skysight-inc/HackerNews huggingface dataset:
For the most part, any party the NSA might be interested into is going to be running an OS and an application suite that will also be used by Americans a whole lot. Probably even other government agencies.

So, every zero day they find and weaponize, is a zero day that they don't tell the vendor about. So to be able to be aggressive with exploits, they have to leave American computers exposed too, and hope nobody else has found the exploit. So even with the same budget looking for vulnerabilities, doing the right thing for one of their roles makes them worse for the other.

It's a bit like the encryption problem: An encryption system with a backdoor that the NSA has weakens American security too, because the backdoor itself is a valid intelligence target: Infiltrate the NSA, take the backdoor key, and anything the NSA can snoop into, someone else can too.

So doing both defense and offense without major tradeoffs requires having some kind of edge that nobody else can ever have: For instance, the rumored gigantic cluster that can crack specific SSH communications, which they expect nobody else to be able to replicate, just due to the cost of the hardware. That's a far more limited offense than what we know the NSA had at the time of the Snowden leaks.

So my guess, based on public information, is that they do trade-offs, and disclose the issues that they think are easier to find, while keeping around enough ammunition to have something against pretty much every target.
>But we threw away the sanctity of the family unit.

What do you mean? Because people who use those words generally mean "the gays are destroying the world" and I'm hoping that's not it.
> your comment is the most retarded

We ban accounts that do this on HN. Please post civilly and substantively, or not at all.

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newswelcome.html
Really? Tame/pledge seems like a good interface but the dig at Linus seemed unnecessary, the masturbating monkey was totally uncalled for, and the coil of poop juvenile.

Seriously lowered my view of the presentation.
Sounds like this could be implemented on Linux as a library on top of seccomp.

I'm not impressed by De Raadt's objection to seccomp. BPF programs may technically be turing-complete, but most of the things pledge() does can be implemented by a pretty simple seccomp filter that's just a flat list of conditionals implementing a whitelist or blacklist.

Meanwhile De Raadt points out, correctly, that voluntary security mechanisms will be ignored by most developers... but pledge() appears to be voluntary.

Seccomp-bpf is often used by sandboxes like Chrome or Sandstorm.io (of which I am lead developer), where it is not voluntary for the code that ends up being run inside the sandbox. But sandbox developers are likely to want seccomp's customizeability over pledge's ease-of-use.

So while it's nice that that pledge() is so easy to use, it strikes me that it's targeting the wrong audience with that design.
The Evolutionary Case for Inclusive Capitalism
Cute dog reacting to his reflection
React.js and Reflux example
> I have a right to free speech, and sometimes your name is on my lips.

Except most people don't understand how cookies or like buttons track their behavior. To assume otherwise is disingenuous. The result is the equivalent of bugging someone's car with a GPS tracker and claiming they opted in by virtue of using your parking garage.
In this case I think it's more that there are only 4 banks in Aus so making a change like chip cards is much less like herding cats than it is in the US.
I just have no idea how he though publishing this rant wouldn't undermine his position as Master, especially since his wife is the Associate Master. The answer is he probably didn't think, which doesn't exactly work in his favor. It's almost like he is being schooled in politics by the students. There's a reason why you usually have a number of co-signers on these things.
> Why don't I let the professor himself explain it to your dumb ass

This comment and some of your other ones break the HN guidelines. We ban accounts that do this. Please post civilly and substantively, or not at all.

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newswelcome.html
Why do you feel this way when even OpenBSD hasn't fully worked out all the details (see the slides) and proven it will work well in practice.
oh boy.

if you run your own biz, you work for someone - your customers. and you need a steady supply of those, which looks easy at the beginning, but a couple years in can get really, really hard as they retire and you suck at sales.

seen this so often not even funny, forced early retirement on shitty terms due to a tanking self-employement biz.
Are you seriously suggesting you don't think the security services have decades of experience in weighing the pros and cons of information release?
I genuinely, dearly miss those guys.
Have you seen WhatsApp contacts show up as suggested friends in Facebook?
Without that broken upvote button I couldn't even tell who's replying to who. http://i.imgur.com/yHki0zO.png
I wonder if this kind of thing is starting up more simply due to the rise in the age of first marriages?

http://www.infoplease.com/ipa/A0005061.html
http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...

Linus, in one of his less bright moments, called the OpenBSD team a bunch of masturbating monkeys [1]. Unfortunately, the Linux kernel's conspicuous lack of attack mitigation measures (compared to Win/Mac/OpenBSD/etc) does make one wonder who has been masturbating over the past few years.

[1] http://article.gmane.org/gmane.linux.kernel/706950 (from the article)

(to be clear: I like and use Linux a lot... but Linus's disregard for security is becoming a liability)
This seems to be entirely: "What Silicon Valley (founders) Think(S) About Politics (and how close are they agreeing with 'general' Democrats)"

I was hoping for something more generic, at least 'what tech workers in silicon valley think' (given YC), not how a bunch of talking points line up to other talking points; but an actual sample of, 'here is a problem, what do you think the best solution(s) are?' (then ranked totaling them).

It also has that new media style that I /hate/ on websites, where there's some full-screen image delineating sections. Yet they absolutely cannot serve you some clean simple web page, it HAS to have full, you must scroll through them, big images and dynamically placed text.
Personal attacks are not allowed on HN. Please don't do this.
This assumes what you want is documents. The web is already great for documents. Meanwhile, a lot of people also want apps. You can bemoan document viewers being stretched beyond reason into app platforms, but it already happened over a decade ago and shows no sign of slowing. It's time to just deal with it. With wasm and webgl, these document viewers can at least be slightly less crappy app platforms.
I don't want this company anywhere near the last mile to me. DoorDash sent a flyer to my house false advertising a coupon code. I spent half an hour creating an order only to realize that the coupon they sent me was different from what the flyer said. When I called to complain they acknowledged their error but said they wouldn't do anything and that I should just place an order anyways.
When Posturing Meets Reality
More than anything it shows how terrible a lot of modern diets are for health. Virtually no one would go around eating lemons, but we've found a way to combine it with sugar to create the worst of both worlds for our teeth.

Sugar isn't easy to come by in the natural world but it's in so many foods now that bacteria in the mouth never go hungry.
http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...

Article could have been good but is a bit too sensationalist, e.g. pointing out that Ashley Madison runs Linux only to admit that it had nothing to do with their security breach -- OK, so why did you mention it, then?

(In truth, kernel security rarely matters for servers, because the application is usually the first line of defense. I say this as someone who runs one of the rare services where kernel security does matter, so yeah, I wish Linux did more hardening, but the article is misleading.)
Well I didn’t say it was easy :)

You do have a little more control over the situation than you do if you get laid off for turning 40.
Previous discussion: https://news.ycombinator.com/item?id=10536683
I have a right to free speech...

Not in Europe. Another overly self-important piece of parallel structure prose ruined by Americocentrism!
Original Washington Post article - http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...
HN Discussion on above article - https://news.ycombinator.com/item?id=10515661 https://news.ycombinator.com/item?id=10515817
Doesn't flipboard still use the DOM to do the initial rasterization? I thought it just used canvas as a caching layer.
Powerful On-Demand Delivery Platform
How does one whitelist open("/dev/null") with seccomp-bpf?
This is very similar to what we did in Samsung several years ago: https://velesnet.ml
Old Techies/Janitors/Bartenders/Drivers/Personal Assistants/Writers/etc..... Never Die....

There is this sense that many problems are unique to one industry when they are shared across many.
I'm not certain if HN will find this article on topic. I'm sharing it because I think that many HN users are still on campuses in some capacity and regularly have to contend with the issues discussed. I hope HN enjoys the read, but I'll understand if it's flagged.
Whats good for one agency may be bad for another, for example the State Department might like Tor because it facilitates anonymous informants while the NSA might not like it because they can't read your email.

I am not even sure if the NSA's mission extends to defending civilians.
Torvalds called openbsd devs "masturbating monkeys" for their focus on security. Wapo had an article on linux security the othe day.
Rather cynically, a marijuana possession charge is probably a lot easier to stick than a rape charge. Caught the suspect with MJ in possession = open and shut case, no expensive tests or investigation necessary, not much possibility of a defense. In the case of rape, proving beyond reasonable doubt that the suspect is the right person and that the sex really was non-consentual, if the suspect fights it, could be much tougher and more expensive. It isn't too hard to believe that the legal system would rather take the easier case than the more serious crime.
Yup. As a white heterosexual male with a lot to lose, I avoid any kind of controversy involving women at all costs. Does this harm collaboration? You bet! But I don't feel safe otherwise.
Yann gave a talk at my university last week. It's really astounding how far deep learning has come from performing classification and regression to now doing things like reasoning and generation. Does anyone else find this wild? These are tasks that historically required a tremendous amount of domain-specific engineering to perform well. And recurrent memory networks just power right on through them.

I understand that learned, dense vector representations are powerful blocks to operate on, but hot damn the trend of general systems that require less domain-specific engineering is an exciting one that blows my mind.
As someone who has gone the other way I would say no. Getting to the forefront in biotech is a 10 year full time journey. I have met a few developers who have tried to learn, but they have all struggled.

Having said this don’t worry, if you think the job prospects are bad for old developers they are far worse for old scientists.
WebAssembly is just a new storage format for asm.js, which is just a javascript subset. It doesn't replace the DOM. That still exists just as it does with Javascript! Any openness problems that exist with WebAssembly already exist with minified Javascript.
I'm in my 40s and recently changed jobs. Every single company that I sent my resume to contacted me and I got through the phone screens on all but 1. That company sent a frontend developer just out of college to interview me, but I'm pure backend and didn't know too many frontend concepts, which flummoxed the interviewer. He basically had no idea how to interview me and gave up.

