jspthrowaway

> I wouldn't want to see comments like the above if I were your investor or your employee.

Why? He called you out and he's 100% correct, why would it matter who he is? Personally, I think it speaks to his "personal image" that he doesn't give a shit about your feel-good CEO image demands. There's also no shortage of hilariousness that you think him taking a shot at you lowers his "personal image"; no harm done for telling the truth, you just don't see it that way because you're on the wrong end of it.

If I were shopping around for a company to invest in and I came across a comment like that, I'd be more likely to toss my money at him. You know why? Because I know I'm dealing with a person, not someone repressing all personal feelings and emotion to create this caricature of someone that they're really not. A person like that is more invested in their failures and successes, and, in my experience, is a better person to work for.

Becoming the leader of a company, as you know, is not a magic threshold after which you have to change who you are. I wish we'd get over this ridiculous assumption that we must hold people to a higher standard based on who they are. It underlies pretty much all of politics, and makes it a newsworthy event when Obama is seen drinking a beer. It's depressing.

Since you keep ignoring my question about licenses, as you have since the very first time I asked it, I am forced to assume your answer.

> The GPL is almost an anti-license, since it exists solely to do the exact opposite of what copyright laws and licenses are intended to do (restrict freedoms).

And yet it restricts my freedom to do what I wish with derivatives. Almost an anti-license, indeed.

I appreciate you side-stepping my point so deftly. Allow me to reiterate it:

- You cannot be an enemy of DRM and support software licenses. They are mutually exclusive positions.

I also hate this pervasive idea that our legal system is "broken". Copyright, just like patents, have been historically important to innovation and we'd be in a much different situation today were it not for both. Every generation always comes along and deems principles of antiquity "broken" because they don't bother to grok the historical context. If you were to say something like "in need of reform," I'm right there with you.

That's a poor and incorrect assumption of what I'm arguing. Do you always counter someone's question with an assumption of what they're going to say? I hate people that do that with a fiery passion, particularly when bucketed into a group that I'm not even representing.

My point is, you say "when [you] buy something, [you] want to know it's yours", the corollary being that you dislike software licenses entirely. Any software with a license is DRM-protected, including GPL and BSD software or software with a EULA. The operating system that you are currently using is licensed to you. There's probably nothing on your computer that you own aside from things you have created yourself.

You have purchased or downloaded the software, yes, but the author has licensed it to you under specific terms. It is not yours. That is DRM. Anybody who hates DRM and continues to enforce a software license on their work, GPL or not, is experiencing cognitive dissonance (Richard Stallman included). GPL is actually one of the worst of the bunch because it mandates how you can redistribute things you build with "what is yours".

Is this an ideal world? No. Is it the world we live in right now? Yes. I will not assume what your response will be, to your respect.

> When I buy something, I like to know it's mine, rather than just 'in my possession with permission to use'.

What license do you use for software that you write?

The split personality in the HN community is interesting.

On one hand, you have things like "never let the perfect be the enemy of the good; better to have a product that works than to get everything right".

On the other, you have things like "Amazon puts DRM on their ebooks and terminated Wikileaks. Boycott everything they do."

Amazon is innovative enough and has benefited my life enough that I'm willing to sacrifice some freedoms for that convenience. Richard Stallman, however, cannot be happy if you make that decision on your own. Eventually, you have to ask yourself if you want to spend your life obeying what an influential person tells you to do (and sacrifice conveniences to hold the world to a higher standard which will never be realized), or realize that ships sail and you'd rather be on the ship than yelling at it with clenched fist from the harbor.

rsyslog's documentation is pretty abysmal, so you can't be faulted for giving up and doing something else. It's actually pretty extensive and useful, the documentation is just awful. Since he's hard at work on v7 I had hoped the documentation would get a little better, since rsyslog is better than syslog-ng in one way (you don't have to pay for local disk buffering), but alas, I'm left hoping.

imfile just injects messages from the tailed file as if they were read from another source. rsyslog just lists a bunch of sources, then dumps all the messages (based on filter) to a destination of your choosing. If, at the end of your configuration you have something like this:

    *.* @@syslog-collector:514

All messages regardless of source will be relayed to syslog-collector port 514. If it's an rsyslog receiving on the other end, try this:

    *.* @@(o,z9)syslog-collector:514

That enables experimental framing that rsyslog can understand, as well as zlib level 9. rsyslog will decode it on the other end just fine. Rainer will tell you to use RELP instead for relaying from rsyslog to rsyslog, but good luck getting it to work on any distribution. A minimal tail-and-forward config would look like this:

    $ModLoad imfile
    $InputFileName /var/log/myapp.log
    $InputFileTag myapp:
    $InputFileStateFile myapp
    $InputFileSeverity 6
    $InputFileFacility local0
    $InputRunFileMonitor

    *.* @@syslog-collector:514

That will tail myapp.log, inject messages as INFO on local0, then forward them to syslog-collector prefixed with "myapp:" on every line. It will not, however, collect the system syslog ... you need to prefix with this for that to happen:

    $ModLoad imuxsock
    $ModLoad imkmsg

Ah, that makes sense, so you're sending a program and sorta-preview from this custom tool to a fuller production studio and it's remote-driven. That makes more sense.

Right on, thanks for answering.

I'll take an opportunity to ask you a question.

I saw the news the other day that you guys had written a video mixer for Linux, with integrated Chyrons, transitions, and all that. That's great work, but I do have a question about the motivation behind it.

As a former television technical director, I was curious what made you choose to write a custom software video mixer. The alternative, of course, would be picking up a cheap digital mixer, like a Grass Valley, and encoding its program output instead. Was the impetus financial in nature? Technical, since making a video mixer train work is a little challenging unless you have experience (reference signals, CCU if you have fancy-enough cameras, and so on)? Are you mixing audio in your software suite as well, or do you have an external mixer? (The rationale for each is the same, IMO.)

I'm just curious. Not saying the work isn't valued, just steaming ahead on writing a custom software mixer is an interesting decision. Production houses usually have old digital mixers in storage and might be willing to donate to your effort, too.

There's a few parts of that anecdote which confuse me as a pilot. The first one is two vastly different aircraft separated by a slash as if to indicate that they are equivalent. The second is an air crew that completed a flight, while leaking fuel, without declaring emergency and putting it down. Lastly, someone actually observing fuel leaking from the aircraft and thinking "meh, it's just old," rather than alerting the air crew.

(Put another way, I have doubts that you were observing a fuel leak. Those are generally pretty easy to notice -- "why are we consuming two thousand extra pounds of fuel per hour?")

You found troll(1) in the OED.

Now find troll(2).

The thread in question involved a few broad oversights in a tool, not an immediate disclosure due to a trivial oversight. There's a difference between not generating random numbers correctly and immediately disclosing every AWS key you've been given.

You repeatedly write some form of that assertion (we're two nerds) as if it is supposed to excuse something. I honestly couldn't give a rat's ass regarding who you are. I care about your actions and your actions alone. Stop making excuses!

I'd like you to apologize not only for the disclosure, but also to the reporter for how you treated him in the other thread. The entire other thread of your responses is disgusting, and you don't get to write it off because of your gender, quantity, or employment status. Own your comments and stop excusing them with that bullshit line.

I have to admit that I would also be pleased if your service disappeared until you're working with somebody who has a little more experience with secure Web applications; this mistake betrays your experience. Since we all started somewhere, though, I can only hope you fix this on your own.

Friends are customers, too. One row in your database is a customer.

Before ever putting a service up on the public Internet (service defined here as "accepts arbitrary requests" and "delivers arbitrary responses"), I would hope every human being that knows his way around a text editor treats user data like the Dead Sea Scrolls. If you store a row in a database, you then think of every way that an unauthorized party can gain access to that row and close each in multiple ways. I can recite dozens of cases where user data hasn't been treated with the respect it deserves (i.e., every single Bitcoin disclosure due to newer developers running sites that are handling money).

If people took user data more seriously than they do in general, we'd have a lot less leaks. Imagine if this had gone undiscovered and the service took off? Imagine how many undiscovered vulnerabilities there are in there, with this track record to start?

I can't sympathize with this at all. I just can't.

Contacted a PR person in between the last thread and this one, I'm guessing? That's a rapid 180.

You have a long way to go in my mind, in terms of fixing the initial response. You probably have help now, which is great, but your initial kneejerk demonstrates underlying trouble to me which you need to fix.

You're in a tough spot, too, because you can't delete those godawful comments without looking suspicious.

He submitted this article after the vulnerability was already fixed. (I grant that the initial comment came before.) I'd be inclined to agree with you, overall, save for a couple mitigating factors in this case:

1) The founder's behavior in the other thread, including refusing to notify affected parties.

2) Such a simple mistake worries me about what else might be vulnerable in the application which is built to handle users' backup data, and for that reason alone, I think this article is extremely important right now.

"Whoops, we disclosed everybody's AWS credentials. I know! Rather than tell our users, I'll wipe the database and remove all evidence of it ever happening."

That's your response to someone (admittedly, poorly) discovering and reporting a security vulnerability in your application? Telling him to "be nice" then dropping his e-mail and face as some kind of stick-waving, threatening gesture?

Congratulations on demonstrating to me and countless others why I shouldn't use any product that you EVER touch. You don't get a pass because you're just two nerds. You have a form with a submit button -- that's where your responsibility as a founder and custodianship of user data begins. Day 1, you're already a liability.

I realize this is a pretty direct attack but I'm appalled and staggered by your behavior in this thread. You launched a service on the public Internet. There is no grace period, there is no "friendly fire"; you fucked up and you disclosed AWS credentials. Not users' favorite colors. AWS KEYS. Tied to credit cards, running servers, S3 backups, God knows what. You don't get to tell people to be nice to you when you're acting as the steward of AWS credentials; you protect them and act like you care when someone tells you that you fucked up doing so.

Your behavior here is just foreboding for the future, and you need to realize that before launching your next endeavor (this one is probably done, after that little mess).