Hacker News Reader

y0ghur7_xxxon Total security in a PostgreSQL database

> To attempt this security model, which can work if everything in the universe goes right for you

Almost all webapps we write, we write them this way. (on oracle, not postgres, but that makes no difference).

> your application needs to be designed for it from the very beginning.

That's true. As in "you can not add security later on".

y0ghur7_xxxon Total security in a PostgreSQL database

> if you concede to an attacker INSERT/UPDATE/SELECT (ie: if you have SQL Injection), even if you've locked down the rest of the database and minimized privileges, you're pretty much doomed.

Well... no. If you lock down your db correctly, using the correct privileges for the users accessing the data, and using veil or rls, the sql executed on the db is just an other way of accessing the data you can see anyway through the webapp. The webapp becomes just a nice frontend so the user does not need to execute sql directly, and if there is an sql injection vulnerability the attacker would still be able to only see the data he has the right to see anyway. He is just accessing it with sql instead of the webapp.

y0ghur7_xxxon Why we love Mozilla Persona

> I know Apache may not be that popular with the HN crowd anymore

I still love it. Thanks for the module.

y0ghur7_xxxon Level 3 are now hijacking failed DNS requests for ad revenue on 4.2.2.x

> Not really thrilled with the idea of using Google DNS.

You can use your own dns server. Just install a recursive dns server on your own network like https://www.powerdns.com/recursor.html or https://unbound.net/

y0ghur7_xxxon Light Table 0.6.2 released

> Names do bring you on the front page, however minor the message might be.

That is just a quick fix for 0.6.1.

0.6.2 was released about 2 hours after 0.6.1.

https://github.com/LightTable/LightTable/releases

y0ghur7_xxxon Stack Exchange tag correlations

This is a client JS API key. If you want to spoof the referer you have to hack into all users of the web page and change the referer header their browser sends. And for what? Makes no sense.

y0ghur7_xxxon Stack Exchange tag correlations

I don't think so. Stack Exchange checks the referer header.

y0ghur7_xxxon Asm.js AOT compilation and startup performance

> No-one really likes the situation

I actually like it. Write once, run everywhere has become true. Of course there is always room for improvement, but that too is happening (and with a really fast peace too).

y0ghur7_xxxon Oracle to issue huge security patch addressing 36 Java vulnerabilities

Yes, we thought of that too, but the installation of the server on every client was a lot more work than writing an applet. But it was a valid alternative if the clients using the app where few.

y0ghur7_xxxon Oracle to issue huge security patch addressing 36 Java vulnerabilities

Why not? - "we did not want to write a desktop app just for these features"

y0ghur7_xxxon Oracle to issue huge security patch addressing 36 Java vulnerabilities

We really need to implement the missing functionality Java applets are providing in plain JS, so applets can die. The last time i absolutely had to implement an applet was to provide my client with this functionality that was not available with pure JS:

- direct access to printer: the user wanted to print on a specific tray of the printer, without selecting it every time. JS only implements window.print() with no fine grained printer control.

- serial/parallel/usb access: access to a POS for card processing, and we needed to write some data on a smartcard.

- plain TCP connections

- read/write files on the local filesystem.

I understand that all these features require more control of the underlying hardware and need to be somehow secured, but we did not want to write a desktop app just for these features, and applets gave us the means to implement what the user needed. Once JS can do that, applets can die a quick dead.

y0ghur7_xxxon The architecture of Stack Overflow [video]

I would love to know more about the Databases:

- Are they used for different things on the sites?

- Is data partitioned across tables?

- Are they all SQL Server instances?

y0ghur7_xxxon This working group has failed

Looks like it's down.

Cache: http://webcache.googleusercontent.com/search?q=cache:https:/...

y0ghur7_xxxon Browser Extension Password Managers Exposing Passwords Everywhere

Why NON--browser-integrated? What's wrong with the one integrated in the browser?

y0ghur7_xxxon 5 predictions on the future of databases (from a guy who knows databases)

> Terabytes and 5-6 thousand queries per second.

That is not much info :)

Just for reference: a simple query by pk index on my veryveryvery low end pc¹ on a table with 1mil rows takes about 0.04 ms (so says pgsql analyze). That is 25000 queries per second. What type of app are we talking here where the db needs to scale? Something like reddit? Stackoverflow? Just curious. Never saw such a beast where a DB server needs that much power. Where I work we have 200 apps on the same DB server, and it's idling most of the time.

¹i5 CPU 2.40GHz with 2GB of RAM

> run Python scripts as stored procs. Great way to slow down your DB.

There is more than one way to shoot yourself in the foot :)

y0ghur7_xxxon 5 predictions on the future of databases (from a guy who knows databases)

> pushing more and more work into the single hardest piece of software to scale - your database.

I never understood this argument. Maybe you can elaborate a bit? Almost all our apps use sp for data lifting work (most of the so called "business logic"), and we never got scaling problems. Well, we don't have that much users or data either, but how many users/data do you have that your stored procs could not keep up with? What numbers are we talking about?

What makes the db slow is throwing bad sql at it, not Stored Procs.

y0ghur7_xxxon Ask HN: Remote access, are you using a VPN?

ssh tunnel

y0ghur7_xxxon Windows XP end-of-life migration guide

> According to Microsoft, a full operating system migration can take up to six months

Well, we have to migrate about 6000 pcs, and it's a 1 and ½ years project. Much more than six moths.

y0ghur7_xxxon Namecoin, A Replacement For SSL

> I'm including the CA system in my definition of "the protocol".