Of the companies I went onsite to, half of them gave me offers. The others didn't, but not because of ageism but because my interview performance wasn't as strong as I hoped (asking questions in areas I wasn't prepared for, lack of expertise in their desired programming lang, screwed up the coding question, etc). All of the offers I received were an increase from my current job.

Overall I would say that ageism doesn't exist. Employers want people that can contribute quickly without a lot of handholding and without training. This applies whether or not you are a fresh grad or a veteran programmer. If you instill confidence that you are highly qualified to the interviewer, you will generally get the job.

And as someone who has been intimately involved in the hiring process as a hiring manager, I can say the same thing. I've interviewed people of a variety of ages and the only takeaway I care about is will they hit the ground running and contribute to the team quickly. That's why software developers are highly paid. When I first started working, IBM would give aptitude tests completely unrelated to programming, and if you did well, you would get a job and be trained.

Unfortunately those days don't exist anymore, for the most part. It's a problem caused strictly because of how highly paid engineers are. If salaries were 50-60k, then I'm pretty sure companies would be more apt to training and waiting for new people to get on board. But salaries are easily 3X that in the Valley, so at that price, you need to be contributing very quickly otherwise you're a waste of money.
Yep, the fundamental termination mechanism seems to be the same. Years and years ago I got into some silly irc nerdgument with a python expert (I think one of the twisted people) about the ugliness of this design and for a moment I thought I got to triumphantly yell 'Told you so!' a decade later. Alas, not the case.
He rides over it, blows a tire, his vehicle throws him into the road alongside his usual path, and he is struck and killed by a passing car. I just caused his death and can be criminally charged and civilly sued. Not to mention I don't want to impede regular pedestrians who are welcome to walk along the perimeter of my yard to avoid traffic (there is no sidewalk since it's semi-rural and it's a busy road).
I knew someone would ask that.

So, the way I'd recommend doing the filename whitelist is by setting up a mount namespace. Create a tmpfs, create the necessary directory tree inside it, bind-mount each whitelisted path in the tmpfs to the real file, then pivot_root into the tmpfs. This sounds complicated but is actually not very much code, and again a library could make it easier.

But I think you could also do it with pure seccomp. The trick is to copy the filename list into memory pages that you subsequently mark read-only. Then, have your seccomp filter whitelist specifically pointers to those strings, and prohibit making the pages writable again.

(Disclaimer: I just came up with this on a whim, it probably needs more thought.)
You know, I see many different big names in the ML field shooting for a personal 'assistant' or something like that. For whatever reason I have always thought what would be preferable would be an advocate. A being that would always have your back and be watching out for your best self and for you in general, preventing you from getting screwed by someone trying to make an information asymmetry play or trying to access your data. Somehow I worry that most big companies aren't going to be trying to create something that puts the user first. I'd love to be wrong.
And yet I can't read HN without seeing this garbage.
Made to Stick
Collecting a rape kit is intrusive and sometimes traumatic for the victim / survivor.

Collecting this evidence with no intent to process it is borderline abusive.

Rape kit collection is one of many reasons why many people do not report their rape to police.
The article has

"stay on the cutting edge".

Ha! The real leading edge is work that is at least "new, correct, and significant" and published in a peer-reviewed journal of original research in information technology, yes, and also powerful and valuable in practice.

So, put on resume that have published in original mathematical statistics for detecting zero-day problems, in artificial intelligence, and in optimization, and still get silence. With Silicon Valley, leading edge has no connection with peer-reviewed original research!

So, do a startup. Web development? Taught myself -- the Web page code works fine. The difficulty was a lot of poorly written documentaiton. The software was fast, fun, and easy.

"Leading edge"? Yup -- my startup is based on some original applied math I derived, complete with theorems and proofs. Likely and apparently I'm the only person in the world who understands that work. Definitely leading.

The problem my work solves, a lot of people have regarded as important. So far, I have the only good solution. Some of the people trying to solve the problem say that the solution I have is impossible -- they didn't understand what the heck they were talking about. They couldn't come up with a counterexample why not or a theorem of why can. The people just were not very good.

Problem is, really, leading is not what Silicon Valley is looking for. They wouldn't know the real stuff about leading if it slapped them in the face. My best published papers, nearly no one in Silicon Valley has
the prerequisites to read, and likely no one outside of Stanford or Berkeley and only a few people there.

Instead of leading, they want two years of experience in just what the heck low grade, routine, simple minded, poorly documented API or OSS they are struggling with today.

