Hacker News Reader

timothyaon Waterloo Co-op: A Blessing and a Curse

If you're in engineering at Waterloo, you don't have a choice about course load - you must have a full course load at all times.

timothyaon Intent to deprecate: Insecure HTTP

Certificate pinning [0] is a common way.

[0]: http://en.wikipedia.org/wiki/Transport_Layer_Security#Certif...

timothyaon YouTube's paid subscription offering takes shape

My interpretation is just that if an uploader turns on monetization for a video, then the money they make for that video can come from both ads and from the people with paid subscriptions (i.e., you can't have a video which doesn't participate in the new program and that just continues to show everyone ads, because then the paid subscribers would not be able to skip ads for that video, even though that's what their subscription is supposed to do).

This has nothing to do with uploading videos for free that can be watched for free.

timothyaon Secret Service Interrogation of Wozniak (2002)

Here's a video of Woz showing his pad of $2 bills and talking about this story: https://www.youtube.com/watch?v=LJ1TIYxm1vM

timothyaon elgooG

failoverflow was actually right; while scaleX(-1) is present, it's overridden: http://i.imgur.com/mNjGE0F.png

It doesn't matter though, both transforms have the same effect.

timothyaon Rethinking office space

MPK is also a common abbreviation for Menlo Park.

timothyaon Our first building block in tech for tykes: YouTube Kids

What you describe is already supported, though it looks like it's only available for paid videos or channels (anyone can set whether or not a video of theirs is "mature" and should be age-restricted, however). The rating levels are listed here: https://support.google.com/youtube/answer/146399

And instructions for creators to set ratings is described here: https://support.google.com/youtube/answer/176714

timothyaon Windows SSL Interception Gone Wild

Since people are disagreeing with my comment, I'll add some extra information (apparently I missed the editing time window, but I stand by my original comment). I should note though that I was talking about Chrome (I don't know what the deal is with Firefox).

If you go through the Chrome bug tracker, you can find several instances where Chrome engineers point out that Click-to-Play is not meant to be a security feature, and that the "Block all" setting is what is actually secure. There are several bugs which demonstrate ways around Click-to-Play which are closed as "WontFix". A quick search yields the following quotes from Chrome engineers:

"Yes, this is why click-to-play is designed as a convenience and not a security feature. If you want plugins blocked in a way that cannot be click-jacked, use "Block all," which requires a protected browser interaction (context menu, page action, etc)." [0]

"The "Click to play" setting is not a security measure. If you want to securely block plugins you must use the "Block all" option, which is a bit less convenient than "Click to play," but provides a click-jack resistant, browser mediated interface." [1]

"I'm kicking this out of the security queue because it isn't a security mechanism ... The secure method of blocking plugins is to select "Block all" and right-click to run. Whereas the "Click to play" feature is for convenience and performance." [2]

"It's not a security feature..." [3]

[0]: https://code.google.com/p/chromium/issues/detail?id=176724

[1]: https://code.google.com/p/chromium/issues/detail?id=225636

[2]: https://code.google.com/p/chromium/issues/detail?id=160707

[3]: https://code.google.com/p/chromium/issues/detail?id=414232

I'm sure there are other instances where they talk about it more, these are just the first results I found.

timothyaon Windows SSL Interception Gone Wild

Side note: click-to-play is a usability feature, not a security feature. It's still possible for Flash code to run before the user "clicks to play".

timothyaon CMU Accidentally Sends Out 800 Acceptance Letters To CS Program

This is exactly what I'm talking about. No one knows what each other is talking about when saying "UW". Looking at chris_va's profile, it appears he was talking about the University of Washington. Most of the US probably thinks of UW that way, though in Silicon Valley I've met a lot more people from the University of Waterloo than from the University of Washington.

timothyaon CMU Accidentally Sends Out 800 Acceptance Letters To CS Program

Note that "UW" is a very overloaded term:

- University of Washington

- University of Waterloo

- University of Wisconsin

- University of Wyoming

etc.

timothyaon Show HN: Browse recently expired, pronounceable domain names

It appears to me (from my quick glance through it) that all of the domains follow the pattern of alternating consonants and vowels (with an additional rule which is that it allows for two identical consonants in a row, e.g. "mm" or "ll"). Combinations of letters which alternate between vowels and consonants are typically at least somewhat pronounceable.

timothyaon Native Americans Say Facebook Is Accusing Them of Using Fake Names

This isn't really too surprising; this is the kind of problem you have when you try to automatically enforce real name policies. When you try to create a system which separates real names from made up ones, it's a lot harder when real names can have common English words which aren't ordinarily found in names.

Google+ had similar problems, if I remember right, and they ultimately solved the problem by getting rid of the real name policy entirely.

timothyaon Google discloses another Windows security issue after deadline exceeded

When I go to their public code review app [0], it looks pretty active. The last 100 changes listed there were modified in the last 24 hours!

Which parts are they coding in secret? (Honestly, I don't know, please help me understand)

[0]: https://android-review.googlesource.com/#/q/status:open

timothyaon Show HN: Primrose – A text editor that draws to Canvas

This reminds me a bit about the Mozilla Bespin editor from several years ago. They've since merged with the ACE editor, but before the merge they drew everything on a <canvas>. There's some more information about that here: http://benzilla.galbraiths.org/2009/02/17/bespin-and-canvas/

timothyaon Google is shutting down OpenID 2.0

> BTW: Maybe you should also read my full post, before answering.

