thomc

A brave effort. Given your commit history, documented plan and great idea I was happy to back it [1] and hope you succeed. Best of luck :)

[1]: https://www.bountysource.com/fundraisers/539-neovim-first-it...

What about the charger, warranty card, manual, etc? There is space at the top of the bottle masked by a silver band which might contain something, but surprised if you could get the charger in there.

I tried it on my account, you get the confirmation that it has changed, but when I logged in it hadn't actually changed the setting. Perhaps one of the URL params is a token, CRC or hash of the email which ensures you need the correct values for the email you are changing.

I'm not sure why, but the blog post seems to be passing off Dan Rosenberg's comment on the stack-based buffer overflow as though it was written by the blog author. The original post with credits: https://plus.google.com/110348415484169880343/posts/5ofgPNrS...

Looks good, and useful to me, nice work.

Will you be covering security in any detail? Most people seem to miss this and I'm discouraged to see when I download the MEAN project this is based on it has serious security flaws.

For example, if you view the articles list at /#!/articles and make a note of any article ID, then visit /article/<article_id> it will return the article author's hashed password, salt and email address in addition to the article content. This also works while logged out. Kinda scary if people are using this as a template for their own apps.

But their OpenVPN support is awful and limited, unless you enable developer mode and set it up manually. Prevents Chromebooks from using VPN in our office.

Seems a number of companies going this route, here's one I haven't seen mentioned yet: https://launchkey.com/

I'm 6 for 5 at the moment - of the 6 companies I've hosted pet projects with over the years, 5 have been compromised at the control panel / infrastructure level while I was a customer:

  * Layered Technologies, dedicated OpenBSD (Sep 17 2007) [0]
  * Hetzner, dedicated Linux (Oct 21 2010) [1] 
  * Dreamhost, shared Linux (Jan 19 2012) [2]
  * Linode, VPS Linux (Apr 15 2013) [3]
  * OVH, VPS Linux via reseller (Apr 23 2013) [4]

  [0] http://what.entwinedstudios.com/?p=21
  [1] http://mybroadband.co.za/news/internet/16021-Hackers-hit-Hetzner.html
  [2] http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-passwords-due-to-security-issue/
  [3] http://blog.linode.com/2013/04/16/security-incident-update/
  [4] https://news.ycombinator.com/item?id=5632479

Food for thought.

It can be surprisingly hard to fight this. As the author notes, even if the ramblings of the stalker are so obviously crazy, it still requires people to evaluate whether you could have done said actions and whether it is a risk to associate with you regardless.

My wife got dragged into a situation a while ago. She merely commented on a blog article about a man who had travelled to another country, got a woman pregnant, and then when the woman got sick and needed treatment, claimed it was a scam. In his mind it grew into a giant conspiracy. Anyone who didn't take his side was involved in this conspiracy, including the hospital, local business people, even the British Embassy was in on it apparently. And then my wife, for commenting on an article. I worked out that if you divided the hospital bill by the number of people he alleged were involved, they'd all make about $3 each.

The local community rallied behind the woman who was disadvantaged and could barely afford the bill. They tracked her down, obtained proof from the hospital, took photos and posted them (with permission) thinking that would clear up the allegations. He started to look for evidence in every blog post, image, comment and forum posting. Where you look for a pattern, given enough data, you start to find them. He tweaked his conspiracy theory to fit the patterns he found, offering them up as evidence. My wife's name ended up on a "website of scammers" he created. He set up free websites on many services, created videos which he cross posted to every video sharing site (surprisingly effective), set up blogs dedicated to his ramblings.

Eventually the community he was targeting with his hate had enough. Being computer literate they beat him at his own game, set up a domain that matched his real name, used masses of SEO and inbound links from networks of blogs they ran, and listed what he'd done on the website. Now whenever someone Googles his name or something related, they can see exactly what he's done. Since he worked as a freelance professional with schools, theatres and companies, this really was not good for him, and after that he seemed to vanish. I presume this was only effective because his own reputation could be used as leverage. If they have nothing to lose it would be a pretty bad situation, as the author has experienced.

I have another anecdote about a friend who tried to raise money in his community for victims of a disaster, only to be character assassinated by a fake facebook account. He stopped raising money and cut himself off from the community which is a real loss.

Same here, from the UK and always wished the outgoing local calls were free like the US.

However, many of the robocalls and scam calls coming into my line these days appear to come from overseas. I don't know how they can afford to do that but I've seen reports that some are using spare capacity in legitimate overseas call centres as a side-business. Otherwise you have to assume they make enough from their scam to be worth it, or purchase the capacity on credit and do a runner before paying the bill, or using stolen credit cards. Actually there are many ways now that I think about it!

Point being that charging for outgoing calls won't stop the robocalls but will cost legitimate users.

