skysight-inc/HackerNews huggingface dataset:
Amazon is different than those companies in that its leveling options are much smaller. SDE II is a very broad range and at a company like MSFT/GOOG it would realistically map to 2-3 different job levels there based on experience and contribution level. Same with SDE III. Principal+ is probably the most aligned.
So, if we assume this is indeed a backdoored Dual_EC PKRNG - how are those typically initialized? Are we looking at something equivalent to the Debian ssh/ssl bug, where we have some millions of "known bad keys", or is it more likely each case is different (ie some knowledge of the state is needed for a useful attack)?

Does anyone have a pointer to a proof-of-concept "evil" (or "escrow-enabled") system based around such an RNG?
I am aware, I still find them too similar for my likings
And how does wikipedia know who the .se belongs to? What I'm getting at is - mostly we don't know who runs it. The best we can know is that danger people run onion and se if they cross link to each other.
Not totally an expert but the explanation of what a PKRNG is overly simplified. The problem with Dual EC is not that it is a PKRNG, but that some design choice made allowed for allegedly planting a backdoor for agencies with enough computing power.

Basically one of the problem you are trying to solve with a CSPRNG is how you avoid to disclose the generator state with the random numbers. Obviously once the state is known it is easy to replay the sequence.

Since we don't like to reinvent the wheel overtime, a solution is leveraging known properties of hashing and encryption algorithms. The idea behind a PKRNG is to use a fairly simple state evolution function but then to encrypt the output with a known public key. Since a property of public key encryption is that you can't know the message if you don't know the private key, the state is safe for everybody except the owner of the key. If you then truncate the encrypted message and you choose the public key without computing the private key you get a very strong CSPRNG. To be more clear:

- There are procedure to generate a public key without generating the private key (but you should trust the person who generated the numbers).

- The encrypted message is truncated, so even if you still have the private key, you should guess the missing bit of the message to decode the state.

The problem with Dual EC is that the resulting encrypted message is not truncated enough (it is enough to protect against a casual attacker, not an organization with massive computing power like an intelligence agency). Plus doubt were casted on the procedure used to generate the public key, given that you were forced to use the one in the standard and not your own if you want to get certified.
Anyone have any tips for a productive way to deal with long compile times?
For a BigCo the Dublin pay is going to be roughly 50-70% of the US pay for the same job.
If I was advocating violence, I would have said so. That said I have a deep frustration for people with not only a negative can't do attitude. But more obsessively look for reasons to say I told you so. There are vast numbers of people like this and it gets worse decade by decade. And these people do vast damage to society.

And also spending £47m for heavy industry technology project is what I would call cheap. And except for the rare exceptions where the engineers nail the design all of these are janky initially. Which of course provides a lot of cud for the naysayers.
"They never lobby for (or introduce, if they're in a position to do so) bills to actually achieve that end, and in fact usually do nothing and let the status quo -- which until very recently was "keep the discriminatory laws on the books" -- stand."

How many self-professed libertarians are there in the Congress? Paul's not even self-professed libertarian. The only one I know is Justin Amash, and he couldn't introduce any of type of bills you reference because under Boehner's regime only bills blessed by his team could ever make it to the floor.
Or just tweak things for high signal:noise ratio. Scan the front page for only things relevant to your work/research/etc, ignore the clickbait. Read only a selection of your favorite commenters. Etc. This works on other social media like Twitter and Reddit too. You can minimize time spent while extracting max value.
You were probably down leveled based on the interview. The comp will max out lower (and therefore the offer won't be able to budge significantly higher) than you may achieve somewhere that did not downlevel you.
I ran this for many years (back in 1997/1998 and onwards) on recycled System 7 hardware[1]. The hardware was very reliable. Mac OS pre-X was horrible, just constantly crashing. MkLinux made the hardware pleasant for web servers and firewalls.

Edit: [1] I think the hardware was this: https://en.wikipedia.org/wiki/Power_Macintosh_7600
Wonderful to finally see governments in different countries finally begin to own up to this global problem, the biggest menace to the future of humanity and indeed the planet.
I don't know exact salaries of that many people, but I know payscales at a couple high-paying companies and people who work there, so I put 2 and 2 together. I wouldn't count people who are borderline since there's a bit of estimating involved. I would slightly less confidently put the same group of people at $250k or more.