Well then, TACK changes "the protocol". As you know better than me it proposes changes to the TLS handshake and how CAs are verified.

y0ghur7_xxxon Namecoin, A Replacement For SSL

> We can and should leave the protocol alone.

Nobody, not in the article and not in the post you replied to, sad that the protocol needs to be replaced. In fact, both say the exact opposite.

I like your posts, and you clearly know what you are talking about, but this time it seems you don't discuss the article, but just hop in the discussion with random and not correlated, but true facts.

y0ghur7_xxxon Renault will remotely lock down electric cars

Why would someone want a non-ssl version?

y0ghur7_xxxon Why You Should Never Use MongoDB

> but it might be the right solution for many others.

The author made the example of the movie database and explained why it was a good idea when they started, and why it didn't work out. Can you point out an example of data you would store in a document database, which is not purely for caching purposes?

y0ghur7_xxxon Firefox Developer Tools, Part 2: Scratchpad and Style Editor

> Anything else? :)

A disable cache checkbox in the developer tools options.

https://bugzilla.mozilla.org/show_bug.cgi?id=651888

y0ghur7_xxxon Android isn't freedom, because Google is closed

> If Android is not freedom what is iOS then?

Who cares? The article writes about Android. Just because iOS i even less free does not make Android better.

y0ghur7_xxxon In Firefox 24 and following, mark all versions of Java as unsafe

> It was released over a month ago too. Has it had any effect on Firefox's market-share?

No, the change went live Friday: https://bugzilla.mozilla.org/show_bug.cgi?id=914690#c20

y0ghur7_xxxon In Firefox 24 and following, mark all versions of Java as unsafe

> This will have a pretty bad effect on Firefox's market-share if it goes live.

It's already live. ff24 is the current stable.

y0ghur7_xxxon SQRL - Replacement for usernames and passwords

> How does this compare to OpenID?

It's completely different. You don't need to remember an url, you don't need to remember a password, there is no third party involved in the authentication process, ... I could go on, but it's really a completely different authentication mechanism.

y0ghur7_xxxon BitTorrent Chat - Private instant messaging via secure, distributed technology

can't an observer possibly encrypt many possible and likely short messages (like, "hey!" or "lol") with the public keys of some users of value and sniff the network for matches?

no. the same message does "never" encrypt to the same cypher:

    $ echo lol | gpg -e -r F8669BB7 --armor
    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.11 (GNU/Linux)
    
    hQEMA2gTLr1USDZGAQf/YbbnzHvNfdqbs6hmdmIaaiZOSfW9P6Bc8tdF4MG/JbP+
    RTxbLpi4W+vXs+WrD9jdik8KuDdZV54O1mb6Ido3xrYeEPBo0Vje2eVpgUy01VUa
    2RM76NvsX1VN9rap6KvHuO/h7IFwDuAtvUUcDyFH+qK2UEHordFi+mWKqICocQt0
    WWgpCk5BVgM/1q2c2ruWxVuZs/IMh9LQGZ1i7hpkJHAYqovhghROmGarUuJYXGDi
    s6rSMpjxbXDhPMYbbhbBI4pRhgKtN2FMlKyI3XoH+LCFHsOyBmazroVYWFu+gafH
    6LU2Z65OQyJWqX5CLdwab4qpUQdht6lqkUHRJB9xdtI/AfTFF7BbRP8PR+q9GVAe
    r4I812VmBn3hwBHJzNiFDEGVkt/IDpd6M/X2Vi0xJx0LUaICL+swPVudenPuvlnt
    =zeUd
    -----END PGP MESSAGE-----
    
    
    
    $ echo lol | gpg -e -r F8669BB7 --armor
    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.11 (GNU/Linux)
    
    hQEMA2gTLr1USDZGAQgAo4ZEHGWKSgwVmbC7crACvTXVtlgP4n8J/3oSohct9zrM
    SqPd4L5TWsjOh+2LlG7WQbPnpn4Tcv9c4RyPNb+1C/fWRmGhV+a3QhuC+rrus5c6
    /FPwsHTjO30N0AnCMzoXAaqDRRGw859BKazEZyxIHherU+o7wNRKrW6U1ikRd/Pu
    BwHChUZHBRmZhomrtYPbQ5cNAJQtPMj94Z8OuZeCEzPNBr3opevoMs2j+9ysOtkF
    7Cam3jTKLM3GwHSm4c7WzhdJJsXbnOn8ODYRBf++4oJChPIqeT2EssigAQuuhHlk
    pDhM40zB7hAd6MJM52cZpM3UqTe/iI4vHSrQ+pw/otI/AWY6s4aIlF5AAzoM0wAR
    FzobJ5Vbp7fBgA1SiOhEhSAdT/U2yy2jQcQN53yyX9Vqtunh3dNmCGaNNavszK8+
    =YDLc
    -----END PGP MESSAGE-----
    $

y0ghur7_xxxon Cisco's Pentesting Team Open-Sources Vulnerability Management Tool

http://datatables.net/index

y0ghur7_xxxon Contact form encrypts message with PGP before sending

I've been wondering about web crypto, and how you can actually be protected from say Google getting your content before it's actually encrypted in the browser.

Just don't load third party js from a domain you don't own, use tls and you are good.