HNHacker News
TopNewBestAskShowJobs

joegosse

91 karma · joined January 9, 2015

[ my public key: https://keybase.io/joegosse; my proof: https://keybase.io/joegosse/sigs/5EYaoMxt4S28ajz0kLt0hKjfZeat5C_v2hi95Zpgp8s ]
submissionscomments
joegosse··on Equifax Breach Fallout: Your Salary History
Under FCRA, your employer or potential employer must get permission from you before performing any credit report (which includes a salary report).

>You must give your consent for reports to be provided to employers. A consumer reporting agency may not give out information about you to your employer, or a potential employer, without your written consent given to the employer. Written consent generally is not required in the trucking industry. For more information, go to www.ftc.gov/credit.

https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-r...

joegosse··on Keybase's mission is to make encryption mainstream
They also support paper keys, which you could think of as equivalent to your mind (i.e. memorize the key)
joegosse··on Juicero Is Shutting Down
One of the VC-funded businesses we all knew would fail has finally failed, is this an early indicator of a market correction?
joegosse··on Studying how Firefox can collect additional data in a privacy-preserving way
>Within the new European GDPR framework, IP addresses are to be considered as personally identifiable information,...

My understanding is that many of these details are yet to be settled with GDPR. The case referenced above was not interpreted under GDPR, which has yet to take effect. The definitions of personally identifiable data data rather vague, and precedent has not been set. A quick search showed conflicting opinions, but one perspective to consider is quoted below:

> In addition, businesses should note that Recital 26 to the recently adopted EU General Data Protection Regulation ("GDPR") states that the test for whether a person is "identifiable" (considered in detail above) depends upon "all the means reasonably likely to be used" to identify that person. The CJEU in Breyer did not directly consider the issue of likelihood of identification. If the BRD was not reasonably likely attempt to identify Mr Breyer from his IP address, this could potentially give rise to a different analysis under the GDPR. Consequently, it may be necessary for the CJEU to revisit this issue after enforcement of the GDPR begins on 25 May 2018.

This is a few years old, so if you know of some new decision or regulation that clarifies it would be great to know!

https://www.whitecase.com/publications/alert/court-confirms-...

joegosse··on Australian PM Calls for End-To-End Encryption Ban
How do we start the process of getting an amendment protecting encryption added to the Constitution?
joegosse··on Google is releasing 20M bacteria-infected mosquitoes in Fresno
While unlikely a factor in this case, I wouldn't be so quick to trust National Geographic as it is a for-profit company owned by 21st Century Fox (of Fox News fame). Its credibility shouldn't be categorized on equal footing as Nature.

https://www.theverge.com/2015/9/9/9296815/national-geographi...

joegosse··on Ask HN: What feature would you want the web to “force” next, after HTTPS?
I love the idea of zero-knowledge password proofs. Others can chime in on the approach you've proposed, but I have a more practical concern about developing critical mass.

How do you break through the chicken and egg problem of not enough users using or not enough browsers supporting this capability?

joegosse··on Ask HN: What was impossible earlier that is easy in the BTC and ETH blockchains?
Maybe to be more precise "anonymous cash replacement" is better?

Electronic "money" in general has long been available through credit cards, PayPal, etc but at higher cost and loss of anonymity

joegosse··on Ask HN: What was impossible earlier that is easy in the BTC and ETH blockchains?
This is a good list of inputs, though I think immutable public timestamps is the only one that was impossible pre-blockchain, and it's not clear what the value of this is.

I'd argue that the rest of them were not impossible before blockchain. From my perspective blockchain just makes these easier/cheaper.

joegosse··on Shared thoughts after 6 years in Pentesting
>I've also never had a full-time job as I jumped straight from my BS to a PhD.

Not having any work experience means you'll go through "University Recruiting" (vs experienced hire) recruiting channels at any large company. This gives you tremendous freedom to explore a variety of careers as employers will only be able to judge you by your academic credentials and you won't be pigeon-holed by your professional experience. Use this to your advantage and explore as many careers & companies as possible.

Your internship will be your first professional anchor point so choose wisely - you may consider starting with a broader, more general software engineering experience before specializing to keep your options open.

joegosse··on No correlation between headphone frequency response and retail price
I've been happy wearing safety glasses with tint. Unlike fashion glasses, safety glasses must adhere to ANSI z87.1 standards that test things like impact and UV protection.

Safety Works (used to be MSA) on Amazon are my go-to.

http://blog.safetyglassesusa.com/what-does-ansi-z87-1-2010-c...

joegosse··on Is the keyboard faster than the mouse?
Learning keyboard shortcuts in Excel yields massive returns on productivity. For an intro, Joel Spolsky has a great tutorial: https://www.youtube.com/watch?v=0nbkaYsR94c

Investment bankers are famous for working without a mouse in Excel.

joegosse··on Why printers add secret tracking dots
Thanks for sharing. I'd read from your research that concerns about counterfeiting were the primary motivation
joegosse··on Technology Billionaires Trying to Remake America's Schools
Reading the research, it was based on an observational study of 42 adults across three segments of musical training: None, Little (1-3 years), and Moderate (4-14) and found that "A greater amount of music training early in life was associated with the most efficient auditory function decades after training stopped."

