skysight-inc/HackerNews huggingface dataset:
Security has nothing to do with their business model. You're not going to stop going to the doctor just because they leak medical records. You need them more than they need you. Not only is there very little legal repercussion, but it's enough for them to just be aware of and document the leaks in their system. I wouldn't expect record privacy from any health care provider (or educational facilities for that matter)
Years ago, I attended a talk from a professor about a networking system using the Lego blocks metaphor. In his examples, he had a block labelled "encryption" and another labelled "compression" and talked about how you could arbitrarily compose the blocks in the system.

To my eternal regret, I didn't call him on the fact that those two blocks are not arbitrarily composable.

Both encryption and compression make the resulting data look random (and you can't compress encrypted data), and compression seems to be a much more likely candidate.

P.S. And spread-spectrum transmissions, as someone else mentioned.
Anecdotes aside, they still require massive amounts of capital in order to create useful applications.

Hobbyists tinkering in a hanger did not create modern airlines - giant corporations like Boeing managed the capital required to make it happen.

Hobbyists tinkering in a garage are not going to be able to carry out years of dedicated research followed by years of study followed by years of clinical trials.
Here is what the software did, according to the EPAs letter to VW:

Specifically, VW manufactured and installed software
in the electronic control module (ECM) of these
vehicles that sensed when the vehicle was being
tested for compliance with EPA emission standards.
For ease of reference, the EPA is called this the
"switch". The "switch" senses whether the vehicle is
being tested or not based on various inputs
including the position of the steering wheel,
vehicle speed, the duration of the engine's
operation, and barometric pressure. These inputs
precisely track the parameters of the federal test
procedure used for emission testing for EPA
certification purposes. During EPA emission testing,
the vehicles' ECM ran software which produced
compliant emission results under an ECM calibration
that VW referred to as the "dyno calibration"
(referring to the equipment used in emissions
tested, called a dynamometer). At all other times
during normal vehicle operation, the "switch" was
activated and the vehicle ECM software ran a
separate "road calibration" which reduced the
effectiveness of the emission control system
(specifically the selective catalytic reduction or
the lean NOx trap). As a result, emissions of NOx
increased by a factor of 10 to 40 times above the
EPA complian levels, depending on the type of drive
cycles (e.g., city, highway).

http://www3.epa.gov/otaq/cert/documents/vw-nov-caa-09-18-15....
Instant douchebag detector. Even more accurate than the BMW logo.
I was running Windows 7 with an HDD and just upgraded to an SSD & Windows 10 because I got sick of listening to my HDD groan for 10 seconds whenever I changed tabs :)

I wonder you're experiencing a use case where you'd see notable perf improvements from a pcie ssd. Jeff Atwood blogged about his upgrade to a faster ssd last week: http://blog.codinghorror.com/building-a-pc-part-viii-iterati...

Of course, assuming you have unused RAM, it would be nice if the OS would just use the RAM available before swapping to SSD.
"" Don't you have to be arguing that a form not allowing modifications to be used or tested is the "preferred form of the work for making modifications"?"

You are trying to take parts out and remove context from them.

I don't have to argue at all about the preferred form, because it very explicitly says what that is:
"The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable."

The first two sentences go together. It defines, explicitly, what the preferred form of complete source code for an executable work includes.

So that isn't going to include signing keys unless you want to argue that one of the explicitly enumerated parts includes signing keys.

For years, people have argued back and forth about whether the scripts include data files.
The general consensus is "no", because otherwise, it has no differentiable meaning from the other parts.
>I have re-read your comment a dozen times, trying to grasp what you mean, and come up short each time

Keep trying, don't give up
Here's Kotaku EIC Stephen Totilo admitting to Kotaku's ethical failures re: GamerGate.

https://archive.is/4Tp9N#selection-7679.0-7679.603

He's downplaying it but the failures to disclose personal ties DID exist in many cases. He also references other ethical failings from Kotaku. None of this would have come to light without GamerGate. They regularly make references to pre-existing relationships now.

Note that this is a pretty important statement from Totilo but he makes it in the form of a comment. Many in GamerGate did appreciate him taking some form of responsibility though.
Newer versions of Unison (since around 2012) can watch directories with inotify: http://blog.nguyenvq.com/blog/2011/07/18/real-time-file-sync...
I always wonder why articles like this don't make any mention of how Ms. Holmes is a billionaire, on paper. She obviously is set up to be an actual billionaire, however we all know there is a huge difference between private valuations and what someone is willing to pay for the entire company (or on the public markets).

Is this me being too critical?
"The addition of explicit anti-tivoization language to v3 does not imply that they think v2 couldn't have that effect, just that they thought it would be nice to have a stronger case."

While true, having been around then and knowing what went on in the drafting committees, it's definitely the case that they were told they didn't think they had a winnable case with the GPLv2 language ;)

If they had thought they did, they also would likely have gone after TiVO :)
It gives further evidence to any claim they have changed, but that is only relevant if you are doubting their claim to not be what they were accused of being (if they ever even were that to begin with).
What others said, but also for very practical reasons. Why roll your own at all since this is an area where lots of FOSS code is already available? I see two broad categories here: your environment already has an scrypt/bcrypt/PBKDF2, so just use that, as you would a regular expressions library or a URL parser; or your environment does not, in which case you should grab the spec for scrypt/bcrypt/PBKDF2 (whichever you think is easiest to implement) and implement it. Inventing your own risks errors, while creating a system that's incompatible with what other systems are doing and does not follow any type of researched security protocol.
There's still some tweaks to be made to Argon2 before it's finalized. Mostly GPU resistance.

Then there's the standardization for the crypt(3) format.
surely there are people here who personally know someone on the project...
Pugachev's Cobra
For instance, more allocations necessary, extra pointer indirection, higher memory use, worse cache locality, needing the TN_ListItem* to perform list operations.
This is a good example of class-warfare. Making a life-saving treatment unaffordable will ultimately lead to deaths of those without the financial means for treatment. It is hard to believe that this kind of practice can be legal.
He only needs one.

As someone who says the hell away from 4chan, I still say he did impressive work. Probably not going to be hired by Walt Disney, but there's a lot of other places out there.
Or better yet:-

javascript:window.location="https://www.google.com/url?q="+window.location
Everything about Android is a rushed project. Rubin's team was running scared of OpenMoko hype, Blackberry success in enterprise, and Windows Mobile everywhere else. Then Google snatch it up and ran scared of Apple. And now here we are.

Android needs an 18-24 "gap" period of re-engineering everything they rushed, but at that point you might as well just write a new OS. I suspect there is a secret 2nd version of Android that isn't virtual machine based, doesn't use Java, but has whatever backwards compatibility needed to work with the existing applications. If things get too hot from Oracle, then that will be the next version of Android. Switching to ART seems to suggest that Google has some portability chops here. Incremental updates like they're doing now is the path of least resistance, but considering how much more polished iOS is, I really doubt Android will ever be on that level. Its always going to be a little quick and dirty and I think if you buy an Android product you have to accept that.

I switched to the Nexus products from my 3GS. I knew Android was a step down in a lot of ways, but I wanted the hardware flexibility it offered. Now that I can get a big Apple phone with a swype keyboard AND it works with Android smartwatches, it seems the Android value proposition keeps getting weaker and weaker.
No. Cook was on Colbert to talk about the new iPhones, iPads, and Apple TV.
> Now the movie, that was definitely meant to be satire. Which is why so many fans of the book hate it.

I don't so much hate the movie because it was satire, I hate it because it was cheap, lazy, unnecessary satire of either a phenomenon to which the book is at best distantly connected or of a very distant reading of the book.
Act like a non-profit instead of a for-profit.
Eesh, let's agree to disagree. EasyMock has some advantages, but I find the readability of Mockito outweighs them.
That only applies to the average citizen, not executives of large corporations. They have more in common with foreign corporate executives than with their own citizens.
War is boring's reporting on the F-35 has biased and is considered among defense reporting to be very un-reputable. "Jack of all trades master of none" is followed by "is better than master of one". It's replacing the F-16 which also was a multirole and did it damn well. The A-10 is just no longer an effective weapon. A turbo propt is better when you're fighting while having complete control of airspace and a F-35 is better when you're fighting in the presence of very advanced air defense systems. The A-10 is old and doesn't fit into modern warfare.
I think that you should be able to find something you like among Camouflage, Old Twentieth, The Accidental Time Machine, and Work Done For Hire. Together they're actually a pretty good spectrum of what he does.

I honestly haven't cracked the Marsbound books yet, although I have them. There's something just a bit off-putting about series books to me...
The page will not be thin content once the exclusivity expires. Even if Google punished the page in the interim, it would not matter much, because Google drives very little of the initial traffic to articles. Social channels eclipsed it long ago. Google is more important for providing a "thick tail" of traffic after the initial social spike.
Many more non-killings start out with a joke about bringing a gun to school.
Error Exposes 1.5 Mil People's Private Medical Records on AWS [UPDATED]
Forever Free was terrible, honestly. It's best to pretend it doesn't exist.
I am very interested in what this car will look and behave like. Until Tesla, automobile interface design was pretty stagnant; Knobs and switches for everything!

