moe

108 ms·

931.
by moe 14y ago
No. A thousand times. A bit more creativity should be allowed when handling a vulnerability of this magnitude. For example, publish a patch that escapes all input in curious ways, presumably to prevent SQL injection. Pad it, obfuscate the
932.
by moe 14y ago
You also cannot publish little known pre-auth remote code execution vulnerabilities for your web-framework without first publishing a mitigation patch that doesn't paint a BIG FAT RED ARROW onto the attack vector. You also cannot leave 6
933.
by moe 14y ago
Well, on just about every profile I tried there was Rails, JQuery or such front and center, on both sides ("Popular repos" and "Contributed to"). I still can't make out a pattern, it looks like a fairly random mix between the repos by the
934.
by moe 14y ago
Well, you are right, the idea wasn't thought out very well. I was in a bit of a bad mood during patching up various rails deployments around here... However, perhaps they could just promise to post a signed message, in a specified format, o
935.
by moe 14y ago
Yes, that is to be expected - and absolutely worth it. The aftermath of an incident like the current one is a lot more expensive than an unplanned downtime.
936.
by moe 14y ago
I want my rails instances to shutdown within minutes of an announcement, not hours or days.
937.
by moe 14y ago
I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism. I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like t
938.
by moe 14y ago
Hm, it seems I stand corrected, the list doesn't work like I thought it does. However, I still don't understand what it's supposed to tell me. See for example (randomly chosen): https://github.com/peterb According to Github his fork of "c
939.
by moe 14y ago
I'm sure you also wanted to say something about the points I made but alas your tomato timer rang before you got to it, right?
940.
by moe 14y ago
Terrible. There's a good idea buried somewhere in this, but they managed to completely miss the mark. 1. It needs an off-switch (globally and per repo). How did this feature get out the door without that switch? Does Zuckerberg manage prod
941.
by moe 14y ago
The author may want to fix his menu-bar before complaining about others. It's a tiny, blurry mess on my 27" Thunderbolt-Display. On a smaller retina screen it probably looks more like a smudge than text.
942.
by moe 14y ago
Yup I know the reasons and implications (have written my own terminal emulators in the past). I just felt the list is not complete without the biggest(?) annoyance of them all. I wish someone would write a "dumb screen" that simply plays ba
943.
by moe 14y ago
0) It sabotages your scrollback (just like screen), no more mouse-wheel scrolling. Showstopper for me.
944.
by moe 14y ago
Yes there has been some decay since 1998 (unsurprisingly), but in the past years it's been nowhere near as dramatic as it may seem at a glance - the charts are just difficult to compare due to the jumping scales and colors. Freenode, for ex
945.
by moe 14y ago
Well, except IRC isn't dead... http://irc.netsplit.de/networks/top10.php?year=2012
946.
Skitch And Evernote: A Letter From Keith Lang(blog.evernote.com)
3 points by moe 14y ago|0 comments
947.
by moe 14y ago
Thank you. I found it hilarious how vaadu led his comment with "OP fails on basic math" and then lands a turd like that...
948.
by moe 14y ago
If you're willing to gamble your imap password on their undocumented process then that's fine. I posted my warning because I think most users are not even aware that they're sending their password to inky and the implied risk. Also inky doe
949.
by moe 14y ago
That's meaningless. It opens a whole range of attack vectors for absolutely reason. No least your inky password (which they presumably use as the key). They allow a minimum length of 6 chars on that, which can be brute forced within hours o
950.
by moe 14y ago
Since my other comment got downvoted for unknown reasons I'll attach the WARNING here again: Be aware that Inky uploads your imap password to their servers (see their FAQ). This is probably due to incompetence rather than malice but if you
951.
by moe 14y ago
Ok. So we have computers now, a truly new technology. And thus we will soon collectively decide that writing backwards is better because then we can look at the world above our screen better. Yes, on second thought this is absolutely compar
952.
by moe 14y ago
Not all devices support all streaming protocols and formats. I.e. their desktop player uses the proprietary SMPTE 421M codec (microsoft) which is not available (or efficiently implemented) on platforms where silverlight is not available (re
953.
by moe 14y ago
We actually talk to other people in the industry sometimes, imagine that...
954.
by moe 14y ago
I work for a media streaming site (rank <30k on alexa) and I assure you the architecture doesn't change much when you scale it up to rank 99 (netflix). "Trivial" may sound harsh but in terms of large scale systems it really doesn't get
955.
by moe 14y ago
I don't know the Netflix contract but I've been involved with a few big (telco) SLAs. The penalties are usually calculated with a points-system and a multiplier that raises according to the duration/impact of an outage. E.g. the first 15 mi
956.
by moe 14y ago
You're blowing this a little out of proportion. Replicating a few petabytes of static videos is not rocket science nor cost prohibitive for a company the size of Netflix. Nor is engineering a system that can withstand a datacenter outage.
957.
by moe 14y ago
100 years? We've been reading top-down for well over 2000 years, since the very beginnings of writing, in almost all languages. If you really believe twitter and touchscreen-gadgets will overthrow that in not even one generation then you sh
958.
by moe 14y ago
I think what you're missing is that terminal output is nothing like the disjunct messages on twitter (and even there the inversion is terrible) but rather like the sentences of a novel. We don't just "habituate to" reading backwards while e
959.
by moe 14y ago
Sites normally employ various mechanisms to prevent session fixation attacks[1] and similar malice. These mechanisms prevent session collisions as a side-effect, thus your scenario seems rather unlikely. [1] http://en.wikipedia.org/wiki/Se
960.
by moe 14y ago
printed in any other way... would want their shell output I never understood why anyone Yes, what a great innovation!

More ›