Thorrez

33 ms·

781.
by Thorrez 2y ago
If you're withdrawing from a traditional (pre-tax) 401k or traditional IRA, you have to pay income tax on it. If you're withdrawing from a roth 401k or roth IRA, you don't have to pay any tax on it. If you're withdrawing
782.
by Thorrez 2y ago
>Starting a Secret Chat takes one more tap than starting a normal chat. Hmm, the article says this: >As John Hopkins security researcher Matthew Green pointed out in his blog on the subject, it’s also a pain in the ass to activate. “T
783.
by Thorrez 2y ago
>hard evidence demonstrating weaknesses The weakness is that e2e encryption is disabled by default, and is a giant pain to enable.
784.
by Thorrez 2y ago
>It's the same thing with the USA in the crypto community, you either don't sell US citizens When I read that at first, I thought crypto was short for cryptography, and you were referring to the crypto wars, back when most cryp
785.
by Thorrez 2y ago
Also, the solid rocket boosters (the 2 things next to the big orange thing) were jettisoned into the ocean, then collected, refurbished, and reused.
786.
by Thorrez 2y ago
>By the way, the default fetch `credentials` value ("same-origin") doesn't send cookies to third-party websites either. Why CORS still applies here is a mystery to me. There are other types of authentication besides cookie
787.
by Thorrez 2y ago
>It is protected by if the request uses JSON or similar. Only if the server checks that the Content-Type header is JSON. If the server ignores the Content-Type header and simply decodes it as JSON, it's not protected. I think there
788.
by Thorrez 2y ago
>Spoofing TCP is useless - you actually need to receive all the packets sent to the original TCP What do you mean "original TCP"? I'm talking about an attacker creating a new TCP connection with a spoofed source address. &
789.
by Thorrez 2y ago
>So without CORS, then someone might be able to create a landing page, which in the background triggers a `fetch` or `ajax` request to your bank's transaction endpoint. For 99.999% of people this wouldn't be effective because t
790.
by Thorrez 2y ago
>Just send the request without cookies if CORS doesn't allow it. The problem is how will the browser know whether CORS would allow it or not? It could send a preflight, yes. In the current rules that's only done for complex req
791.
by Thorrez 2y ago
I agree with how you describe the behavior, but the terminology you use differs from how I understand things. The canonical example you give for something CORS and the same origin policy protect against isn't even protected against by
792.
by Thorrez 2y ago
That's not really correct. CORS and the same origin policy don't protect against CSRF attacks by default, at least if we're using the standard definition of CSRF attacks. An attacker can still "send emails on your behalf
793.
by Thorrez 2y ago
You're correct.
794.
by Thorrez 2y ago
That attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.
795.
by Thorrez 2y ago
>The fact that a website can’t make a request to another website unless that domain like it That's wrong. Any website can make a request to any other website. The same origin policy will prevent READING the response, not making the
796.
by Thorrez 2y ago
What type of encryption is used?
797.
by Thorrez 2y ago
I think that's only true if you're using direct asymmetric cryptography. In the real world people use hybrid asymmetric cryptography. Hybrid asymmetric signing is: hash the payload, then use direct asymmetric encryption/signi
798.
by Thorrez 2y ago
Even if that was protected against (by putting the source IP inside the payload), I'm not sure it's really much more secure. An attacker who can intercept the packet can likely also spoof the source IP, so the attacker could wait
799.
by Thorrez 2y ago
I think even a single change (married->divorced) counts as a form of instability. Of course more changes are worse than 1 change. >Instability is best described as the experience of abrupt, involuntary, and/or negative change in
800.
by Thorrez 2y ago
>The more significant statistic qua correlations is the impact of growing up with just one parent after divorce, and of instability of changing circumstances Doesn't divorce cause those two things? Either the kids live with just one
801.
by Thorrez 2y ago
Yes you should continue to be a parent after divorce. But the divorce will have a negative impact on the kids. The statistics show that children of divorced parents have more problems than children from intact marriages. People I know whose
802.
by Thorrez 2y ago
How about this one: https://hackerone.com/reports/745324 It's a $20k bounty for simply taking a cookie that a HackerOne employee accidentally pasted when responding to a different vuln report on HackerOne.
803.
by Thorrez 2y ago
The number of babies being born is decreasing each year globally. 2012 was the peek.
804.
by Thorrez 2y ago
>While we were crossing the 180th meridian it was Sunday in the stern of the ship where my family were, and Tuesday in the bow where I was. A difference of 2 days? How does that work? I thought it would just be a difference of 1 day.
805.
by Thorrez 2y ago
The article covers that: >And then, of course, there’s the matter of the new century. As some may remember from the whole Y2K hullaballoo, centuries (and millennia) only end when the year ending in zero is over, not when it starts. So, j
806.
by Thorrez 2y ago
>The sanctity of marriage is what's at stake and one's own happiness is secondary. Let's not forget about the happiness of one's spouse and kids.
807.
by Thorrez 2y ago
So some CPU models wait 120 cycles and others wait a millisecond (millions of cycles)? That seems like a pretty drastic difference. I wonder why they would write code with such a drastic difference between CPU models.
808.
by Thorrez 2y ago
I agree it's a form of censorship. But HN needs some censorship to avoid becoming reddit. There are many websites with less censorship. I come to HN because the quality is high, in part due to censoring low quality content. I think any
809.
by Thorrez 2y ago
Interesting that in a thread about comment kindness, there are so many snarky and inflammatory comments. Goes against the HN guidelines: > Be kind. Don't be snarky. Converse curiously https://news.ycombinator.com/new
810.
by Thorrez 2y ago
Does the spinlock last a millisecond? It sounds from the article that it lasts 120 cycles.

More ›