I recently turned down an offer from Google for $270k total comp, so they're definitely one of the high-paying companies. I know Facebook pays similarly well, but have no interest in working there. Being in NYC, though, the highest paying are mostly in finance.

I've found Glassdoor to run very low for higher-paying positions, though. Their numbers are all salary as far as I can tell, while a large portion of compensation is in RSUs and bonuses (40%-90% at compensation levels of $250k and up).
Wine asks you to join the Software Freedom Conservancy 2015 Fundraiser
The constraints on the signal are:

decays into 2 photons, so must be a boson, integer spin, probably 0, 1 or 2
both signals are 45Gev wide and look like the Higgs signal.
ATLAS has a 1.6TeV bump at 2.5 Sigma, potentially a resonance.
ATLAS has 747 GeV at 3.6 Sigma, CMS 766 GeV at 2.6 Sigma - combines to 4 Sigma although the Look Elsewhere Effect is disputed.
ATLAS run1 at 8TeV did not see the signal.
ATLAS has a 2.2 sigma for the 2 TeV excess that CMS saw in Run1, potentially indicating the 750GeV is a composite particle.

4 Sigma diPhoton excesses have turned out to be random fluctuations before.

http://resonaances.blogspot.fr/2015/12/a-new-boson-at-750-ge...

http://motls.blogspot.co.uk/2015/12/first-batch-of-9-pheno-p...

http://www.math.columbia.edu/~woit/wordpress/?p=8174
I have been excited about the bump, even if later the bump turns out to be false. I wanted to make sure people have a chance to follow the story unfolding if they didn't know about it. I also appreciate the thought exercises surrounding the bump as I'm not scientifically literate enough to do them myself.
I'm inclined to declare ploxiln's Law of Negative Usability Cascades.

This dynamic does seem to strongly reflect how marginal UIs get progressively worse.

Don't design for idiots.

Oh: and there's some truth in the observation that 90% users don't know how to do anything. People are far less rational and sensate than we typically believe.

P.T. Barnum had something to say on that.
Or it could be literally nothing at all because the signal isn't strong enough to conclude anything is actually there to begin with. Which at this point is pretty likely, especially for any hypothesis that doesn't fit with the standard model.

The coverage of this has been absurdly breathless given the nature of the "result". The bandwagon jumping (or as the author themselves so elegantly put it, ambulance chasing) is truly something to behold...
Moving a team from Scala to Golang
Meteor: A Look Forward [video]
> Reverse sorting should keep subscripted users on top.

Will userOrdering.reversed() account for this?
There are some interesting points here, but I don't think the author adequately addresses research funding transparency concerns. Many funding sources require researchers to include a grant number in any publication. This would effectively deanonymize at least the Principal Investigator and their work related to the grant, since that is public information.

On top of that, many fields are small communities, and everyone knows what everyone else is working on and which methods they use.
What RESTful actually means
How to Build a Sustainable City
Oops I thought you meant within the HTML file itself.

CSS means "Cascading Stylesheets"
Using the framework the developer does not have write CSS.
What you pointed out is the "style" attribute.
Obviously the engine has to use the "style" attribute to communicate to the browser about the positions and remaining computed style properties.
If names and affiliations are hidden, how will applicants to graduate school find potential supervisors?
Ask HN: LinkedIn alternatives for engineers
Are there any good LinkedIn alternatives? Any specifically targeted at engineers?

My major issues with LinkedIn are:

1. Data ownership and privacy (essentially selling data to paying customers)

2. Inability to easily export data

3. Spam from recruiters / people I don't know

4. Awful to use and ugly interface

5. Very bad developer relations and closed platform

6. Overall spammy and dishonest past

7. Out of control email spam (that continues after closing your account)

Does anyone else feel this way, or am I on my own here?
There Are Twelve Different Kinds of Rainbows
A Cybersecurity Bill Loathed by Tech Companies Is Now Law
I'm always curious about the latter sentiment. Maybe I just haven't been on enough interesting projects, but I've never had a program that didn't have/need side-effecting code nearly every other line. Upload something to S3, if X then call some web service, otherwise log and call something else, etc etc etc. Pure data manipulation has always been a fairly minor component limited to dashboard statistics for me. Is purity that really your experience? What industry / types of projects?
I'm afraid that you have completely missed the target on this. MGP (or LDI, Lawrenceburg (IN) Distillers, Inc) distills and ages at their Lawrenceburg, IN location. In addition to distilling, barreling, and aging there for other customers, they also now sell some product directly - see Metze's Select, as an example.

