dfranke

43 ms·

391.
by dfranke 17y ago
I was looking for login cookies, not fnids. Fnids are worthless since there's already code that checks that the user who called the closure is the same as the user for whom it was created.
392.
How I Hacked Hacker News (with arc security advisory)
928 points by dfranke 17y ago|78 comments
393.
by dfranke 17y ago
Most real lineups consist entirely of criminals too. One person in the lineup is the suspect, and the rest are inmates from the local jail. You implicitly identified the reason for this: everyone in the lineup needs to look equally sketch
394.
Bruce Schneier on the risks of cloud computing(vnunet.com)
3 points by dfranke 17y ago|1 comments
395.
by dfranke 17y ago
In what project in what universe are outside contributions not subjected to more stringent quality control than those made by people who are already trusted members of the development community? How could it possibly be any different if
396.
by dfranke 17y ago
At least until the next time Techcrunch links to news.yc.
397.
by dfranke 17y ago
Don't bother with the ask-HN post; just see a @#$%! doctor! While a lot less alarming than the TLP, this sounds vaguely like bipolar disorder, but you're not going to get help or a diagnosis on an internet forum, even if anyone who reads y
398.
by dfranke 17y ago
See a doctor and do it soon, unless you're in your late teens or early 20's, in which case do it yesterday. That's the peak age range for the onset of schizophrenia.
399.
by dfranke 17y ago
The CoS doesn't often let little details like that get in their way. See chris11's link in this thread.
400.
by dfranke 17y ago
I don't see down arrows on old comments.
401.
by dfranke 17y ago
This code doesn't appear to include the anti-karma-bombing restriction on downvoting old comments.
402.
by dfranke 17y ago
I've applied twice to YC, so my own applications would provide a Rosetta stone for a lot of important words. But that would be cheating.
403.
by dfranke 17y ago
You could probably extract a good deal of information from this by examining word frequency and sentence structure. Or at least, the attempt would be too much for me to resist.
404.
by dfranke 17y ago
We're talking about startup school, not funding.
405.
by dfranke 17y ago
Huh. For startup school applications that's actually a surprising result. I was under the impression that the admissions process on that was basically just to weed out the hackers from the business people, and with an application that bri
406.
Ask PG: Could YC admissions be replaced with a very small shell script?
17 points by dfranke 17y ago|12 comments
407.
by dfranke 17y ago
I'm not a CG guy, but I'm guessing it's pretty simple and efficient to recognize which of a set of images a given image is a rotation of. So the ability to create lots of rotations doesn't buy you any security.
408.
by dfranke 17y ago
It's been tried: google "kittenauth". The problem is that you need to collect the images from somewhere, so the keyspace is too small.
409.
by dfranke 17y ago
I think these sorts of sites are the best you're going to do if you nobody you already know fits the bill and hence you and your potential cofounder are starting out as strangers. The qualities that you're (rightly) looking for are much mo
410.
by dfranke 17y ago
http://partnerup.com , but beware incessant customer retention spam.
411.
by dfranke 17y ago
Usually I find API documentation more inspiring than actual code. It's higher-bandwidth. That said: - Some bits of On Lisp - Haskell's SYB and Parsec libraries - MINIX (2; have yet to play with 3)
412.
by dfranke 17y ago
charity is about signaling your fitness to others While this is undoubtedly a factor, it fails to be a complete explanation, given that much charity is anonymous, and anonymous charity has no obvious utility for signaling. It would also
413.
by dfranke 17y ago
Okay, good point about eventual consistency. I maintain that Amazon really ought to do a better job of explaining this, though. I assume the typical window for consistency is significantly shorter than the leeway that they allow for clock
414.
by dfranke 17y ago
Isn't that a bit much to be throwing onto the shoulders of the application developer? At the very least I'd expect it to be explicitly documented that the possibility of replays by untrusted parties needs to be considered. I know you to
415.
by dfranke 17y ago
Where does the nonce go? I skimmed the REST API for S3 uploads and didn't see a mention of one other than possibly the date, and the date only has a granularity of one second.
416.
by dfranke 17y ago
Huh. This is a pretty straightforward vulnerability. The fact that it took anyone this look long to notice makes me skeptical that it's really this simple. I'll make a note to toy with this and see if it's actually exploitable.
417.
by dfranke 17y ago
If it was only three months ago, more likely this service was already in development and you were customer #1 without knowing it.
418.
by dfranke 17y ago
Was this conversation transcribed by someone's secretary? JA: So, you are using a Sequel server? Or are you using a database? SP: We use Sequel Server 2005. I guess I should be thankful it's not in lolspeak.
419.
by dfranke 17y ago
Reminds me of the spiders from Minority Report.
420.
by dfranke 17y ago
He perscribed me 1.5mg lorazepam, but I've yet to observe any physiological evidence that they didn't give me a sugar pill by mistake. Just got a new perscription for 50mg trazodone. We'll see if that fares any better.

More ›