Heh, I see that you edited it to add more since I originally pressed "Reply".

You imply Google is "evil" because they write "only about Google+ SignIn", but I'm not seeing that. The link that you provided has two sections, migrating to Google+ SignIn if you are already using a Sign In with Google button, and a section on how to migrate to just basic OpenID Connect. It doesn't seem hidden away like you are implying.

timothyaon Google is shutting down OpenID 2.0

Google+ Sign-In is an implementation of OpenID Connect, with some nice features built on top:

"Google+ Sign-In is built on the OAuth 2.0 and OpenID Connect protocols. It supports over-the-air installs, social features, and a sign-in widget on top of standardized OpenID Connect sign-in flows. Google+ Sign-In works for all users with a Google account, whether or not they have upgraded to Google+." [0]

I don't understand where all your other conclusions came from.

[0]: https://developers.google.com/accounts/docs/OAuth2LoginV1

timothyaon An Update to End-To-End

Unless I'm reading this wrong, according to the End-to-End docs, it looks like keys are kept in a "Key Directory", and that Google will run one Key Directory, but you can use whatever Key Directory you want. I haven't seen evidence that Google will have any access to your unencrypted data.

timothyaon PresidentObama on GitHub

Unfortunately, such a system would be very difficult for U.S. law. See this previous discussion: https://news.ycombinator.com/item?id=3968653

timothyaon Gangnam Style breaks YouTube viewer count

From the Google C++ Style Guide:

"You should not use the unsigned integer types such as uint32_t, unless there is a valid reason such as representing a bit pattern rather than a number, or you need defined overflow modulo 2^N. In particular, do not use unsigned types to say a number will never be negative. Instead, use assertions for this." [0]

[0]: http://google-styleguide.googlecode.com/svn/trunk/cppguide.h...

timothyaon Why browse the Web in Emacs? (2008)

Plenty of sites do use client-side instrumentation, and so they do indeed benchmark their site on your machine, and then make decisions based on the results of those benchmarks (likely aggregated with many other benchmarks from many other users). Yes, sometimes JavaScript is used poorly in ways that make sites bloated and slow, but plenty of sites use it properly in ways that only make their sites better (collecting the appropriate data to confirm that what they are doing is making their site better).

timothyaon Map JavaScript API

Even today, you shouldn't need to write code like that. Just bind functions to the current scope. That looks something like this (imagine this code is in the context of some object):

    element.addEventListener('click', function(e) {
      this.foo();
    }.bind(this), false);

Notice the call to "bind" which binds the click handler function to the current object, so that inside it can call this.foo().

timothyaon Why browse the Web in Emacs? (2008)

Why does that make you angry? Sometimes, reimplementing how loading works can make your website more performant, for example. If JavaScript gives developers the power to make their websites better, why shouldn't they take advantage of that power?

timothyaon Yahoo Mail moving to React

1. This is rarely a problem. You want to be careful about writing code that will take a long time to execute, but most long-running APIs are async which helps a lot.

2. Weak typing is a nice feature for prototyping, but for larger projects, a stronger type system is better at catching bugs. Many JavaScript programmers (myself included) are used to using separate systems to check types for them. My team uses the Closure Compiler, which, along with compiling the JS to a more optimized version, is also happy to check all your types and fails to build if your types don't line up.

3. Again, I believe this is something that you can make sure that the compiler catches. And, of course, anyone can write bad code (in any language); if you're overwriting stuff halfway across the codebase, then that's "bad code" and you should avoid doing that (and during the code review stage, you should be making sure that your coworkers don't do that either).

4. Like for any language, have guidelines for how you write code, and enforce some of your conventions with the compiler and with linting tools. It leads to a more consistent codebase.

timothyaon Google disables SSL search at BT’s request

Some more information: http://googleonlinesecurity.blogspot.com/2014/10/an-update-t...

timothyaon Nineteenth century machine that performs Fourier analysis

Direct link to the eBook PDF: http://www.engineerguy.com/fourier/pdfs/albert-michelsons-ha...

Direct link the the accompanying video playlist: https://www.youtube.com/watch?v=NAsM30MAHLg&list=PL0INsTTU1k...

timothyaon Why Asana Is Switching to TypeScript

Dart can as well. In fact, I think that the whole type spec in AtScript is based on Dart.

Edit: Quote from the doc you linked: "This runtime type system is modeled after Dart’s runtime type assertion. Dart users working on large scale applications point out that optional types and runtime type assertions work well in practice."

timothyaon Ask HN: Where do you see web and desktop apps in 5 years?

The fact that your data is stored on a cloud provider doesn't mean that that provider owns your data. For example, from Google's TOS:

"You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours." [0].

The context of the quote from the court documents you referenced [1] is that Gmail inevitably needs to be able to process your emails in order to send them (and potentially filter out the spam). It is not, as you seem imply, about violating your privacy.

[0]: http://www.google.com/intl/en/policies/terms/

[1]: https://www.scribd.com/doc/160041493/Google-Motion-061313

timothyaon Google Inbox

Yes. Things marked as done in Inbox (including marking many things as Done by sweeping) are shown as archived in Gmail (and vice versa).

timothyaon What Is Google Chrome Helper, and Why Is It Hogging My CPU Cycles?

That code doesn't work (at least in ordinary page scripts), as far as I can tell.

http://jsfiddle.net/vej6vbdt/