Hacker Newsnew | past | comments | ask | show | jobs | submit | nickfrostatx's commentslogin

> acting solely out of greed.

That's a weird thing to complain about. In a capitalist country, how would you prefer companies act? Not greedy? The whole point of a free market is that everyone tries to maximize profit. There are a lot of things you can point at to claim that Uber is evil, but I don't think greed is one of them.


Okay, so don't associate the SSN hash with the account. Come up with a mechanism to store anonymized SSNs to detect duplicate accounts.


Bloomfilters.


You can always drop out if you feel the tuition is too high. We can talk all day about how much it ought to cost, but clearly you feel it's worth it to stay enrolled.


You can always avoid hospitals if you feel the cost is too high. We can talk all day about how much it ought to cost, but clearly you feel your health is worth it for continued check-ups.


Your analogy doesn't work, because of the existence of Medicaid. And the fact that emergency rooms must treat you no matter what.


I agree with most of what you're saying, but I'm not sure about shifting the cost of textbooks to the school and charging for it through tuition. In my three years of school so far, I haven't bought a single textbook, and I've only had to pirate two. And I only pirated those two to have the questions for mandatory homework problems, didn't really use the material.

I think that if a student can find better alternatives to their assigned textbook, making the school buy it anyway and charge it through tuition just seems wasteful.


In my case, at the University of Kansas, a lot of the time assignments will come from the required textbook (when not taken from some online system), so still kinda required. Homework is a teacher aid anyway (in a sense, though I do realize for many it is also a study aid), so why am I forced to pay outside of tuition? I don't pay for tests outside of tuition.

Either way, the intention is to make the person (ie the dept chair/professor) who selects the textbook/online homework/etc be the one to pay for it; otherwise there's no is pressure to use cheaper books (or rather the books with the best value/cost ratio).

Also, I presume that the universities would be able to bargain down to a lower price, due to gains had in mass production (as an analogy) or your usual volume ordering discounts reminiscent of Monoprice. This is especially true if the university buys access to N pdf every semester, which offer practically free distribution costs vs textbooks.


They usually set the content type to that of an image so the browser won't execute the JS.

They've messed this up in the past, see this legendary bug bounty report [1]

1. https://whitton.io/articles/xss-on-facebook-via-png-content-...


Given how important domain names are for security, it would be concerning if domain names get truncated.

I could craft:

evil.net/this-is-a-very-very-long-path/bankofamerica.com/account-settings/blah/blah/blah

Which, depending on how this is implemented, might render to

...bankofamerica.com/account-settings/blah/blah/blah


this horse bolted long ago with ubiquitous shortURL services


The domain and path are truncated separately. Your example would be displayed as evil.net/this-is-a-very-very-lo…


So evil-bank-of-america.net would do?


That wouldn't be truncated, no. It's not long enough.


One problem I have with this tool is support for pre-computed public keys or CSRs. The client prefers to generate a new key pair for every certificate. Automated renewal that works the same way for existing CSRs as it does for regular certificates requires undocumented hacks.

Using the same key pair for multiple certificates is necessary for public key pinning, since Let's Encrypt only issues certificates that last 90 days. I would love to see this feature get developed further.


It's worth pointing out here that reusing a static keypair with Let's Encrypt is currently more or less straight-forward using acme-tiny.

https://github.com/diafygi/acme-tiny

Edit: Looks like https://github.com/lukas2511/letsencrypt.sh is capable of doing the same, as pointed out in another comment.


There is code in the client to reuse a keypair when renewing (without needing to reuse a CSR); there's just no way to trigger that from the UI so far. Maybe I'd better add one soon.


https://github.com/certbot/certbot/issues/2373 (if you want to reuse a CSR; reusing the key is probably easier)


> Using the same key pair for multiple certificates is necessary for public key pinning, since Let's Encrypt only issues certificates that last 90 days.

So do like Github does (did?)[0], and make the pins valid for 5 minutes.

[0] looks like they upped it to 60 days?


> So do like Github does (did?)[0], and make the pins valid for 5 minutes.

That kinda defeats the point of HSTS. If the key is changing regularly, it makes it easy for an attacker to just temporarily prevent access to the site for long enough for the pin to timeout, and then present their own certificates and keys.


Perhaps you mean HPKP, not HSTS?


Yes, sorry, HPKP.




Ugh, more of this low-contrast nonsense. Give me black text or give me death.


This one is obviously for you: https://bestmotherfucking.website/


What is the rationale of low contrast text?


This is exactly the problem that Uber's rating system solves, but without all the arbitrary factors that tipping incidentally includes.


That's a good point. I honestly haven't thought enough about the virtues of rating vs tipping. One potential issue that comes to mind is that people might be more frivolous with a rating than with real money.

I guess you could do an experiment at a restaurant. Give half the tables standard receipts with tip lines, and the other half a receipt that lets you choose a rating.


> One potential issue that comes to mind is that people might be more frivolous with a rating than with real money.

When you rate someone lower than 5 stars, Uber prompts for an explanation. And if you provide one, it often generates a direct followup from Uber support trying to address the problem; if there was anything seriously wrong, addressing the problem often includes either a full refund or some small credit for future rides, and some indication that there'd be an attempt to solve the problem. I think that's a pretty reasonable way to keep ratings meaningful, and actually address any problems that produced a low rating.

So, I actually feel like there's more connection between a rating and actual action, whereas choosing whether to submit a tip or not seems very likely to correlate with factors other than the quality of service.


The article admits that information from eight drives is "a hopelessly anecdotal number"... then goes on for several paragraphs to imply that these eight drivers are evidence to systematically disprove Uber's claims about racism and sexism.

Completely bogus.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: