wuest

Fantastic. I've been riding for roughly 10 years and, in the US at least, the idea of learning to ride before one hops on a scarily-powerful/heavy motorcycle is a polarizing factor (either one absolutely agrees with it, or one scoffs at the very notion).

I realize this is targeting Aussies, but the more resources dealing with the idea of learning to ride _safely_, the better.

Short answer: yes.

Long answer: Sometimes. It's also one of the most frustrating things you can engage in. Up until the point where you have a 'eureka' moment, you feel like every step you've taken was through a tar pit. Pentesting is definitely full of pain; it's easy to imagine it's nothing but an adrenaline rush, since that's what people are inclined to discuss--but that's not the case at all.

Edit to answer the other half of the statement: Pentesting is not dangerous. Malicious network activity (i.e. network activity which the target does not desire) is dangerous. There are lots of great resources (OffSec offers fantastic training, for example) on the topic, and there are gobs of free resources as well (CoreLan, interactive stuff like SmashTheStack's CTFs, DamnVulnerable Linux, etc.) for learning about the topic--tools, methods and such.

In addition to your point, Diablo 3 also introduced a real-money auction system, which necessitated a need for far deeper control over inventory etc. Online-only for such a system is a fairly obvious choice.

Looks pretty sweet! I'll be digging in tonight.

Looks like there's even an official build for the ODroid U2! Sweet deal, I happen to own two.

The crux of this sort of issue was laid bare relatively early in this article: results and papers are more important than good science, which leads to an increased incidence of fraud and related misconduct. If good science were actually valued, one scientist wouldn't have been driven to suicide by the fact that his research (assuming it was not fabricated to begin with) was being questioned and the colleague who raised valid questions wouldn't have lost his job. I can't imagine that this is all that uncommon a scenario.

The Adderall analogy really drives the point home. This is well put, and a powerful message more people (especially those in a position to effect policy) ought to read.

There's not a lot in the way of new ideas here, but it's a nice distillation of bits and pieces that I've seen incorporated into other games.

The web-based half RTS/half TBS genre has incorporated the idea of X command points per Y time period as part of the norm for a long while (Travian, et. al.) Turns in such games are generally not immediately exposed as mechanics (if they, in fact, exist at all). I recall an old space based RTS (the name escapes me, sorry) which exposed the amount of time left until the next tick, at which point all players would get more command points, while Travian appears to have a tick per second, with long waiting periods (relative to tick length) between updating command resources.

One thing which might be useful as a thought experiment to further this article is to look at TBS games which aren't dying--why is Civ V still popular? Or, to get even more basic, why is baduk still widely popular? Some thoughts regarding the latter: each move is very granular, which keeps the game moving foreward. Each move has an immediate impact on the game state (this relates to your point that "nothing happens in the first move.") There is a deep element of strategy, which is augmented by a need for strict time management. It's easy to review games and find mistakes, as well as to review games of higher level players to find new ideas and strategies.

Absolutely agreed--this is a point I made in other posts. I apologize if I came across as harsh--absolutely not my intention.

This is a clever bit of social engineering which really taps into the mentality, not to mention the rhetoric, of open source hackers. I like it!

This sounds mostly reasonable at first glance. I'd have to dig a lot more into how it's played out in practice to have a fully-valid opinion, of course.

The one thing you mention that worries me, though, is dropping 0day. Would this include full disclosure? Would this include developing an 0day as part of a pentest? How does this affect things even as far reaching as responsible/coordinated disclosure? If a law makes doing the right (let's use open disclosure, whether full and immediate or coordinated and timed just to mean "right" while selling 0days for ostensibly criminal purposes as "wrong" for the sake of this conversation) thing as difficult (or even more difficult) to do than the wrong thing, then the law will only bolster the black market.

Yeah, this is pretty likely. It's a dangerous road to go down, however, as regulatory bodies can be far from impartial.

It's a difficult issue to properly address. I think the right method to go about it is to punish actions, rather than possession of tools. On some level, simply having the ability to write software makes one suspect, if you start scrutinizing tools. Actions (compromising boxes and running exploits without permission of the owner of the host, advertising explicitly criminal use of software) are easy enough to define, and it's easier to define an exclusive list of "bad" actions, than to come up with generalizable rules.

> does that impinge on free-speech?

It could be argued that free speech necessarily has limitations. Depending on where you are in the world, this involves hate speech and incitation to violence.

I would readily agree that distributing (especially SELLING) tools with the expressly stated purpose of criminal use should be punishable. That being said, the same tools are likely useful for legitimate purposes. Heck, I could see an argument for Back Orifice being useful in that one would really like to be assured that their network's egress filtering would raise flags when BO traffic is on the wire. This brings up another important point--these tools are always useful for people who are writing protection and mitigation against the tools' methods.

s/could/do/

This is the problem with these manner of laws. Criminalizing the very method by which entities guarantee their security is never a good idea.

