skyraider

16 ms·

91.
How we approach schema design at Tutorspree(zachdex.tumblr.com)
8 points by skyraider 13y ago|0 comments
92.
by skyraider 13y ago
Not getting a wage equal to your productivity at the margin may be considered exploitation in several schools of microeconomics. If an employee provides value X and receives wages X-10, the amount of exploitation is 10. However, depending o
93.
by skyraider 13y ago
I understand what you are saying, but cannot see how employees are comfortable with ascribing virtue to large-scale microeconomic exploitation. To me, the behavior of employers towards employees ("here, go create all of our value; go l
94.
by skyraider 13y ago
>>> it is okay if the talented developer narrative doesn’t necessarily involve the company in five or ten years. That’s fine. I always get queasy reading lines like this. In the US, most employers can fire at will. The corollary sh
95.
by skyraider 13y ago
Thanks, opensiteexplorer displays about 75x more links that GWT does. Great stuff.
96.
by skyraider 13y ago
Right now, it seems GWT only shows a "sample" of links, and that sample is chosen from the 100 domains that link most frequency. GWT's "total links" count for my site is about 75x larger than the number of links they'll give me. I'm wonderi
97.
by skyraider 13y ago
Does anyone know if it's always the case that you can find spammy links to your site by using Google (e.g. link:mysite.com)? My link count in webmaster tools is an order of magnitude higher than the inbound links that I can find by using th
98.
Ask HN: Do you have a need for architecture-as-a-service?
1 points by skyraider 13y ago|1 comments
99.
by skyraider 13y ago
You won't see many leftists pressing for competitive purchasing of goods and services on an open market, i.e., where the payers are individuals and not governments - that's the context in which I was writing about a universal minimum inco
100.
by skyraider 13y ago
The income must be cash or cash-equivalent (as opposed to a monopsony, where a single payer buys tries to negotiate lower rates with, say, farms and landlords) so that purchasing occurs competitively. Government's role would be to break up
101.
by skyraider 13y ago
Wait, ya'll, let me know what you think about this idea as a way to enable more people to work on math, CS and other formalized things and get paid. More generally, this is a potential way to solve the friction between what workers are do
102.
by skyraider 13y ago
Two ways: It's voluntary, and you might get some of the profits if the company goes in the green. In a state socialist economy, you have to go work on the pig farm or whatever. In a market-ish economy, the attachment to a particular communi
103.
by skyraider 13y ago
Just going to add a bit about some potentially fertile intellectual grounds for bipartisan support for some form of universal minium income. From the right: F.A. Hayek, another right-leaning Nobel-winning economist, also supported a univers
104.
by skyraider 13y ago
The economic concept of centrally-coordinated production has nothing to do with 3D printing (?) or "centralized" / "decentralized" in the computing or distributed systems sense. It has everything to do with economic planning (the Argentinia
105.
by skyraider 13y ago
Yeah, wealth-building activities that are truly valuable to society probably should remain incentivized by the possibility of great wealth. It's not the only incentive but it's one that works well. What about most economic activities, tho
106.
by skyraider 13y ago
Socialism is about attaching yourself to the community (or usually the Politburo's) 5-year dream for production. Doesn't have anything to do with individual freedom. In the 21st century, there is little valid reason to coordinate production
107.
by skyraider 13y ago
Isn't the idea to be happy during the journey? I'm following about the same path and can't find balance. If ever there were an economic problem in need of solving, it would be the friction between how people spend their time (i.e., slaving
108.
by skyraider 13y ago
I empathize with this a ton. Reminds me of a David Foster Wallace commencement speech in which the takeaway point was something to the effect of 'you graduates don't yet know what day in, day out really means.' ( http://www.youtube.com/watc
109.
by skyraider 13y ago
Well, a CSRF attack doesn't involve reading cookies. I believe you'd need an XSS vulnerability in order to do that. (Or, if the site isn't using SSL, just sniff the network traffic.) CSRF just transmits the legitimate cookies to the server
110.
by skyraider 13y ago
If a CSRF attack is not coming from a browser, how are you going to get the victim's session cookies? If you do get them, it's not called CSRF anymore.
111.
by skyraider 13y ago
That's incorrect in this context, which is trying to get a victim to use their own browser to submit a request that uses cookies on said browser for authentication (CSRF). Please take a look at the following link: "Although it is trivial to
112.
by skyraider 13y ago
Thanks for pointing this out. A lot of people here don't seem to realize that exploiting a CSRF vulnerability involves tricking the victim's browser into doing something. You cannot both a) forge the Referer header and b) trick the victim's
113.
by skyraider 13y ago
Yeah, definitely, it's all an input to the threat analysis. Thanks for the great discussion. It's interesting stuff and fun+important to just think through. Yes, you're right that someone could intercept the HttpOnly cookies, but as you sai
114.
by skyraider 13y ago
It's harder than it sounds, as we use HttpOnly cookies and, much more importantly, have little to no XSS attack surface. As far as injecting JS after server compromise: At that point, an equal concern is really attacker access to applicatio
115.
by skyraider 13y ago
I think you're right - we should include those instructions for now, and provide a bastion-as-a-service later. The daemon route is clearly preferable for customers, so we'll build that out (we already have manual key-adding confirmation, an
116.
by skyraider 13y ago
How is what we're doing less secure than, say, provisioning servers through a provider like Linode that gives customers a web-based access panel? (One can use their provisioning tools to create users with root access.) Also, running a daemo
117.
by skyraider 13y ago
Hi - It's not enough to compromise the Bastio servers. Some of the data facets needed to successfully decrypt the SSH keys are stored securely in the browser. This is why we can't deploy OS users or keys if a Bastio user is not logged in an
118.
by skyraider 13y ago
Thanks, that's a great point that the agent is an easier sell. We're going to add one soon so people won't feel uncomfortable opening up their SSH ports. We've heard this a lot and really appreciate the feedback on this point.
119.
by skyraider 13y ago
You'll have to develop a cryptographic scheme makes sure that when your management service is compromised, it does not affect the servers the management server controls. We've done that work. Say we have a daemon though - the daemon would r
120.
by skyraider 13y ago
We were originally going to create a bastion but got some early feedback that server admins wanted user management, and a bastion as a side feature. We've got two-factor auth right now. Would you use a bastion + user management, or if not,

More ›