Those people are being self-taught on their way to the leading edge and are floundering around and stand
not to get to the leading edge. E.g., they keep saying Bayesian and power law but don't know the difference between the weak and strong laws of large numbers or about conditional expectation, non-parametric hypothesis tests, the Radon-Nikodym theorem, anything about martingales, the Neyman-Pearson lemma, etc., enough about conditioning even to understand the definition of a Markov process, a basic result such as

E[E[Y|X]] = E[Y]

the role of sigma algebras,
or any such things.

Early in my career, I started in computing and started to get self-taught in the often associated applied math. I made good progress in some things but otherwise floundered around with low quality materials, etc.

Then I went for a good Ph.D. and got one. Now I can say, nearly no one in Silicon Valley startups is in any significant sense even near the leading edge and, instead, they are just floundering around.

Back to my startup -- a few good days and I should be able to go live.
A book series and website where I explain LSAT practice tests. The LSAT is a standardized test used for law school admissions. It's an analytical test with very precise English, and my explanations help people make sense of it.

A significant portion of the material was done in the early years, when I worked like mad. Now I'm running the business at a more comfortable pace, though ramping things up to work on a new product for the site.

http://lsathacks.com/explanations/
That's not really the use case for it, the use case for Web Assembly is to take web audio and turn it from being a kind of toy into a platform where an ableton live could be empowered to run in the browser, as well as being able to load native plugins for audio processing and generation. Also say you want to transcode a video file from webm to hls, with web assembly that becomes possible, even with asm.js its really brutally slow to try to do that.
Of course, one should bear in mind what eventually happened to Rome…
Linus was the one calling the OpenBSD developers "m...... monkeys" (apparently that word triggers the HN spamfilter, I vouched your comment), so I think the OpenBSD guys are allowed to be "a bit miffed".
This campaign will bring up more awareness and more impact. LOVE IT! share and donate everyone!!
Windows 2000 CSS Theme
"Unsupervised learning"?

Well, setting aside the jargon, one approach is just a statistical hypothesis test, and a lot is known about that.
Most apparently don't believe this is possible or worth their time.

Or perhaps they would rather their patients come back with cavities so he/she can charge more to fix them? Here's an experience of mine that's relevant: I once had a dentist who told me I had a cavity and showed me a little black spot on one of my teeth; for whatever reason I declined that day and said I'd come sometime in the future when it was convenient, to fix it. In the meantime I was introduced by a friend to another dentist who was recommended because he was much cheaper, and so I went to him to fix the cavity - to which his response was, "that ain't no cavity", and promptly scraped the spot away with a pick. He also did an x-ray and showed my teeth were in perfect condition with no signs of any decay. This was a few years ago and I've not had any problems with my teeth since.
Yeah, I guess it affects someone like me (or younger) more. It does only affect a small area of the city, but that part now becomes dead after midnight, and the problems that used to be encountered have just shifted to other neighbourhoods.

I actually think we are paying more in rent than the cities mentioned. The only place where I can think of higher rent is in SF.
Your missing the point of pledge. It's for the developer to protect their code from the outside world. A malicious developer won't let we this and will try to obfuscate their intent and code. This is for the honest developer to mitigate the risk of a programming blunder to become a major exploit. Yes, its voluntary, but the developer has a self interest in using it.
Same, but I watched this in Brazilian Portuguese! Glad I can watch it again in its original English.
Assembly of the International Space Station (Animation)
I like this link
Now the question is, are vendors deliberately putting in security flaws at NSA's instigation?

Intel's "system management mode" and code need to be viewed with extreme suspicion. So do network controllers which accept management commands from the network side. It would be so easy to add some system management passwords to a network controller that don't show up when you list them. (In fact, if you're willing to have them show up in a list that nobody ever checks, you can insert a backdoor in a motherboard if you can get hold of it anywhere in the supply chain, hook it up to power and Ethernet, and talk to it briefly.)[1]

[1] https://en.wikipedia.org/wiki/Intel_AMT_versions
GLAZ – 3D printing platform with some cool 3D visualization tech in place
Applications that embed many utils into one almost always have a dispatch tree based on what they were called as and/or what their first argument is. In such an app, the app could figure out what job it's doing at the moment, and then call pledge() appropriately. Pledge() essentially says, "from this point forth, I pledge I will only need syscalls x, y, and z, so don't let me do anything else."

For plugins, that gets complicated. That's a case where there would need to be some reworking of how plugins are called, perhaps breaking the program into a series of plugins connected by pipes, where each individual program has its small set of abilities. But that's just an off the top of my head guess, there could very well be a better way of doing it.
I was referring to Google collecting non-user data as a practice and strategy. What would it mean to them if they were blocked (legislatively) from doing so?
collections.Counter() was the slowest option according to the benchmark from 2010
http://stackoverflow.com/questions/2522152/python-is-a-dicti...