tombrossman

I got burned by this in upstate New York and it caused an unnecessarily long delay. I was following the directions provided by the customer and came across a 12'6" marked bridge towing a 13'6" trailer on a narrow two-lane highway. I stopped, obviously, and had to ring the highway patrol for help. Traffic behind me was stuck waiting and this low clearance bridge was not properly marked in the trucker atlas and (if it had truly been 12'6") not up to spec for a state highway overpass. I'd done my due diligence so this was the highway patrol or customer's problem to sort out.

About an hour and a half later, we established that the road had been recently re-paved and no one was exactly sure what the height was. Backing up to the nearest intersection was not an option because there were none close by and turning the tractor-trailer around was impossible. The cops were cool about it and suggested that I creep forward very slowly and see if I'd fit. I was able to do this and stop just as the trailer reached the bridge. I got out of the cab and climbed up behind the tractor to have a peek and had about an inch to spare. I went for it, very slowly, and made it under. No fun but I did get a cool photo as a memento: http://i.imgur.com/64uYu2z.jpg

I took a different route on the way back of course!

The water is right at the tunnel entrance, not in the area where you would be braking to avoid impact. By the time you've reached the water you will have collided with the top of the tunnel, which should go a long way towards helping you slow down. Literally 'idiot proof' design right there.

Are you scrubbing Exif metadata on all these? I spot-checked a few and there didn't seem to be any embedded. A surprising number of people have no idea that their mobile phone may embed GPS coordinates in images they take with it.

I think most social media sites do this by default but I wish they were more selective about it. Okay to scrub GPS location if present but copyright/photographer/exposure details, etc, are all helpful and should be kept if at all possible.

The end result would be that responsible gun owners who wished to practice at a shooting range could no longer afford to, and criminals would continue uninterrupted because they would just steal the ammo they need.

A variation on this theme already happens with cigarettes, when one state raises tobacco taxes, bootlegging from neighbouring states goes up.

Now the responsible gun owners are no longer a very good shot, criminals are roaming around with plenty of ammo (which they need because they often have terrible aim), what could possibly go wrong?

Instead of no longer paying attention, just manage your timeline better. Stop following people who automate tweets, it's mostly garbage and it comes with extra baggage like more click-tracking and redirects. I've found that most of the items people share on Buffer are things I already read here on HN or saw someone else share earlier.

Not following too many people is great, because the people you follow will curate the interesting stuff for you and re-tweet it. Stop following all media accounts for instance, maybe follow a couple reporters instead and you'll still catch all the interesting stories.

If un-following is socially awkward for whatever reason, mute people you follow or at least toggle off re-tweets for those that do too many.

I read my whole timeline most every day and it's great. It does take regular pruning though, like a plant in your garden.

I'm guessing one that large would simply pull any metallic objects straight out of the meat, even if it were on the other side. Seriously, they sell smaller ones than that coated in epoxy for pulling up boat anchors when the anchor chain has broken. The ones I have are tiny, watch battery size and I can barely pull them apart. It simply isn't possible to hook your fingernail under one and lift it from a metal surface. You have to slide it to a corner and grab it. Hard to describe, but when you first handle them it's like "how the hell is this possible?".

Confirmed not banned in the UK, here's some for sale right now on Amazon's UK site: https://www.amazon.co.uk/Bargain-Neodymium-Strong-Magnets-Mo...

I have ordered rare earth magnets several times and it's always interesting to inspect the packaging when they show up. Clearly there are a lot of metal parts in Royal Mail's sorting machines as they frequently arrive in an absolutely tattered padded envelope, usually with tape patches over big holes ripped in the side.

If you can find some N52 grade magnets it's worth ordering them just for the novelty value. Hand someone a roll and ask them to peel one off the end. Or, stick one on the refrigerator with a note "pull this magnet off" and see who falls for it. They are so strong it's like seeing an alien technology in a sci-fi flick.

Here's another interesting link, for what it's worth: http://www.crimeflare.com/cfssl.html (don't let the funny title and amateur look fool you, it's regularly updated).

Upvoted, I think this is by far the best suggestion. Find a local charity or non-profit and help them get online or update their site, and add an easy way for people to donate online. Re-imagining a popular site to show off your skills seems like a vapid decision, much better to do something more meaningful. The charity benefits either way, and you've made some contacts which may help you in the future.

