wieghant

It's monumentally stupid to think auth is easy. Yes there are standard cookbooks and checklists out there. The hubris to think that auth fails due to a crypto scheme choice is why average programmers consistently fail at it.

The yearly report of leaks in Fortune 500 companies should be proof enough of this.

EDIT: To elaborate. Crypto scheme is only one tiny facet of a successful authentication solution. Where do you store the hash? What language and stack are you using? What is the maturity of libraries available to you? What protocols? And many more seemingly tiny decisions. All it takes is a lazy developer that imports an insecure transient dependency or snoozes on a CVE.

Yet we are as of right now where even our OS will go behind our back and act like malware to collect data even when we explicitly say no.

The native apps are also all trending to online first and cache offline.

I don't understand how a native app going behind your back and asking only for internet connection permission (and not hardware) is viewed as more secure. Why do we trust these native apps more?

Arbitrary psychopathic outsiders have already been here for quite a while. Even if you're running super paranoid homebrew linux distro.

Exactly. But for the savy it's easier to see from network tab in dev tools where your data is sent.

No such luck with native apps. I don't almost never use wireshark to figure out what my native apps are doing.

Also. The entire argument falls apart when you factor in the ability to proxy data. E.g google.com -> bit-shady-site.com -> for-sure-shady-site.com

During my time in conscription, one thing that stuck with me was 'Forbidden Order'.

If a superior gives you an order that violates set rules or laws (e.g shoot civilians). You HAVE to obey and BOTH parties will be accountable.

It's crazy how severity of ignoring an order can be worse than tribunal. However I totally agree with accountability.

Though corps would figure out a way to weasel past this regardless.

Left and wished I had done it earlier. Once I gave my notice, that's when they gave a counter offer but I had made up my mind.

Cost the company upcoming tenders and my entire team soon followed. Not something I'm proud of. But priority 1. should be personal wellbeing.

One thing I learned from this is, that I fail to convey severity of issues to certain type of managers. Framing the issue in dollars helps in those cases.

And if it is understood and still ignored. Welp, time to move on.

I just recently understood the deep connection between bytes and hex, hex and decimal.

Can someone ELI5 what would be the use case for having data represented in Base32H? I understand it conveys more info in less runes but it feels hard to keep in my head. Is this just something that takes practice and getting used to or I'm not supposed to try to use this to read binaries?

Feel like we've gone full-circle for the umpteenth time.

This is great. Clean. Simple. No nonsense. WebSockets is a cherry on top!

So I hear the cons for e-voting all the time. It's absolutely true no system is sound and secure. However consider this: most politicians aren't exactly tech-savy. There are way more cost-effective methods to "rig" elections (for the Swiss scale). Dead people voting. Volunteering staffers. Depending on country method of vote transfer. Human error when counting.

Having helped with an e-election system myself, I saw first-hand how it caught "bugs" in the process. For example some district entering wrong information (lots of cross-referencing checks tripped an "alarm").

In the U.S sure, I can see why people would be concerned. No offence, but the systems in place for social and other citizen-related info ain't excellent. If there's an entire market for false identities it's saying something. Taxes not being done automatically. Social security number being the one way to identify. Online banking being a pain in the ass.

Scalability is an issue. If a system is open to billions, there is more incentive to work on "theoretical" exploits. But let's not pretend paper-voting is a better alternative. E-voting doesn't solve the corruption problem, but it makes it easier to find.

Tom Scott and some of the pen-testers that shit on on the concept have good points. However they all are based on the idea that staffers manually counting works better. Tom Scott's New Hampshire example is anecdotal – that system was an insult to the word naïve. The pen-testers taking a dump on Estonian system were picking on stuff like WiFi passwords being visible and seeing over the shoulder an admin's terminal. The systems responsible for the counting weren't connected to the WiFi and it was there for guests. Lot of good staring at a terminal did with no access to the actual machines holding the program.

I don't see e-voting becoming a thing due to all the FUD spreading. But I hope it will be reviewed as a means of double-checking. Perhaps some studious people might actually go out and study the actually proposed architecture. It's really never as simple as one program doing the counting with a flavor of auditing. At least when done right(ish).

I liked the no bootstrap section. People lack the foresight of shooting themselves in the leg. Currently working on a project where the front-end guys ended up using !important for literally everything due to lack of knowledge on how Bootstrap works.

Recently needed multi-threading with Arduino. Going to give this a shot. I'm sure people more well-versed with non-POSIX may have gripes, but I'm just doing this for hobby purposes. I'm familiar with Linux, I need multi-threading and maybe a network stack. Given that, this seems like the thing for me.

It's a cool project and I admire the attempt, however

1) It's been done before, it's not original

2) The cost is outrageous (I see you use more expensive materials, but it's not $1400 more expensive material)

3) Likely copyright infringement

I just find Go a more pleasant experience. The source code is easily readable and understandable. I don't run into weird wrong version or dependency problems ever. Go get, go build and i'm done. Or if i download the binary, just dump it in a bin folder and it works without even having Go on the system. I haven't written anything in Rust or Erlang yet, but I have run into trouble when building Rust packages from source. Maybe it was the package maintainer's bad every time, the system setup or I'm just dim, but I just need to get stuff done and not go down the rabbit hole. I also personally don't like the hassle with Python version environments.

Why did you choose executions over something mundane like blogs or comments? Reading last statements isn't exactly something I want to be distracted by. The data is interesting sure and if this just happened to be based on something you did recently, I get it. It's not something I'd recommend to students doing data science or getting acquainted with SQL when there's less morbid source material out there. The interactivity provided is cool though, no doubt.