Hacker Newsnew | past | comments | ask | show | jobs | submit | vivan's commentslogin

The source article provides much more detail: https://www.smh.com.au/national/secret-agents-targeting-drug...


The headline is misleading. According to the article it's the Colombian police that got hacked, not the AFP.


I used to report things like this that I had found, including cases where I can see people used the default "sample" config for security purposes, but I found that either people would not care at all, or massively overreact and somehow blame me.

If an organisation is disorganised enough to leave critical details in public, they're probably too disorganised to handle someone reporting it.


I cannot recommend fastmail to anyone for the simple reason that if your account expires and gets deleted, anyone can create an account with the same email address and take over your identity. This seems like a massive security flaw.


You should always own the domain your email is sent to. If this is the case then the solution to this problem is trivial with DKIM/SPF, if this is not the case then it does not matter what third-party provider you are using because this can always happen. Your complaint has nothing to do with fastmail.


Other email providers don't allow recycling of account names - once they're gone, they're gone.

That said, I do agree that using a domain you own is better practice. However, I have been burned there before - I used a .eu domain for pretty much all of my email sign-ups for over a decade, then had the domain yanked away because of Brexit. Yes, my fault for not realising that this would happen (I lay some of the blame with my domain provider for not mentioning it to me at all).


I think you are woefully mistaken here, plenty of mail providers allow you to scrap your account and get a new one with the same mail address.


> You should always own the domain your email is sent to.

Can you own a domain name? I was under the impression that it can still expire, which makes this solution about just as bad.


Well it can expire if you let it expire. There is nothing that can absolutely guarantee you keep you email address, but owning a domain name (say with a 10 year prepayment) is damned close.


Isn’t it the same as paying Fastmail for 10 years?


But on the flip side, good luck making any kind of sensible Gmail account for example, which means either fastmail needs multiple domains or their service will see new customers reducing over the years as people can't get sensible email addresses.

The same thing is true of phone numbers, but it's more obvious that there's a finite number of... numbers... So they need to be reused eventually.


Fastmail does indeed use multiple domains. However it's much better to use your own domain with fastmail to truly own your email address.


What do you guys recommend as a good way to continue work undisrupted when GitHub goes down? A second remote mirror?


A second mirror doesn't really help - when github goes down, the code should still be available locally on your computer. The things that become truly available when github dies are all the non-git features: issues, PRs, etc...

There are several ways to work around this, but none are really satisfying.


Use self-hosted repos like gitlab or fossil, and then mirror the public parts to github.


Git or fossil mesh.


Outlook add-on to give the ability to "undo" sending email. It just mimicked the functionality in Gmail where it holds your email for 10/30/60 seconds before sending, which gives you a chance to stop the message being sent if you notice an issue. For some bizarre reason Microsoft built this in their web app but never in the desktop version of Outlook, which is what most people in big corporate environments use.

Finished the project, built the tool and it worked great, had a bunch of people using it. Then I got to the point of having to actually distribute/market it and I gave up - the idea of having to actually support a desktop application was just too much for me.

I'll probably throw the code up on GitHub at some point so people can still get some value out of it, since a lot of people have been asking.


I guess it's a bad time to make a presentation to let us move from an on-prem SVN repo to GitHub...


That depends, do the on-prem SVN have better uptime than Github?


> I guess it's a bad time to make a presentation to let us move from an on-prem SVN repo to GitHub...

On-prem Git with mirrors. (with Googs, Gitea, GitLab as a GUI...)

Developers should also keep local clones and so the CI, etc.


It also has macroing functionality with profile switching. You could achieve the same with something like AHK but the Razer interface is easier for simple tasks.


You would think that this is a fairly rookie error and that big companies would know better, but I regularly see this on Uber: https://i.imgur.com/qDACtG0.png


Uber does not use float for money but the internal representation is converted to something displayable in the API layer.

Normally strings are used, for example: https://developer.uber.com/docs/riders/references/api/v1.2/r...

Guess somebody messed up for this case.


Interestingly even in your link you can see that most of the money values (subtotal, total_fare, total_charged) are strings but for some reason total_owed is a float.

Presumably someone messed up but it wasn't caught in code review.


In this case, the value is the "surge_multiplier", which is indeed a float: https://developer.uber.com/docs/riders/references/api/v1.2/e...


On the surface one would think big companies should "know better". I mean, a large company is the accumulation of centuries or even millennia of career experience. Unfortunately, they also contain just as much accumulated nonsense and foolishness; and enough bureaucracy and organizational cruft to hide it forever.


Plus there’s the issue that the career experience isn’t evenly distributed, so you can often have people implementing features without the background necessary to do them right.


A large company is the accumulation of a large number of people, some of who will know better and some of who will not. Hopefully the company is organized such that the people who know will be in a position to catch those kind of errors, but that's not guaranteed.


browser console:

(1.005).toFixed(2)

(1.005).toFixed(20) reveals the problem.

Math.round(1.005 * 100) // wrong

In the end these conversion errors are not solvable in any language, so you have to "cut off" somewhere. There are different approaches to this.

Wasn't there a case where programmers stole the "wrong" cent and wasn't The Office a persiflage on that?


That was the main plot of Office Space.

https://www.imdb.com/title/tt0151804/



According to Snopes, there was a third: Hackers.

https://www.snopes.com/fact-check/the-salami-technique/


Yeah. Underrated movie, actually.


Ah yes, I meant Office Space. Old but great movie.


> In the end these conversion errors are not solvable in any language

Not true at all.

Ruby has BigDecimal: https://ruby-doc.org/stdlib-2.5.1/libdoc/bigdecimal/rdoc/Big...

.NET also has a Decimal type.

I've worked on salary calculation applications and e-commerce platforms, and found that language choice makes a big difference.


With insolvable i meant just the technical restrictions of floating point numbers. There are of course solutions. But there is just the fact that binary numbers with discrete length can only be mapped to so many numbers.

If you use numbers directly in exponential form in vanilla javascript, you already get better results.


It's not that they're not solvable, it's just that you have to go out of your way to use the proper type or library. The default floating point type still has problems.


Important caveat: BigDecimal is arbitrary-precision, not infinite-precision. Using it still requires you to think about the precision of each number you operate on.


The story I heard is that the first time this was attempted in real life, the account balance grew so fast that it attracted attention and they were caught.


I've actually seen it on a statement from my bank.


As with most questions about stack choice: it depends.


Huh, I'm on Windows and it auto-joined the meeting too, with video enabled. I wonder if this is because at some point in the past I opened a Zoom meeting and allowed Chrome to open the Zoom URI in the Zoom app?


We need "allow only for this session" (or tab) in the permissions popup bar.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: