johnvschmitt

It's unlikely that the powerful institutions will give up their powerful tools.

What I do think might work, though, is a system added to it where every human query is logged & their human peers can ask, "WTF Carl? Why are you looking at data on your ex wife? Or, Why are you looking at your political enemies?"

I think the humans inside those institutions would not limit their power, but they would want to keep an eye on their peers to make sure their peers are not abusing their power.

Those query & access logs can be periodically reviewed by their peers, and their superiors, and those logs should be kept as long as the data is, & queryable just the same as any other data.

This seems odd. I mean, if their code was properly modular, they would have just one place where they "fetchUserIdByName(userName)", which returns one user ID or null if it's not used yet.

When a new user is created, it then gets assigned a unique user ID. The email address is assigned to that user ID.

Then, if they do a password reset on user = "bigbird", it should do the exact same lookup to find the email address.

The security bug was not really about having an improper function to do unicode translation. It was more about having different functions for the same check, simply because they were in different parts of the code.

Modular code is just so much better on all fronts, including security.

From the article:

"Control Center is a pull-up tray that is available in your lock screen.

You can adjust brightness, volume, and other settings including Wifi, Airplane mode, rotation lock, or Bluetooth. "

They allow changing Wifi settings without even unlocking the phone.

Be really careful about letting anyone touch your phone, esp. at conferences/airports. A hacker could setup an easy MITM Wifi, to capture all of your traffic. But, now, without unlocking your phone (but still getting their physical hands on it), they can connect your phone to the Wifi SSID of their MITM attack network.

Then, you're just surfing facebook, email, bank sites, & everything looks 100% legit. Meanwhile all of that traffic is going through their wifi & they can capture your sessions & impersonate you. Nasty stuff.

All it'd take is one malicious network, and a band of attractive agents to shmooze unsuspecting people into showing them their phones to harvest tons of sessions & data.

Hmm... It seems the major factor is simply overbuilding.

"Overbuilding in one year leads to lack of building in subsequent years".

As building homes is a big cause of temporary job growth.

Also, I doubt long commutes lead to higher unemployment rates, as the economic pressures would step in. Companies hire to meet consumer demand. If they need workers, they'll raise wages, or open satellite offices where the workers are. They don't just stop hiring & let their production go down when they have orders.

It takes me only ~30 seconds per day to filter mail manually & toss 90%+ into the recycling. That's not a big problem needing solving.

And, they don't explain how they "pickup" securely. Do I need to be home? Then you've lost all time savings, as I have to answer the door to do the transaction with you.

If I don't have to be home, then how can you get into my mailbox securely?

Right. The economics just don't make sense, and I'd be shocked if they were still in business in 2 years (unless they sold your private data.)

This would only work efficiently if it were part of the USPS.

Exactly true. Today's tools* require far too much maintenance & operator involvement to be fully automated like this.

Shapeways.com & Ponoko & others have "upload & print" (by mail) services, & they work well, since they have operators in their facility.

*But, things change fast. It might just be a few months or years before the machines can reliably produce without maintenance & operator steps. Is this it already? I'm curious & signed up & will give it a try.

It's a natural fit.

Startups use Mailchimp & Sendgrid, etc. for email marketing, but then as they mature & grow, they see the need for more mature (although, yes, more expensive, complex, & slower) tools like ExactTarget.

Very similarly, how do startups track their customers & leads? Often, with no CRM other than spreadsheets or in-house tools. When they scale & have >10 sales staff, they realize they need a more mature, slower, more expensive CRM, & SalesForce is there.

So, yes, the acquisition price seems high, but the complementary fit is solid.

You are both true & making good points. It sounds like another "offshoring" idea then.

The bigger problem from my POV is that the old folks they serve are being treated as "steady state", when in fact their conditions are often deteriorating. And, when Grandma dies, will her family have to wait 1-2 weeks for her ship to return to port for a proper family gathering & funeral? Stinky...

Yes, that's a shame. But: Netflix makes it easy & convenient. They are not the bad guy. They are really stuck between a rock & a hard place. (Between old school distributors of content (Hollywood), squeezing them for money to make sure they have no margin), and ISP's (Comcast, AT&T) who are saying, "Hey, Netflix is popular, >50% of bandwidth, so let's shake them down" (net neutrality needs to keep them from doing this).

Don't blame Netflix for that DRM behavior. They are the early innovator & they look after their customers. They are just squeezed so badly. If you support net neutrality & ban DRM, you'll see more convenient, customer-friendly companies thrive in that ecosystem. If you don't, you'll see only bad players (DRM+$$$$+inconvenience) playing content you like.

Good for EFF. DRM is futile.

There is NO stopping people from recording what's on their screen (with a cell phone camera among other devices).

What we've seen is:

A) The more barriers you put in front of legitimate use, the more you see illegitimate use grow.

