msmith

IBM is also behind the very nice Carbon design system and its React component library.

http://carbondesignsystem.com/ https://github.com/carbon-design-system/carbon-components-re...

WP Engine | Austin, TX and Limerick, Ireland | ONSITE Full-time

WP Engine is building a high-scale managed cloud platform for WordPress. We have solid and growing revenue with 70,000+ customers and 500,000+ sites.

Our current tech stack is primarily Python & Go, running on GCP & AWS. We have opportunities to work on our container-based hosting platform, our service layer, or our UI and developer tools. This is a great place to grow your career.

Apply at https://wpengine-careers.com/job-openings/ or email me questions at michael.smith[at]wpengine.com

Most of the content has a shelf life much longer than one year, so I'm sure that factors into the equation.

How about creating hundreds of millions of certificates, developing a new standard protocol to interoperate with CAs, managing millions of registered users, managing certificate revocation, logging to certificate transparency logs, running OSCP responders, developing clients for a wide variety of platforms, and keeping up with the latest happenings in the crypto world?

I've built a small project using v2 and it really helped me get up to speed and learn some of the best practices for React front-end development. I'm looking forward to trying v3, because it addresses a several things that I felt could be improved in my current project. Specifically, Component tests, CSS organization, & integration with utilities like ImmutableJS & reselect.

It doesn't even have to be an undisclosed vulnerability.

iOS 9.3 was released today and included several fixes to vulnerabilities which allowed arbitrary code execution, including one with "kernel privileges" [1]

Now that these vulns are out in the open, maybe someone has offered to help the FBI use them to gain access to the phone.

[1] https://support.apple.com/en-us/HT206166

I'd just like to point out that the majority of those are sector funds, so it really doesn't make sense to compare it to a broadly-diversified index like the S&P 500. On top of that, many of the high-fliers in that list are leveraged ETFs, which magnify gains and losses, and would not be suitable at all for long-term portfolios.

The first code I ever shipped was an ANSI viewer that was included in several artpacks. It's so great that I can still find it after almost 20 years. I really wish that I'd kept a copy of the source.

I don't know if you can draw a conclusion from those numbers alone, but it's typical for a SaaS business to measure Customer Acquisition Cost (CAC) and Lifetime Value (LTV) of the typical customer. Sales and marketing seem to be the majority of the CAC, but you can't tell the LTV from revenue numbers alone.

Ruby's dependency management (rubygems) also came from the community and is now part of the standard library. That seems like a good model to follow.

Dependency management for Go is definitely on people's radar. https://github.com/tools/godep has been getting some traction.

Realize that Sal recorded this video in March of 2008, at the peak of the housing bubble. Many of the assumptions made in the video are certainly not going to be the same in today's market.

When you're modeling the rent vs buy scenario, the outcome is hugely dependent on regional factors (like average rent & purchase prices in your area), current economic factors (like mortgage rates), and also your estimates of future events (like long-term investment return, rental price growth, and home appreciation). Even small changes in these factors can make a huge difference in the outcome. If you're interested in going into more detail, I suggest downloading the model [1] that Sal was using for these videos and plugging in your own numbers:

[1] https://www.khanacademy.org/downloads/buyrent.xls

Used in this context, "reasonable royalty" is a legal term that describes the money that is to be paid due to the infringement. I don't believe the author was making a judgement call on the fairness of the award.

> “He doesn’t have all these fancy degrees,” said Fenster.

I find it funny that Fenster, after praising Jones in this way, would attack Diffie's credibility by pointing out that he lacks a master's or PhD.

[1] http://arstechnica.com/tech-policy/2013/11/newegg-trial-cryp...

Ironically, I think it's actually slightly easier for an eavesdropper to detect that your keystrokes are part of a password if the password is not being echoed.

They could potentially use this information to know the length of a password, which would make brute-forcing easier. A very hypothetical attack, but fun to think about! Less effective than a $5 wrench, no doubt.

One interesting thing about this is how it can lead to timing attacks which leak information about your keystrokes. There's a great paper [1] which gives some examples. One more reason to use pubkey authentication for SSH.

[1] http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf

Wow, that certainly is surprising. I've looked at the EC2 pricing page many times and never noticed that.

I think you pasted the wrong link, though. Here's the page which contains that quote: http://aws.amazon.com/ec2/pricing/#reserved

I put something like this together a while ago. I think it still works. Just two scripts, ffmpeg, and a cronjob. https://github.com/msmith/caps.

He was probably talking about VTSAX. A different class of shares within the same fund, which has a $10,000 investment minimum.

I occasionally read about people's 401K options on the Bogleheads forum [1]. You're right, many of them are shockingly bad. Startups and small companies are especially likely to have poor options.

The solution is for employees to become better educated and demand better plans. This Frontline program does a pretty good job of getting the message out.

[1] http://www.bogleheads.org/forum/viewforum.php?f=1

I've watched the Frontline piece that this article is based on. It's not quite as hysterical, but it does make the case that the high-cost actively managed funds offered by most 401k plans underperform low-cost index funds, which are not available in many 401k plans. So, you're stuck paying the high fees or losing out on the tax-advantages of the 401k.

OP has a good point about deployment. DevOps tools have made huge strides in the last few years and it's feasible to build something that approaches the convenience of Heroku's fully-managed deployment pipeline, but that's not the only value that a PaaS provides.

You really shouldn't underestimate the amount of work that it takes just to keep a product running. For example, dealing with hardware & network failures, maintaining data backups, keeping up with OS-level security, & scaling up. That's a huge part of the value that Heroku provides for us.

bundle install has several other useful options too. My favorites:

--local will prevent rubygems.org from being contacted, and will only use previously cached gems

--standalone will package all dependencies into ./bundle, so that you can copy and run it on a server that doesn't even have Bundler

[1] http://gembundler.com/v1.2/bundle_install.html

It is possible for the publisher to sign the gems [1], but it's not common.

If rubygems.org is keeping fingerprints of each gem, then it still isn't sufficient, since those could have been compromised as well. If there's no other trustworthy source of fingerprints, then maybe we need to crowdsource it. Built a tool that will md5sum all the .gem files in your local cache directory, so that we can look for any files that were changed on rubygems.org

[1] http://docs.rubygems.org/read/chapter/21

More than half of the states in the Union have some sort of Castle Doctrine or Stand Your Ground law [1]. It's not just Texas.

[1] http://en.wikipedia.org/wiki/Stand-your-ground_law#United_St...

I agree that it's a bad idea to have a null check on req & req.getHeaders(). One might think that this kind of thing makes your code more resilient, but instead it just makes it harder to track down the inevitable bugs like forgetting to initialize Request#headers.

I'm not sure about Perth, but from AWS Sydney I'm seeing pings of around 400ms to AWS Singapore.

One nice thing about git is that you can easily amend your commit history. If you've done several related refactor commits in a row, then sometimes it makes sense to squash them into one, using `git rebase -i` [1].

[1] http://gitready.com/advanced/2009/02/10/squashing-commits-wi...

I've done a fair amount of resume screening and it's definitely useful to be able to filter out the obviously unqualified or uninterested candidates.

I checked out the EDITD test and it's a little more involved than Parse's.

I'm not sure how it compares in performance, but I've always used scp -r for this:

   $ scp -r remote foo /where/to/unpack

This post is talking about changing TCP, not SPDY. The changes mentioned here would probably benefit SPDY as well, but to a lesser degree than HTTP, since SPDY was designed to handle multiple concurrent HTTP requests on a single TCP session.