angelbob

24 ms·

181.
My First $1000 in Product Revenue, with Graphs(codefol.io)
19 points by angelbob 14y ago|6 comments
182.
by angelbob 14y ago
I think he's saying he wants to make programming better for newbies. It really kinda sucks for them right now. Serious hard-core engineers that need serious tools are actually pretty well served by current tools. No, no, they're not perfec
183.
by angelbob 14y ago
Which brings "mistaken" back down to the average CTR for an ad of that type, instead of double the average.
184.
by angelbob 14y ago
If the web app uses extra memory or CPU, SSH response time may be affected. So delaying in the web app doesn't do a good job of concealing CPU and memory use by the web app, because it's a shared-resource system.
185.
by angelbob 14y ago
SSH isn't out of scope for your attacker. If it's out of your scope as a defender, that's a problem. That's why this is hard. You don't get to control what channels of information the attacker looks at.
186.
by angelbob 14y ago
See below. There are truly not trivial solutions to timing attacks. Patrick knows what he's talking about on that one.
187.
by angelbob 14y ago
How is your "do not respond before" implemented? Does it sleep? Or busy-wait? Either is basically detectable because it affects (or doesn't) the performance of everything else on the machine (such as pings, other web requests, SSH login,
188.
by angelbob 14y ago
Yes. That will make it tougher to figure out. Your assumption that timing attacks are impossible because they are hard to trace seems optimistic, though. This is specifically a security problem. Saying "I'll sweep it under the rug" and c
189.
by angelbob 14y ago
Yes. Now if you have a problem and the email isn't sent, you have still told the user it has been. Also, you have to fix this problem every place else that you touch the user database, such as your signup process. There are normally many
190.
by angelbob 14y ago
Yes. Now find every place that can be slow in some cases and do the same thing. Note: just doing this in your app isn't enough, because you run in a framework and on a virtual server, and things like memory usage affect the speed of these
191.
by angelbob 14y ago
but standing for periods of just 10-15 minutes is correlated with vascular disease; Just 10-15 minutes? Where did they find subjects for a research study that didn't stand for at least 10-15 minute spans during the day?
192.
by angelbob 14y ago
Sure. Pretty much none of what he's talking about is unprecedented (except actually breaking the speed of light). It's just inconvenient and far from mainstream.
193.
by angelbob 14y ago
World of Warcraft (and now other games) have a great semi-solution to number six. It turns out that by doing the game world calculations on the server but doing them in parallel on the client and updating regularly, you can beat the speed
194.
by angelbob 14y ago
Indeed. Several of these problems actually say a lot about the design of the games that implement the solutions. This is one of those. Similarly, "start with procedural and add some bits on top" (one proposed solution to this) would be
195.
by angelbob 14y ago
Sure. It'd be nice to have some kind of actual standard to at least make a good best guess here. Cookies are a really, really bad start.
196.
by angelbob 14y ago
"Leakable" in the sense that you can hand it to somebody else and they can actually use it. A cookie is leakable because the client chooses to send it, so copying it to somebody else is really bad. A server-assigned per-connection ID is no
197.
by angelbob 14y ago
If you don't store a leakable cookie on the client and only use a connection ID (which is autoassigned by the server and cannot be easily forged) then a lot of cross-domain evil hackery goes away.
198.
by angelbob 14y ago
An American tourist was harassed but not physically injured. He has evidence (some hearsay/unverifiable) that random McDonalds employees destroyed property, but it's going to be annoying and difficult to prove anything. I wouldn't expect a
199.
by angelbob 14y ago
In silicon valley we dislike the term "delusional." It's our "reality distortion field" :-P
200.
by angelbob 14y ago
I think that line is more for contractors than full-timers. Less red tape to let you go. Which sounds snarky, but I mean it seriously.
201.
by angelbob 14y ago
Anybody she was getting recruiting emails from was trying to poach her (a founder). Silicon Valley is small, incestuous and political. If all your competitors, other portfolio companies, etc. are getting recruiting emails from you, includi
202.
by angelbob 14y ago
If you envy our level of spam, change the address on your LinkedIn profile and/or make a new honeypot one. Like the original article, you can actually find out empirically! Then write a blog post about it.
203.
by angelbob 14y ago
He's picking a bunch of problems C is really good at and then roughly, fairly mechanically translating to Go. I don't think he's trolling, but I do think he's playing to C's strengths and Go's weaknesses, possibly by accident.
204.
by angelbob 14y ago
Alas. They're not as bad as they were at first. That's something. I'm still embarrassed to be a member of HN when these threads roll around. Thank you, by the way - you generally do an excellent job of being a voice of reason here.
205.
by angelbob 14y ago
No, it really doesn't boil down to that. Silicon Valley Startup culture does currently create a hostile attitude for a lot of female founders and potential female employees. NYC is handing us our ass on female founders and employees, par
206.
by angelbob 14y ago
I really like it, and the "artistic direction" is lovely. With that said, I would put more of the specifics (my software) earlier and some of the generalities (traits of a great software engineer) later on. If you start with a lot of genera
207.
by angelbob 14y ago
It would be nice to see differing MurmurHash performance on different string lengths as well. Not that I can't do it for myself, of course :-)
208.
by angelbob 14y ago
This seems like a very "beginner" presentation of some very interesting (and normally considered advanced!) concepts. I'm curious how it will do. I love the information, and I love the "prove it works in Ruby code" concept.
209.
by angelbob 14y ago
Most employers are fine if you take extra unpaid days off as long as you tell them in advance. Disclaimer: I work in software in silicon valley.
210.
by angelbob 14y ago
(Disclaimer: I am a professional Ruby developer) The problem is that the various packaged versions of Ruby are a shambles. RVM has a number of significant problems and difficulties (rbenv is both better and worse). Right now getting a goo

More ›