absherwin

12 ms·

61.
by absherwin 13y ago
It's possible in both cases. The difference is two-fold: The landlord can control the probability of damage through the application process, assuming some people are predictably more risky, and the renter can be required to purchase in
62.
by absherwin 13y ago
The guarantee terms and conditions exclude damage to common areas and units not owned or controlled by the host. Water damage or a truly abusive guest still leave the host exposed to claims and the landlord exposed to damages for which no s
63.
by absherwin 13y ago
Replace copyright with monopoly and your argument is equally sensible. Using textbook micro, the cost of copyright is clear. The copyright on Mickey Mouse raises the cost of goods featuring it. In a world without copyright, my expenditure o
64.
by absherwin 13y ago
Kipling's The Palace is also fitting perhaps even more so for those building today's successful platforms: http://www.kipling.org.uk/poems_palace.htm . WHEN I was a King and a Mason - a Master proven and skilled I
65.
by absherwin 13y ago
Absolutely nothing. According to the linked help page, a fake email address must be provided to git config. They'd need a separate copy of the repo with the blinded email address for public access. It's not hard to do but I imagin
66.
by absherwin 13y ago
Anyone seriously worried about privacy should also ensure that their gravatar doesn't point to their real email address, especially if there's a simple relationship between the email addresss and GitHub username. Edit: Apparently,
67.
by absherwin 13y ago
Of course, there are imperfections in some assets. Let's not talk in the abstract. We've established that this problem applies to 5.8% of assets. Some percentage of those have reasonably computable valuations. If not or if the val
68.
by absherwin 13y ago
You're absolutely right about where the risk lies. That's why large shareholders have become increasingly concerned about alignment. CEO pay is increasingly in equity and they are subject to minimum equity holding requirements and
69.
by absherwin 13y ago
Non-financial non-real estate assets account for 5.8% of the total according to the Fed's flow of funds report (Z.1) table B.100: http://www.federalreserve.gov/releases/z1/Current/z1r-5.pdf . Note this al
70.
by absherwin 13y ago
Yes, given executive compensation trends, I wouldn't be surprised if executives would get a disproportionate share. That's largely irrelevant to understanding the aggregate impact. At large corporations, CEO compensation is usuall
71.
by absherwin 13y ago
Given that the vast majority of wealth in this country in held in liquid assets or in real estate which is already taxed based on value, why do you suppose that a scheme to tax it would be more complex than the corporate tax system which em
72.
by absherwin 13y ago
It's not that simple. Of course, the direct effect of corporate taxes is mostly on the wealthy who own most of the stock but that's not necessarily the group who gets most of the wealth--more on that below. Even in terms of direct
73.
by absherwin 13y ago
You can fix this without government intervention: Launch an a16z ETF. It could help you as well because you could secure more favorable terms if you so desired to offset the additional work. This may yield higher returns to investors than t
74.
by absherwin 13y ago
While you're correct as a matter of legal theory, this doesn't happen in practice. Aside from Felt and Miller who were given small fines and then pardoned, can you name another precedent for prosecuting government employees for ov
75.
by absherwin 13y ago
http://www.cmegroup.com/trading/real-estate/files/spcaseshil... Beware. The liquidity of these markets is vastly lower than that of equities. Also remember Keynes: "The market can remain irrational longer than you can stay solvent" or in
76.
by absherwin 13y ago
Since it's too late to edit, I'm posting here to correct my statement that Chrome is the only browser that supports HSTS preload; Firefox does as well.
77.
by absherwin 13y ago
I appreciate your responding thoughtfully. Regarding Moxie, I noted in the original post and immediately after his first post that he'd need to provide a valid SSL certificate. He asserted one wasn't necessary and I assumed perhaps he had s
78.
by absherwin 13y ago
Yes, my name is public. I don't really care about you mentioning it. What I care about is my name being mentioned in a way that implies my dishonesty which is all lawnchair_larry originally argued. His argument had two components: You're m
79.
by absherwin 13y ago
Thanks. This is an attempt at doing three things: 1. Learning more about the security risks of JavaScript 2. Facilitating a more create and nuanced discussion of its pros and cons 3. Learning about interacting with HN I failed at my second
80.
by absherwin 13y ago
I truly appreciate your attitude. As you can imagine, having my integrity questioned is quite hurtful. So before I address, your point, thank you. Your comment means a lot to me. Moxie did provide a more detailed attack description. I had t
81.
by absherwin 13y ago
I haven't paid anyone yet because no attack has yet met the conditions. As others have noted, a valid SSL certificate is required for this to work. Moxie suggested that I acquire a certificate for a similar domain to meet that requirement b
82.
by absherwin 13y ago
Think of what's being built as a machine for taking several great ideas and spreading them to areas to which they haven't yet spread. While there's much talk of disruption in startups, their goal isn't to destroy, it's to build something be
83.
by absherwin 13y ago
The key is derived by PBKDF2 with 1000 iterations. For weaker passwords, I suspect a couple of order of magnitude strengthening would be required. Your point about weak passwords holds in both ordinary clients and in the browser. It's just
84.
by absherwin 13y ago
Intercepting the plaintext of the communications to the server isn't sufficient since the password is sent to the server after being hashed and the plaintext is encrypted. It may provide the basis for an attack but in itself it doesn't brea
85.
by absherwin 13y ago
1. Agreed. That's an avenue by which a vulnerability in the server or communication channel could be exploited. 2. It doesn't exist. The code was written in the same form it was uploaded.
86.
by absherwin 13y ago
Email me and I'll send you the DB dump. You can brute force it . I don't think it's as trivial as you suspect but I'd love for you to prove me wrong.
87.
by absherwin 13y ago
You're implicitly applying different threat models to browser-downloaded vs. alternatively downloaded code. If the maintainer of JS code make a mistake and fixes it in future versions, there's no need to worry about it anymore either. Howev
88.
by absherwin 13y ago
I've emailed him to arrange. If it works, he will receive the reward.
89.
by absherwin 13y ago
I welcome the discussion and am learning what I can from it. I was hoping for an exploit. So far one person has proposed one that may work. Those are creative solutions to your contest. I should have been cleverer.
90.
by absherwin 13y ago
1. As discussed in another comment, this requires a similar level of trust to encrypting the data on the server. The only difference here is that, to the best of my knowledge, an attacker who took control of the server, could silently log t

More ›