mhansen

8 ms·

31.
by mhansen 15y ago
VPN/SSH Tunnel. But seriously, you're just as screwed if they inject HTML that changes the form submit URL for your password to an attacker-controlled site. The real answer to this problem is HTTPS, everywhere.
32.
by mhansen 15y ago
That won't work without javascript, and then you need another URL to fallback to that'll respond to GET requests for non-javascript browsers. And then you could just XSRF the non-javascript URL. [Disclaimer: I work at Google, but not on any
33.
by mhansen 15y ago
I use golang
34.
by mhansen 15y ago
Google's always hiring. http://www.google.com/intl/en/jobs/index.html
35.
by mhansen 15y ago
This is what Closure Compiler does, without the need to even dump in a large test suite.
36.
by mhansen 15y ago
Your HTTP headers alone per requested file is probably 1KB - 3KB is still tiny.
37.
by mhansen 15y ago
being "liberal in what you accept" is a discredited software practice. What? When did that get discredited?
38.
by mhansen 15y ago
[after you're dead]
39.
by mhansen 15y ago
FYI, This American Life is WBEZ, not NPR (although TAL cooperates with NPR for things like the excellent Planet Money)
40.
by mhansen 15y ago
And if you set it aside you get 40% time next quarter. It's very much alive and well.
41.
by mhansen 15y ago
This is ridiculous. I love python, but it has no language support for an event loop, and if you put it in a browser, everything would have to be done in an event loop. It'd be ugly. Javascript excels at evented programming. Use the right to
42.
by mhansen 15y ago
FYI, Dart does type checking. If you want to give your javascript some type-checking, try running it through the closure compiler. This is what we do, and we annotate our methods with type signatures like this /** * Queries a Baz for
43.
by mhansen 15y ago
Better: name the file README.md
44.
by mhansen 15y ago
Interesting that you choose Wave as an example, because Wave was run as a semi-independent startup, and it ended horribly.
45.
by mhansen 15y ago
It's not zero-sum. The devs get a lot out of it, too. All the devs that buy tickets to IO think that IO benefits them more than the $900 they're parting with.
46.
by mhansen 15y ago
Do you go back and refactor #promoCol to .promoCol? Yeah, that's exactly what you do. Just because your new dev doesn't know how to refactor (and it's hardly even refactoring, it's like a two-line diff) doesn't mean we all shouldn't use I
47.
by mhansen 15y ago
Yeah, I hear ya, it takes ages to load my data too. If there's a way to cache on the serverside without running into the API throttling, I'd love to do some caching.
48.
by mhansen 15y ago
It's pleasant to look back over your life - the graph probably reminds him of great stories that are too private to share :)
49.
by mhansen 15y ago
If this kind of thing interests you, I made an app that graphs last.fm song listens in the same way as Wolfram's graphed his emails. I find changes in listening habits correlate well with big life changes. http://markhansen.co.nz/scatter.f
50.
by mhansen 15y ago
You've probably already seen this, but for the sake of others, Google recently released the research paper detailing their petabyte-scale ad-hoc logs analysis platform, "Dremel". http://research.google.com/pubs/pub36632.html
51.
by mhansen 15y ago
Very nice! I like how the lines on the graph wrap to 45 degrees.
52.
by mhansen 15y ago
FYI, this isn't as general, but I think it shows off underscore quite nicely: _(people).max(function(person) { return person.firstName.length + person.lastName.length; });
53.
by mhansen 15y ago
I'm not sure where you got this idea. V8 does not optimize tail calls. It's easy to see this in the Chrome console, I just entered this now: var a = function(x) { if (x == 0) return 'done'; return a(x-1); }; a(100000); RangeError: M
54.
by mhansen 15y ago
Yeah. It gets annoying when you just want to write one blog post, and you feel like it shouldn't have to recompile everything else. I profiled it once, and most of the time was spent shelling out to python to do the syntax highlighting.
55.
by mhansen 15y ago
Very smooth interface, from what I can see. FYI on demo.fluent.io I'm getting HTTP 400 error trying to connect to the websocket.
56.
by mhansen 15y ago
Another telling gem is StackOverflow page doesn't even have a proper encoding declaration. They declare the encoding in the HTTP Response. Content-Type:text/html; charset=utf-8 That's totally proper. If you specify it again inside
57.
by mhansen 15y ago
Uh, yeah, you needed flash. You can't read local files in javascript without the HTML5 file api. Reading the value of <input type='file'> tags is forbidden in javascript. Try it.
58.
by mhansen 15y ago
>> you lose static typing and type inference in the compiler It doesn't matter what the target language is if you want to do static typing or type inference. For example, Haskell compiles down to assembly , but still has an extreme
59.
by mhansen 15y ago
FYI to people considering .nz: WHOIS Privacy is not allowed in .nz. I'm very happy with my .nz domain, but it's lame that I have to have my home address in a publicly accessible database.
60.
by mhansen 15y ago
To choose who is in your contact list, log into G+, and hit the little arrow menu next to the chat list. Inside 'Privacy Settings' you can restrict which circles appear in your chat list.

More ›