alinajaf

As a new parent this is somewhat terrifying. But good on your daughter for setting the teacher straight!

At the same time, I was lucky enough in my education in the UK to get a steady stream of secular humanists as science teachers. They never directly attacked my religion, but by the end of it I had the skills to tear it to shreds on my own.

Having met the instructors (and some of the students), they're an incredibly bright bunch of people. They would have put a lot of time and effort into arranging this course. This is probably an excellent way to kick-start your programming skills, let alone "legit".

Do note that entry requirements are strict i.e. you need to show some aptitude for programming before they even let you start the course.

I get that all the time. I politely remind them that I made a commitment to report their reply as spam, so it would be unethical of me not to.

Never engage with them directly. They're a time sink, and they never have your interests at heart. I manage all comms with them through gmail canned responses.

Here's mine:

Hi there,

Please remove all data pertaining to myself or Happy Bear Software from your systems and refrain from contacting me again. Any future correspondence including a reply to this email will be reported as spam.

Kind Regards,

Honestly, a developer who's taken a flick through a book about sales and marketing (e.g. Ultimate Sales Machine) would do a fantastically better job of selling recruitment services (at both ends) than 99.99% of recruiters.

I've found that I make a lot of good contacts at my local Ruby user group and through just helping people as much as I can via twitter, mailing lists etc.

One problem I have that's similar to what you're talking about is people either have a huge budget and an endless supply of soul-crushing and pointless work for me to do, or they just can't afford me at my rates.

More recently I'm finding a sort of sweet spot in bootstrapped companies that have some revenue and can afford to bring me in for one or two weeks per month. Those are my ideal clients, as I'm not very good at dealing with government/BigCo.

I love talking about this stuff, so if you want to talk shop more at some point feel free to ping me via email (in profile).

I envy you because you've yet to discover Greg Egan. You'll want Axiomatic, Permutation City and Diaspora, in that order.

I think there's a distinction to be made between a web site and web application developer. One builds posters on the internet and the other builds software that just happens to use HTTP.

I've found the latter to be considerably more lucrative and engaging. The work I've done ranges from language teaching software to automated trading bots for second hand books.

The market for this sort of work is so screamingly hot right now that if I did all the work that my current clients are asking for in series, I'd be booked into early 2015. And that at a daily rate that the me of three years ago would have trouble even asking for at the negotiation table.

> Panic attacks throw about 50 different symptoms (you have to have a few before you see them all) of which any one of them would feel like an acute, life-threatening crisis to a sane person. Almost everyone who has a true panic attack will end up in the ER, the first time. You have to cycle through all of the bizarre symptoms a few times before you realize that the attacks aren't dangerous. Once you've learned this, they're just annoying ("shit, there goes the next 10 minutes") but the first few attacks are devastating because they feel real.

I've never suffered from a panic attack, but my wife does, and regularly. This describes our situation almost exactly. The symptoms are diverse enough to be congruent with everything from acid reflux to a full blown heart attack.

The attacks are milder now primarily because she started timing them and now knows going into one that they'll be over in ten to twenty minutes. Not knowing that leads to the spiral of despair, where you become more and more anxious because you don't know how this panic attack is going to end.

Yep. I'm perpetually waiting for square to get their shit together and just give us what we want: A frame-by-frame remake with PS4 generation graphics.

> For example, do you know what AES-GCM is? Do you know HOW the secure cookie store in Rails works? What algorithm it uses?? Do you know you have to change the secret pretty often??? Do you know how authentication in Rails (Devise) works??? Can you build it from scratch????

If I answered yes to literally all of these questions, am I still allowed to use rails?

> In a little more, I'll show a prototype

Say what you will about HN, but comment threads about seemingly impossible technical challenges that end in this make me immensely happy to be here :D

> But programs in languages which enable, if not encourage, developers to add new methods to the integer '5' can quickly become very difficult to reason about.