Some organisations may be reluctant to accept because they've tried this before and the developer moved on to other things. The charity can't be left with no clue how to update the website, so make sure you have a plan to hand things over to them. It can be something as simple as styling a Tumblr page mapped to their own domain.

This contradicts what they claim on their DDOS explanation here: https://www.ovh.co.uk/anti-ddos/mitigation.xml First question to ask them is why was their response different from what practice they advertise? That isn't cool. I would open a new support ticket with them and ask for an explanation since that happened to you recently.

If you need something low-cost and dedicated try their SoYouStart range, which is just their last-generation hardware. Going from a VPS to SYS is a huge performance jump for minimal cost. They have a higher guaranteed minimum bandwidth throughput than the VPSs and may get you better support possibilities. Cost is similar to a mid-size VPS.

I'm living next to France and in talking to local geeks the name kept coming up (OVH is a French company). I had been using DigitalOcean but needed more storage space so I tried Kimsufi and SoYouStart which are both OVH-related, and then I started A/B comparing performance of VPSs for OVH and DigitalOcean and saw that the VPSs at OVH were consistently out-performing the same size machines at DigitalOcean. So, I moved everything I plan to keep online for more than a month to OVH. OVH's dashboard for creating and managing machines used to be really horrid but it has improved recently.

I don't know what to make of the bad reviews you found, my personal experience has been great for several years now. Multiple products used, the occasional support ticket with quick response, and decent pricing.

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer.

OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them).

For quick side-projects I still fire up a DigitalOcean instance or two because their UX is so slick and easy. If I needed huge scale and price didn't matter I would probably go with AWS (their 'anti-DDOS' is their vast bandwidth + your ability to pay for it during an attack). For everything else, I put it on OVH.

[0]https://www.ovh.com/us/anti-ddos/

[1]http://weathermap.ovh.net/

That's right. A poorly-engineered 4WD system means you are stuck on a hill because one wheel is on slippery wet leaves. AWD should mean you can get up that hill with three wheels on slippery wet leaves, and one with grip. That's the simplest explanation.

I had an old Toyota Tercel 4WD station wagon and it was very difficult to steer sharply at low speed with 4WD engaged because of the lack of a differential. It would lurch and I had to press harder of the accelerator to get straightened out and pop it back into 2WD. It was my first car so I didn't know any better. Fun fact: In 4WD, you got an 'extra low' gear below 1st and that car could very nearly climb trees. The gear ratio was insane. No ground clearance but I used to scare the crap out of friends by going up very steep inclines in extra low gear with 4WD engaged. They would have to park their pickup trucks at the bottom of the hill and ride with me, and this caused them some embarrassment. Good times.

Have you had any contact with DO's support or security team prior to this? You are correct that companies frequently ignore or downplay reports but it's nice to at least make that first attempt for each new find (per company). This is only ever done as a courtesy, I'm not saying you must or even that you should have here.

Remember, it's just another nerd out there somewhere who receives your report. Sometimes they are super stoked to have it and will be very responsive. This can be more satisfying than a public disclosure without first contacting the company.

I have an account with DigitalOcean (and several competitors) and I'm not going anywhere or moving any sites around because of this. Sure, they could have handled things better and the security researcher could have too. I don't see any malice or incompetence here, nor do I see a reason to make the effort to switch to another provider.

Where are you going to run off to? How is their security better over there? How many hours of work does that involve?

If you want to go a small step further you might consider using exiftool to rename all your photos by date. I do this to make sorting and identifying them easier. If you assume fewer than 999 photos/day, this command will rename JPEG files to YYYY-MM-DD-NNN (where 'NNN' = 001-999 in strictly chronological order). Run it in any parent directory when you want all photos there + all subdirectories renamed accordingly.

  exiftool -fileOrder DateTimeOriginal -recurse -extension jpg -extension jpeg -ignoreMinorErrors '-FileName<CreateDate' -d %Y-%m-%d%%-.3nc.%%e .

Make sure those camera clocks are set correctly! Just like with servers, it's easiest if you always use GMT/UTC time.

This is especially cool when you have a collection of photos from an event taken by multiple people, because you see everything in the order in which they were takes regardless of which camera took them (again, assumes clock was correct).

