HNHacker News
TopNewBestAskShowJobs

bbatsell

5,423 karma · joined February 2, 2010

Hi, I'm Brock, a hacker/developer/sysadmin/photographer in Austin. Would love to chat about infosec, machine learning, public policy, food, beer, or pretty much anything else.

hn@brockbatsell.com || https://brockbatsell.com

-

[ my public key: https://keybase.io/bbatsell; my proof: https://keybase.io/bbatsell/sigs/_HwLLWndCOi_jNgT2aIWlLQ0M3G2wy610Syr0v8ppNo ]

submissionscomments
bbatsell··on Google Cloud SQL for Postgres
That is pricing for 1st Generation, which is a whole different product that does not support Postgres. The pricing for Postgres is here: https://cloud.google.com/sql/docs/postgres/pricing#pg-pricin...

    (1*0.0413+2*0.0070)*730 + 5*0.17 = $41.22/month
      1 vCPU   2GB RAM        5GB SSD
bbatsell··on The power of role models
I think it might be valuable to reflect on why your immediate reaction to "push them into positions of influence" is to think that women are unqualified to be there and they must be receiving "special advantage" if they are.
bbatsell··on A Lawsuit Against Uber Highlights the Rush to Conquer Driverless Cars
The headline really undersells the story.

The New York Times has internal Uber documents, confirmed by multiple Uber employees, showing that Uber lied to the public and to regulators by falsely claiming that a self-driving Volvo running a red light on the first day of its operation in San Francisco was caused by human error.

bbatsell··on How I got my attention back
Lynching is named after the brother of the man for whom Lynchburg is named.
bbatsell··on Statistician calls for audit to address election hacking fears
A completely independent group, led by Alex Halderman (who is 100% legit), has come to the same conclusion and is quietly demanding that voting machines in certain suspicious states be forensically audited:

http://nymag.com/daily/intelligencer/2016/11/activists-urge-...

bbatsell··on How an accused drug dealer revealed Jacksonville's facial recognition network
George W. Bush was president during her entire Senate career (save one day, technically). When Obama was elected, she became Secretary of State.
bbatsell··on Facebook deletes Norway PM's post as 'napalm girl' row escalates
(Kinda gross Hannibal spoilers below)

There's an episode where a man's skin is flayed off his back and turned into metaphorical wings, which are then used to hang him from the ceiling.

In depicting this from behind, you could originally see the man's buttocks. NBC censors objected, so the "fix" was to digitally add a massive amount of dripping blood to cover them up.

The absurdity of that has always stuck with me.

bbatsell··on Hosting My Static Site
You are confusing Cloudfront and Cloudflare.
bbatsell··on SpaceX's Dragon cargo ship splashes down in Pacific
Soyuz returns three human beings in circumstances that could generously be called "very cramped". It carries no cargo.

The Russian cargo vehicle is named Progress, and it does not survive re-entry.

bbatsell··on Washington Should Prepare for Saudi Arabia's Collapse
To be clear, the wingbox is, by far, the strongest part of a plane, but it's the most devastating if you can compromise it. (And its primary design goal isn't to account for explosive loads coming from the fuse.)
bbatsell··on Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone
> I'm NOT for backdoors

I think you've just learned that you are, in fact, for backdoors. A backdoor doesn't become any less of a backdoor when it's only used against bad people.

bbatsell··on Let Snowden Come Home
> I'm not a lawyer, but if he wants to argue that he's innocent or that the law is unconstitutional, it seems like the courtroom is the right place to make that argument.

