rudolf0

42 ms·

391.
by rudolf0 12y ago
Git isn't exactly a startup (or a company, or even a product), nor did it ever intend to be. Lots of great software happens to be difficult for a lot of people to intuitively understand.
392.
by rudolf0 12y ago
At least it's going to charity.
393.
by rudolf0 12y ago
I believe that sentence is grammatically correct without the "why".
394.
by rudolf0 12y ago
It doesn't really make a difference in a case like this. Though certainly not an ideal algorithm, the chance of a collision for something like this is low enough to never be a concern.
395.
by rudolf0 12y ago
I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whiteli
396.
by rudolf0 12y ago
Well, presumably they'd want to keep the money from the competition. That's definitely an incentive.
397.
by rudolf0 12y ago
NoScript won't actually execute any of the Javascript, though. I am not aware of any historical vulnerabilities from the mere act of loading and parsing Javascript, though they're certainly theoretically possible. It's much e
398.
by rudolf0 12y ago
They're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised. If you'
399.
by rudolf0 12y ago
My understanding is that would violate the rules of the competition. Though of course if a competitor were to do that, odds are no one would find out.
400.
by rudolf0 12y ago
Skill definitely plays a role too. If you are smart and experienced enough, you can theoretically churn out a valuable exploit once every 1-2 months on average. At a company, you're generally going to get a flat salary. Many vuln resea
401.
by rudolf0 12y ago
Yes, which is why NoScript allows fine-grained controls. It's not a straight up disabling of Javascript. You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src=&q
402.
by rudolf0 12y ago
Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.
403.
by rudolf0 12y ago
Most (not all, but most) of these exploits cannot run if you use NoScript/NotScripts or equivalent.
404.
by rudolf0 12y ago
Here's a deobfuscated version of that: http://pastebin.com/TwP9bAc4 This is a pretty common malspam campaign that's been seen for the past few months. No exploits, it just requires a Windows user to save and run i
405.
by rudolf0 12y ago
Same here. Blue Coat proxy? :)
406.
by rudolf0 12y ago
Default Windows shell also has `findstr`, which works very similarly to grep. It's also quite fast.
407.
by rudolf0 12y ago
Mike last updated that page in 2012, and I'm not sure if he's publicly committed any code for it. I seem to recall him requesting a sponsorship for it.
408.
by rudolf0 12y ago
Isn't LuaJIT's GC not that robust? I believe Mike Pall has lamented it as being the worst part of the compiler. I think he's wanted to rewrite it from scratch for a while, but doesn't yet have the time or resources.
409.
by rudolf0 12y ago
In most cases a competitor is not doing exactly what you want to do. If your idea involves some sort of a gimmick or very specific point of attraction and that is already being used by a competitor, then sure, maybe you should pick a diff
410.
by rudolf0 12y ago
Funnily enough, after reading more into this myself I'm actually going to partially retract some of my statements above. I don't know if it was definitively proven that he copied the code with the intent of helping the new startup
411.
by rudolf0 12y ago
Ignoring the obvious FBI blunders and them being far too buddy-buddy with corporations, doesn't he have a point? Aleynikov intended to monetize code which was technically Goldman's property, even if he wrote most of it. It would b
412.
by rudolf0 12y ago
Not a very fair comparison due to Go's (mostly) static typing and Ruby's very dynamic typing. In this case, the author wants to use a struct with custom user-defined types as members, while JSON only has concepts of primitive type
413.
by rudolf0 12y ago
Interesting to see Bitcoin use almost the same principle. Essentially it's "if there is a hash with enough leading zeroes, we can assume a lot of CPU time has been put into the network." Of course that's just an artifact
414.
by rudolf0 12y ago
If he did so, he'd seem more like a greedy opportunist rather than someone genuinely interested in pushing the industry's goals.
415.
by rudolf0 12y ago
Valid point. We don't know if they're doing that (and I suspect it's probably illegal) on a wide scale (the parallel construction cases appear to be specific help requests made by the FBI/DEA to intelligence agencies), b
416.
by rudolf0 12y ago
It's a lot easier to handle feeling like a fraud when you receive no negative feedback with overwhelming positive feedback, and are very confident regarding a certain domain. If someone feels like a fraud even in their "core compe
417.
by rudolf0 12y ago
Signals intelligence agencies have to deal with enough data as it is. They don't have the resources to care about piracy or even the vast majority of drug offenses.
418.
by rudolf0 12y ago
I think it's okay to assign a media name to vulnerabilities, but only if the vulnerability is truly severe enough (easy to exploit and serious magnitude) to warrant it. Otherwise it's just an attempt at marketing and PR. In this c
419.
by rudolf0 12y ago
Go is also completely overhauling their GC for the next release (1.5). See http://llvm.cc/t/go-1-4-garbage-collection-plan-and-roadmap-...
420.
by rudolf0 12y ago
> once saw a technique where you simply write your really detailed log messages to a ring buffer (using a lockfree algorithm), and spit them out when you fail. This is even easier to do in Go, since you can just send the messages over a

More ›