying for it.
timsally··on Programming languages that make you think differently
The idea that one should experience different types of programming languages is fairly well known. But there are wrong and right ways to use any given language and reaping benefits depends on you using it the right way. But how one should know whether s/he is using a language correctly? I suggest the following, decreasing order of effectiveness (1) find a mentor who deeply understands the language, (2) read programs by those who deeply understand the language, and (3) read writings by those to deeply understand the language. As you might expect, a mentor is by far the most effective method. However, you can still do quite well without one. Between Paul's On Lisp [1] and various online resources [2, 3] one can still do quite well.

The above actually applies in most areas of our profession. For example, how sure you are that you are using Vim/Emacs in the right way? Do you actually understand how to think in the way these editors want you to think [4]? I find these thoughts deeply humbling. There is a reasonable chance that you don't fully understand the languages or the tools you use and thus always an opportunity to improve.

[1] http://www.paulgraham.com/onlisp.html

[2] http://www.xach.com/naggum/articles/ (a filter: http://xach.livejournal.com/221433.html)

[3] http://lists.common-lisp.net/pipermail/pro/

[4] http://stackoverflow.com/questions/1218390/what-is-your-most...

timsally··on Phil Zimmermann: Beware of Snake Oil Crypto (1997)
Yeah there definitely is a bit of an art to reading them. But we can't have cryptographers and security professionals merging too fast... that would just make too much sense. :P
timsally··on Facebook announces new privacy and tagging model
And this is why competition is a good thing. If you read between the lines, it's clear a lot of these features are motivated by Google+'s privacy controls. Facebook has even exceeded Google+ in a few areas like tag approval. What's interesting here is that people have been asking for features like tag approval for several years. Honestly, it's a no-brainer feature that has had widespread support. But it took the entrance of a serious competitor into the market to force Facebook to respond to user demands.
timsally··on Phil Zimmermann: Beware of Snake Oil Crypto (1997)
You'll want to follow people in the industry as well (I've found Nate's blog in particular an enjoyable read). A lot of the practical knowledge accumulates in the brains of the guys who actually get hired to do crypto work. It's an interesting feedback loop to be sure.

Also, it's my impression that start of the art papers aren't really necessary to start off with. The implementation errors people make in their code are flaws that have long been published, sometimes for decades.

timsally··on Why Arabic is Terrific
> Apparently, to a person who only knows english, which is a very inconsistent and mixed language, these features could look extremely neat, but the reality is that they are quite common.

I don't know enough to comment on the issues of language, but Maciej speaks Polish, French, and Russian. This is like the umpteenth comment that has assumed the author only speaks English. A curious pattern.

timsally··on Get Out While You Can
You can't perform experiments in chemistry or material science on a laptop. The practice oriented classes in these fields often require facilities and equipment that are too expensive for individuals to purchase. Hence why in those fields college credentials is a variable with r > 0 for on the job competence. In contrast, it costs about $600 dollars in computer equipment and used books in order to get started in programming or security. The security industry in particular reflects this. Over half of the guys running top security companies either don't have a degree or have one from a highly technical college. Hell, the guy running cyber security research for the government has a music degree.
timsally··on Getting Bin Laden: What happened that night in Abbottabad
That's some awfully selective quoting. The Vice President made the comment about Mass as the troops were getting out of Pakistan safely. Regardless of whether you agree with the mission, seem's like a pretty reasonable thing to be thankful for. Religious ceremonies are one way that billions of people express such feelings of thanks.
timsally··on Could You Modify It ‘To Stop Students From Becoming This Advanced?’
> Where do you draw the line on pharmaceutical marketing?

The line is pretty straightforward. No marketing to patients of any drug that requires a prescription whatsoever. The reason why these medicines require prescriptions is because they are more serious than aspirin or sunscreen, so it's an easy and reasonable line to draw. Marketing to doctors is fine (i.e. the market actors who have the base knowledge necessary to make reasonably informed decisions). There are plenty of policy arguments to be found on why direct marketing of pharmaceuticals is not a net win. There's a reason why it only happens in the United States and New Zealand.

> If you are seriously worried about a highly educated segment of society being misled by a simple numerical trick like the one you describe, there must be no hope whatsoever for humanity if the only people we can trust to watch commercials are people with a Ph.D in stats.

The same arguments were made about predatory lending agreements and similarly misleading financial mechanisms. Society has come down in large part against these things, rejecting the idea that the consumer is wholly responsible to educate themselves. Marketing with law schools is a serious problem and the ABA is currently under investigation by several senators on this issue.

> If someone has not become well acquainted with the sorts of semi-misleading things mentioned in ads by the time he/she is an adult, something is seriously wrong, and the sort of paternalistic society needed to protect this person from him/herself is unacceptably oppressive to everyone else's freedom.

Sounds great on paper, but like most arguments of this type it doesn't hold up. In reality you've got people with average college educations going up against PhDs in finance, economics, psychology, etc. Companies can afford to pay these people huge salaries in order to increase sales, while the consumers are just regular people who get home after a hard days work and don't want to spend the balance of their free time on figuring out how the business execs are trying to trip them up. The bottom line is that in this country and others companies don't have the absolute freedom to represent their product how they want. As a practical consideration consumers don't have the time to educate themselves to the proper level and so regulation stops companies from taking advantage of consumers.

The argument that typically comes back is nanny state, etc, etc, etc. But I find it telling that it is only the people with the ability and education to combat predatory practices that make this argument. In reality America is composed of a diverse set of people, some with education, some without, some native speakers, some not. Some regulation to protect everyone who otherwise would trample the average citizen because of greed is the right thing to do.

← PreviousPage 6 of 8Next →