HNHacker News
TopNewBestAskShowJobs

richardjs

544 karma · joined February 10, 2012

submissionscomments
richardjs··on Firefox Developer Tools and Firebug
Also, bundled developer tools can be nice when you're trying to debug an issue on a user's machine. It's a small thing, but it's nice to not make them install some plugin.
richardjs··on SQRL - Replacement for usernames and passwords
With the traditional username/password system, you have to remember a unique, secure password for each site--or else you use a password manager, which involves more steps as well. He's also mentioned that this could be adapted into a browser plugin, so that would streamline use on a trusted machine.

As for losing the phone, he suggests a passphrase-like "local password" on "The user's view of the application" page [1].

[1] https://www.grc.com/sqrl/userview.htm

richardjs··on SQRL - Replacement for usernames and passwords
Yeah, that's a concern of mine too. Looking deeper at the description, looks like he describes a passphrase-like "local password" on the "The user's view of the application" page [1]. Hopefully that would address that issue (at least as much as passphrases do for SSH keys).

(And no problem. If we were forced to comment using only precise terms, with no simplifications, comments would either be ridiculously long or nonexistent.)

[1] https://www.grc.com/sqrl/userview.htm

richardjs··on SQRL - Replacement for usernames and passwords
Sure, if you're using an appeal to authority as part of the argument in favor of the protocol. Hopefully we're relying more on logical analysis of the protocol than we are on the proposer's authority, in any security context. Isn't that one of the points of open protocols?
richardjs··on SQRL - Replacement for usernames and passwords
He described a local password (basically a passphrase) on the "The user's view of the application" page[1].

[1] https://www.grc.com/sqrl/userview.htm

richardjs··on SQRL - Replacement for usernames and passwords
Not to use a debate cliché, but isn't this a ridiculously shameless ad hominem? He's published the protocol and disavowed any intellectual property claim to it. Let's focus on critiquing the protocol.
richardjs··on SQRL - Replacement for usernames and passwords
It's not really a password manager--there's no shared secrets. The site identifies you by a public key. For authentication, it gives you a nonce, and you sign it with the corresponding private key. All the secrets are kept on your device.

I've wondered about the "something I know" dimension as well. Perhaps a passphrase could be used (it already is used to secure the master key). It'd still be a major improvement, as only your local device would need it, and you wouldn't have to have a separate password for each site.

richardjs··on SQRL - Replacement for usernames and passwords
That's a question I have. One potential answer is that it moves authentication out-of-band, in case there's a keylogger or other malicious mechanism of the machine you're using. Also, it removes the need to remember a separate password for every site. Your master key is secured with a password, but that's it. It also removes the need to have a shared secret with a site, and doesn't require any third-party involvement.

He spends a good chunk of the latest episode of Security Now [1] describing it's advantages over current schemes. The episode isn't up yet (I listened to it on the the site's live stream), but it should be soon.

[1] http://twit.tv/sn

richardjs··on HTML5 Flash Player (Shumway) lands in Mozilla
Fair enough. You have to be careful taking this argument too far, though, or you end up saying something like no other browser besides IE should be developed, because it increases the attack surface.

Ultimately, individual users have to take charge of their own individual attack surface. If switching from one Flash player to another increases their personal security, it's a good thing.

richardjs··on HTML5 Flash Player (Shumway) lands in Mozilla
Sure, and not browsing the Web at all is even safer. But it's nice to see developments that make insecure technologies more secure.
richardjs··on Don’t Slurp: How to Read Files in Python
Is there a difference between the two? I assumed that without the "with", the file would still be closed once the loop was exited (and thus the reference to the file is dropped), but I'm open to the possibility that I'm mistaken.
richardjs··on Don’t Slurp: How to Read Files in Python
Is it non-idiomatic to do "for [line] in [file object]"? I use "for line in open('file')" all the time, for similar reasons as presented in the article. "for line in sys.stdin" is basically the same pattern, just with a different file object.

