aegiso

Is this a stab at the fact that there's no hashing? Or that the credentials are pointless when you could just generate a random url to authenticate, since the HTTP channel is encrypted anyway?

A curious result, but the conclusion is ridiculous. I can think of a handful of explanations for this result, none of which would implicate libcurl.

-Incomparable harnesses

-Misuse of the library's api

-Build switches

-UA sniffing

-Not measuring or controlling for system/net load

This isn't a post about why you shouldn't use libcurl; it's a post about why you shouldn't benchmark your way to blind conclusions.

On the bright side, this project acknowledges the killer issue with these kinds of marketplaces: scalably managing quality, scope, and disputes.

But on the other hand, I see nothing but assurances and a woefully low cut that I can't imagine could keep this train chugging without shoveling time (=money) into the furnace. At ~$140 revenue a pop, if even 4% of projects go off the rails, the "insurance" policy already puts the company in the red -- forget profit.

There is a huge problem to solve here, for sure. I want someone to solve it. But I'm not seeing a solution.

Thing is, software doesn't happen in a vacuum.

Perhaps it's worth considering that maybe the reason that checklists aren't the norm in the FOSS "meritocracy" is that they hinder progress, for a certain value of progress. Maybe there was a stealth project that could have been OpenSSL, developed with scrict adherance to checklists, but OpenSSL won because it didn't have that burden? I suspect this applies more broadly to startups, too.

Maybe checklists are a silent killer in the natural selection of the software ecosystem, and that's why so much of our software is tripping over peacock feathers?

Just a thought.

I assure you I'm serious. You might be interested in reading patio11's essays on this. He says if far better that I can.

Famous last words when going up against Goliath Hollywood.

Because space isn't this thing where you eject stuff like a garbage chute.

I recommend reading up on rocketry, orbital mechanics, and modern space programs because a) it's really cool stuff! and b) you'd quickly realize how ridiculous, dangerous, and counterproductive this suggestion is.

Just classic marketing psychology, of the "stopped beating your wife yet?" variety. By pondering why Google missed the forecast you automagically dump the blame on Google instead of the shitty forecast.

Vocab is hardly more twisted now, though; journalism has always chosen its words deliberately.

Except the cups must be recycled where you bought them, and when they accidentally turn out to be super toxic Bob insists the recycling fee was clearly posted.

I don't know who's right here, but it's definitely not that simple.

Yes and no.

First off, TLS is crypto bread-and-butter that's used for a lot more than HTTPS. You're not out of the woods because you're not running a webserver.

Second, SSH itself doesn't use TLS; it has its own protocol, so sshd isn't vulnerable.

But third, read overflows like this can be escalated in countless ways to total compromise if some credential, key, canary, or such gets leaked. So just because sshd isn't vulnerable doesn't mean you're not screwed.

I won't speak to this particular case, but look at the incentives for any service that stores people's coins:

-You can cash out (steal) an arbitrary amount of people's coins, blaming it on a "hack". If technically competent you can make it look as legitimate as you like, even giving a detailed post-mortem.

-This will probably tarnish your operation and possibly your internet rep if the Google juice flows that way.

So how much is your internet reputation worth? Personally, there's probably a number that would sway me.

Until these incentives are changed somehow, with regulation or otherwise, it will happen.

You know what would be brilliant? If this were Karpeles himself using "hackings" in a desperate attempt to deflect legal responsibility.

I have no idea what the likelihood of this is, but it's in the realm of plausibility with all of the feces hitting the fan at Gox.

Your comment demonstrates how monumentally "The War on Terror" has failed, now that people have been so thoroughly terrorized that the most available explanation for a plane disappearing has become "terrorism".

It's less incredible once you come to terms with the fact that like so much "zero-tolerance" emotionally charged legislation its role is to be a political gun that doesn't require the ammunition of justice or reason to function. "But he's a child molester!" is all you need, logic and facts be damned. What's worse, is it's impossible to get rid of these laws because anyone who tries can easily be branded as a <insert evil demographic> sympathizer.

As unsurprising as it is that these laws exist and continue to do so, it's still utterly horrifying when you realize it's combined with indiscriminate data hoovering for later use.

I don't think there's any solution but to stop reacting emotionally to terms like "child-molester", "murderer" and "terrorist" and instead think critically about the deeper reasons behind why people do what they do. I'm doing my part and I encourage anyone reading this to do the same.