senorprogrammer

I think you just described programming.

I wish that affected sites would simply reset my password themselves, internally, and then inform me when I visit the site that I need to use the 'Forgot Password' function to reset my password.

As it stands, they get to say they're patched while I remain vulnerable, and now it's my fault if my account is compromised if I don't get around to resetting my password (or they're a site I visited once, years ago, and forgot all about).

Simply updating OpenSSL without fixing passwords just shifts the onus to the users.

These cameras aren't baby monitors per se, they're designed for surveilling a space. They have both a microphone for listening and a speaker for... shouting at ne'er-do-wells stealing your stuff, presumably.

As an owner of one of these cameras I remember being appalled at how difficult it was to actually secure, how many settings needed to be changed, and how bad the defaults were. Foscam cameras are practically shipped open and insecure by default, and it's not a stretch to say that you need to be a security-minded technophile to figure out how to lock them down properly.

They make commercial routes look positively impregnable by comparison.

In this case I would replace "stupidity" with "assumption". It was code-reviewed so that level assumed correctness. It's in OpenSSL, which is written by experts, so the millions of us that use it every day assumed correctness. Our customers know little about the workings of the internet, so they assume correctness.

This, incidentally, is the same sort of thinking that sometimes kills experts in dangerous situations: the assumption that someone smarter than us must by definition know more than us, so we can be lackadaisical. Witness Snow Fall (http://www.nytimes.com/projects/2012/snow-fall/?forceredirec...)

Nope, there's more bad code being written now than at any other point in history (I totally just made that fact up and I stand by it). If ever there was a time to be hero through code deletion, now is the time. Carpe diem!

I hypothesize that any numbers-based code metric management comes up with can also be gamed by adequately-motivated developers. In fact, if you come up with such a metric and have a developer who can't figure out a way to game it, perhaps you want to consider letting that developer go.

Were I to work in a place with a 'git commits' metric for productivity, I'd happily commit each line individually, to ensure that any potential data loss was as limited as possible, of course.

To paraphrase Wally from Dilbert: "I'm writing myself a mini-van."

"meatspace firewall" might be the best term for a cease-and-desist lawyer I've ever heard. Well said!

Once upon a time I did the start-up, sleep-deprived, living at work thing, and frankly younger me thought it was awesome. Older me looks back and things younger me was sometimes an idiot.

Recently I had a kid and got to experience the sleep-deprivation effects all over again except this time with one big difference: I work with an awesome team who were able to pick up the slack, and I was smart enough to know when to ask for help (once literally saying "I'm too stupid to do this now, can you do it?")

Sleep-deprivation is going to continue to be endemic in our industry (not just amongst start-ups, the twenty-somethings today are going to be having kids soon themselves). Instead of fighting through the slack, find ways to mitigate it; build your teams with people you can rely on to cover you when you're short.

I mean this in the nicest way, but you've rather missed the point. While your response might be technically accurate and true, the author speaks to a greater issue than a one-off hack will support.

As a Canadian I've learned we seem to get practically waved through as well. The most pleasant immigration experiences I've ever had have been in Germany and France over the past few years. By far the least pleasant experiences have been travelling from Canada to the US.

Regarding your last point, and as pure conjecture, it depends on how old the password is. When I was a student signing up for trial software etc. I often thought such things like "No one will ever guess 'offspring' as my password, that band is so obscure!"

Young me was much less paranoid than old me.

I would recommend 4 unless you have prior knowledge of an incompatible gem you can't live without. The benefits are worth it. I've built two small-scale Rails 4 apps now and all incompatible gems have been easily replaced with either custom code or other gems.

On average. I suspect his clicks were bursty.

Nope, this is a front-end interface for getting your files from the user to the browser and then to your Rails app.

Paperclip and Carrierwave (I highly recommend Carrierwave) manage the actual storage of the file data (ie on S3) and the incorporation of the file into your ActiveRecord model (I'm glossing over a lot but hopefully you get the idea).

Basically, Dropzone would be a companion to your Rails-based file storage mechanism.

The "no code" aspect is bandied about a lot but it looks legit in this case. That's extremely attractive; sending common automated emails should really not need development team effort. Nice work!

Most IFE systems are air-gapped from flight control systems, if that's what you're worrying about.

Could you expand on this? I've been eyeing the Belkin.

Link to the actual article: https://medium.com/life-hacks/80f8d525b0d8

The simpler explanation is that the cluster running all developer-related sites is down. It doesn't always have to be a conspiracy.

Almost as they they're trying to report rather than spread "rumor, or conjecture"? If that's the case they deserve applause; it'd be nice to see news agencies back on the reporting track, analysing and filtering before going on-air.

"Changing the facts?" - I don't follow. The data is there in front of you, nothing has been changed. Most likely article authors have no capacity to remove that statement from their posts and that it's just boilerplate CMS content.

We should not necessarily ascribe to malice what can be explained through lack of functionality.

Imagine, if you will, a father who knows he needs to make a public statement, one that will be scrutinized by an entire world. A father wanting not only only convey his pride but also to help sway a country's opinion. Such a father might well turn to a legally-educated, historically-knowledgable third-party, one well-versed in writing convincing, lucid arguments, for guidance and oversight. I think I would.

Most likely boilerplate provided by the CMS and attached to every article. Don't read too much into it.

Yes, in the same way that an excellent front-door lock doesn't stop someone from smashing your front window.

For the purposes of encrypting traffic to prevent eavesdropping, one of the recipients sending the unencrypted data to a third-party is not an attack vector of consideration. In your scenario the only viable measure is to send no data at all (aka "don't play").

Agreed. It's just as feasible that the beneficial effect is derived from his sense of taking control over his condition rather than being controlled by it (effectively feeling like an active rather than passive participant in his depression). I make no claim that this is actually the reason, only to provide one feasible, untested alternative theory.

Further scientific study in this field should be very interesting indeed.

Sadly there's very little value in reading this article, insofar as it contains no useful insights or lessons but rather is simply an exercise in throwing stones at someone's life-work, and, near as I can tell, it comes from out of left field.

Mostly this article makes me feel bad for its author. He must have spent a non-trivial amount of time writing this piece, and it serves no end. I suppose I just can't fathom why it made him feel good to write it.

The article's author cleverly avoids the shame of Betteridge's Law by simply leaving off the question mark, but alas the result is the same. And in that you find your answer.

Nicely done!

This is beautifully designed, and I think you ought to raise the price. Lots of comments about the potential support headaches are spot-on; price as many of those out as you can.

Check out patio11's online talks for more rational.