Can you give me an example of a single ruby developer who thinks this is a good idea when writing new code/a library?

You do realize that if you have the private key then generating the public key is trivial? As in you can run a single command with OpenSSL that does it?

> AES is a crypto primitive, AES-CTR-CBCMAC (aka, AES-CCM, but spelled out to emphasize the complexity of it) is a scheme.

In this particular example, the 'schemes' you point out didn't fair that well in pretty much every single codebase I've seen them implemented in after I finished set two of the crypto challenges.

> We also tend to recommend that people simply use PGP for data at rest, and TLS for data in motion

When I complain about bad crypto (in API auth in particular) and my clients really really push for me to give them advice, I repeat this line verbatim.

They hate it because TLS with client-side certs for authentication (where you become the CA) is unfamiliar and has too many moving parts for them. They go and develop their hand-rolled API auth, I proceed to shoot holes in it and come across as a bit of dick (to be fair, I'm not hired as a security consultant, just a regular developer).

I can normally get a few developers on board, but have yet to convince a client to use TLS in this way in production.

> another worry is that what is considered secure today might not be secure tomorrow

If history is anything to go by then what is secure today will definitely be insecure tomorrow. No real solution to this AFAIK. If vulnerabilities in the crypto itself doesn't get you eventually, quantum computing will.

The answer is no, but I forget the exact reason why. Will do a little more research and report back.

You are of course correct. Thanks! Will fix and rollout once traffic from HN/reddit dies down.

Author here. A good place to start (mentioned in the article).

http://www.matasano.com/articles/crypto-challenges/

Never met any of them in real life, but they seem like good people to me. I've actually used knowledge I picked up from those exercises to fix vulnerabilities in past clients code, and I'm not yet half-way through them.

> btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack.

Yep, probably. In fact now that I look at it definitely, I should have gone with that instead!

I forget who said this but basically any feature that exists in TLS that doesn't exist in your hand-rolled authentication scheme is a vulnerability.

Hi, author here, I'm glad you found it useful!

> I didnt know for example that you can basically extend an MD5ed string and keep the original MD5 value

Thank tptacek for that knowledge, I think I picked it that up in a talk he did that's somewhere on Vimeo (will link to it).

> Then again, I know that MD5 isn't a secure cryptographic hash function so I wouldn't have used it from the start. Nice to know why thats the case.

Nope! I was going to mention in this in the post but removed it to keep things simple: This particular vulnerability is not due to MD5 collisions or MD5 being cryptographically insecure. It's because of the internal mechanism (a "Merkel Damgard Construction") intrinsic to hash functions like MD5, SHA1, SHA256 and friends. Even if MD5 were cryptographically secure, this vulnerability would still present itself if used in the way I described.

Don't mean to nitpick, but with crypto small misunderstandings lead to big vulnerabilities. Hope that makes sense :)

Hi, author here. I would have liked to have made useful suggestions, but having made so many errors with cryptography in the past, I don't really feel qualified to do so.

I do however recommend getting in touch with tptacek and co and doing the crypto challenges. I mentioned this at the bottom of the post.

Edit: re: timing attacks, it helps if you're in the same data centre. I've never personally implemented a timing attack, so I'm hesitant to make any assertions further than that either way.

It is. Bug them on twitter and they'll invite you to the beta.

> Any time data is sent to your site, check it for injection attacks or password guessing.

That's two classes of exploit out of a very, very long list. The set of things that could possibly be wrong with software that reads HTTP requests out of a tcp socket is legion.

> I didn't get this part though. What would be a better alternative?

To clarify: I'm not saying that static assets behind an edge cache is not performant, just saying that a dynamically generated site behind an edge cache is effectively the same performance wise. It's probably not worth the sacrifice in convenience if performance was your main reason for going the static generated route.

