skysight-inc/HackerNews huggingface dataset:
Well, there were two different backdoors:

- This one could be the work of an intern, maybe a smart one but definitively it doesn't seems very sophisticated (we should look at the code).

- The second one, we are not sure it actually existed but just that someone changed the parameters for the PRNG. But if it existed, well, it was a very sophisticated attack.

But that's not the point of your question! A string compare with an if is pretty easy to hide in the code. Especially if the string looks like a logging string. I'm pretty sure in a big patch could pass through a quick code review. Calling an HMAC function or hiding it in the auth code that already call the HMAC function is much more complex. Plus it is much more difficult to generate a password, salt couple where both the salt and the HMAC seems legit code. Even for an intelligence agency or an attacker with huge resources, it is difficult to get such result!
> All non-ms programming languages are UNIX-first. They feel bolted-on when ported.

This is not an argument against Windows, but against these programming languages and their maintainers.

> And let us also not forget the complete freedom you have on UNIX systems.

There are lots of commercial UNIX systems that have much more restrictive licensing terms than Windows.

> Another benefit is, the lower level APIs are the same they were two decades ago, some are even older. And that API surface is much smaller. You basically learn them once, and they're good for life.

The same holds for WinAPI etc.
I find that often my interest in projects waxes and wanes periodically, and seemingly randomly. I like the organizational ideas of GTD, specifically the getting the ideas out of your head and collecting them into a known place, and breaking down TODOs into components until they're not so large and abstract as to cause paralysis -- but I agree that they can still be overwhelming.

This article made me think of an idea of mitigating the former issue; that is, instead of have a huge list of "next steps" that can cause their own form of analysis paralysis when I'm feeling indecisive, even if they're small and easy, but instead have a mechanism to choose and display a single, randomly chosen item from the list of items.

If I'm not interested in that, I could skip to another one. Otherwise, it catches my fancy and I now have something concrete to work on, without wasting any effort trying to figure out what to do myself.
Those pre-modern dudes had awesomely-groomed beards.
There's no undefined behavior there. It's just an example of why one might want the compiler to entirely ignore code you wrote.

If you want to use undefined behavior to elide the NULL checks, consider:

int computation(int *a, int *b) {
if(a == NULL && b == NULL) return 0;
if(a == NULL) return *b;
if(b == NULL) return *a;
return ...something with *a and *b...;
}

...elsewhere...
int *a = malloc(sizeof(*a) * 1024);
int *b = malloc(sizeof(*a) * 1024);
for(int i = 0; i < 1024; i++) {
a[i] = i;
b[i] = i * 2;
}
int c[1024];
for(int i = 0; i < 1024; i++)
c = computation(a + i, b + i);

The compiler is allowed to remove the NULL checks from an inlined computation here, since the code already dereferenced a and b in the initialization step. Failing to do so would make the code a lot slower, and this optimization seems completely reasonable to me.
> Having written code for Win32 for a while, I kind of have to disagree. Compared to Gtk+ (I admit, I only used it from Python/Perl/Ruby) or Qt, building GUIs in C/Win32 is a huge pain.

On the other hand: WinAPI stays (even binary-)compatible with new versions of Windows. Gtk+ on the other hand is replaced by newer incompatible versions all the time.
If othe back doors are as well hidden as this one it will take a while to find them out and even then you might not find all of them.

ScreenOS has probably 2 decades worth of code in it, some of it is sure to no be well documented.
We know that Jesus was not a white European.

https://en.wikipedia.org/wiki/Race_and_appearance_of_Jesus
The Future of Mruby in HTTP Server – RubyKaigi 2015
In my circles that judge books