You should know that he would be legally barred from doing so under an Espionage Act prosecution.

https://freedom.press/blog/2013/12/if-snowden-returned-us-tr...

https://freedom.press/blog/2014/01/sen-schumer-wrong-snowden...

bbatsell··on White House Sides with Oracle, Tells Supreme Court APIs Are Copyrightable
The current holding comes from the Federal Circuit Court of Appeals and is in Oracle's favor. Unlike other regional Courts of Appeal, the Fed Circuit's decisions are binding nationwide because the court has subject-matter jurisdiction rather than geographic jurisdiction. The Solicitor General's amicus is in full support of the Fed Circuit's decision, and the Supreme Court has historically taken an SG amicus hugely into account when the SG is not a party to the case. Should they choose to do so here, they will not grant cert, let the decision stand, and it will be binding nationwide due to stare decisis.

So, while your statement is true, the situation is more dire than you suggest.

bbatsell··on SpaceX Plans to Land Next Falcon 9 on Solid Ground
Return to Launch Site (RTLS) has been the goal from day one. Yes, it's expensive in terms of payload (about 30%), but SpaceX thinks it's worth it. The cost to fill all tanks is ~$200,000, which pales in comparison to everything else. They will land every rocket they can (determined by how much ΔV the payload requires). I'm quite sure that reusable Falcon Heavy launches will be cheaper than expendable Falcon 9 launches, which incentivizes customers with payloads on the margin to choose the Heavy, which allows SpaceX to return at least 2 cores to the launch site.

(Neat little aside: launches from Florida and Texas can also take slight advantage of the earth rotating beneath the rocket in the direction they want it to.)

bbatsell··on GitHub hit by DDoS attack
Mozilla actually has done this (sort of), once. They restricted French agency ANSSI's root CA to only be valid for TLDs ending in .fr, .gp, .gf, .mq, .re, .yt, .pm, .bl, .mf, .wf, .pf, .nc, .tf.

https://wiki.mozilla.org/CA:IncludedCAs

bbatsell··on TurboTax halts all state e-filing amid data breach probe
Wow. According to several posters in that thread, Intuit was allowing guest users to pull up data from prior years' tax returns (and subsequently file this year with correct data) by providing only an SSN and not any other form of authentication. If true, that's basically a criminal level of negligence.
bbatsell··on Federal law enforcement documents about Aaron Swartz, released under FOIA
They'll receive a Glomar response.

https://en.wikipedia.org/wiki/Glomar_response

bbatsell··on iOS 8 randomises the MAC address while scanning for WiFi networks
I feel like this comment might give a mistaken impression, so I'd like to clarify.

Simply rolling out iBeacons does not replicate the copious data that one can currently get by monitoring WiFi probe requests. iBeacons, as designed, broadcast packets at a set rate using Bluetooth LE, and devices scan for those broadcasts. There is no two-way communication, and no probe requests from client devices.

In order for a company to use information from an iBeacon installation, they must have software running on the client scanning for unique iBeacon UUIDs, optionally filtered by "major" and "minor" uint16s to represent separate locations and nodes. Apple limits iOS apps to scanning for 20 UUIDs at any given time.

If the user does not have software that in some way scans for and does something with data from a particular iBeacon UUID, then the implementer gets no information. Thus, iBeacons move control over location and identity data from third parties to users. If a user installs, say, a Target iOS app, it can now scan for an iBeacon UUID that Target generates and can roll out across the country. Only once the user has made that affirmative choice can Target acquire information about that user or device.

bbatsell··on Can I drop a pacemaker 0day?
Michael Hastings and Barnaby Jack were not the same person. They weren't in the same industry; they weren't even from the same hemisphere. To my knowledge, there were zero connections between the two.

The death of Barnaby Jack (who was to present at Defcon) was tragic, but not suspicious.

bbatsell··on LastPass Now Checks If Your Sites Are Affected by Heartbleed
You might consider reaching out to the people behind the Perspectives Project. They run 10 public notary servers [0], and chances are good that they have fingerprints for most of the widely-trafficked websites.