Welp. I almost purchased this book last week in addition to the IDA book, but decided to purchase one at a time. I hope the EFF enjoys my money; you forced my hand.

The problem is that the behavior itself is rarely viral. What's the difference between this and, for example, gotomypc?

That's beside the point. There are plenty of valid uses for other things which would have been criminalized such as Metasploit and Core Impact. Not to mention that such things as writing PoC code to validate vulnerabilities would have been right out of the question.

I'd be curious to find out as well. It's a very fine line between a luhn10 checker, and a luhn10 sniffer--the law's wording would need to be very precise to avoid criminalizing legitimate business software.

There are blind go players, so I assume blind chess players also exist.

All-too-common response: "Oh, but they're just warnings mumble compiles and runs 'cleanly' mumble..."

This is true. There are ways to transact which don't compromise your identity. They are a pain; it's a trade-off.

To your point at [1], I am not aware of any way which mining can compromise PII.

Bitcoin is traceable. This means that it does not provide privacy. Note that cash is also traceable in edge cases thanks to serial numbers.

Bitcoin is definitely anonymous. Consider: a wallet has no PII attached to it, beyond what you give it via transactions. Contrast this with a credit card, which typically has PII as an integral part of the way it operates.

Disclaimer: I didn't read the original post, so I'm not sure where it was in your post that the word 'asshole' used to live.

In my circles, at least, 'don't be an asshole' and 'you are being an asshole' is harsh-not-mean, while 'you are an asshole' is mean-maybe-harsh. The explicit declaration of state of being, rather than observation of behavior is the differentiator.

Thanks for posting this--I hadn't seen the side by side comparison. If this is what's being claimed as 'copies' of their artwork, then it's clearly an empty claim. The Flat UI icons look better, to my taste.

Indeed; in order for any standard like this (or UPC, EAN, etc) to gain widespread usage as opposed to very narrow, single-organization usage, it has to be EASY to adopt.

This means that while the standard's official documentation might require that it be purchased (this is the case with QR), or while software which interacts with it might not be free/gratis, it must not carry with it patent or licensing encumberances. While ISO allows "reasonable and non-discriminatory" patents/licenses to be enforced against technologies which are ISO standards, something like a barcode format is difficult to justify licensing restrictions in almost all cases.

> It's a bit of a double standard, but they might have been expecting you to be dressed in a suit anyway.

I've encountered this. My current workplace has a notoriously laid back and straight-forward culture. Knowing this, I asked the interviewer who was inviting me to interview if I should dress up, or dress appropriately for the company culture. "I would recommend you dress up a little, and hope it's the last time you have to wear those clothes," was the response.

Showing that you are familiar with the culture into which you're walking is worth a lot in such situations.

Me too. Until my family moved to an area, the schools in which didn't recognize ability as an appropriate differentiator. It was not good times for me.

This doesn't mean that ability as a differentiator is bad--I think that it's a great idea. What it does mean is that consistency is absolutely crucial when such an idea is implemented; I was in an environment where excellence was encouraged, and that led to a lot of self-motivation. Not all children are going to be in the same situation, and that could be disasterous.

"The Art of Learning" by Josh Waitzkin tackles the concept of the environment which best facilitates learning and personal growth, and touches on the idea of ability-based classes as well. It's a great read for anyone interested in such.

Nice write-up. It's easy to fall into the trap of assuming that things are "thread-safe" when writing under the iron fist of a Global Interpreter Lock.

Ruby threads seems to be a fairly narrow topic on which to base a book; I'll look forward to seeing what all the book covers.

This is a fascinating topic. I haven't heard of this in the past, but I certainly can relate. I hate talking about things I (do/have done) and usually tend to prefer to just wait and talk about things "once I actually do something worthwhile."

I'm glad to see the Surface Pro getting some good reviews. I actually really want this sort of hardware to take off--and I _really_ want to see a compelling Linux offering on it. This sort of device would fit the needs I have both for a laptop and for a tablet, and if/when I hear that Linux is running great and Plasma Active works like a charm on the Surface Pro (or, indeed, comparable piece of hardware), I'm dropping the full sticker price on one.

At first I thought the same thing as you. However, for instances such as this where the service is especially appealing to criminals I think this solution is reasonable.

Finding effective ways of detecting someone who deserves a hellbanning vs a college campus which has all users behind NAT who will all be upset when the cards they ordered don't arrive as expected (let's assume users don't check their statements daily so won't notice a lack of charge) is a difficult task. It's quite the tightrope you end up having to walk.