kneath

16 ms·

121.
by kneath 16y ago
Okay, here's another "just as easy" scenario: 1. You include http://google.com/trusted.js on a https page 2. Someone goes to a cafe, opens up your website with Safari while someone is performing a MiTM attack on that file. 3. No warnings,
122.
by kneath 16y ago
Unless they're using Safari which doesn't have a mixed content idea. My point is that it doesn't fix anything at all. Like filling 8/10 holes in a bucket of water. It's still going to leak out.
123.
by kneath 16y ago
1. Include https://hot-new-metrics-startup.com/tracker.js 2. hot-new-metrics-startup gets hacked. Sends over malicious js 3. Your page is no longer secure. https certificate remains. We can argue semantics, but I guess I'm more concerned
124.
by kneath 16y ago
Indeed, the warning has it's merits. That being said the second part of your argument is completely wrong. You can just as easily inject evil JS using an https server and never get the mixed content warnings. The warning serves to indicate
125.
by kneath 16y ago
This is a problem we (GitHub) are facing in a big way right now. Google Charts doesn't offer https alternatives, so almost all our users get a big "this site is going to steal all your private information" (mixed content warning). We chose
126.
by kneath 16y ago
Well, first off... that's a really old archive (come on now). The problem there was that the wording was wrong (private repositories vs paid accounts).
127.
by kneath 16y ago
We have always implemented SSL regardless to your paid or unpaid status. This is an unfortunate inaccuracy in Eric's Firesheep followup post that he refuses to correct. Previously, SSL was only implemented on private facing pages, such as (
128.
by kneath 16y ago
Since we're being pedantic... What the human race perceives as creativity is largely mashup of what others have done in a new way. Mozart? Derivative of music played by instruments. Van Gogh? Derivative of people painting on canvases. Once
129.
by kneath 16y ago
I can definitely see why you'd need a profile picture when you're about to randomly video chat with someone's face. Sometimes simplicity is a virtue. It's supposed to be anarchic.
130.
by kneath 16y ago
You have to pay social security on every dime up to $120,000 you personally make. Doesn't matter if you make it through an Sole Proprietorship, LLC, C-Corp or S-Corp. Although in Amy's case, she may not have to pay any living in Vienna. But
131.
by kneath 16y ago
ProTip: Just because someone puts a form in front of you doesn't mean you have to sign it :) That form (release of inventions) scared me the first time I saw it (agency job) and I asked if I could just not sign it — they said that was fine.
132.
by kneath 16y ago
We base our entire business around making GitHub an awesome place to work with code. Our users, our revenue, our reputation is all centered around this. There's really no future in which we would move away from that. In terms of exporting y
133.
by kneath 16y ago
HTTP is the future for git and github. It has several benefits and no downsides. 1. No SSH keys required (if you've worked with people on windows machines or newbies to the command line, you'll recognize this is a massive win) 2. The same U
134.
by kneath 16y ago
Thanks! We do our best to balance features, stability and ubiquity. We consider your data your data, not ours. We've been working on increasing ways to export your data out of GitHub — the new wikis being the latest example — and have a l
135.
by kneath 16y ago
I'd love to see any screenshots or features that you find valuable. Feel free to throw anything at kyle@github.com that you want (rants appreciated)
136.
by kneath 16y ago
If GitHub was open source, we wouldn't be able to make money to hire people to make awesome features. An Open Source GitHub would without a doubt be a much worse experience for everyone.
137.
GitHub launches Pull Requests 2.0(github.com)
204 points by kneath 16y ago|38 comments
138.
by kneath 16y ago
Explaining how subpixel rendering technically works seems like the worst possible argument against something that exists purely for aesthetics. Just because something is more technically complicated does not make it a better option. There a
139.
by kneath 16y ago
At it's core, YCombinator is a Venture Capital firm. A very different one, but still — they give money, advice and connections for equity in hopes of a return on their investment. You make returns on your investment by companies getting acq
140.
by kneath 16y ago
Right now, no. In the future, yes. So if you're willing to keep an eye on our blog (we'll warn you before we make this info public) you can check it. Or you can just search on the jobs site itself — http://jobs.github.com
141.
by kneath 16y ago
It actually will. There's a lot of things we weigh the contextual job ads with. A lot of it is the (public) code you write and the location on your public profile. We do ask that people explicitly opt-in for the ads (available for hire chec
142.
by kneath 16y ago
Can't stress this enough. The languages we use here is for the code in GitHub. So it's a lot more robust than simply counting the dominating language of a repository. For example if there were only two repositories on GitHub, both were cl
143.
by kneath 16y ago
Probably because most projects are JavaScript and people don't want to admit it :) We have an extensive list of library-type files and paths that we ignore.
144.
by kneath 16y ago
There's no conflict of interest here. We're focused on making GitHub the best place to collaborate on code. Part of collaboration is having others to work with. If anything, we have more of an incentive to keep quality jobs. We don't need t
145.
by kneath 16y ago
It's hard to say what active means. For example http://github.com/technoweenie/acts_as_versioned/commits/mas... hadn't had any commits in more than a year until today, but now it's up-to-date with rails 3.
146.
by kneath 16y ago
Thanks for your suggestion, I always love reading detailed descriptions of what people would like from GitHub. However, now I've got a bit of a question for you... My opinion is that every extra field I add to a page means I've personally f
147.
by kneath 16y ago
We happy (and often!) re-root repos to show point to the canonical one in the case that projects get abandoned and picked up by someone else.
148.
by kneath 16y ago
If you go to https://github.com/account/notifications you can see all the notifications you receive. Here's a screencap in case you don't feel like logging in: http://share.kyleneath.com/captures/Notification_Center_-_Gi... We send you
149.
by kneath 16y ago
We plan on eventually revisiting our Inbox in it's entirety. In the meantime, I'd highly suggest using stars to fix the problem. http://share.kyleneath.com/captures/GitHub_Mail_-_Inbox_-_ky...
150.
by kneath 16y ago
In fact the source of nodeload is written in CoffeeScript

More ›