Hacker News Reader

throwaway125on [dead]

I'm not sure I understand with how you got to "entirely". Yes, his pull request was dangerous but it also reveals how the repo owner would accept just about any pull request you send him. That seems like a major issue. I'm sure both parties involved will not make these mistakes in the future.

throwaway125on Bitcoins can now be used to pay for Domino’s Pizza

While it may be easy to transfer bitcoins anonymously, spending them anonymously on tangibles is just as hard as spending any other kind of money anonymously. Tax evaders are often caught because their lifestyle and assets are inconsistent with their reported income, and not necessarily because government is able to follow their money.

from https://en.bitcoin.it/wiki/Myths

throwaway125on Poll: Do you find article title changes annoying?

To be fair, usually when a title changes post submission it's to rename it from obvious link bait to something more reasonable. If people are discussing the link bait title instead of the actual content then that's all the more proof that editing the title makes sense.

throwaway125on Poll: Do you find article title changes annoying?

If done well I much prefer an editorialized title to the original title (providing the original title is not a good fit as per the guidelines.)

throwaway125on Police crack down on Silk Road following first drug dealer conviction

https://www.torproject.org/docs/hidden-services.html.en

tl;dr hidden services are anonymous

throwaway125on How Yahoo allowed hackers to hijack my neighbor's e-mail account

the gist of it seems to be that yahoo ran a vulnerable wordpress site that allowed the attacker to run javascript from the yahoo domain, allowing them to steal login cookies.

That makes me wonder, doesn't yahoo set the http only flag for their session cookies? Is there any reason you may want javascript to access the session cookie?

Suppose it's a good time for everyone to verify that their websites properly set http only on any cookies you don't want to access via javascript.

throwaway125on Mozilla Recognized as Most Trusted Internet Company for Privacy

Speaking for myself here, but many of the reasons Google is so bad for privacy isn't necessarily because of something Google did themselves. There are very few websites on the internet that don't have some form of Google tracking device on them (analytics, ad-sense, jquery loaded from a Google domain, etc).

Any one company having access to such a big database of information about pretty much everyone that has ever used a web browser should never happen, but it happens at Google.

throwaway125on Megafail

So you're one of the people that buys into the whole "It's easy to tell what files are legally shared" and it's just not true. Which is proven time and time again when publishing companies send DMCA takedown requests for the content another department in their company published intentionally.

Almost everything is covered by copyright, it's indeed not too hard to figure out if something is covered by copyright. It's much harder to figure out who owns the copyright on something, and it's almost impossible to figure out if a certain file is authorized by the copyright owner.

Just because a file is popular doesn't mean it's infringing. Can you guarantee this popular file wasn't posted on twitter by the artist for a marketing campaign? Can you guarantee the artist didn't upload it to a torrent site to get attention? No, you can't. You'll just take a flamethrower approach and many legitimate files will be removed in the process.

throwaway125on Youth expelled from Montreal college after finding security flaw

I've had similar encounters with privately disclosed vulnerabilities that are still live years after the fact. What is the right course of action here? If you just wait out and the vulnerability eventually gets exploited they could blame whoever reported it "because he was the only one who knew". You can't really anonymously disclose it after privately reporting it either, because they'll quickly link it to who reported it before.

throwaway125on 'I Have a Dream' Posted in Defiance of Copyright for Internet Freedom Day

I'm really sorry, I didn't know it caused that because it didn't happen in my browser (firefox) but after the complaints I looked at it in chrome and it does indeed break the formatting. I can not edit my previous post anymore, again sorry for the inconvenience.

throwaway125on 'I Have a Dream' Posted in Defiance of Copyright for Internet Freedom Day

Since some people can't access the videos and many of the links will go dead here's a torrent[1]. I also found the text[2] but that seems to have some of its words changed slightly compared to the video.

1) magnet:?xt=urn:btih:f8b92a305da8a7d12081cd348ba9859b299b3486&dn=Martin+Luther+King%7E+I+Have+A+Dream+Mp4&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80

2) http://polyticks.com/home/Visions/dream.htm

throwaway125on 'I Have a Dream' Posted in Defiance of Copyright for Internet Freedom Day

I was curious about this and a search came up with this http://en.wikipedia.org/wiki/Martin_Luther_King,_Jr._authors... in case anyone else is interested too.

throwaway125on Website Sells Fake Facebook Girlfriends

is there a name for that?

