Aldo Cortesi

> Any Markdown editor worth its salt should have a permanent live preview Perhaps devd¹ with livereload is a good option here? ¹) http://corte.si/posts/devd/intro/

As a side note, you can do something similar (albeit a thousand times safer, as you (= your computer) issues the certificates, not some unknown hacker) to fool Game Center. I get maybe 20 Game Center invites from 8 year old kids on a daily basis... The reason is I faked my score on the popular game Jetpack Joyride (I'm #1 out of 16 million players), and also beat Minesweeper's hard map in a few milliseconds (second guy is I think over a minute)... I did it just for fun and experiment, but apparently there are kids who really take Game Center seriously and I stopped doing it, not wanting to hurt their feelings. The instructions are here: http://corte.si/posts/code/mitmproxy/tute-gamecenter/index.html , but please don't go crazy, and don't submit ridiculous scores like I did. You may get your account banned (which is not a great thing, if you're a developer).

Why, hello there Hacker News. Just a note that I've written two follow-on blog posts after this one, developing the idea a bit further. First, using a color function that encodes local entropy to show how crypto keys and other high-entropy data can be picked straight out of a visualization: http://corte.si/posts/visualisation/entropy/index.html And next, using this in bulk on samples from a malware database, with what I think are beautiful and interesting results: http://corte.si/posts/visualisation/malware/index.html

Nice, though I think static visualizations illustrate the examples more quickly and are easier to compare: http://corte.si/posts/code/visualisingsorting/index.html I also love Robert Sedgewick's technique of using angle to encode array value. Animated and static examples here: http://bl.ocks.org/1243323 http://mbostock.github.com/protovis/ex/sort.html

Agreed re: the quality of Frank McSherry's posts - they're all great fun and push the technical envelope! I'm glad you brought up Hilbert ordering. It's fascinating but I rarely see it. I usually see Z-order curves in their place - simpler and more intuitive but also less effective. Does anyone know of large scale databases with Hilbert ordering out of the box? For anyone who hasn't seen them before, or why they help in ordering, I highly recommend "Portrait of the Hilbert curve"[1] and "Spatial indexing with Quadtrees and Hilbert Curves"[2]. The tldr is that they enable efficient multi-dimensional indexing. Given a request like "X < 40 and Y > 80", most databases need to run "X < 40" and then filter over the results for "Y > 80" - Hilbert curves allow you to find the query's intersection and only then perform minor filtering. As far as large scale use of Hilbert ordering, Google use it internally for much of their geographical work. They even open sourced a Java library specialised in multi-dimensional indexing based on Hilbert curves called Uzaygezen[3]. [1]: http://corte.si/%2Fposts/code/hilbert/portrait/index.html [2]: http://blog.notdot.net/2009/11/Damn-Cool-Algorithms-Spatial-indexing-w… [3]: http://google-opensource.blogspot.com/2008/08/uzaygezen-multi-dimensio…

Reminds me of this: http://binvis.io/ http://corte.si/posts/visualisation/binvis/index.html (Ancient HN discussion: https://news.ycombinator.com/item?id=11077222)

Reminds me of the (sadly) now defunct choir.io. Intro post > https://corte.si/posts/choir/intro/choir.html They had a demo of Github realtime activity and I hooked it into a bunch of different events around the org - Salesforce/Yammer/Github/JIRA - was neat to have a "pulse" of daily activity in the background.

More info here http://corte.si/posts/visualisation/binvis/index.html

See this blog post by the author showing his earlier work in visualizing binary files: http://corte.si/posts/visualisation/binvis/index.html

Few other helpful resources in the same vein - This came up on HN a couple of months back - http://www.algomation.com/ A few sorting algorithms - http://corte.si/posts/code/visualisingsorting/index.html Visualization of Path-Finding Algorithms - http://qiao.github.io/PathFinding.js/visual/ Lastly, Mike Bostock (creator of D3) has a really cool bunch of algorithms over at his blog - http://bost.ocks.org/mike/

I like Cortesi's take on algorithm visualization: http://corte.si/posts/code/visualisingsorting/index.html My sense is that animated visualizations are good at giving an intuitive sense about performance, but static visualizations are better for understanding how an algorithm works. If I was implementing a sorting algorithm I'd rather have one of Cortesi's visualizations on hand.

[1] is a similar project someone else did, where he used a space-filling curve (Hilbert's curve, specifically) to plot all the RGB colors in one image, and have nearby colors be similar. [1] http://corte.si/%2Fposts/code/hilbert/portrait/index.html

I'm getting a 508 error... But somewhat related, and I think was on HN at some point: http://corte.si/%2Fposts/code/hilbert/portrait/index.html

The first demo of bubble sort made me think the bottom row was being sorted and then the rows above were just the previously sorted row. I like Aldo's visualizations a bit better: http://corte.si/%2Fposts/code/sortvis-fruitsalad/index.html

OP, have you seen this? http://corte.si/posts/hacks/github-shhistory/index.html

Why is this on the front page of HN? Anyone read http://corte.si/posts/socialmedia/trouble-with-social-news.html? Unfortunately, that article is spot-on. I want to be reading industry news, not someone's social gossip. Specifically, I want to read articles about optimizing Erlang, the latest developments in NoSQL databases, developer war stories, and changes in the funding landscape. I don't want to hear about someone apologizing for an offensive Twitter post. I think we need a separate category called 'industry gossip' for this kind of drama.