B) The EFF is rock solid in standing up & protecting our rights & values in the modern, internet, connected age. Please help fund them.

Meaning: DRM all you want. Make it so that you can ONLY see Game of Thrones if you pay $100,000!!! Great! And, imagine how long it'd take for a copy (lower fidelity, sure) to get in the hands of a larger audience that you can't control, who doesn't like you, who you collect no $ from.

Or: Drop DRM, & go for "iTunes or Netflix" or other distribution methods that are EASY & fair. Watch your revenue boom, while you collect user stats to make your next content even more appealing & marketable.

Good points. Yes, these comments truly prove that "Your mileage may vary".

The grass isn't always greener, and with so many users, our personal experiences are simply "statistical anomalies / anecdotes" to the other guy, but are 100% our relevant personal experience to ourselves.

It kind of reminds me of my uncle who does surgery on backs. When a patient asks him, "What's the success % rate on this surgery?" He replies, "100% or 0% for YOU". It irked me to hear that from him, as an engineer, but he's so damn right when it comes to personal experiences & preparations (emotionally & otherwise)

I've been on Linode for a few months, after years on AWS, and I'm not nearly convinced to trust them with these "Managed Services".

Why? Too much "scheduled downtime" (few hours/month) vs. AWS's 99.999% uptime.

Why else? Well, it's a perverse incentive. If they have less reliable systems, the pain goes up, to where more people will sign up for "Linode Managed". We should all get good uptime, not have to pay extra.

Most importantly, their offering is not an SLA. I don't see anywhere in the "Linode Managed" where they are guaranteeing uptime %'s, or penalties for lower performance. And, how can they realistically handle even 50% of the 3AM panic problems, if some of those will be my website's inability to talk to 3rd party sites (which neither of us have control over).

If they really can fix 90% of the 3AM problems, then they are the root cause of most of those in the first place. There's not many good reasons why Linux will break at 3AM often if you've setup your stack correctly.

This is good advice when you're new to a stack.

But, if you know better, do better please.

After writing tons of code, I've come to realize that 80% of the time, it takes about the same time to do it "right" (scalable/secure/modular) as it does to do it "OK".

Ex: Are plaintext passwords any faster to build/code than encrypted+salt passwords? Nope.

And, it's fine to intend to refactor later. But, too many organizations have no tolerance later to let engineers do things that don't have visible results. I've suffered through a stint of handling "legacy code" like that & it was painful & demoralizing.

Saul Griffith (co-founder of Makani) is a far more valuable asset than just the tech/product here. He's very active, collaborative, & well respected in the Maker community.

Although I agree with you 100% on "hey, I have enough junk!"....

I think there's a great (ok, obvious) reason to ship t-shirts to early backers. It's essentially marketing, as you figure a good portion of those early backers are proud, & will wear it around publicly, & then your company gets talked about in new places.

Regardless of you how feel about FB, Banks, etc... In this case, the IPO underwriters DID serve the founders/company, which is their job.

Meaning, a "pop" means the IPO was priced too small, giving the early investors/founders/employees a low price, and giving the first-day IPO purchasers (who did no work, & are just gambling) the benefit of that new, higher price.

No "pop" means it's priced about right, and serves the interest of early investors, who took far more risk & often built the company.

ryannielson's solution is the best IMO, as it requires the environment variable to be set, & most importantly, shows a nice error to the developer should they miss it.

Even better, raise 'SECRET_TOKEN not set! Please refer to the doc in xyz'

So, the specific method for setting is in an "xyz" doc that your team keeps in a SEPARATE location from the code repo.

And, we really need a standard way to do this, or Github pulls / forks will have more friction or bad security when setting up forks.

Also, I really would rather put it in a file, not system env, as the env might be setup different on different systems, & you'd hate to have that env potentially shared in multi-user systems. Files are more reliably locked down.

3. Put the email address raw on a web page. Don't put a contact-us link.

No. That'll get you far too much spam.

A stand? That's not what they need to go mass market.

When I show people the square dongle on my phone, the first thing most people ask is... "OK, that's cool, but how can it accept cash"?

If their communication is not really simple & clear about how they can be a "total" solution for a small business (which yes, must also take cash + CC's), then they will not get to mass market. Having more hardware (which is far harder to scale than software) will not be the best path.

That said, I'm still impressed with Square, as it's very hard to compete in a non-level playing field with huge entrenched players (Visa/MC/AMEX + big POS players), and the ecosystem needs successful upstarts to freshen the ecosystem for consumers.

Correct. The government probably figured, they don't need a subpoena, because they already manage the AP so closely.

You aren't hearing any serious dissent from the AP.

That said, we have to be vigilant about any overreach, as civil rights are too hard to get back once you give them up.