Do the others in your circles also judge books before reading them?
They use the Gregorian calendar in China for everything except traditional holidays.
can you point me at a chassis designed for that?
Your parent poster asked how a command line should look like "to be more in line with everything else on Windows". Not how a good command line under some UNIX looks like.
Google Fiber Might Put Me in Jail
Pinboard is fantastic, but it doesn't look like it exposes the archived pages through the API. If you ever wanted to leave Pinboard and do a data export, you might not be able to take everything with you.
I get skeptical when people are so enthusiastic about some newfangled anything that they compare it to reading and eating vegetables. GTD could be that good but it's an extraordinary claim and it deserves to be scrutinized accordingly.
I don't have an answer to your question but note that bhyve is still very new, it is still very experimental, and the feature list is still pretty short. That said, work is ongoing and progressing pretty quickly.
I read David Allen's book back when the web was at version 2.0 and the one thing that has stuck with me is this: if something is going to take two minutes or less, just do it. That simple rule helped me immensely.
Focus on college affordability obscures real problem: we’re overeducated
Senator Boxer is retiring after her current term, so I doubt that cowardice explains her non-vote.
This white noise maker has worked well for me for 8 years:
http://www.amazon.com/dp/B000LQI2S0

They work by increasing the volume of the background noise. Sounds that would normally affect or you sleep end up blending in with the background noise.
The buildings I've lived in were built in: 1910 (Lower East Side), 1920 (Yorkville), 1915 (Kensington), 1928 (Brighton Beach), and 1910 (Upper East Side), and all of them were awfully thin. Maybe we have different definitions of paper thin, but I have always been able to hear my neighbors: walking, talking, playing music, taking a shower, or watching TV.
You should put this link to the demo https://mahsu.github.io/mariocaml/ at the beginning of your README.md.
I agree, but the downside is that all these noises are going to wake you up the next morning, while you're trying to sleep.
Compare "quantum". Clearly a buzzword in many contexts, even though quantum physics is a legitimate thing.

I've had the "pleasure" of working with big European consortiums where REST is very much a buzzword. I quickly realized that people were using the term as a synonym for "HTTP" for the purpose of making grant proposals and deliverable reports sexier. It's definitely a buzzword!
Actually, at least in the US, physics is funded because of things like the atomic bomb and the transistor, as GP points out. Observe the rhetoric of any congress member. They don't care if physics is "cool", any more than the general public probably does.

Football isn't funded by the federal government at all, so your point about national security is just silly.
If you have an interest in distributed computing "The End of Protocols" is a great read:

http://www.cc.gatech.edu/~keith/classes/ubicomplexity/pdfs/i...

The whole RPC vs. REST thing is not a useful distinction.
If I hadn't come to the comment thread, I would not have realized that the commit message was sarcastic - I thought to myself, "wow, people are still finding bugs in calendars - this stuff is hard."

This is probably tangential but when it comes to code and context and everything (e.g. commit messages) I like to be as dry and clear as possible. Just the facts, ma'am.
Theorem of the Day [pdf]
Cybercrime Week in Review 19 December 2015 – MailShark
In addition to using the Gregorian calendar, China has a couple thousand McDonalds and people there are well aware of major world currencies.
It's probably the biggest problem with pairing HTTP(S)/1.1 and REST. TLS/SSL will require a session that is much more "bound" (entangled?) -- and really would be the sane place to keep track of authentication/id bindings (Who is the client?) -- and use as a basis for authorization (What does this client have access to). But because of the "bolt-on" nature of TLS, we get things like TLS terminating proxies/load-balancers etc, and a lot of passing flags in headers (ProyxN confirms that it's relaying over plain-text HTTP on the (assumed to be) secure internal network, on behalf of clientX that's connected over TLS and has been authenticated...).

The "simple" answer is to have client-certificates, and allow a client access directly to an application server over TLS, or use a secure transport (eg: IPSec), and just use standard HTTP auth on every pass (which AFAIK never was extended to use some form of standardized token, so one's left with sending the actual login/password pair every time).

The sane compromise is to just use encrypted cookies -- but they are also bolt on solutions.

The problem is that essentially one needs encryption to ensure secure sessions, which essentially boil down to authenticating the client to the server, and the server to the client, and forming some kind of session (typically DH for a symmetric session key).

For a long while, encryption was really expensive compared to the db lookup and template render that "every" web application did -- and so we've ended up with a mess of "best practices" which aren't very good at all (and not a very good way of moving from REST-that-trusts-plaintext-ip to REST-and-also-secure).

