nmjohn

7 ms·

121.
by nmjohn 10y ago
Basically, because there is no verification/validation surrounding caller id - https://en.wikipedia.org/wiki/Caller_ID_spoofing
122.
by nmjohn 10y ago
At least in chrome, you get the warning: > Blocked a frame with origin " https://www.google.com" from accessing a frame with origin " https://news.ycombinator.com" . Protocols, domains, and ports
123.
by nmjohn 10y ago
> The newly opened tab can then change the window.opener.location to some phishing page. This is true, and is a vulnerability I have been looking at for a while now, though I've not actually seen it exploited yet in the real world.
124.
by nmjohn 10y ago
Thankfully you can usually find this info: > This work was supported by grants to T.W. and Y.S. (NIH R01MH091801, R01EY019466, and NSF BCS 1539717). This work also involved the use of instrumentation supported by the NCRR Shared Instrume
125.
by nmjohn 10y ago
Considering node.js is able to spawn subshells and execute whatever code it wants when running, install scripts pose no additional threat to just running the javascript.
126.
NPM Package Hijacking: From the Hijackers Perspective(medium.com)
4 points by nmjohn 10y ago|0 comments
127.
by nmjohn 10y ago
x.sh was just the script I used to automatically register all the packages. It takes one argument, a package name, then attempts to publish that package. So cat list | xargs -I{} ./x {} was what I used to publish the whole lis
128.
by nmjohn 10y ago
Some examples of how it works: ^1.2.3 := >=1.2.3 <2.0.0 ^0.2.3 := >=0.2.3 <0.3.0 ^0.0.3 := >=0.0.3 <0.0.4
129.
Managing Nerds (2011)(randsinrepose.com)
2 points by nmjohn 11y ago|0 comments
130.
by nmjohn 11y ago
> Besides, the right answer is: use bastion hosts to proxy SSH connections, preventing them from the outside world Agreed > It makes perfect to block repeat offenders because they might get lucky No, just no, please don't spread
131.
by nmjohn 11y ago
There's a problem with viewing security as a "checklist" problem, it treats everything as binary, black or white problem/solutions. In reality, this is _far_ from the case. For example: > Is TLS1.2 the only supported
132.
by nmjohn 11y ago
Keep in mind the topic at hand is downloading a single large file, the TLS handshake is a rounding error of the total time, regardless of where you are in the world.
133.
by nmjohn 11y ago
Quote from a google engineer in 2010 (it's only gotten cheaper in the last 6 years w/ advances in CPU tech) regarding SSL overhead: > On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load,
134.
by nmjohn 11y ago
FYI: Prime one/same-day shipping is still $35 - this only seems to apply to non-prime shipping.
135.
by nmjohn 11y ago
If true portability is your goal this probably isn't an option, but may be something to consider if your use case is a bit more flexible - you can connect a GPU via the thunderbolt port with something like this: http://www.a
136.
by nmjohn 11y ago
> services should allow me to easily create lots of aliases. Right now the best defense against social engineering seems to be my fastmail account which allows me to create 1 email address alias per service What you may want is a catch-a
137.
by nmjohn 11y ago
> A casual browse through the other entries seems to suggest that people mess up BGP announcements all the time. While true, incorrect bgp announcements happen all the time, I think this is one of the cases that Hanlon's Razor proba
138.
by nmjohn 11y ago
Heads up this happened a few days ago, not currently hijacked. Handy tool though, bookmarked it - using the event graph to display route changes as detected over time is a great visualization - would be really cool if there was the same eve
139.
by nmjohn 11y ago
There is _absolutley_ no value for a language to provide handy built-in functions that are trivially made available by a library. If we were talking about language constructs/semantics or flow-control abilities, I'd have a very di
140.
by nmjohn 11y ago
> Let's Encrypt requires individual certificates That's not accurate - you can have up to n[0] domains on a single certificate [0]: I don't remember the exact number, but it's more than 2 at least.
141.
by nmjohn 11y ago
Are there any trade-offs to this approach? This seems so obvious to me I'm confused why it is more widely used.
142.
by nmjohn 11y ago
> Imagine you live in a hypothetical world where all things you consider moral, just and socially acceptable were legal and societally acceptable and where everything else was illegal and societally reprehensible. What role would privacy
143.
by nmjohn 11y ago
> How is this not just positive spin on a doj money grab? While the _best_ case scenario would be the entire notion of any asset sharing program be made outright illegal [0] because it has been shown to be corrupt, etc, etc - simply havi
144.
by nmjohn 11y ago
Empathy goes a long way in programming discussions simply because for _all_ of us, we often make decisions and hold opinions regarding programming based on gut feel but far less often are honest about the origin of said opinions - falsely a
145.
by nmjohn 11y ago
> their containers Build your own images, problem solved. (Albeit creating a whole host of other problems in place of it, but those are no worse than a world without containers.) No one relying on third party images beyond an OS can clai
146.
by nmjohn 11y ago
Nice - I've previously implemented this in (albeit far less extensible) a curl request, it's been working without hiccup for a while now as a cronjob CURRENT_IP=$(dig +short myip.opendns.com @resolver1.opendns.com) curl
147.
by nmjohn 11y ago
Not exactly - you've also got to consider the tax consequences on cashing out directly so with the charity, the money only gets taxed once instead of twice. Scenario a: Bob starts Hooli - his stock is now worth 100 million. He wants to
148.
by nmjohn 11y ago
> But calling it a tax shield makes it sound like you can stand to gain personally by doing this. One (with that much wealth) absolutely stands to gain a ton from it. A family member of mine works in financial trusts / estate planni
149.
by nmjohn 11y ago
If you're looking to improve the CSS you end up writing - I highly suggest considering BEM [0]. It stands for block, element, modifier and defines a fairly rigid structure to build components with. tl;dr: It promotes extremely simple,
150.
by nmjohn 11y ago
There is a firmware to run lua directly on the esp8266: https://github.com/nodemcu/nodemcu-firmware

More ›