Yes. http://makerschmitt.blogspot.com

I have actually used it for not just the toys/fun you see on the blog, but also some actual parts in my home that broke too.

Yes, it's truly an early adopter's point, with pain, & costs, & trouble. Yes, you can order parts from shapeways.com & ponoko.com without having your own machine.

But, this is truly magic, in that it brings mechanical iterations into the realm of software, with reduced cycle time.

Before these things, as a mechanical engineer in the 90's, any iteration would be 2-4 weeks, & $2-4k, and now, I can do 3 iterations in one afternoon for <$2.00 of plastic.

If you've studied other fields, you might know how radical a transformation reduced cycle times alone can make.

When I hear that the FBI interviewed the Boston bomber a year ago, I don't immediately think of FBI incompetence. No, rather, I think, "Hey, the bomber had many experiences & changes of mind, & is truly a different person a year hence".

I mean, are personalities & motivations & intentions truly permanent? C'mon, haven't we all changed as life goes on?

It's a fallacy to think you can ever 99.9% predict the future regardless of how much "big data" & "army of experts" you have.

That approach hasn't predicted the stock market within 70% accuracy, so how can we expect it to predict security issues any better?

We need to just realize that we're far more likely to die from causes other than terrorism, & just treat it like other crimes.

OK, but look at the growth after 9/11. Are all of those simply hardening/defensive mechanisms?

BTW: I firmly believe that the best defense against a possible attack from ~7B+ people is:

A) in cyberspace: to simply build better security rather than counter-attack those that attack us, as there are countless attackers from anyone with internet, often with nothing to lose, so counter attacks are futile.

B) In physical space: deal with attacks as criminals, not state or stateless organizations that require sacrificing civil liberties & core morals. There are not 7B+ people who can physically attack a structure, so standard policing suffices. Giving them more attention than that is playing directly into their goals, & counter-productive.

C) Nobody likes a police state. Jefferson famously said, that all governments creep towards tyranny, so we must remain vigilant towards increased power for our "safety".

This also points to why "apps" are a broken model.

We desperately need mobile device standards, and HTML5 is just one step on that needed path.

Could you imagine, if browser had to do this? (Say, you're on Firefox, thinking of using Chrome, & have to use a complicated feature that analyzed all of your most recently visited sites, & told you if those sites worked on Chrome, & then if not, showed you comparable sites)

This makes more sense every year:

It gets easier to run a business from home. Your website is your front door for customers, so you need not have a real receptionist & office, and cloud services just keep improving.

And, when you work at home, at something you love (your own business), you have no problem motivating yourself to work nights, after the kids are tucked in. And, mixing work time with kid time gives you good, rewarding breaks.

And, explaining my business issues to my kids gives me great practice in better communication, & better clarity on my own goals, and smarter, more aware kids.

That said, this works much easier with school-age kids. When they are under 4, it's much much harder to work while taking care, as they need so much more care.

Very welcome. We need to change things, and the sooner in their lives, the more difference it makes.

Back in the 90's, I was an engineering student at Berkeley. I was bored eating lunch outside one day by the engr bldgs, & decided to pass the time by counting the gender of just those folks passing by. It was consistently 25% female. That includes non-engineers who were going up to the coops.

And, this is Berkeley. Nobody's going to (rightly) accuse them of anything other than liberal.

When your inputs are 75% male, your outputs are too. You can't put the blame downstream like that, & can't change it downstream as easily.

It's orders of magnitude easier to change this from childhood, early.

I ended up marrying a fellow engineer from Berkeley, & we are raising both our son & daughter to be passionate, curious builders & makers & coders. You don't just use the world, you adjust it & improve it.

Go with the data, right. The data shows that NFL players have damage, not the average high school player.

That's like saying, "Studies show that the top 0.01% of hackers are suicidal, so don't do computer programming!"

I've played other team contact sports (Basketball & soccer), but really football was the best at making me resilient. There's no comparison. The benefits outweigh the risk for 99.9% of players, & for the elite who go on to the NFL (0.1%), then the risks may outweigh the benefits.

This is another example of how you should handle fear-based news.

This coming from a guy who played H.S. Football in Texas, & is still good at math:

Look at your odds:

1) You are VERY unlikely to ever play in the NFL. 7B people, ~10k people in NFL.

2) If you play team sports as a youth, you will learn how to: A) deal with adversity, & perserve. Even if you don't win, you learn that you can survive, learn, & live. It makes you resilient. Resiliency is better than raw strength. B) deal with team dynamics. If you can't fire the member, you quickly realize that you must improve the weakness of your teammates, & welcome similar offers from them on your own weaknesses. C) Learn that exercise is fun, is living, & is something you embrace.

Or, you can simply live in fear, & increase your odds tremendously to die by diabetes, & idleness. "Sitting is the new Smoking Cigarettes.."