I wouldn't draw any conclusions from this.

joegosse··on USCIS Announces Further Measures to Detect H-1B Visa Fraud and Abuse
> Employers who abuse the H-1B visa program negatively affect U.S. workers, decreasing wages and job opportunities as they import more foreign workers. To further deter and detect abuse, USCIS has established an email address which will allow individuals (including both American workers and H-1B workers who suspect they or others may be the victim of H-1B fraud or abuse) to submit tips, alleged violations and other relevant information about potential H-1B fraud or abuse. Information submitted to the email address will be used for investigations and referrals to law enforcement agencies for potential prosecution.

I wouldn't want to be responsible for managing this inbox:

REPORTH1BABUSE@USCIS.DHS.GOV

joegosse··on Ask HN: How do you set prices?
Conjoint analysis is also a common approach. It requires less specific answers from customers about price points, which people are often unwilling to share.
joegosse··on Ask HN: How do you set prices?
Use good invoicing/billing software that allows you to discount on a per customer basis.

Start with two price points: one targeted at price sensitive customers, call it price A, and one targeted at price-insensitive customers (think enterprise), call it price C.

Set price A lower than you think - you can always add features and raise later to the point that people start to scream.

Set price C at much higher than you think - use volume discounting to offer discounting where needed, but this is your anchor point for conversations with big customers.

Consider whether price A is your acquisition channel or if you will have a "free" tier. If you don't have a free tier, you can feel fine with a lower than optimal price for tier A, as this is your conversion channel to price C.

Eventually you'll want a tier between A & C (call it B) to anchor pricing and encourage people to choose A or C. Refer to research on movie popcorn prices.

joegosse··on Unplanned Freefall? Some Survival Tips
Interesting that the overall advice here is "Don't Panic"

Also interesting that having a towel could be incredibly useful in this situation.

joegosse··on 14 Character Random Number Generator in C
Is dieharder considered as the industry standard tool for testing randomness? Is it commonly used by experts?

https://www.phy.duke.edu/~rgb/General/dieharder.php

joegosse··on 14 Character Random Number Generator in C
Thank you for the writeup. What was the tool used to generate the .GIF of the shell?
joegosse··on Snap Inc. S-1
Interesting detail from the Google license exhibit:

Encryption Technologies. Google makes HTTPS encryption (also referred to as SSL or TLS connection) available. Google servers support ephemeral elliptic curve Diffie-Hellman cryptographic key exchange signed with RSA and ECDSA. These perfect forward secrecy (PFS) methods help protect traffic and minimize the impact of a compromised key, or a cryptographic breakthrough.

https://www.sec.gov/Archives/edgar/data/1564408/000119312517...

joegosse··on Wells Fargo’s ‘Living Will’ Plan Is Rejected Again by Regulators
>Presumably, C-suite people are compensated based on the financial performance of the bank...

They were. Many of their performance incentives would have also been tied to WF stock values, which were greatly inflated due to WF's higher than industry average cross sell metrics. Although as you observed many of the accounts were no-fee the company's stock benefitted from these non-revenue improvements

joegosse··on Kids Win the Right to Sue the US Government Over Climate Change
The initiative wasn't so simple. In addition to the carbon tax, it included a reduction in the state sales tax, with the net result being an overall reduction in tax revenue for the state. With social services and education already underfunded (at least in people's minds), this was a difficult tradeoff to make.

My sense was that the initiative was formulated to appeal to two different groups of voters but in doing so ended up alienating both.

joegosse··on On AWS vs. Azure, Vendor Lock-In and Pricing Confusion – Part 1
I look forward to reading the pricing analysis, it'll be great to hear your perspective as an experienced customer of both clouds. The pricing is complex so anything you can do to make simplifying assumptions that make sense to a real-world use case will be helpful for all.

(disclaimer: I work on Azure at Microsoft)

joegosse··on 10K Google Wi-Fi kiosks are collecting millions of faces and MAC addresses
From the Privacy Policy

INFORMATION COLLECTED BY OUR SENSORS AND CAMERAS ... We will not use facial recognition technology for any reason, and we will not use our cameras to track your movement through the city.

http://www1.nyc.gov/assets/doitt/downloads/pdf/Proposed-PCS-...

joegosse··on Show HN: A random startup generator
Looks like it is fixed already :)

https://github.com/zhangtiff/startup/commit/b8940962caea72b0...

joegosse··on Here is now available on iOS
The ability to download maps for use offline has been useful for international travel. GPS on with data roaming off comes in super handy in a pinch.
joegosse··on Ask HN: Best Supply Chain Management Books?
The Goal is a great introduction to the concepts that underlie thinking about supply chain problems and should be considered a must-read.
joegosse··on Miles O'Brien: My life, lost and found
Am I the only one that thought this was a Star Trek TNG reference?
joegosse··on Ask HN: Who wants to be hired? (February 2015)
Erik, Substantial in Seattle does great work (my wife is a client) and recruits a lot of Ruby talent. You may want to take a look: http://substantial.com/careers/inspired-developer-sea/
Page 1 of 2Next →