My Setup: Passwords, 2FA, and Yubikeys - captn3m0
https://captnemo.in/blog/2020/01/04/security-setup/?2
======
captn3m0
I recently moved to running my `pass` setup against my Yubikey and wrote about
everything surrounding it, including the various failure modes I could think
of.

Running GPG/SSH alongside `pass` on the Yubikey was a gradual process, but I'm
so glad I managed to get it working correctly. Open to suggestions if there's
anything HN thinks can be improved :)


Edward Snowden says British spy agency GCHQ 'worse' than NSA - SonicSoul
http://www.globalpost.com/dispatch/news/regions/europe/united-kingdom/130621/edward-snowden-gchq-tempora-worse-nsa-prism

======
daledavies
Time to dust off the IP Over Avian Carriers RCF maybe?

~~~
milliams
Then all they have to do is stop the pigeon
([https://en.wikipedia.org/wiki/Dastardly_and_Muttley_in_Their...](https://en.wikipedia.org/wiki/Dastardly_and_Muttley_in_Their_Flying_Machines)).


Traits Of Stellar Managers, Defined By Googlers - amirmc
http://www.businessinsider.com/8-traits-of-stellar-managers-defined-by-googlers-2011-3?op=1

======
citizenkeys
What's interesting from the article is the internal Google survey revealed
"Technical skill" was the absolute least important trait that Googlers sought
in a manager.

This is not unlike the brief failed experiment years ago where Google tried to
get rid of managers entirely and have teams report directly to engineers. The
lesson from that was engineers are best left to do engineering and managers
are best left to manage.


Dear HN: Please don't start a response with the word "wrong." - samd
Example:
Dave: The sky is green.
Bob: Wrong. The sky is blue.<p>It just makes you look like an asshole. Be more tactful and civil in your discussions. I promise you people will respond more favorably if you don't come out the gate blaring a buzzer like a game-show host.
======
seiji
_Be more tactful and civil in your discussions._

Not every opinion is valid or deserving of civil rebuttal. It's a result of
modern "every opinion is equally valid as fact" syndrome. We don't have time
to cordially try to rewire your brain to think the sky isn't green.

Also, when trolls are trolling, they _want_ elaborate thought out responses to
their drivel. It's easier to shut them down with "wrong." And, as we know, you
can't distinguish an intentional troll from someone with sincerely warped
views of the world.

In short, shut it all down. They should be inspired to research their
wrongness to turn into more right-thinking apes.

[relevant life story: one of my high school math teachers had a big "WRONG"
stamp (with red ink) he would enthusiastically smash onto your work if you
were, well, wrong.]

~~~
mgallivan
We should shut down other people who are being needlessly facetious.

But to suggest that rejection should be our default behavior is absurd.
Discussion should be encouraged because, more often than not, neither side is
100% correct. The way we further ourselves is by talking to those people with
dissimilar views.

~~~
seiji
_more often than not, neither side is 100% correct._

You are very right. The problem is when one side stands up and says: "We are
obviously right. We will never change our opinions or ideas. You must agree
with us or die."

At that point, the reasonable side doesn't have any options left. You can't
argue with crazy.

Take the current US Congress situation. One side is saying, "We want to hurt
you." The other side isn't saying "Okay, how much do you want to hurt me?
Let's find a compromise where you can just cut off my hand." No. The only way
to stop American elected terrorists is to tell them "No."

If people have valid points, you can draw out truth. If they have points based
on pride, ego, or falsely implanted childhood memories, you can't do anything
productive except stop them. If that doesn't work, ignore them.

Topics of note which regularly draw out crazy people from one side: nobody
needs college, X city is better for startups, religion Y is right, bitcoin is
a "currency," (or anything else getting 400+ comments around here).

------
ifyoumakeit
I'm dealing with that right now. Completely negating someone's opinion only
shuts down communication. It's all in the phrasing and makes it sound like you
are on different teams, especially in a work environment.

~~~
palidanx
When doing consulting and engaging a sensitive issue, I always begin with,
"Correct if I'm wrong, is this how this feature is supposed to work..."