This topic comes up a lot on HN and my response is always the same. Try NoScript again. Give it a day or two and whitelist the sites you use a lot and trust. You will have a stunningly faster browsing experience and the number of sites that don't work will be surprisingly small.

We have passed a tipping point where all the annoying bullshit that depends on JavaScript to function far outnumbers the random websites that NoScript breaks. LONG time user of it and I just don't have much trouble browsing. It makes the web insanely fast and eliminates most annoyances.

For a truly ridiculous example of this, see this "Chaser's War On Everything" clip is which the same guy films a few different sites dressed as an American tourist, and later as a Saudi (in a thobe and gutra - had to look up the terms).

The security response is hilarious in how differently they react when the clothing changes.

https://www.youtube.com/watch?v=xxq4Y7QUdPA

(Bonus, watch the same clowns hire a limo + guys in suits jogging alongside and use that to get into a 'secure' conference site in the related video in the sidebar. Comedy gold.)

This is cool, thanks to OP for submitting this.

In the past I have ordered topographic maps from Raven Maps and they really are excellent. Not cheap, but you can get plain paper suitable for framing or laminated if you want to write on them with whiteboard markers. I have a giant one of the USA, plus a few of states I've lived in.

No affiliation with the company except as a customer. http://www.ravenmaps.com/

TL;DR - The possibility of Small Claims + attention to detail is all it takes, you rarely have to actually file and appear.

I've done this with Sprint in the USA, and later with LG and HTC in the UK (they call it 'Petty Debts' but it's basically like Small Claims in the USA).

Bottom line is that these stickers are effective - much like the parking lot signs that say how the lot owners 'accept no liability' for damage to your car. Whether they accept liability is irrelevant, you can still sue and a court may assign liability whether they like it or accept it or not. This point is overlooked by many who don't want the hassle and that's why such signs (and stickers) are effective.

They are just part of a layered defense, and anyone with the will to pursue a claim can still prevail. It's not as if you show up in court and they point to the damaged sticker on your laptop and the judge says 'case dismissed' or whatever. They have to actually defend their point that their warranty does not apply because of some silly sticker (it almost certainly does).

LG, Sprint, and HTC all did the right thing ultimately when I sent a properly formatted business letter demanding that they uphold their end of the warranty terms, and giving them a deadline of ten days to comply or they were going to be sued in Small Claims. I kept it short and sweet, and attached a comprehensive time-line with exact times, dates, and names of everyone involved's correspondence and what they said. It was a bit of a hassle but still cheaper than repairing or replacing an expensive handset off-contract.

They'll usually send an NDA that they want signed before they pay out, and you can ignore that and let them know the ten-day clock is still ticking. They may also ask you to log in to their support website which subjects you to additional T&C's more restrictive than your legal rights - avoid that, it's a minefield! Stick to registered postal mail sent to the companies registered business address.

I think they assess what it will cost to repair versus what it will cost them to show up in some random county court, and cut their losses when it becomes clear a customer has no intention of giving up. Having complete documentation plus a time-line with everyone's names that you spoke to is the single most effective tool to win when you are up against a big company, so always plan offensively from the start of any trouble with a device and keep a simple text file that you maintain for reference.

You shouldn't do any of the above if you really did break the device by doing something stupid, just take the loss and buy a cheap or refurb replacement. Don't try to lie and plan on them not showing up and you winning a default judgement. But if the company is doing you wrong, by all means go after those bastards.

I don't particularly like ads but I don't have a problem with the idea of ad substitution. This isn't very different from ad injection that WiFi hotspot and other captive portal operators do. For me, it is more about privacy than not seeing ads (provided the ads are not annoying and don't interfere with my viewing content).

Now for Brave, their incentive is to maximize profits just like any other ad broker. This is not necessarily aligned with my interests as a user. I get their theory, I just worry about how this works out in practice. To trust Brave, I have to believe they will never get greedy and never relax their privacy or security standards, even if these interfere with profit-making. That's a big ask. I would be tempted, too.

I also have concerns about 'malvertising', which has affected many high-profile sites who employ world-class security teams. They haven't been able to stop malware infecting their users via ads.

