AretNCarlsen

11 ms·

61.
by AretNCarlsen 15y ago
"It was a political decision not to use Busybox, rather than a technical one, he said." Anybody know what that means? Licensing conflict, perhaps?
62.
by AretNCarlsen 15y ago
OP: > I'm bidding against people who will work for $10/hour or less and do really good work. Repeated response: > No, you aren't. No programmer does good work for $10/hour or less. The implication: We are obviously worth more than $
63.
by AretNCarlsen 15y ago
The timeout behavior I describe is only for the Droid X model. For instance, I'm told that variants of the Galaxy S series (e.g. T959) have a 30s delay every 5 tries, but no limit on total tries. That would be a little easier than my 13s/tr
64.
by AretNCarlsen 15y ago
I wonder how secure the screen lock pattern option really is. I notice that the OS requires that the user draw at least four dots in their pattern. In theory, then, you have sum((9!/5!)+(9!/4!)+...)=9!(sum(1/n!)) options, where the integer
65.
by AretNCarlsen 15y ago
Hence the caveat: "and hope/trust that the entropy you observe is unique, not copied to any other instances". I suppose it would take a centralized web service to detect correlated unrandomness between servers. I am not personally willing t
66.
by AretNCarlsen 15y ago
Entropy testers: Robert Brown's dieharder: http://www.phy.duke.edu/~rgb/General/dieharder.php NIST Statistical Test Suite: http://csrc.nist.gov/groups/ST/toolkit/rng/index.html Fourmilab's ENT: http://www.fourmilab.ch/random/
67.
by AretNCarlsen 15y ago
I'm coming from a background in massively parallel computing and financial services, both of which are heavy on security. Nonetheless, and even though I have been running cryptographically active instances on Amazon and Rackspace for a long
68.
by AretNCarlsen 15y ago
I put up a poll on the subject: http://news.ycombinator.com/item?id=2597256
69.
by AretNCarlsen 15y ago
I had to submit this three times before it would show all of the options properly. Think I lost one vote for (1). Sorry about that. Poll prompted by: http://news.ycombinator.com/item?id=2596822
70.
Poll: Do you trust VM RNGs?
5 points by AretNCarlsen 15y ago|4 comments
71.
by AretNCarlsen 15y ago
1.) you haven't ever thought about whether /dev/random is reliable in a VM environment.
72.
by AretNCarlsen 15y ago
2.) you have thought about it, and chosen to hope/trust that the VM provider has implemented a reliable RNG (and that your server image/snapshot accesses it properly, especially restarted snapshots).
73.
by AretNCarlsen 15y ago
3.) you regularly run entropy testers against /dev/random to verify randomness (and hope/trust that the entropy you observe is unique, not copied to any other instances).
74.
by AretNCarlsen 15y ago
4.) you have implemented your own RNG (e.g. *haveged* or a WAN-accessed entropy source).
75.
by AretNCarlsen 15y ago
1.) you haven't ever thought about whether /dev/random is reliable in a VM environment.
76.
by AretNCarlsen 15y ago
2.) you have thought about it, and chosen to hope/trust that the VM provider has implemented a reliable RNG (and that your server image/snapshot accesses it properly, especially restarted snapshots).
77.
by AretNCarlsen 15y ago
3.) you regularly run entropy testers against /dev/random to verify randomness (and hope/trust that the entropy you observe is unique, not copied to any other instances).
78.
by AretNCarlsen 15y ago
4.) you have implemented your own RNG (e.g. *haveged* or a WAN-accessed entropy source).
79.
by AretNCarlsen 15y ago
1.) haven't ever thought about whether /dev/random is reliable in a VM environment.
80.
by AretNCarlsen 15y ago
2.) have thought about it, and chosen to hope/trust that the VM provider has implemented a reliable RNG (and that your server image/snapshot accesses it properly, especially restarted snapshots).
81.
by AretNCarlsen 15y ago
3.) run entropy testers against /dev/random to verify entropy (and hope/trust that the entropy you observe is uninot copied to any other instances).
82.
by AretNCarlsen 15y ago
4.) implement RNG independently in software (e.g. *haveged*).
83.
by AretNCarlsen 15y ago
But users might actually read the developers' explanations, in which case they would need to be true. If no 3rd-party verifies the permissions explanations before the app is released, then the only value is as a legal agreement between the
84.
by AretNCarlsen 15y ago
The cause-effect relationship is exactly the point. IRL, I am an app developer. When I deliver a new app, I have two ways to monetize my development time: I can either charge money for the app (and call it the "Pro" version), or I can put a
85.
by AretNCarlsen 15y ago
I use "monetize" as a superset of "sell", in that "sell" is usually taken to imply a direct payment by the end user, whereas "monetize" also provides for indirect payments like ad views. You are allowed to decide not to give my application
86.
by AretNCarlsen 15y ago
Is the word "piracy" considered troll-bait now? I thought that was the kindest available euphemism for "taking a not-free thing for free".
87.
by AretNCarlsen 15y ago
@everybody: "This way we can disable Internet access on apps and games that are just downloading ads." In The Business, we call this "piracy". Unless, of course, the developer is an altruist who did not intend to monetize their app, but acc
88.
by AretNCarlsen 15y ago
I disagree completely. It's just like real estate: since I only use about 50% of the floor space in my apartment at any given time, I roll over my unused square footage and only pay rent every other month.
89.
by AretNCarlsen 16y ago
Article is clearly intended to pacify humans, not convey info about robot(s). Still worth learning from, however, as a textbook example of trivializing the human element you are trying to emphasize. To test whether you're making that mistak
90.
by AretNCarlsen 16y ago
Good idea! Here it is in C: http://pastie.org/1824968 (You have to manually add the 'f' after the constants if you want to do the whole thing in floating-point, as well as uncommenting the correct Dollars_t definition.) For the range $20.

More ›