Edit: The idiom's mentioned in the Python docs on IO [1] as "memory efficient, fast, and leads to simple code"

[1] http://docs.python.org/2/tutorial/inputoutput.html#methods-o...

richardjs··on Steam Controller
Super Mario 64 DS had an interesting feature where you could put your left thumb on the touch screen and use it like a joystick. The neutral zone would be wherever you put your thumb down, and a little diagram would appear on the touch screen showing where the edges, neutral zone, etc., were.

I remember this actually not being too bad. I didn't use it over the D-pad for any precise movement, but part of that was the awkwardness of having to stretch the thumb over the the touch screen. There also was a little thumb pad on the DS strap you had to wear to get it to work smoothly, and that was a little clumsy to use. It was also hard to get a sense of where the neutral zone was, etc., since the only indication was a diagram under your thumb.

It looks like this controller takes that same idea and improves on it. You won't have to stretch your thumb or wear a thumb pad, and the circular trackpad maps better to a joystick than an arbitrary circle somewhere on a touch screen. It also looks like there's ridges on the pad, which could help with getting a sense of where you are.

If it was sort-of viable as a side feature in a nine-year-old game, I'm optimistic about Valve's ability to make it work. As you said, it's not like Valve is unfamiliar with the area.

richardjs··on How many people are in space right now?
Site's broken. Clearly there is one hedgehog in space, as illustrated by the site.
richardjs··on Large patent holders hate this reform proposal. That’s a good sign
Exactly what I was hoping for. Thanks!
richardjs··on Large patent holders hate this reform proposal. That’s a good sign
Also related to the ads, does anyone have some marketing distillation of why they always use the words "weird trick"? Weird trick for weight loss, weird trick for language learning, etc.
richardjs··on Metadata Equals Surveillance
Good point. On the other hand, many people have hand-waved the issues by saying "it's just metadata" in the sense that Schneier is describing. While Obama and the NSA might not have dismissed it that way, many people have, and it's that view that Schneier's objecting to.
richardjs··on Joe Armstrong on Programmer Productivity
He's sleeping right now. Try again in twelve days.
richardjs··on Python coding standards
PEP 8 goes on to give the rational: "Limiting the required editor window width makes it possible to have several files open side-by-side, and works well when using code review tools that present the two versions in adjacent columns."

It also says that if your team can agree on a longer length, it's okay to increase it.

richardjs··on New NSA Leak Shows MITM Attacks Against Major Internet Services
I wondered the same thing regarding them requesting private keys a while ago. If they could break the ciphers, why would they need the keys?
richardjs··on I feel like Gmail went from being Photoshop to Draw Something
I don't think it's nitpicking. It's the difference between the standard way web forms work and Gmail overriding a known behavior to do something else.

That said, after you hit tab, you'll probably type a word and hit space, which will then click the button and send off the message.

richardjs··on What Thomas Edison expected job candidates to know
Part of me wonders if Edison wasn't concerned so much with the actual answers to the questions as how an applicant went about answering the questions, and how the applicant reacted in the face of the test. Or perhaps he cared about some questions, and threw in a bunch of random ones to see what the applicant would do.
richardjs··on The Basement
True, but there are other kinds of images--paintings, sketches, drawings on a cave wall. We've been putting things on walls for a long time.
richardjs··on Instagram's official response
Legal documents are easy to misinterpret.

It's a shame this is the case. Isn't it part of the point of legal documents to be hard to misinterpret? Isn't that supposed to be why they use such stiff language?

richardjs··on Instagram says it now has the right to sell your photos
Would it be viable to let users opt-in to selling their photos, with users and Instagram splitting the money? That seems to be a system that would appeal to both sides.
richardjs··on Show HN: Music for Geeks and Nerds
Thanks!
richardjs··on Show HN: Music for Geeks and Nerds
The site says a paperback edition is coming... is there a way we can sign up to be notified when it's available?
← PreviousPage 2 of 2