Apple has been very focused on virtual interfaces lately, I wonder what their return to physical will look like.
Seconded the cross-reference gripe with Markdown. Somebody clever has to be working on that already, it's such an obvious gap. I think it would enable things like RMarkdown to reach "critical mass"
You can only get a million for a really impressive jailbreak. If it involves plugging the phone into your computer and downloading something, or even just pushing a button, it doesn't qualify for this bounty.
If you consider this bad, wait until you see what "proof" gamergate offers.
Apple employees are contract bound to not discuss work on even the most mundane of product updates. As friends, we respect their obligations (though we do give them a hard time by sarcastically badgering them about upcoming updates)
Apple is historically very secretive, no reason why that shouldn't continue to be the case. Other than who's getting hired I doubt you will learn more.
Technically yes, but I would imagine they'd subsequently hash the hash on the server side as well.

I assume the extra client-side hashing is done to keep the plaintext passwords out of the application memory, not protect it in transit.

To clarify, this is just an assumption. I have not read up on the topic nor do I claim to be a security expert. This is just what came to mind when I had the same thought as you.

Anyone else know for sure?
How directional cues maximize UX and boost conversions
$ rpm -qf /usr/bin/ssh-copy-id
openssh-clients-6.9p1-6.fc22.1.x86_64
"I have to imagine that the scripts controlling installation must sign the executable. "

This is a pretty big assumption, and in fact, is not actually true in a lot of cases :)

Let's assume it is here.

"Why isn't that data file also part of "the scripts used to control installation of the executable"?"

Because the data file literally isn't a script used to control installation of the executable?
It's a data file.

At best, btw, you'll be able to argue that it would have to include the signing key, but not any password for it. So you are still pretty screwed :)

Your argument also swallows the definition. Where does it end? Do i have to include the interpreter for the script, and provide source?
Why not, since it's required for the script to function.
(Note, this would not be covered by the next exception in a lot of cases)

If i give you a bash script
The installation script also almost certainly refers to the executable, but that's called out explicitly as something i have to give you source to. Why bother if it's included in the "scripts to control compilation/installation" part?
(In general, courts are going to read definitions into things that make parts of enumerated lists differentiable from each other )
In general, i would say you can go down this path, but you won't get a court to come with you.

Scripts means scripts. Data files means data files.

If the key is literally part of the script, yes, you'd have to ship that. Not the password, mind you.

If they wanted something else, they should have written something else. Which they did, in gplv3 ;)
The library can't be updated automatically, because suddenly all your stored passwords wouldn't work.

If it's a big monolithic library like Spring, they just deprecate APIs and add new ones (which is in fact what they do); if you're in a microframework language like Node, you're on your own to rip out your md5 module and switch it to bcrypt.
GoCo.io Is Hiring a Full Stack Software Engineer
So how would the reddit equivalents of /out or /fit compare for example. I don't really see a lot of advertiser banning for example. Is it because there is more moderation in those communities?
The A-10 is an obsolete concept. Weapons are so much more advanced than armor that the best defense is to not get hit. If you want cannon fire supporting you from above then you want an Apache.
In this case they seem to have the revenue to justify a similar public market valuation.
Start-up spending 'extremely wasteful': VC
That's what I hate about JMock, lol.

You had better mock everything, and better put them in the exact order they will occur in, or your test fails.

Most JMock unit tests I see are essentially the exact same code as is being tested, written a second time in the unit test. So if I want to refactor or modify this code in any way, my unit tests break- even if functionally, my tests are doing exactly what their spec says.

With Mockito, I can say 'Hey, if anyone calls this method with parameters sort of like this, give them this response', and then focus on my unit tests actually testing the output for a given input.
I kinda feel like you're getting too bogged down in the detail here. I don't think anybody would agree that Thiel is literally 100% correct in saying "technology stalled in the 1970's, but if look look at the statement as a bit of hyperbole with a kernel of truth to it, he has a point. And whether you agree with him in general, or not, I think his rhetoric serves a valuable role in terms of encouraging people to reach further, and work on big, hard, fundamental problems.

Anyway, I don't see what he said as being a statement like "I, Peter Thiel, could trivially cure cancer" or anything like that.. I see it as a call to arms to people who are working on, say, ad serving networks, to work on curing cancer instead (where "curing cancer" is a variable that could be replace with any "big, hard, fundamental problem").
Not alone, but as part of a chain of exploits (which is what most jailbreaks are, and which is what this document expressly asks for), certainly it is: it allows you to get arbitrary code execution on the device, which can be paired with a kernel exploit (something that has been comparatively quite common) to get root. I mean, this same argument can be said about the individual components of JailbreakMe 2.0 and 3.0: the initial exploit in FreeType only just barely got you the ability to run code as Safari within its even-at-the-time relatively restricted sandbox: it was then paired with a kernel exploit to finish the jailbreak. Zimperium actually did a demo on stage at BlackHat of using Stagefright as the vector to push a privilege escalation (probably some old kernel exploit; I think they said, but I don't remember) to the device, and they have also posted a video of that process.

https://www.youtube.com/watch?v=PxQc5gOHnKs
Poorly titled article. I am disappointed and only skimmed. I was hoping for something about actually improving health using data.