I can't speak to the argument from uptime as I haven't used shared hosting in a while. Using an edge cache (without S3) might give you a little help there, as it only needs to hit your shared hosting on cache expiry, but that obviously won't be as safe as statically generating the files and making CF read them out of S3.

I think S3 behind CF is a perfectly good approach. I was just saying that if you've currently got a dynamically generated site and are considering moving to static generation because of performance alone, the trade-off probably isn't worth the effort.

I wouldn't advise you personally to go back on that decision at all, especially because of the issues you've seen with uptime.

> I think my assumption was S3 did have edge locations

I think you get this from the rest of my comments but just to be clear: I've only ever experienced bad download times from S3 and would not feel comfortable recommending that you use it to serve traffic directly from the internet. It's not what S3 is for and so you shouldn't expect good performance from it in that use case.

I don't think you're an idiot, it's more likely that you were just unaware of cloudfront or perhaps CDNs in general.

S3 is for storing files, Cloudfront is for serving cached versions of them really quickly out of edge locations (i.e. the closest CDN datacentre to the user that requests it).

In your usecase, your best bet is to use them in combination. Set up a Cloudfront distribution to point to your S3 bucket, then setup DNS to point to your Cloudfront distribution.

One big point to note is that you need to either:

* Configure Cloudfront to expire objects after a TTL (time-to-live) that is reasonable to you (e.g. 1 hour, 1 day etc). You can do this from the Cloudfront 'new distribution' wizard.

OR

* Let Cloudfront respect HTTP headers and then make S3 (or whatever your custom origin is) set cache-control headers that make sense for how often you update your site. Not sure if/how you can do this with S3, with a custom origin its your app so you can set whatever http headers you like.

To be clear: if you don't do this, I'm pretty sure cloudfront caches things forever, or at least a very long time.

Personally, I think triggering cache invalidations should only be for emergencies (e.g. someone has uploaded questionable content to serve to other users and it's cached in at and edge). Rather than screwing around with that, save yourself some headaches: pick a sensible TTL and wait a little longer to have things up to date at your edges.

Note that by using Cloudfront in this manner, you get the performance benefit of serving static files. If performance at the expense of convenience was your main reason for going with static site generation, you might want to rethink that decision (there are other perfectly good reasons for wanting to use a static site generator, security being my favourite).

Do feel free to ping me over email if you have any questions on the above.

> This is smart, I usually use the precompile with upload to S3 via asset_sync gem

I used to do the same until cloudfront rolled out custom origins.

> Since Heroku will precompile by default, what do you do to disable it.

I misspoke in my comment, what I meant was you can skip the synch with S3 step. I've never actually bothered to stop heroku precompiling assets (though I may as well). This question on SO looks promising:

http://stackoverflow.com/questions/8953360/preventing-heroku...

If you do that though, as you mentioned, you will definitely need to flip serve_static_assets on.

> I think S3 is a great origin server for static assets

Pro-tip: If you're using Rails, just create a distribution with your app as the origin server and in production.rb, set your asset host to your distributions host. You get the asset cache without having to do the precompile step. Tastes great with Heroku.

> (their average IQ is 100, for God's sake!)

Their average IQ is 100 by definition. If everyone got twice as smart overnight, the average IQ would still be 100.

Very well, you get your wish: A war with North Korea is bad times for pretty much everyone involved. Seoul bombed into the dust, thousands of refugees crossing the Chinese border and a potential for a proxy war between the U.S. and (China/Russia/Iran). Nobody wants this, especially not the North Korean regime. For all their bluster, they are still begging for food from pretty much anyone who will listen to them.

According to experts on the regime, recent threats directed at Seoul and Washington were moves to shore up support from the military faction that was waning after Kim Jong-un came to power and fired a bunch of senior military officials.

Instead of war, you get to watch a country deteriorate into the seventh circle. Humans bred for slavery in concentration camps, people below a certain height relocated to remote islands and left to die and mothers executed in front of their children for being 'enemies of the state'. Does that make you any less scared?