What this does is diffuse a tense situation and allow the client to issue a
correction without feeling bad.

~~~
ifyoumakeit
I think that's a great approach, especially when handling a new client. The
worst situation is landing a client who also personally designed or developed
the last iteration of their website or app. They need to be dislodged from the
work they've done and sometimes that takes kid gloves.

------
kohanz
Of any of the proponents of the "Wrong. ..." response, I wonder how many would
use this phrasing face-to-face as opposed to online. Unlike my younger days, I
do my best now to converse online as I do and would IRL and I find that this
is one of those phrases that does not pass that test. IRL it would be
considered plain rude and obnoxious.

------
frou_dh
If this is pet peeve time then I'll go with the alarming number of sentences
people want to start with the word "So". It makes you sound like you're in
constant rebuttal mode and trying to lay out the one true world view.

------
marssaxman
Yeah, I've noticed this. It doesn't work.

------
informatimago
Wrong. People should learn to make the difference between an sentence they're
issuing being wrong or false, and they being bad. "wrong" does not mean
they're bad persons. Perhaps at most that they're lazy or bad thinkers. That's
all. In any case when something is wrong, it would be wrong not to stop it
immediately, telling it wrong.


If Everyone Ate Beans Instead of Beef - screamingninja
https://www.theatlantic.com/health/archive/2017/08/if-everyone-ate-beans-instead-of-beef/535536/
======
jbdigriz
Kind of telling the article makes no mention of what degree this shifts
"greenhouse gas" generation from cows to people. Quite ironc considering they
are suggesting beans to be used.


Krugman reviews Geither's book - mooreds
http://www.nybooks.com/articles/archives/2014/jul/10/geithner-does-he-pass-test/?insrc=hpss

======
warmfuzzykitten
The man's name is Geithner.


Team USA Giant Robot Duel - cjm
https://www.kickstarter.com/projects/megabots/support-team-usa-in-the-giant-robot-duel?new=yes

======
JoeAltmaier
Cool; but what are Suidobashi Heavy Industry up to in the mean time? This will
be epic.


Ask YC: How Big Is the HN Team? - Kinnard
How big is the HN team @ Y-Combinator?
======
mtmail
Best way to reach the moderators is to email hn@ycombinator.com. They've been
quiet responsive in the past. Personally I think it's one person only.

~~~
Mz
No, it is not one person. There is one paid moderator who is the face of HN.
But, I know there are others who do moderation work.

I am not clear on the details. My impression is they have no plans to divulge
all the details.


Exclusive Interview: Hacking The iPhone Through SMS  - edw519
http://www.tomshardware.com/reviews/hacking-iphone-security,2384.html

======
tptacek
_Charlie: The iPhone bug has to do with telling the phone there is a certain
amount of data, and then not sending it as much as you said you would. The
function that reads the data starts returning -1 to indicate an error, but the
other parts of the program don't check for this error and actually think the
-1 is data from the message. This shows how complex it can be to write secure
code, as separately, each part of the program looks correct, but the way they
interact is dangerous!_

OUCH.

If there's an industry contest I'd like to referee now, it's fuzzers vs.
static analysis. Industry spends a cubic shit-ton on static analysis (for
instance, find an F-500 that doesn't have a couple copies of Fortify gathering
dust). But fuzzers appear to be kicking ass in terms of actual findings, and
vendors don't invest nearly as much into them.

(Static analyzers parse and symbolically analyze source code or binaries
against rules, like taint propagation and API blacklists; fuzzers mimic actual
inputs to real running systems and vary those inputs maliciously over minutes,
hours, or days).

~~~
ajross
I continue to find it amazing that people don't routinely fuzz their protocol
handlers. It's a test that you can literally write in 10 minutes.

~~~
tptacek
Especially if you're the actual developer. 80% of the time it takes to write a
third-party fuzzer goes into reconstructing the target's protocol or API from
scratch.

------
euroclydon
The SMS handling process runs as root. The protocol is used for all kinds of
device <\--> network traffic. Developers have the ability to make these SMS
messages look however they want them to. Users have no indication when a
malicious SMS is received.

I think we may see some real exploits happen soon.


There Are 13 Quotations in a U.S. Passport. Guess How Many Are from Men? - cbhl
https://www.nytimes.com/2020/02/28/travel/american-passport-quotes-women.html
======
downerending
Given that nobody even looks at these, it doesn't seem very important.
Personally, I'd prefer a raise instead.