A few random thoughts:

Genetics is probably the wrong place to look for explanations of the dramatic increase in premature births. Environment and lifestyle changes are probably a better place to look. If it were genetic, it should not be a sudden new thing -- unless it involves genetic damage, which can happen from envirinmental issues, which brings is back to environmental causes.

Genetic information can be amazingly empowering, but it is like a blueprint for how to build the body. Ignoring how throughputs interact with that information misses a big piece of the puzzle. Genetics are not destiny. They are code and how that code behaves depends on what it is given to work with.

Insurance companies will have to change how they work. Insurance is about risk management -- i.e. betting the odds. When the information you have about risks changes dramatically, you have to bet differently. The current model cannot survive in the face of emerging data of this sort. It will have to adapt or die.
What I was told by some former employees from years ago is that people in other groups, even if they're your best friend, many times you don't hear a word about what they're working on until you have to integrate it and even then they may just give you an interface or something small and tell you your stuff has to work with it.

So even someone working with someone on this project may not even know that person is on the project.

Though surely some people do talk amongst themselves...
Another discussion 6 months ago triggered by a Blockspring (SaaS tool) blogpost:

https://news.ycombinator.com/item?id=9258774
What do you actually know about the CAS mission and NATO SOP to be making such inflammatory claims?

Maybe British FACs just suck. <--I can generalize too.
Some sites are reporting that 600 people are working on the project and they will be tripling that number to 1800 people:

http://appleinsider.com/articles/15/09/21/apple-has-target-s...

[Update]

Actually, the WSJ also reported. Guess other sites are reprinting.
Knobs and switches are not a bad thing when you need to keep your eyes on the road.
Even within the company they are. I was speaking with 2 different groups at the same time from Apple and they had to ask me certain questions about their particular projects secretly while the other group was in the room. I had an NDA so I could know both sides but I could not discuss one groups project with the other.
The client's hash is the password but the password file contains salted hashes of the client's hash. An attacker that has the client's password hash can replay it, but they don't know the user's password. An attacker with the password file doesn't know any clients' password hashes or whether any of the password hashes are reused by different users.
10 years of monitoring marine protected areas finds positive results
Brain data crawler and its interactive 3D Model and tree structure
A-10 cannot penetrate modern armor with it's gun. It had difficulty with T-72 when it was designed and could only kill them from the rear.
>> If they're wildly successful, the only ones left on the traditional internet would be those not producing content for money.

Well, what it actually means is that folks who monetize their content in ways other than ads could begin to have an advantage. For example, Red Bull Media monetizes their content with drink sales. PBS, NPR, and Think Progress monetize their content with donations.
off topic, but wow it's really annoying that the site overrides your scroll-speed settings.
Automated API Testing Tutorial from Webtesting.io
Plus node, and npm. That's an extra 59 packages from Apt. before you install this tool.
Goto is absolutely the right tool for: "the instruction pointer finds itself here, and at this critical juncture in the algorithm, one would rather prefer that it were over there, for want of correctness, if not beauty."
Those goalposts are heavy, aren't they? I mean, that's interesting, but it's completely unrelated to anything related to the coordinated harassment campaign aimed at Zoe Quinn. So what's your point, exactly?

Don't get me wrong: I love you guys. You have made "SJW" a desirable thing to be. I'm just not big on this whole dishonesty kick.
I am sure there are lesson to be learnt.
A million bucks for a iOS 9 vulnerability sounds nice. But is that worth having the death, imprisonment, or torture of possibly innocent people on your conscience? If a government is buying these vulns, there is no telling what they will do with them.
pbkdf2 is included in Python's stdlib since 2.7.8[0] and 3.4[1], though sadly the interface isn't great: it outputs the hash only, not a modular crypt[2] and it requires a salt instead of generating one. Passlib[3] provides more algorithms, a much better interface and handles hash migrations[4] ridiculously cleanly.

[0] https://docs.python.org/2/library/hashlib.html#hashlib.pbkdf...

[1] https://docs.python.org/3.5/library/hashlib.html#hashlib.pbk...

[2] http://pythonhosted.org/passlib/modular_crypt_format.html#mo...

[3] http://pythonhosted.org/passlib

[4] increase of rounds # or KDF change http://pythonhosted.org/passlib/lib/passlib.context-tutorial...
They aren't that annoying in my opinion since Win10 will ask you to schedule a reboot in advance (within 3 days I think).
I was using consumer-goods purchasing power as an estimate of wealth. It is obvious that if you can time the market you can make more than if you can't time the market.

However, until someone seriously suggests keeping a significant fraction of your investment portfolio as cash (preferentially to e.g. bonds) as a hedge against market crashes, I don't think it makes sense to classify cash as an investment instrument.