At the very least it's copyright infringement, although I'm not sure it's criminal copyright infringement.

throwaway125on Mozilla adds all recent versions of Java to its Firefox add-on blocklist

I wish Mozilla (and other browsers) also blocked plugins that don't behave while updating. I want to have java installed so I can decide to run java programs, but I don't want to have a browser plugin, so I disable it. Every single time java updates itself it enables the browser plugin again. Users should not have to put up with every installer under the sky silently installing browser plugins, or worse, updaters enabling them again.

throwaway125on Student Suspended for Refusing to Wear RFID Tracker Loses Lawsuit

Several things: 1) Mass scale surveillance becomes trivial and you'll end up in a database of suspects even if you've never broken the law 2) Your identity can be checked without your knowledge regardless of probable cause 3) The technology might not be safe, but this is much less of an issue than #1 and #2

throwaway125on An IRC bot written in Brainfuck

With all lower case it does exist: http://news.ycombinator.com/user?id=sircmpwn

throwaway125on Why You Should Join Diaspora Now, Like Your Freedom Depends On It

The core value of any social site or network isn't in the software, but in the community.

The article recognizes this and suggests that the people who care about freedom should make the initial 'investment' by creating an account, thereby increasing the value of the network for everyone else.

throwaway125on A Tor proxy that runs in your browser

From how I understand it this is not a javascript Tor implementation at all. It's an entirely different piece of software that allows you to create a whole lot of volatile short lived proxy servers that can then be used to connect to actual tor relays. The idea being that it will be really hard for censors to block proxy servers that only exist for a short period of time.

throwaway125on How and why I run my own DNS servers

With Moxie Marlinspike's KnockKnock[1] port knocking offers real additional security.

1) http://www.thoughtcrime.org/software/knockknock/

throwaway125on EFF Patent Project Gets Half-Million-Dollar Boost from Mark Cuban and 'Notch'

Regarding #3 I think they want the patent holder to prove he is actually using the invention for a (commercial) benefit. If you invent a copy protection scheme they want to see you actively sell it to third parties or actively use it in your own product. I think that makes sense to be honest, people shouldn't be able to sleep on an invention until they find a suitable company to sue for high profit margins.

Edit: This is in reply to points about software patents only.

throwaway125on Facebook's legal team bans developer of F.B. Purity from Facebook

I don't understand where your malware remark comes from. I've visited his website (albeit with noscript on) and it looks a lot more readable than your average news site. Seems like a low blow to attack him over how the website looks, especially when you mention you were surprised it didn't serve malware.

throwaway125on Is my developer's home-brew password security right or wrong, and why?

http://codahale.com/how-to-safely-store-a-password/ or PBKDF2 is also a good solution. the tl;dr version is: sha1(md5(pw + salt)) is too fast to be good, crackers can run millions of attempts per second if they have access to the hash.

throwaway125on Facebook Users Must Be Allowed To Use Pseudonyms, Says German Privacy Regulator

You can turn the same thing around, no one is forcing Facebook to do business in Germany. If they want to do business in Germany they have to follow German regulations.

throwaway125on Can websites personally identify visitors?

Reducing the uniqueness of a browser's fingerprint seems like a more valuable privacy investment than a DNT header that may or may not be adhered to by the websites you visit. Are any of the major web browsers actively working on this?

throwaway125on ITU Approves Deep Packet Inspection Recommendation

While that choice seems to make sense on a short term, I don't think giving up liberty can lead to safety in the long term. At some point your liberties will be so restricted that you're at the mercy of the rulers without much chance to influence how they rule.

throwaway125on Keep encrypted files private even from governments demanding the password

Phrack 65 had a paper calling out for people to write software that would make those types of laws unenforceable. The paper described the general idea and also presented a very technical explanation of one particular piece of software that did pretty much what the OPs software does too.

The paper is very much worth the read if you have some spare time. http://www.phrack.org/issues.html?issue=65&id=6&mode...

throwaway125on Tor exit node operator raided in Austria

I briefly looked for other information about this and I found this thread on the tor-talk mailing list. The thread mentions he contacted the torservers.net team for a recommendation about a lawyer. The thread also mentions someone is going to provide better proof soon.

https://lists.torproject.org/pipermail/tor-talk/2012-Novembe...