For example, here's the Perspectives report on lastpass.com showing the brand-new key as well as the old ones: http://i.imgur.com/hJkFTAy.png

[0]: http://perspectives-project.org/notary-servers/

bbatsell··on Spiped – symmetric, encrypted, authenticated pipes between sockets
FYI, I just submitted a pull request fixing this in homebrew. They're usually pretty good about merging PRs fast, but if you'd like your manpage right now, you can run:

  brew install https://raw.githubusercontent.com/bbatsell/homebrew/spiped-1.3.1-fixmanpage/Library/Formula/spiped.rb
Edit: 1 hour later, it's already been merged.

  brew update;brew reinstall spiped
bbatsell··on The right way to ask users for iOS permissions
Yes, they do. Many apps use them (including the one in the linked article, which shows customized usage descriptions in their screenshots). The documentation I linked applies to both Cocoa and Cocoa Touch, and you can see whether OS X or iOS or both supports each key based on the Platform column on the right.
bbatsell··on The right way to ask users for iOS permissions
> Apple should really let the developer put some information like that on their permission dialog.

They do :)

See all of the NS.*UsageDescription keys listed here:

https://developer.apple.com/library/mac/documentation/genera...

bbatsell··on New partition function record: p(10^20) computed
MathJax:

http://www.mathjax.org/

bbatsell··on One of the Most Alarming Internet Proposals I've Seen
It's part of GigaPower (their 300Mbps, soon-to-be 1Gbps FTTH service they rolled out quickly after the Google Fiber announcement). AT&T does a good job of obscuring it on their website[0], but if you click "See offer details", you'll find that the $70/month price is a "special" that requires you opting in to "AT&T Internet Preferences", which is their euphemism for DPI. It's not explained there, but if you opt out, you lose the "special" and your price goes to $99/month.

From just a random googling, here's the first news article I found detailing the plan.[1] (See the last three paragraphs.)

[0]: http://att.com/gigapower

[1]: http://news.cnet.com/8301-1035_3-57615246-94/at-t-delivers-g...

bbatsell··on One of the Most Alarming Internet Proposals I've Seen
Thanks for this correction; I was under the impression that opportunistic encryption had already been chosen based on HTTP/2 descending from SPDY, but I clearly am not following the WG all that closely.

Is a fair reading of your blog post that it has a high likelihood of succeeding?

bbatsell··on One of the Most Alarming Internet Proposals I've Seen
HTTP/2 changes the meaning of the http:// scheme. All connections will now be TLS-encrypted. (Edit: Maybe not. See hobohacker below.) http:// means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be checked out-of-band).

The purpose is to provide confidentiality to the vast majority of traffic, even if the authentication part of the CIA triangle isn't achieved. This proposal's purpose is to undo that and expose all traffic using the http:// scheme to your ISP, exactly as it is today. (I would also note that this draft is proposed by AT&T, which is now rolling out new plans in Austin that charge an extra $30/month if you do NOT agree to them inspecting and data-mining all of your internet activity and selling it to advertisers.)

bbatsell··on Trevor Perrin requests removal of NSA from IETF Crypto Review
He's saying that Gilmore was attributing to malice what Thomas believes more likely to be due to incompetence. He's not asserting that Gilmore is incompetent.
bbatsell··on 'How Much Will Obamacare Cost Me?' Try Our Calculator
> Also, even if you apply for the subsidy, you'll be paying full price for an expensive plan in the meantime.

This isn't true. The subsidy is estimated and applied when you sign up for a plan, and your premiums are adjusted to account for the estimated subsidy:

https://www.healthcare.gov/will-i-qualify-to-save-on-monthly...

bbatsell··on Voyager 1 has been traveling for about a year through plasma between stars
Yes, NASA released research and related press releases in the past corresponding to new, unexpected data from Voyager that led to "[discovery of] a new region of the heliosphere that we had not realized was there" as well as "[leaving] researchers without a working model for the outer Solar System." [0]

Heaven forbid NASA do something as inconvenient as sending out a press release about its copious new discoveries in our solar system.

[0]: https://en.wikipedia.org/wiki/Voyager_1#Heliopause

← PreviousPage 4 of 10Next →