brianmwaters_hn

The problem-solving aspect of climbing (esp. bouldering) is definitely one of the best parts. Very easy to get sucked "into it" once you get started.

Totally anecdotal here, but I would not hesitate to wager that many climbers' grip strengths lie way outside the normal range. The sport has a higher grip exercise-to-cardiovascular exercise ratio (however you might measure that) than probably any other sport that exists today.

"Zero-day protection" is marketing-speak for what security engineers call "exploit mitigations." Of course they don't prevent exploits; they mitigate them. Pretty typical that the marketing term is an exaggeration of the more accurate engineering one.

Nick, (this is a reply to your post at the same nesting depth, as we're at the max here)

We're pretty much on the same page on this whole thread, but consider the idea that perhaps the fact that it took so many years and thousands of papers wasn't because the previous generation didn't organize them well, but was simply due the the sheer volume of information. That time wasn't wasted sifting through irrelevant stuff - you're now an expert.

On the contrary, I think the writers and organizers of all that material did a great job; both of us owe nearly everything we know to them.

So he's a "crotchety old guy" with an analogy relevant to just "one failed subject." You have absolutely no respect for your elders, do you?

Also, the second sentence of your second paragraph makes no sense to me.

Hm, I agree that there's a lot scattered out there, but I hope that there's some room for exploration (and maybe specialization) somewhere in the noise.

I actually have an interesting perspective on this, being completely self-taught, before returning to university as an adult to get a computer science degree.

There are pros and cons to both sides of the self-taught vs. teacher-taught thing, though I'll make my bias clear up front: I spent a lot of years reading books and messing around with stuff; now, when I hear college students complain that a teacher "isn't a clear lecturer" or "didn't answer my question well," my tendency is to say "there's a book and an Internet out there, suck it up and get to studying, buddy," though I realize that attitude isn't perfect for everyone.

Totally agree with everything you're saying, but I would point out the the article is not about addressing a lay audience, it's about addressing network engineers who are supposedly lacking some historical/technical knowledge of their own field of work.

This is an attitude I see more and more of today, and I think it's unfortunate. The slides in question aren't "a pile of acronym data;" they're made of lingo that would be recognizable to anyone who works in the field of networking - even if they don't understand the specifics of the protocols in question.

At any rate, the author's complaint isn't that "kids these days" haven't heard of all these acronyms, it's that they haven't learned any of the technical details behind those acronyms, and that those details are still relevant.

Finally, I have a bone to pick with the "it's the older generations' responsibility to educate the younger generation" idea that I hear so often. At the end of the day, it's everyone's own responsibility to educate themselves, and we all know there's plenty of materials available for that.

For UT, the surface needs to be directly contacted with an instrument; but that's not all.

First, insulation must be cut off and disposed of (properly). It's usually tin flashing covering some kind of insulating material. If the insulation is asbestos, then it's not acceptable to have any of it blow off into the wind at all.

Next, the surface has to be polished, usually with a rasp or grinder, so that the probe has clean metal to make contact with.

Then, the probe, coated in ultrasonic-conducting jelly, gets applied to the surface, and must maintain sufficient contact for as long as it takes for the instrument to get a reading (at least a few seconds, and it's not always reliable). This step has been done in the past with robots, albeit in different access environments.

Finally, the insulation gets re-applied, covered in tin flashing, and sealed with caulk.

I'm not saying it's not possible in principle for a flying robot to carry out steps one, two, and four, but I can't forsee a technology able to do this within, say, the next ten years.

As for RT, you have to understand that a lot of refinery inspections are done in what's called turnarounds - where the refinery is turned completely off for a week or two at a time. Tons of contractors are called in to work overtime on top of one another in order to carry out planned maintenance and get the thing back online ASAP (time is money - big money). Obviously, extreme care is taken when doing RT in this kind of environment, because a mistake can be extremely dangerous.

It simply isn't safe, in any universe, with any technology, to put a radiographic source (actual radioactive elements) on a flying object and zip it around in the middle of a refinery turnaround. Period. Maybe during normal operations, but only at the cost of extreme interruption of everybody's work - eg, everybody literally has to exit the entire facility.

EDIT: on second thought, having everyone leave the refinery isn't even possible without turning the thing off. There are operators who need to be on-site at all times, monitoring and making adjustments to the various processes. And sometimes a valve really does need to be turned by hand ;)

That is so cool. We're used to thinking of programming as a sort-of abstract job that is that takes a long time to do and gets deployed to everyone. It's really cool to hear about a programmer being able to make an on-the-spot operational impact on a real work site.

Also, I wonder how the hell the thing survived?

Okay, I used to actually do inspections on oil refineries and wind turbines using rope access techniques, so I think this is a good one for me to chime in on.

In rope access, we like to pride ourselves on being the technology that can get the job done faster, safer, and more flexibly than older methods (say, scaffolding or boom lifts). I kind of see drones as having the same advantages, but squared - kind of like LED light bulbs compared to CFL's, compared to incandescent.

However, this Bloomberg article doesn't mention any of the downsides of drone inspection. Last time I checked (and I've been out of the industry for about a year), there were concerns over the quality of the photos taken by drone teams, although there is room for the technology and the skills get better there fast. The real caveat here, though, is the limited usefulness of visual inspection in an oil and gas environment. Most of the work done on-rope is UT (ultrasonic testing), which requires hands-on contact with the structure, and RT (radiographic testing), which involves lethal doses of radiation aimed in specific directions. Obviously, this would be wildly dangerous from an aircraft, and will probably never happen regardless of technology.