You are not incorrect about MGP, however you're speaking about a completely different side of the business.
Why is it that Apple apparently is so keen on Mach? As I understand it, both this and XNU/Darwin/OSX have Mach in the lower layers. And if it adds so much value, why doesn't regular Linux distributions build on top of this?
Padlet is hiring developers to build the largest site in the world
This is a perfect example of why have a suspect feature present at all is problematic. Its usually just one configuration or compile time switch away from being used in real situations. The only reasonable response to the Dual_EC backdoor is to just delete the code entirely, keeping it around is asking for situations like this.

Its a lot easier to sneak a build or configuration flag in somewhere than it is to sneak in an entire CSPRNG subsystem.
1. Write documentation while things are compiling.

2. Finish other work.

3. If you iterate a lot, maybe just reading the code figuring out your next steps.

4. Maybe figure out why it's taking so long, and figure out a way to speed things up.

5. Write more tests.
It tends to balance out, while they need more health care, they use less of other resources. But put it this way, the US spends about 17% of it's GDP on healthcare. So an aging population is a serious issue. Say you double that and now it's 34% of GDP (yikes). Now consider Japan, 10%. And Japan has a significantly older demographic already. So say it rises 50% over twenty years to 15%. That's still better than the US right now. China's healthcare expenditures are 5% of GDP.

Numbers from here.
http://data.worldbank.org/indicator/SH.XPD.TOTL.ZS
Nobody but us
What I would like is to be able to explore the full citation graph, both interactively and programmatically. I think it would make identifying the key literature in a new topic much faster.
Making chocolate in small batches doesn't have anything to do directly with making a better chocolate bar.

I agree with most of your points (both in this post and more generally elsewhere on the site), and even acknowledge that you might be right if you define "directly" in a particular way. But I'm almost certain you haven't made your own small-batch chocolate, and would guess you haven't personally compared products from the producers being discussed.

You are right that small batch doesn't matter much, but timing is crucial. Freshly made chocolate has a lot of volatile flavors that dissipate quickly. Large producers age their product to produce a consistent (and sometimes excellent) product. Some small producers achieve a much faster turn-around from roasting to consumption.

I've both made chocolate and done a lot of comparison, and I've never tasted a mass produced chocolate where the taste is comparable to a fresh batch made by an amateur using quality ingredients. I suppose that theoretically it could be done, but in practice, to my taste, freshness has always had the flavor advantage.

My usual comparison would be coffee: freshly roasted and freshly brewed coffee tastes significantly different than freeze dried. Both have their place, but you should doubt the taste of anyone who says there is no significant difference. Fresh versus canned tomatoes is another example I've considered. There are some excellent canned tomatoes, and some lousy fresh tomatoes, but no canned tomato is a decent substitute for an excellent fresh tomato.
Do you know why they listed these specifically? All the title says is "here are some of the deadliest ..."

Even if you don't subscribe to the "more than once a day" statistic (which does include gang violence), it's still "about once a week" in 2015 for non-gang completely-innocent random victims -- and yet, this page lists only about 5 a year.
Probably not possible with ligatures/glyph variants but really cool would be grouping of numbers: In groups of three the first digit would be moved to the right and the last one to the left to simulate a narrow space as thousands separator.
The Mystery of Tetrachromacy
I'm not sure that small barrels harm the maturation of whiskey at all; see Laphroaig's excellent Quarter Cask scotch, as an example.

As an aside, some of the current rock-stars in the 'artisanal' non-distiller producer world make extensive use of MGP/LDI products - High West and Smooth Ambler come to mind. Templeton is an easy (and deserving) target, but I'd rather highlight the resellers that are blending MGP, and are doing amazing things with it. If you're ever in SF, I'd be happy to buy you a flight of whiskies sourced from MGP (sans Templeton) that all exhibit wildly different profiles; it may or may not change your views on MGP.
Which is true. But that seems to be more important to buyers than the taste/experience of the product.