Admittedly this whole comment is pure FUD but that's just it - I am not certain Brave is the answer, and the easiest thing for me to do is keep using an open-source browser with an ad-blocker. Bonus, I'm using NoScript and have a gigabit FTTH connection and let me tell you, the web is lightning fast!

Good luck Brave team, but I don't think I am your target demographic.

Looks like the spec is 10,000 cycles: http://www.anandtech.com/show/8377/usb-typec-connector-speci...

That's over 13 cycles/day for two years. Probably fine for most users.

Edit: The official spec is only available via a zipped folder of PDFs, here's the particulars to save readers the effort.

  5.7.1.3
  Durability or Insertion/Extraction Cycles (EIA 364-09)
  The durability ratings listed in Table 5-16 are specified for the USB 3.1 connectors.
  Table 5-16. Durability Ratings
  Connector   Standard Durability Class               High Durability Class
  USB 3.1     Standard-A connector 1500 cycles min    5000 cycles min
  USB 3.1     Standard-B connector 1500 cycles min    5000 cycles min
  USB 3.1     Micro connector family                  10000 cycles min
  The durability test shall be done at a maximum rate of 200 cycles per hour and no physical damage to any part of the connector or cable assembly shall occur.

The EU did, here's some background[0]. As for Apple, they didn't 'get away' with anything as far as I can tell. While iPhones are very popular, they make up well under 20% of the global smartphone market. It's a bit early to say standard headphone jacks are obsolete, but the notion sure does generate clicks and catchy headlines.

[0]http://www.bbc.co.uk/news/technology-24726077

Interesting to see that Alamy are involved with this. I have firsthand experience dealing with them first as a photo contributor and later as a copyright holder finding Alamy to be in breach of both UK copyright law and also their own contributor agreement.

Alamy claim they delete all copies of contributor photos from their servers 45 days after you terminate your contract but failed to do this, and continued serving my images for many months after our agreement ended. When I contacted them they first claimed it was Google's fault (cached images) and them later admitted they had done it but were still defiant and claimed they could do it because finding my images was 'difficult'.

They are a large photo agency and their infrastructure is first-class, so I had some interesting email and telephone exchanges with Level 3 and AWS when I sent them DMCA takedown notices and explained that there was no 'safe harbor' for them and I had absolute proof (the Exif metadata with my name and copyright notice was still preserved in the images and I provided direct alamy.com/... links to them hosted by Alamy).

Blog post here, if you want the whole story including replies from Alamy. They seem like one of the better photo agencies but damn, they really don't like being held to the same standards they hold the public to. https://www.tombrossman.com/blog/2014/alamy-copyright-and-ex...

So a laptop or phone with a fingerprint reader and TOTP app would qualify as well I suppose. I think many people assume that two separate devices are necessary for proper security, and I wonder if this is true?

I'm curious, do people still consider it "two factor authentication" when you have a mobile device generating (or receiving via SMS) one-time codes and that same mobile device syncing passwords?

For example, if your web browser or password manager is syncing your passwords to your mobile phone, and that's the same phone the SMS codes or TOTP app runs on, is this completely circumventing the whole concept of "two factors"?

Asking for a friend, because I'm sure no HN readers would be dumb enough to do this...

(also, The Register covered this same story yesterday, here's my dupe submission: https://news.ycombinator.com/item?id=12157529)

You are correct but in my use-case I have my browser remember the passwords and use a standalone password manager for storing credentials that I infrequently access. An exploit compromising the browser would next have to compromise the password manager's encrypted database.

Admittedly this is not perfect, but I am comfortable with the level of security it provides. I think it is also roughly comparable to users who have a 2FA app on their mobile and a password manager syncing to the same device.

Depending on the handset model, you can open one up and physically remove (or disable) the mic, and use it with a wired headset that you plug in when you want to make or receive a call.

Admittedly it is a bit drastic, but low-tech and very effective.

I don't know of any CLI clients (that would be perfect with a Bash alias) but I just store the initial 'seed' passcode in my password manager. When setting up a new device, I manually enter that instead of scanning a QR code and it works perfectly.

Maybe for something important like account access, keep things open-source and use FreeOTP as a drop-in replacement. It's on F-Droid here: https://f-droid.org/repository/browse/?fdid=org.fedorahosted...