HNHacker News
TopNewBestAskShowJobs

cottsak

440 karma · joined January 11, 2009

[ my public key: https://keybase.io/mattkocaj; my proof: https://keybase.io/mattkocaj/sigs/MOxk5grfyH6MofSa_1ji8Pt9_WrzL_CRoGQE2ajolN8 ]
submissionscomments
cottsak··on Apple's T2 chip will prevent hackers from eavesdropping on your microphone
When are we going to get projection against unauthorised USB devices when the workstation is locked (ie, I'm away from my computer and a nefarious actor inserts a USB device) similar to the recent iOS 12 improvements?
cottsak··on Pro-privacy search engine DuckDuckGo hits 30M daily searches, up 50% in a year
As a dev I was pretty anxious about the quality of results from DDG but a couple of months into my experiment I’ve only found myself going back to Google for dev-related searches a handful of times (maybe 2 handfuls).

So I’m now sold on DDG. Yeh sure there are cool little helpers in Google that DDG doesn’t have (yet) but can’t think of any right now that I miss so they can’t be too important.

cottsak··on Well-Architected Monoliths Are Okay
Microservices pundits have strategically (or accidentally) engineered the hate for non-microservice design. They chose the term "monolith" to disparage anything that wasn't SOA. "Monolith" has a natural negative connotation so right there, you're winning at the "tech pissing fest" at the bar after work.

The fact is that "monolith" applications can scale, and they can be deployed as a unit and they can still adjust to varying load using modern cloud infrastructure.

The enemy to scale, productivity and success isn't "monoliths". It's complexity! And an experienced and pragmatic developer will tell you that they fight daily to avoid complexity at every turn. Yes, sometimes it's necessary, but they weigh the pros and cons on a case-by-case basis to ensure that the gradient to complexity is always as low as possible.

cottsak··on Chrome 69: “www.” subdomain missing from URL
Fixed in a week (v69.0.3497.92)! Nice one Chrome
cottsak··on Chrome 69: “www.” subdomain missing from URL
ugh!!!!! this is killing me
cottsak··on Model predicts we're the only advanced civilization in the observable universe
Why do we keep hanging around the Drake Equation then? or: What is a better tool?
cottsak··on Elon Musk emails employees about 'extensive and damaging sabotage' by employee
This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influence.
cottsak··on App Maker, Google’s low-code tool for building business apps, comes out of beta
How will this not become hell on earth for software developers, al-la Microsoft Access, Oracle APEX, etc.. ??
cottsak··on Polly.js – Record, replay, and stub HTTP interactions
I still don't get why we do this [mocking http endpoints].

Sure this makes the problem of mocking the server less painful. Well done. But I'd take completely integrated tests over these any day. Sure they're slower but that's more or less irrelevant with feature toggling, staged roll-out and continuous production monitoring.

It's totally possible to completely avoid mocking http endpoints thus making these tools completely obsolete.

cottsak··on Wireless laser power transmission using a gain medium between retroreflectors
I'm more confident now that it's probably very dangerous and may not get the FDA approval. If they do it will be trickle charging. https://www.youtube.com/watch?v=2bXjn3wwM8o
cottsak··on Wireless laser power transmission using a gain medium between retroreflectors
I bet you the lasers in these transmitting devices will not be gas but small solid state units. As this becomes more popular, like surface-mount camera dies, these SMD IR laser diodes will become smaller and smaller.
cottsak··on Wireless laser power transmission using a gain medium between retroreflectors
Read the patent or watch the video https://www.youtube.com/watch?v=YeNXRD8eziA&t=0s

In simple terms, the laser transmitter, the laser receiver and the beam that is used introduces a feedback mechanism that the transmitter can employ to immediately detect an unsafe condition and cut the high power (infra red) laser transmission. The response is so fast that the risks to damaging eyes, etc are acceptably low.

cottsak··on Wireless laser power transmission using a gain medium between retroreflectors
Agreed. This is exactly the implementation described in the patent.
cottsak··on Chip Hall of Fame: Zilog Z80 Microprocessor (2017)
I had a similar high school experience. Not as much asm but spent way too many hours writing basic programs on that thing. prob should have spent more time listening in class.... nar! :-D
cottsak··on Ask HN: [Advice] How to start learning about Computer Science/Engineering?
Watch conference presentations/youtube about cool tech.

Learn (read: Google) about and experiment with what interests you.

Use your network (go to meetups if you don't have one) to find intersection between interesting tech, and roles/opportunities in the marketplace. Then double-down on those (learning, OSS contrib, etc) so you can become more appealing to employers.

cottsak··on Don't use 1Password (2017)
This argument is just degrees of risk. He's much safer using any password manager than not one at all.
cottsak··on Don't use 1Password (2017)
True. But HN does invite this kind of thing..

I didn't finish it either.

AgileBits are trying to change their business/revenue model and that transition is not suiting this user. Shame for AgileBits but you can't please everybody.

One thing I noticed is that he's not happy to have his encrypted password file in the AgileBits cloud. This is the way LastPass works too. I get some folks don't prefer this but I don't see it as a major risk. If you're using any reputable password manager (a set that includes 1Password IMO) then you're 100x safer than the mainstream even using the vendors cloud hosting.

cottsak··on AT&T updates firmware to block access to 1.1.1.1
More solid advice regarding home internet/ISP routers: https://www.tomsguide.com/us/home-router-security,news-19245...

Try to avoid the cheap bundled cable/fibre/DSL routers that ISPs "throw in" with their plans/packages.

Disable the remote management/update/TR-069/CWMP/SSH/etc if you can. You don't wanna trust someone else to secure your home.

cottsak··on AT&T updates firmware to block access to 1.1.1.1
This problem has been around for a while and is pretty serious! https://www.routersecurity.org/ISProuters.php
cottsak··on AT&T updates firmware to block access to 1.1.1.1
How is the ISP performing this remote update? Is it TR-069/CWMP or an open SSH port or something? Many routers will allow the user to disable TR-069 even while it's running. Often a hardware reset will also disable it and then the user can put the manufactures update on it and prevent the ISP from managing it in the future. If it's an open SSH port then we all have bigger problems.
cottsak··on You know how HTTP GET requests are meant to be idempotent?
The intersection of full-stack web devs from the commercial line-of-business world; and hardware/embedded hackers brings a lot of room for accidents IMO. I'm not saying any one of these groups are bad or inept. I'm in the former and completely accept that I'm new to embedded programming. It seems kool and I wanna learn about it. But I can also see the flip side where a hardware hacker sees query strings for toggling an output as a perfectly reasonable interface. Do we expect the embedded guys to grok HTTP/REST? The web-dev would be like "no, no, that has to be POST or PUT". But these things are going to happen. We don't yet have a large pool of experts across both fields.

It's no surprise the level of compromise and breach when you intersect what were pretty distinct skillsets and dump them in the mixing bowl together. That's what this IoT thing is like - it's a bunch of household and industrial chemicals all poured into the one container. It's not going to be very safe.

cottsak··on Tesla explains Model 3 build in response to Munro’s teardown analysis
Great video at the bottom of the article: https://youtu.be/CpCrkO1x-Qo
cottsak··on "@" on Twitter
I love how the routing is all borked and you can't properly interact with that account.
cottsak··on Woman Partially Sucked Out of Jet When Window Breaks
Particularly this image https://youtu.be/4yG2h1aDB6k?t=133 which shows the "person" partially sucked out when the whole window went - eerily similar to the description of the woman in the window seat.
cottsak··on Making the Touch Bar useful by abandoning Apple guidelines
Don't wonder, see for yourself:

https://www.ifixit.com/Teardown/MacBook+Pro+13-Inch+Retina+D...

https://www.ifixit.com/Teardown/MacBook+Pro+13-Inch+Touch+Ba...

Not a lot has changed in the past few years. Macbook Pros are NOT easy to mod/change or swap parts. This is very clearly the intention of Apple.

cottsak··on Making the Touch Bar useful by abandoning Apple guidelines
Me too. Insanely frustrating.
cottsak··on Show HN: URL Canary – Get an alert when someone finds your secrets
Lots of Mac users with out of date OS :S https://uriteller.io/ZBt0gGoUHtIsyQ7KFwikYg
cottsak··on Show HN: URL Canary – Get an alert when someone finds your secrets
But it demonstrates nothing if no one clicks. The channel may be insecure, compromised and no one knows - not the author or the parties who are supposed to have the secrets.

I see what he's trying to do, but this isn't the way I don't think. Mathematical proofs that verify that a payload is observed, opened, or accessed work. They are deterministic. They are also way more complex. I think this is trying to solve a problem in a simple way but it's still just as nondeterministic as without this solution IMO.

cottsak··on Show HN: URL Canary – Get an alert when someone finds your secrets
How does a potential customer know how effective this is? How do you even know that it's effective for your personal use case as described https://urlcanary.com/about ?

How many attackers are going to click that link or any link for that matter? Seems the value prop of the product is based on the assumption that folks will click. Maybe it's a solid assumption. I just can't see the evidence for it.

cottsak··on Show HN: Real world advice for getting agile working in your dev team (ebook)
Thanks. What in particular did you like?
← PreviousPage 5 of 9Next →