With HTTP/2 it looks like things are moving towards making the transport-protocol part do the things it should -- track the session, and secure the session. Still doesn't do a good job of authenticating the client in any meaningful way, but it should simplify some of the assumptions that are necessary to build a secure(ish) system.
We detached this subthread from https://news.ycombinator.com/item?id=10767524 and marked it off-topic.
> I feel that in many cases, ebook prices are just ripping me off.

The material costs of a physical book are probably well under $0.50, and the manufacturing is done by automated machines so that should add very little to the marginal cost. Shipping and storage could very well be the biggest contribution to the marginal cost of a physical book.

The costs for a book other than manufacturing, shipping, and storing should be about the same for ebooks and physical books.

Thus as long as an ebook is maybe $1 or so less than the print edition it seems I'm getting a fair deal (or rather I'm getting as fair a deal as I'd get with the print edition...). Most Kindle books that I've been interested in were priced under the physical editions by at least that much.
>>> Obfuscation and complexity screams cyber criminals which care more about covering their own trail than ensuring functionality.

spies, you mean? The NSA, that is
Is crispr actually used for fungal genome editing? It seems like TAR cloning would be much easier.
Is there a form of static analysis that transforms source code into a normalized representation, such that two semantically identical programs with different source can be proved identical?

No, there isn't. Not in the general case. Solving program equivalence would also provide a solution to the Halting problem.

One way to prove this is as follows:

Given an arbitrary function, f, we choose a number x and define a function f', which on input n returns 1 if n = x, and otherwise calls f(n).

We now statically know that f' halts on at least one input. If functional equivalence were decidable, then deciding whether f is identical to f' decides whether f (which, recall, is an arbitrary function) halts on input x. That would solve the Halting problem. Thus, functional equivalence is undecidable.

You can design normalized forms which will tell you if some classes of programs are functionally equivalent or not (and it's a darn good thing, too, or it would be impossible to do compiler optimizations), but any realizable algorithm for such must always have edge cases where it either gets the answer wrong, or has to output "I don't know".
Coelux artificial skylight
I have a tough time ginning up a whole to of sympathy here. Most people in business would kill for such attention. Not being able to figure out what to do with it seems like a comparatively small problem.
Who is "they"? I doubt it was Juniper who put this in, and whoever did it, I doubt he cared about how many people would abuse it once it got out.
Speaking to scientists I know, quite a lot of the problem is university press offices. The bullshit articles start as bullshit press releases, bearing little resemblance to any actual facts in the original paper (or arXiv preprint). Not sure of a way around this one.
But the user will probably open a new thread asking the same question, fragmenting the answers (between new and old thread) and still create content that needs to be moderated.
My impression was always that most of the assholes in question here are the same as the assholes of any other philosophy: they think they have the inside track and everyone else is just a bunch of ignorant idiots. The key difference is that these ones have a bigger target on their backs so cutting them down is easier. Even more so since a triple-A game was created that crucified the philosophy.
Compared to taking amphetamine? On average, yes, of course.

SSRIs don't work very well for many people, but they do work well for many other people.
If you're using an authentication token, it's not really REST. Because of the dire situation wrt. client certificates, the only straight-forward, "pure" REST, would be to supply Basic Auth on every request (that doesn't allow anonymous access).

I'm not really convinced that's not a good idea for a TLS-only service (compared to the complexities that tokens/cookies introduce). One reason why there was a move away from Basic Auth was ofcourse that it is crazy to send plain-text login/password pairs over a plain-text transport (HTTP sans S).

And there's never been any working, cross-platform effort to improve things (AFAIK).

There's some work on Kerberos that's interesting, but again, many of these efforts have been simply co-opted by the fact that everyone used cookies (and had problems, and started encrypting them etc), and then moved from HTTP to HTTPS.