I'm in the UK and mostly work from my home office so robocalls and the like became really annoying. I installed a "trueCall"[1] device and it completely stopped robocallers, those "I'm calling from Windows" scammers (which were actually funny) and others. I just use the basic setting where it tells the caller "Press 3 to be connected. If you are a cold caller please hang up and do not call again". I'm actually a little surprised how effective it is.

If the robocall were to blast DTMF tones down the phone it could automatically bypass and I'd need a more advanced setting (of which there are many). But I haven't needed to do that in over a year of operation. Only downside so far is my bank has recently taken to calling me up to verify transactions, using a robocaller, so I may need to give them my mobile.

I considered setting up asterisk to do something similar since the device was a little pricey, but decided the time saving was worth it. It also records my calls to a SD card if needed. Now my land line is the disposable one I give out and my mobile number is the one I'm careful with.

Not affiliated with them, just a satisfied user.

[1] http://www.truecall.co.uk/

It was apparent with NGS too, who were (are) one of the most highly regarded pen testing companies here in the UK. Having worked with many of the leading ones I can say NGS was always at the top of the list, helped not only by their talent but also small size which made them flexible and adaptable. After the acquisition I noticed this changed and a number of the guys I'd worked with left. So it is probably good that Matasano is staying Matasano but with the ability to draw on the collective resources of all the other teams.

I use the compact TypeMatrix USB keyboard which can switch to hardware Colemak using a hot key. When I plug it into my Android tablet I can type Colemak with no issues. The keyboard was an ideal size for taking on the plane yet full featured enough that it is my main desktop keyboard.

On Android, apart from being able to run Backtrack on certain Android devices you have tools to MITM WiFi and other fun stuff (on rooted phones) and there is some movement in making it into a developed product, e.g. ANTI: http://www.zimperium.com/Android_Network_Toolkit.html

Not exactly BS - it depends on the cards. In the UK this has been demonstrated to work on Visa cards from a few different banks. I did a quick demo for Channel 4 News at their request a little while ago, video:

http://www.channel4.com/news/millions-of-barclays-card-users...

Also did one in a crowded lift for BBC Watchdog and live on This Morning breakfast show. It is pretty old news (as in years old) and is not exactly an effective way to lift lots of details. But makes a cute demo.

Ruby too:

  ['dog', 'cat', 'bird'].zip(['brown', 'black', 'red']).each {|animal, color| puts "See the #{color} #{animal}?"}

I'm fairly certain you can do it in other languages, unless I didn't understand what you mean. In Python it would be something like:

for animal, color in zip(['dog', 'cat', 'bird'], ['brown', 'black', 'red']): print 'See the %s %s?' % (color, animal)

edit: eurleif beat me too it.

On the one hand if you can argue that someone can guess the unique gist ID, you could also argue they can guess your Github session ID, in which case authentication is moot*

On the other hand, because the Gist ID is in the URL, it is more prone to leaking.

One example: I uploaded a PDF (classification: public) to a web server and sent the link to a few people. It was not published anywhere, not communicated outside our group, there were no external links to it, so it could not be spidered. Couple of days later Google had managed to index it, and it was getting downloads. How did Google know it existed? Maybe someone used GMail, maybe they had Google toolbar installed which submits URLs to Google for indexing, who knows? I noticed Github has blocked Google et al from indexing all the Gists with robots.txt, which helps.

Either way, probably best to be careful how you handle the "private" Gist URLs, or just don't use them for super secret information.

*yes session ID is longer, and should have a finite life span, so it may be harder, but the same kind of issue.

These kind of tricks are pretty handy, and I don't know why I wasn't taught them back in school, growing up in the calculator generation. My father could do all kinds of math in his head, which was just as well since he was a mathematician, but couldn't explain how he did it, he just "knew" the answer.

I taught myself some tricks after the fact, the rest is just practice I think. Some examples:

Multiply any two digit number by 11 easily:

Using 62 as an example. Separate the two digits (6__2). Notice the gap between them Add 6 and 2 together (6+2=8) Put the resulting 8 in the gap to get the answer: 682, 62x11=682.

If the result of the addition > 9, put the least significant digit in the gap and carry the most significant digit.

This can be expanded to multiply any number by 11 in your head.

Even really easy/obvious tricks are useful, e.g:

To quickly multiply any number by 5, divide the number in two and then multiply it by 10. Very quick to do in your head.

Nice start. Little way to go before it overtakes commandlinefu.com but already I see a really nice feature - people asking for help creating a one liner. Bit like a stack overflow for bash one liners. Always fun to see people compete for the best/shortest/weirdest one line answer.

I find it hard to navigate at the moment - I mean looking for what you want, searching. Still a bit raw. Maybe needs tagging and more advanced search options.

Thanks for making the site open source too.