anonymous246

So you don't understand why one should separate the discussion of LEGAL temporary/permanent immigration from ILLEGAL immigration? You are proving Bloomberg's point about the urgent need to separate the two.

Good point. I had forgotten about the PIN. But that's simply yet another password that amenable to guessing/bruteforcing/keylogging etc. The securid is not vulnerable to such attacks which why is why this crack is a big deal.

Here's my hypothesis for why they need to replace all devices.

The securid tokens are basically sealed, tamper-proof etc hardware pseudorandom generators. RSA knows the seed burned into the PRNG for every device they manufacture.

At customer premises, there's a RSA server component that simulates the same algorithm as the securid devices owned by that customer. This is how they verify that the number you enter is what it's supposed to be, hence proving that you possess the securid. To do this, the customer server needs to know the seeds of all of that customer's devices. This is a trivial computational burden btw, since securid generates a new number only once a minute.

I strongly suspect that RSA continued to store the seeds for their customer's tokens after selling them on an internet-connected computer on their premises. Somebody cracked into this database and stole the seeds for all RSA devices in use by all of RSA's customers.

Once the crackers have this information, they can predict the sequence of numbers for any device out there.

The only fix is to change the seeds: since the hardware is sealed, the only way to do so is to replace the tokens.

I think it's ULTRASTUPID of RSA to (1) keep the seeds after selling a device, (2) keep it on a internet-connected computer.

THIS IS A BIG DEAL, imho.

Interesting middle ground between Swig+(C++)+$scripting_language and pure C++.

A key weakness I see here is the lack of a standard library for Chaiscript.

If I choose to use my preferred approach of Swig+(C++)+Tcl, I get a command line REPL shell and Tcl's excellent file I/O stuff, regex, string functions etc for free (the Tcl pieces I mentioned are never the efficiency bottlenecks in the sort of compute-intensive programs I write).

I don't see enough here to convince me that it's better than pure C++ or swig+scripting language.

You're mostly correct, but the code they wrote DID use fancy abstractions like hash tables, templates etc. C++ delivered on abstraction WITHOUT a performance penalty, which is what the C++ designers have claimed it could do since forever. Nice to see it verified again. I have no doubt that the C++0x syntactic sugar enhancements would have have also delivered the same high performance.

I love bitcoin stories. I've learned a lot about economics, crypto, and social interactions through the stories. No, I'm not being sarcastic, I'm sincere. One of the most useful things about which HN has alerted me.

Keep them coming. I would rather read that than that Pandora/Groupon filed for an IPO, the latest marketing driven from Joel/Atwood/37 Signals, or Techcrunch's reblogging of WSJ/AP/Reuters.

You comment puzzles me. Hopefully you will reply below.

Are you discounting the value of reversible birth control based upon your feelings at a certain point in time? Also remember that evolution has probably programmed children be "amazing" until they can fend for themselves.

Presumably you're comfortably middle-class in a first-world country with a good social contract (yes, kid-friendly services like subsidized/free public schools and universities are a safety net). You need to step back and think about societies which don't have such luxuries.

And sorry to get all personal on you, but do you use ANY scientific form of birth control? Are you ok with you/your SO getting pregnant every year (unsure about your gender, hence hedging)? That's usually what happens w/o birth control. If you do use scientific birth control (so-called "rhythm" method etc don't count) then your comment is pretty hypocritical.

Sounds completely useless to me unless we up with a way to obsolete the "real" wallet (which I need to keep my driver's license). I'd much rather carry the programmable credit card that was posted here a while back. http://techland.time.com/2010/09/14/programmable-credit-card...

Maybe women might be a good target market at first. It doesn't seem like all women's clothes have pockets.

Ok, I'll bite. Why did you bin the recommendation to use a password generator along with other "baloney" using the adjective "dismissive"? I guess it was directed at my comment about PwdHash. That seems like the only thing that would protect somebody in case Newegg's password database was cracked.

Ok, I see how my comment could have been misread. Here's my clarification:

You need take a step back and think about why it is bad that your password is stored in cleartext: if there is a security breach at site X, your login credentials can be tried on many other sites. Since people tend to use the same login/password combo everywhere, your exposure is likely much larger than your info stored at site X.

Which is why vandals/criminals covet password databases.

You seem to be under the misapprehension that the risk is that somebody will search through your email archives (or while it is in transit) and sniff passwords. IMHO, that's a trivial risk.

A tool like Pwdhash will ABSOLUTELY protect you against the "en masse password theft at website" sort of attack, which is the more serious threat.

Don't see a mention of Pwdhash in the comments. That Firfox/Chrome extension would have protected you. https://www.pwdhash.com/

Umm, I think you misunderstood his point. I guess he was trying to make the point that a 110k salary will barely (if at all) cover the sorts of expenses he described.

Which is actually true, unless you go through contortions like interpreting "foreign vacation" to mean shacking with friends in a different country. Btw, AFAIK, new condos do cost more than older ones.

Yes, we were talking about different things.

I wonder if the AWS-Oracle license prohibits this.

Why should it be any different? Applying patches is likely the same effort for Oracle as for MySQL. If they hadn't done this, some startup would have tried to feed off the arbitrage.

I wonder how their checks compare to Coverity's and QAC++'s.

I have a passing acquaintance with both, and I'm almost certain both would have caught the three bugs listed on that page.

It's not any one thing, but it's a lot of small things. When I last looked a couple of years ago, vertical split wasn't in screen mainline and so it was non-starter for me. Check out the list of tmux commands: it's a very powerful program that's continuously being enhanced.

Dunno if screen has this, but in tmux IIRC, you can have two different tmux servers running in totally different processes, and transfer a window from one server to another. That's pretty cool, imho. The graphical equivalent would be running two VNC servers, and moving an xterm window from one to the other.

Another cool thing: pipe the entire contents of a window in realtime to an arbitrary program.

Who else thought the "designed in SF, CA" slogan at the end was a pathetic echo of Apple's "designed in CA"?

This is a super-unclean API, but that's just IMHO.

We'll just have to agree to disagree that what you've shown above is an acceptable API for a vector module.

So you have a memcpy() call in vector_push? I wonder if that's less efficient than a straight-up assignment for small objects such as integers. The C++ equivalent can be further optimized during instruction generation by keeping things in the CPU registers as long as possible. In your C case, the int has to be written to memory before memcpy can load it into its buffer.

I don't think it's because the Boost guys thought it "too hard". Having seen/used some of those libraries, I'm 100% sure they can handle the alleged "hardness".

C++ in general values performance over safety almost everywhere (just like C). That's probably why they made certain parts exception-unsafe.

Yes, several people have already piled on. But if the compiler didn't say "Equal", then I would be claim it's confusing/inconsistent.

Are you saying that the funtion YOU wrote to convert C/D to a bool shouldn't be invoked when YOU are using C/D as booleans?

It would help with dup detection if Google had a "push" mechanism for websites to upload their content to Google.

Umm, wasn't Google supposed to "Don't be evil" and care about their search result quality about all else? I find your defense of and apathy to hypocrisy disturbing.

And oh, your post pushed a hot button of mine: comments by people who think they're being incredibly insightful by saying "the world is not fair" in different ways. On HN, I think we can assume that people are adults and understand such things. Sorry about the flame.

wrt "honest, legit reasons" as opposed to selfish ones: the deal was scuttled by a person partly in charge of Google VOICE, which would have surely gotten killed if Google had bought Skype. Looks pretty selfish to me.

This is a very revealing article. Google is more dysfunctional than I thought.

These guys only DELIVER pre-packed lunch boxes. Somebody in the lunch-eaters' HOUSE makes the food and it's picked up from there and delivered to the lunch-eater. This is not a catering service (hence the part of of your comment about procuring food doesn't apply).

Umm, I fail to see the relevance of your response to the comment you're responding to.

> Personally, I'm looking forward to moving to India.

Keep us posted on how it goes. Good luck! (not being sarcastic).

I downvoted you for not explaining better what you mean by spend more time looking for stuff. Are you a subscriber?

If you type in a movie/show's name, it shows up if it's available. And usually they show a list of similar shows/movies. And to save time, they even show a mini-synopsis when you just hover over any title (no click; no new page).

I've found some real gems by clicking around and hovering.

Btw, it's possible to rate a movie without having watched it (at least on my Roku). So you could go ahead and rate some of your fave movies and see what else they recommend.

And here's my chance to plug the BEST wildlife documentary I've ever watched (recommended by Netflix): http://movies.netflix.com/Movie/National-Geographic-Eternal-...

My uneducated two cents:

1) The USA's economy is "financialized" to a much greater extent than Europe's.

2) Lots of "phantom" GDP in USA which makes US "productivity" and per-capita GDP look higher than corresponding Europe figures (it's not an "apples to apples comparison"), thereby hiding US economy's weaknesses (e.g., high college tuition costs, health insurance costs, high healthcare costs (paid out by insurance companies to hospitals), doctor liability insurance etc all inflate the GDP but the corresponding figures for Europe are smaller).