Hmmm, it seems that despite removal of the personal info, there may be ways to link it back to partial profiles via OpenFeint... http://corte.si/posts/security/openfeint-udid-deanonymization/index.ht… also: http://corte.si/posts/security/udid-must-die/index.html

We currently only have it on AntiSec's word that the information came from an FBI laptop, so technically their statement is true. According to this blog, several organizations aggregate said information[1] so it's possible that one of them was hacked. I wouldn't expect AntiSec to frame the FBI, but then again they're not exactly buddy-buddy. [1]http://corte.si/posts/security/apple-udid-survey/index.html

In case anyone hasn't already seen it, "A journey through the bowels of proggit" http://corte.si/posts/socialmedia/redditgraph/index.html

I can't speak for himself, but BSDs, especially NetBSD and OpenBSD are known for their code quality. Quoting from "What is NetBSD?"[1]: "The basic features of NetBSD are: Code quality and correctness ...". [1] http://www.netbsd.org/docs/guide/en/chap-intro.html [2] http://corte.si/posts/code/reading-code.html

You might find this useful: http://corte.si/posts/visualisation/binvis/index.html and related: http://corte.si/posts/visualisation/entropy/index.html (visualizing entropy in binary files) I used his software on an unknown format from the 1988 game Circuit's Edge to find out if/where the file was encrypted or compressed. It works well and was able to give me a (very) general idea of where in the file I needed to look further. Edit: Nope, I remembered incorrectly. I used it on the game's .exe to tell me if I was dealing with a compressed executable. It turned out that it was compressed and so I went on a search for an ancient unpacker. See before and after: edge.exe packed: http://imgur.com/PlHGl edge.exe unpacked: http://imgur.com/jeFLb

Humans are awesome at recognizing visual patterns. It's difficult to get a sense of what a file contains from a hex editor, but if you apply the right transformations on the data, distinct features stand out in the visualization. This allows people to recognize similarities between different files as the resulting patterns are revealed. Take this previous blog post by the same author: http://corte.si/posts/code/sortvis-fruitsalad/index.html This shows various sort methods operating on a set of unsorted data. If all you had visibility into was how the data was manipulated, by generating an image based on the data transformations, your pattern matching brain will quickly be able to see which sorting algorithm was used.

If someone managed to compromise LastPass' servers, they would be able to modify the content that was sent to your browser, and thereby do anything they wanted with your master password after you typed it in. That's the weakness of services that are supposedly "Host-proof". If the host is sending you the webapp/javascript/webpage in which your data is decrypted, each and every time you visit their website, you have to trust that they wont (or someone else wont) modify it in a malicious way in order to gain access to your data. The only way to be safe from this kind of attack is to use the same trusted copy of the code, and not use any new versions until you trust that it is also safe, or to somehow verify that the webpage sent to your browser is exactly what you expect it to be. Cortesi has a very good write up on this issue: http://corte.si/posts/security/hostproof.html

> Better still might be to sort by position along a Hilbert-curve traversal of the RGB cube or HSL space or something Like this? http://corte.si/posts/code/hilbert/portrait/index.html

Another example of Hilbert curves used for trawling the RGB cube: http://corte.si/posts/code/sortvis-fruitsalad/index.html (And, of course, IP addresses: http://xkcd.com/195/)

This is really cool. I've thought about how a host-proof app might be built, but not very seriously. I actually have a pretty simple project coming up that'd benefit from it, too. Maybe this'll motivate me to experiment. Any resources/reading you'd suggest, or have you mostly been figuring this out on your own? edit Ah, I see you've written a bit on it yourself (http://corte.si/posts/security/hostproof.html). Time to go exploring! As far as the actual app goes, I have only one real gripe. Being used to Vim, I expect i to add before and a to add after (with I adding at the beginning, and A at the end). Not having i/I do anything confused me for a moment.

You should read http://corte.si/posts/security/hostproof.html and http://corte.si/posts/security/crypsr.html. Was also discussed here - http://news.ycombinator.com/item?id=1226277

It's not really true that (due to the data being encrypted client side) your data is safe even if someone were to gain control of the server. It's something often claimed by these "Host Proof" style services. As long as you are downloading the client side code from the server, someone just needs to make a small change to the javascript and they get access to your data. Only if you can trust the code, and then make certain that the code does not change, is your data truly safe from the host. Cortesi (http://corte.si) has done some interesting writing on the subject. http://corte.si/posts/security/hostproof.html He implemented a similar service (http://cryp.sr + http://corte.si/posts/security/crypsr.html ), and also worked on creating a browser addon that would verify a webpage against a known hash (https://github.com/cortesi/apphash). Here are a couple of HN submissions on cryp.sr which have some discussions on the "Host Proof" concept: https://news.ycombinator.com/item?id=1438552 https://news.ycombinator.com/item?id=1226277

Similar thing, other data sources: IP address space: http://corte.si/projects/geohilbert/index.html and http://xkcd.com/195/ Genomic data: http://www.ebi.ac.uk/huber/docs/btp152v1.pdf A portrait of the Hilbert curve as a young fruit salad: http://corte.si/posts/code/hilbert/portrait/index.html and some art.. http://www.donrelyea.com/hilbert_algorithmic_art_menu.htm