HNHacker News
TopNewBestAskShowJobs

nbpoole

2,035 karma · joined November 2, 2010

Web application security enthusiast. Currently a Security Engineer at Facebook. Formerly a security consultant for Matasano Security. My posts and comments do not reflect the opinions or views of my employer.

Blog: https://nealpoole.com/blog/

Twitter: https://twitter.com/NealPoole

Contact me: https://nealpoole.com/blog/contact/

submissionscomments
nbpoole··on Companies that make money by distributing misleading versions of VLC
The difference there is "I want a link back from your site to my site." That's the point at which the offer loses all possible shreds of credibility.
nbpoole··on Apple servers hacked by Anonymous
abs.apple.com resolves to 17.112.144.82, which appears to be part of an IP range owned by Apple. It's possible that the server is running third-party software, but it does appear to be hosted by Apple.
nbpoole··on Show HN: Affililink - An automated way to monetise your site
So, how would you compare your site with http://www.viglink.com/ or http://skimlinks.com/?

Edit: Never mind. I posted this before checking out your site. I see that you provide the Javascript to perform the URL rewriting but require webmasters to register separately with affiliate programs. A very different model than Viglink or Skimlinks ;-)

nbpoole··on Endless URL Shortening Redirection Loop
http://kb.mozillazine.org/Network.http.redirection-limit

All other browsers, to the best of my knowledge, have similar systems built in. So your premise is flawed: you can't have an "infinite redirect."

nbpoole··on A cron pitfall that will probably snare you at least once in your career
That has to do with how spoiler tags are set up on that subreddit: the actual spoiler content is in the title attribute of the link and the href points to /s. The CSS for the subreddit uses an attribute selector to find links pointing to /s and styles them appropriately.

If you view the posts outside of the context of the subreddit, there's no special CSS, so the link appears normally with some title text that appears on hover.

nbpoole··on A cron pitfall that will probably snare you at least once in your career
Screenshot: http://imgur.com/Uq9Fs

I'm just hoping I'm not color-blind :-P

nbpoole··on A cron pitfall that will probably snare you at least once in your career
I posted a link (http://news.ycombinator.com/item?id=2701527) to a Debian bug that explains the rationale (aside from the historical behavior argument) a little better: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308911
nbpoole··on A cron pitfall that will probably snare you at least once in your career
Strange. I'm running Chrome 12 on OS X and I have no issue (although the contrast is very poor).
nbpoole··on A cron pitfall that will probably snare you at least once in your career
Click and drag over the text with your mouse and you should be able to see it.
nbpoole··on A cron pitfall that will probably snare you at least once in your career
I found an older bug report for Debian that sheds a little light on why this behavior is useful: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308911

    I can understand not changing the behaviour wrt historical
    precedent: I have been told that people used to rely on the
    ignore-dot mechanism to disable things (e.g. mv foo foo.disabled).
At the end of the report, you can see they added the --regex flag to allow for user-defined filename validation.
nbpoole··on "//" should indicate a URL
The // prefix is actually used for protocol-relative URLs. So //google.com leads to https://google.com on a page with SSL, and it leads to http://google.com on an unencrypted page.

See:

http://nedbatchelder.com/blog/200710.html#e20071017T215538

http://paulirish.com/2010/the-protocol-relative-url/

nbpoole··on The FBI stole an Instapaper server in an unrelated raid
So, the FBI has a copy of Instapaper's complete database and a copy of their website code. The database includes:

- Salted SHA-1 hashed passwords for Instapaper

- Encrypted passwords for linked Pinboard accounts (with the encryption key stored in the website code)

- OAuth tokens for linked Facebook/Twitter/Tumblr accounts (and presumably also the secret keys used by Instapaper to use those tokens).

That's (potentially) a lot of personal information.

nbpoole··on Why a*a*a*a*a*a cannot be optimized to (a*a*a)*(a*a*a)?
Google Cache version: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...
nbpoole··on Ask HN: Could we improve password security by using a public/private key system?
Yes: SSH allows for password-less logins through the use of public/private key pairs.
nbpoole··on ICANN Approves generic top-level domains
From http://www.icann.org/en/topics/new-gtlds/factsheet-new-gtld-...

> How much is the evaluation fee?

The evaluation fee is estimated at US$185,000. Applicants will be required to pay a US$5,000 deposit fee per requested application slot when registering. The US$5,000 will be credited against the evaluation fee

> Are there any additional costs I should be aware of in applying for a new gTLD?

Yes. Applicants may be required to pay additional fees in certain cases where specialized process steps are applicable, and should expect to account for their own business startup costs. See Section 1.5.2 of the Applicant Guidebook.

And the guidebook (http://www.icann.org/en/topics/new-gtlds/rfp-clean-30may11-e...) mentions a number of different fees.

nbpoole··on ICANN Approves generic top-level domains
I wonder who's going to register "localhost" or "mail"? ;-)

EDIT: There's a list of reserved TLDs that won't be allowed to be registered. It includes localhost (but not mail)!

AFRINIC IANA-SERVERS NRO ALAC ICANN RFC-EDITOR APNIC IESG RIPE ARIN IETF ROOT-SERVERS ASO INTERNIC RSSAC CCNSO INVALID SSAC EXAMPLE* IRTF TEST* GAC ISTF TLD GNSO LACNIC WHOIS GTLD-SERVERS LOCAL WWW IAB LOCALHOST IANA NIC

(example and www have asterisks next to them because "in addition to the above strings, ICANN will reserve translations of the terms “test” and “example” in multiple languages. The remainder of the strings are reserved only in the form included above.")

nbpoole··on MtGox account database leaked
http://news.ycombinator.com/item?id=2671714 (Summary: Because you can Google at least some of the hashes and find they're already cracked)
nbpoole··on MtGox account database leaked
The list I've seen has over 60k entries.
nbpoole··on MtGox account database leaked
The crypt'ed MD5 hashes have a special prefix which indicates that's what they are.