When you have HTTPS, there's not that many reasons to not just have "SECRET PASSWORD" in the URL (granted that'd not be REST either, but BASIC AUTH does the same thing, just in a header).
Dispossessed in the Land of Dreams
Intersting read on Bayesian Epistemology

http://plato.stanford.edu/entries/epistemology-bayesian/
Interesting. I haven't used Swift yet, but been learning Rust recently - the "protocols" look an awful lot like Rust's traits, is that so?

The three groups shown ("can do...", "is a...", "can be..." sorts) feel like a helpful way to think about these things in general.
I’ve been documenting my life through gifs for the past year
Most physicists are experimentalists, who work on testable predictions. And most theorists work on easily testable systems, like solid state physics or nuclear physics. And even cosmologists and astrophysicists in are very aware of the problems of ascribing astrophysical phenomena to new physics, it just took 70 years after Zwicky's invention of dark matter before anybody took it seriously as a sign of new physics.

By contrast, the small bit work done on theories that have purely theoretical appeal is getting all the press, and in a way that needs to improve a lot before one could call it grossly misleading. Take for example the sentence,

“The imprimatur of science should be awarded only to a theory that is
testable,” Ellis and Silk wrote, thereby disqualifying most of the
leading theories of the past 40 years.

Well, what is a leading theory supposed to be, 40 years ago the standard model was just that, a model that needed confirmation. The W and Z bosons were only discovered in 1983, the Top quark in 1994 and the Higgs two years ago. General relativity only had strong support in the high field regime with the discovery of the Hull-Taylor pulsar a year earlier. And as I said, most physicists did not work on fundamental physics in the last 40 years, but instead on stuff like the quantum Hall effect ( discovered by von Klitzing in the early 80ies) or the Giant Magneto-Resonance ( discovered in the late 80ies), both solid state effects with technological applications and Nobels in the last thirty years.
Looks like it will be a good week to be a Cisco salesman. Hopefully Juniper can get past this as the competition between them is a healthy thing for the marketplace.
Excellent! Thank you!

Guys, do you consider making an edX/MITx course on Deep Learning based on this book as well?
تور کیش در هتل شایگان- ۲ تا ۵ دی ۹۴
Such kind of work is almost certainly within reach of wealthy individuals, let alone companies. As the KGB showed, it doesn't cost much to turn people. Decades-long spies operated in the CIA and FBI for very little money, despite only doing it for the money.
Because having freedom in how you spend your leisure time obviously means that taking away that optionality would lead to.. revolt!!! I just don't see your logic here. It seems outdated.
In a first, East Texas judge hits patent troll with attorneys’ fees
I agree that functionality and simplicity is very important, but having the password in plaintext is just sloppy. LukaAI suggested using a hashed password. Surely that would have been much better at containing the fallout.
Yeah, a lot has changed indeed, and I'm not surprised that many things were "better" before. Population density rise takes its toll. The endless cities are indeed a thing, wouldn't be totally surprised if the plain on west side of the island would become a sort of mega-city spanning the entire length.

Seems like river-relocation is also a quite common thing (see e.g. Taipei's Neihu area in the NE, bunch of smaller examples too).
> But yet, there isn't a crisis in physics at all since these theorists are so far removed from reality, I don't really care what they think. They don't really tell use anything useful or interesting so I tend to ignore them.

Einstein was a theoretical physicist. Without his theories:

* Japan might not have been defeated in WWII.

* There might be more coal power plants, because there would be no nuclear power plants.

* GPS probably would never have worked.

* We'd have fewer successful space missions.

* There would be no superconductive magnets.

* There would be no digital cameras or solar cells.

* There would be no lasers.

I could keep going if you want...

References:

https://en.wikipedia.org/wiki/Albert_Einstein

https://en.wikipedia.org/wiki/Theory_of_relativity

http://www.guidetothecosmos.com/present_wwe.html

https://en.wikipedia.org/wiki/Theoretical_physics

https://en.wikipedia.org/wiki/Nuclear_fission
setup in a 'winner takes all' kind of way

Photography is what is known as a scalable profession. A quick search turned up this good explanation:

http://casnocha.com/2009/03/scalable-vs-non-scalable-careers...

