metavida · HackerTrans

They mention terminal passwords on their privacy page (short story, they don't read passwords if they aren't echoed on the terminal)

The ability to exclude files that I know contain sensitive data would be a very nice step. Even better if you explicitly state that retroactively excluding files will result in a deletion of the file from your servers.

metavida

11 anni fadiscuss

A few of my friends found multiple copies of ssh_config lying around, so I wrote this one-liner that looks at 3 separate known ssh_config files & patches any vulnerable ones that it finds.

$ for SSH_CONF in /etc/ssh/ssh_config /etc/ssh_config /private/etc/ssh_config; do [ -f $SSH_CONF ] && ! grep -q 'UseRoaming no' $SSH_CONF && echo "Patching $SSH_CONF" && echo -e '\nHost *\n UseRoaming no' | sudo tee -a $SSH_CONF > /dev/null; done

metavida

11 anni fadiscuss

I'm not terribly familiar with blackbox, but based on the blackbox Readme it seems that this critique from Vault's website [1] addresses why HashiCorp thinks Vault is a better solution.

> Chef, Puppet, etc. all solve this in a similar way: single-key encrypted storage. Chef has encrypted data bags, Puppet has encrypted Hiera, an so on. The encrypted data is always one secret (a password, a key, etc.) away from being decrypted, and this secret is generally not well protected since in an elastic environment, every server needs to somehow get this secret to decrypt the data. Additionally, access to the encrypted data isn't always logged, so if there is an intrusion, it isn't clear what data has been accessed and by who.

[1]: https://vaultproject.io/intro/vs/chef-puppet-etc.html

metavida

11 anni fadiscuss

I'd say nearly every move the CAH folks make is some form of nontraditional marketing. Sure, buying an island may seem like just throwing away profit, but the amount of buzz and fan loyalty generated by that sort of stunt is a big part of what keeps their brand relevant & growing.

metavida

12 anni fadiscuss

Danilo, I loved the article & thought it was much needed. Agreed that it's not the job of the marginalized to educate oppressors. Agreed that it's frustrating and exhausting for anyone to take on the task of educating others, and that your writing is an attempt at making others aware of the problems that exist. I agree that BrandonM's classification of your article as "cherry picking" demonstrates a lack of awareness of the difficulties of minorities and women in tech & at HN. However, simply because a person doesn't express a certain level of self-awareness or education about the disadvantage others are experiencing doesn't automatically quality them as an enemy nor a bad human.

BrandonM, I'd encourage you to keep educating yourself. I'd suggest reading resources like http://juliepagano.com/blog/2013/11/02/101-off-limits/ and following some "social justice warriors" via your platform of choice.

I, personally, am still very much in the process of learning about how my own privileges (white, middle-class, male, cis, het) affect me and others, which is why I find article's like Danilo especially useful.

metavida

12 anni fadiscuss

> I see no actionable suggestions for how to solve the problem

Here are a few actionable suggestions from OP's article:

    * "[Create] a Code of Conduct for Hacker News." This helps all community members share clear expectations of appropriate & inappropriate behavior.
    * "After providing clear guidance for what kinds of comments are acceptable to its values, YC must fund a means of consistent enforcement when content is posted outside those bounds."
    * "[YC] must publicly accept its complicity in building and maintaining a business asset with these negative externalities."
    * "YC must submit to accountability for improvement."

metavida

12 anni fadiscuss

Agreed that HN is not facing a unique problem of *ist comments/members. However, as the OP points out, given that the leadership of Y Combinator say that "Sexism in tech is real. ... We—the tech industry as a whole—need to fix this. ... And speaking for YC, it’s also in our best interest."[1] it makes sense that HN should be taking concrete steps to make the community a safe place for diversity. It doesn't really matter whether or not a representative portion of the community is behaving poorly. If a subset of the HN community is making HN inhospitable to the diverse members HN seeks to support, that is the problem that the leadership & the community should be trying to solve.

[1] http://blog.ycombinator.com/diversity-and-startups

metavida

13 anni fadiscuss

From the "How can visitors connect?" page:

> Visitors who are XFINITY Internet subscribers can simply select the XFINITY WiFi network “xfinitywifi” on their device and open a Web browser to get started. They will be able to sign in with their XFINITY email or username and password.

So now anyone can create a hotspot named "xfinitywifi" and phish for passwords from folks who doesn't look for an https connection. I hope Comcast does some good training beyond "connect and enter your password."

metavida

13 anni fadiscuss

Bridge is still visible on Apple Maps, though at least they added little warning/info indicators: http://farm4.staticflickr.com/3706/8813508276_05c689345b_o.p...

metavida

13 anni fadiscuss

Somebody should team up with the Better World Shopper folks (http://www.betterworldshopper.org) to make this happen. They do currently have an iOS app, but it's still way more manual work than it sounds like the author of this article is looking for.

metavida

13 anni fadiscuss

If you prefer, here's the bill on POPVOX https://www.popvox.com/bills/us/113/hr1892/

Also makes it very easy to contact your representative.

metavida

14 anni fadiscuss

Seems like making the calculation of Hash2 computationally expensive places more burden on the application than it does on a hacker trying to compute plain-text passwords. The app has to work twice as hard to verify (e.g. scryptX2) while to brute force you only really need to match Hash1. To keep latency down this might encourage use of weaker hashing for Hash1 which seems bad.

Of course you could seed your hashes table with false positive matches (perhaps from the list of the top 10,000 passwords), in an attempt to force a hacker to calculate the second hash, but that doesn't seem like a strong defense.