So I see a place for drones today in visual inspection of equipment while it's online, but I can't imagine a near-term drone-based technology that would be able to carry out UT. So us rope guys will be in business for a while longer.

It's called an "autoblock" by climbers today in the US: https://en.wikipedia.org/wiki/Autoblock

Yes. Among them, Vim, Bash, and OpenBSD, the latter of which supposedly has a very good reputation on security.

For the record, GNU's Not Unix.

I think this is kind of antithetical to the Unix philosophy.

If you add special exceptions for things like "rm -rf /" then you start to wonder, why not add exceptions for other dangerous things, like "find / -delete" and "rm -rf /usr".

In general, most of the basic Unix tools operate off of relatively simple first principles and don't contain exceptions for things like this.

Except by default, bash from the Ports tree gets but into /usr/local/bin/bash. An easy fix for users, but a better hashbang would be #!/usr/bin/env bash

Well, yeah, you can just pony up the cash and take the class. Your experience would be something like this: https://www.youtube.com/watch?v=xUDob3m6rds - it's really technical, and really challenging. If you have the cash to waste, and a week, it could be fun.

Watch out! That technique is really sketchy, and won't work if the rope goes over an edge (like the edge of the building). You also have the problem of a falling metal object that can smash windows, your head, or itself.

That, or rappelled on one strand and used a classic pull-through anchor: https://www.youtube.com/watch?v=SSGUPd6RKAM

There are a lot of companies that claim to do industrial rope access outside the scope of the certification programs, but be skeptical of them at first. (That doesn't include companies in other rope disciplines that are different from rope access, like tree climbing and entertainment rigging. Those are different trades. RA takes most of its methods from caving, and some from rock climbing.) If you want to learn to do it right and have a good experience on the job, "go legit." But that means you'll have to get certified. Unless you have specific, in-demand skills (electrician, fiberglass technician, weld inspector), few companies will pay for your first course - you'll just have to pony up $1000+ on your own. However, once you get a job, they'll pay for your re-certifications, as well as follow-up courses that you take as you get more experience and climb up through the certification ranks.

Shameless plug for Randy Rackliff's packs out of North Conway, NH (the company is called Cold Cold World: http://www.coldcoldworldpacks.com/). They are hand-built, to custom order, in New Hampshire, weigh less than name brand packs, are made of tougher material, AND will only run you about $125.

What's the secret? Simple construction, no bells and whistles and unnecessary crap like water"proof"ing. Tougher, cheaper, lighter. Not made in China by a giant corporation. The ultimate hacker pack!

I just got done with a three year "mini career" in industrial rope access, where I got to work on-rope on wind turbine blades, in oil refineries, on the sides of high-rise buildings, and even one job up in the rafters above a professional football (American football) stadium. I'm now working towards a first job in IT or app dev, so this article is right up my alley. Nice work ;)

If you're interested in a job working on-rope, and, uh, learning the ropes, I suggest you take a look at rope access. It's a small niche industry, but pay is very good, technicians are treated well, and many companies offer an "alternative" work schedule/lifestyle where weeks of travel work are interspersed with weeks of total off-time - and good technicians can sometimes choose how much they want to work (or not work).

If anyone's interested, run a Google search for SPRAT and IRATA (those are our professional certifying bodies), and look on those sites for companies in your country. You'll have to take a week-long course (it's hard) and pass an exam before you're allowed on a job site, but if you have the stuff you'll pass, and most companies are hiring.

Also, this article goes over "parallel construction" quite a lot. Although we've heard about it a lot in the past year, this leak shows how and what kind of data NSA is sharing with DEA, FBI, etc.

It's even more important for us to know what kinds of data about us domestic law enforcement has access to, than it is to know what foreign intelligence has access to.

In Burlington (the smallest biggest city in any state), our local elections are between Democrats and Progressives. Republicans don't even make the ballot.

I can't believe noone has mentioned NRO and NGA:

https://en.wikipedia.org/wiki/National_Reconnaissance_Office

https://en.wikipedia.org/wiki/National_Geospatial-Intelligen...

Relatively less is known about them, since CIA and NSA get all the attention lately (to their detriment), but as far as we can tell (from Snowden docs), NRO has about equal budget to NSA, and NGA has about half (and CIA has 1.5 times NSA's):

http://www.washingtonpost.com/world/national-security/black-...

Considering the incredible things NSA has been able to do with its $10B/yr, a combined NRO+NGA budget of $15B/yr sure raises a lot of questions. Presumably, they do a lot of work similar to the OP's - but noone really know what the capabilities are.

I think they're speaking more about the much less exciting form of network everyday network monitoring that goes on inside the enterprise - troubleshooting, performance tuning, etc. But you've got an interesting, if not a bit cynical, interpretation there.

Well, it does say that a fog machine is used, so it looks like there aren't "real" clouds; at least not in the sense that they're overwhelmingly water vapor.

Still cool though.

This is a huge problem that's akin to "replacing HTML/JS." It's a non backward-compatible change that make the plugin nearly 100% useless for current PGP users. Obviously folks can generate new EC keys, but they will be reluctant to abandon keys they've had for years that contain valuable third-party signatures. I think this will be a huge hindrance to adoption, and it would be imperative for the community to implement RSA, even if it's only for key import and interop, not generation.

I think you're both right. There are side channel attacks against remote hosts (timing-based padding oracle attacks agains TLS come to mind). But for the case of PGP, which is mostly for encryption at-rest, attacks like this don't seem as relevant. I say seem as relevant, because crypto attacks can be surprising :)

Another one: you guys are using a DV certificate, which is really less than ideal for an app like this, that needs to be trusted by its users.