It's something I've been thinking about as I try to guide my children into selecting a college and major.
I'm glad you stood your ground. But what I don't get is the mindset of everyone who wanted to publish the potentially-faulty data. The moment anyone tries to build on the result, its faultiness will be known. Is that not more embarrassing?
Well, I have a biased view here. I'm a knowledge junkie and I love learning systems. In software, I _actually_ RTFM for every single tool I use even tangentially. (As a side note, reading tech documentation cover to cover is actually awesome). So instinctually my gut reaction is to say "yes of course learn the system".

But as far as a more measured, less biased opinion goes: it depends on how professional you want to be. Most real consumer hardware doesn't really have APIs in the same manner that arduino and other user-friendly platforms do; arduino is basically designed to make programmer hobbyists feel comfortable with hardware.

But real embedded systems are programmed on microcontrollers (generally, sometimes we use FPGAs or other exotic platforms) in assembly or a dialect of C. And there, you're not so much "using an API" as you are manipulating output pins directly. So if you really want to work with high powered, professional platforms, you should certainly learn the stack.

Learning the stack is advantageous even with a friendly platform like the Arduino. At low power, most robotics are pretty easy to work with, very few surprises. But as you try and build bigger and more powerful robots, especially where motors are concerned, you start running into real electrical engineering problems (like back-EMF) that you _can't_ fix with software. So if you aren't comfortable with electrical engineering, the first time you attempt a more ambitious project you'll find yourself at a brick wall that you don't know how to get around.

So, unsatisfyingly, the answer seems to be "it depends" ;)
I agree with how verbose some of these languages are, but this is a bogus argument. You can shorten almost any design on a rewrite, regardless of language. Not to mention the "density" metric is ridiculous. Minified javascript is certainly more dense than regular javascript, but nobody would argue it's simpler.
You won't have much help from Nvidia, they like to disable this sort of thing when they can, artificial limits in their binary drivers etc.
Skrolli, Computing Magazine – International Edition
If you are capable of inserting this kind of backdoor, how easy is it to compromise a version control system? (or the login details of one of the programmers?).

Is it possible to prevent history of the code being modified? Do DVCS use blockchains?
What's Next for Apple?
How Much Money Was Tyler Durden Making with Soap in Fight Club?
> You're probably tired of hearing this from me, but if you distribute the storage, you can evacuate all the VMs off a host, down it, do whatever, bring it back up, and then unevacuate.

Yes. The same conversation is happening right now in the living room, because security has forced three reboots in the last year, after having several years where simply by being xen and pv and using pvgrub (rather than loading a user kernel from the dom0) we haven't been vulnerable to the known privilege escalations. This is a lot more labor (and customer pain) when you can't move people.

No progress on that front yet, though.
The rise, fall, and return of Star Wars Galaxies
Sigh, maybe Client-Server or Remote Data Access?:

"3.4.7 Remote Data Access (RDA)

The remote data access style [131] is a variant of client-server that spreads the application state across both client and server. A client sends a database query in a standard format, such as SQL, to a remote server. The server allocates a workspace and performs the query, which may result in a very large data set. The client can then make further operations upon the result set (such as table joins) or retrieve the result one piece at a time. The client must know about the data structure of the service to build structure-dependent queries."

http://www.ics.uci.edu/~fielding/pubs/dissertation/net_arch_...

REST is a very specific architecture, with very specific constraints. Not everything is REST, not everything should be REST. And there's certainly no reason to call things REST, if what one means is simply a client-server application over HTTP. But if what one is building is "just" client-server, perhaps HTTP isn't the best transport.
I'm happy that your work in experimental physics has given you an appreciation for the vital part experiment plays in science. But dismissing theoreticians for working in the clouds while you work "in the trenches" is not very fair. Not every theoretician works in 87-dimensional string theory.
Chuck Moore came out and spoke to us at work not long ago, and I have to admit I had a total fanboy moment. There are very few people in the world with as clear a view of how to make an entire system, hardware and software, directly reflect the problem to be solved with no cruft. There's alot to learn just from the way he decomposes a problem.