For the other hashes, the fact that there's no nonce or other value stored alongside them was a strong hint (although it doesn't rule out a site-wide nonce). However, I confirmed my suspicion by Googling one of the hashes: it was on a list of unsalted hashes that had been brute forced (unrelated to this, the password was fairly common).

nbpoole··on MtGox account database leaked
Yes, although some of them (especially for older accounts, which probably haven't been logged into in a while) appear to be unsalted MD5. That's not unusual: it probably means that MtGox used unsalted MD5 at some point in the past and was upgrading people's passwords in-place after a successful login.

It's worth noting that crypt-ed MD5 (which appears to be what's in use here) is fairly weak on modern hardware when compared to an alternative like BCrypt. There's some basic information available on Wikipedia: http://en.wikipedia.org/w/index.php?title=Crypt_%28Unix%29&#...

nbpoole··on What did Google do to my Wordpress.com hosted blog on Jun 14th?
The title posted here is misleading. Why do you think your blog's traffic numbers imply that Google did something to impact Wordpress.com as a whole?
nbpoole··on Bitcoin: Did you ever ask yourself why ...
Something like this, I assume: http://www.bitcoinminer.com/post/5328668205/deepbit-50-perce...
nbpoole··on Google just blacklisted the whole .cz.cc TLD
http://mxr.mozilla.org/mozilla-central/source/netwerk/dns/ef...

.cz.cc is not on that list, nor should it be. This is a free "domain" generator using subdomains of cz.cc. Hence, all of the subdomains are grouped together. I don't see anything wrong here.

nbpoole··on Ravelry.com hacked - user information leaked
http://www.knittingparadise.com/t-13211-1.html

http://www.sheffieldforum.co.uk/showthread.php?p=7720333

Apparently if you log in there's a notice telling you they were hacked.

nbpoole··on The GPL Sucks
"When I release an open-source program, I want to guarantee something very simple. The program and its source code can be distributed and used by anyone for any purpose, and all modifications to the program must be released as open-source under these same terms. I want to guarantee that the program and any improvements made on it are available to anyone, proprietary or not, forever."

Those terms are contradictory.

On the one hand, you want to guarantee "The program and its source code can be distributed and used by anyone for any purpose." That seems to mesh with the BSD license in a straightforward way: you want people to be free to use the code in proprietary or open source applications. On the other hand, you also "want to guarantee that the program and any improvements made on it are available to anyone, proprietary or not, forever." That requirement is much closer to the GPL (or even the AGPL): if someone distributes a modified version of the software, you want the source of those modifications to be released so other people can modify their application in the same way. Unfortunately, that requirement is also completely at odds with the BSD license you champion in your blog post; under the BSD license, I'm free to modify your application and distribute a modified binary without ever releasing the source. There's no guarantee that modifications are ever made available to anyone.

A lot of the rest of the post appears to be hyperbolic anti-GPL rhetoric, not backed by any facts or examples. "A company has zero motivation to help improve GPL'd software because they can't benefit from their improvements" for instance. RedHat or Canonical serve as decent counter-examples.

There are many legitimate reasons to disagree with the GPL's philosophy: this is not one of them.

nbpoole··on Let's make the web faster: PHP performance tips by Google
The example they gave ($description = strip_tags($_POST['description']);) would trigger copy-on-write, unless I'm mistaken.

And the SQL example isn't meant to be copy/pasted: it's a demonstration of a fairly common anti-pattern that has nothing to do with SQL escaping. Adding escaping there would just confuse the point.

nbpoole··on Why Spammers Spam
http://news.ycombinator.com/user?id=xnerdr

It appears his old username is/was.

nbpoole··on Let's make the web faster: PHP performance tips by Google
Those comments appear to be based on an older version of the page. The current page doesn't have most of those "optimizations."

Edit: And confirmed. See http://web.archive.org/web/20090628004019/http://code.google...

nbpoole··on Legal contracts for freelance developers on Github
From earlier today (since it's related, especially the HN comments): http://news.ycombinator.com/item?id=2612245

Personally, I would be wary of using any contract written by someone who isn't a lawyer. Telling people that you feel "there is no need to state the obvious as many contracts do" doesn't instil a lot of confidence either: how do you know what needs to be explicitly stated and what doesn't?

nbpoole··on Why NYC is not Palo Alto cc: MikeBloomberg
As you pointed out, it's a gray area.

http://answers.onstartups.com/questions/19422/if-im-working-...

"Not related to your employer's line of work. Um, wait. What's the definition of related? If my employer is Microsoft, they do everything. They made a goddamn BARNEY PLUSH TOY with a computer in it once. Are plush toys related? Obviously operating systems, compilers, desktop applications, search engines, and games are related to Microsoft's line of work. Hmmm."

"This ambiguity is meant to create enough of a chilling effect on the employee working in their spare time that for all intents and purposes it achieves the effect that the employer wants: the employee doesn't bother doing any side projects that might turn into a business some day, and the employer gets a nice, refreshed employee coming to work in the morning after spending the previous evening watching TV."

← PreviousPage 6 of 15Next →