I'm not a fan of dishonest advertising. But that conclusion seems a bizarre place to end up in.
Not the most serious issue but, how come they're encoding these constants as ASCII strings?
ccache[1] works for me.

http://ccache.samba.org
12 years ago, I have decided that I would forever change the way people communicate.

Today, nothing has been done. I'm struggling to get people to relate to this need for a better communication system and language. I am convinced that this is very important, but I fail to get the positive feedback I've always expected.

Should I ignore people and blindly trust my guts? Taking on such a massive task is very difficult for a single person.
"instead I offered broad time ranges that would narrow down to more accurate ones as work progressed"

Well, that is an estimate according to managers who actually understand what they're doing ;-)
Have you looked at bosh.io? It's being actively worked on by our designers and engineers, I bet that feedback would be welcome. If you email me I can put you in touch with them.
My other comment above is a better reply to this:

> Quality is a tricky word, but in terms of the appreciation of craft goods, your ability to identify the subtleties that make more higher quality products _better_ is a learned trait.

If your references are wrong, or you miss out on the identification of a nuance, you haven't learned from the experience or you've learned bad information.

For example, individuals who say "I can't taste the difference between a $30 and $300 bottle of wine" are not _wrong_ - they just lack the formative experiences and education to appreciate the attributes that the more expensive product has.

There is an entire world of great flavor out there that is very hard to perceive; for example, I don't eat any artificial flavorings, preservatives, or food coloring,
and when actually doing tastings for work, there are lists of black list foods and cut-off times for a clean palate - we go to that extent because anything less would cause us to miss what makes that product unique and special - we would be entirely unable to perceive it, learn from it, and appreciate it.
You sure about that? How many startups feed their customers a line of bullshit around, say, uptime or data security? The answer, in my experience, is "bunches". Which is emphatically not to excuse them, I wish pretty much every kind of ill on that sort of company, but I think that's just "part of the process" for plenty of morals-optional people in startupville.
I would love to know what the commits in the source code look like for these. Author, message, date.

How did they bypass the review process? Was the process socially engineered, or was the repo hacked directly?

What will the new process be to ensure this doesn't happen again?

This has implications for the process at most companies.
I agree with you on most of your points, but don't know an alternative. I actually accept all requests from recruiters and will hit them up if i ever need extra work, so the spam I get ends up paying off in the end. I've gotten a few gigs from recruiters on linkedin.
How Martin Shkreli, the Teen Wolf of Wall Street, Thrived
This is a hilariously bad idea.

As the author notes, there is no way to make conference presentations anonymous. But the problem is much bigger than that. Even most informal conversations between scientists involve promoting and discussing one's own ideas and work.

How could hiring or awards work? It is simply not possible to make such decisions on meritocratic basis without individual credit for ideas. The only consistent way I could see that working is to make such applications anonymous, but at a certain point anonymity will inevitably break, if only for in-person interviews or once people are actually hired.

More broadly, complete anonymity is impossible, and incomplete attempts towards anonymity would only reinforce existing old-boys networks within science. Authorship would become a matter of gossip and innuendo, which would make it even harder for new-comers to break into science.
So it's like shorting a stock... Limited upside, unlimited downside.

Interesting observation, I'd never thought of project planning that way.
You can if you're just avoiding bad luck; You often cannot if you're avoiding an active opponent - in which case, your random would need to be cryptographically secure AND not leak any data through timing or other ways.

Here's an observation: Quicksort is similarly vulnerable to an active attacker[0], and can similarly be "protected" with random pivot selection. How many quicksort implementations have you seen in production quality libraries that actually have a random pivot selection? I have seen none. As a result, I avoid quicksort (and cuckoo, and any other basic algorithm which depends on good crypto to perform well).

[0] I'm not referring to McIlroy's "antiquicksort" here, which makes quicksort O(n^2) even in the presence of completely unpredictable pivot selection -- I'm assuming the data to be sorted is laid out before the sorting starts.
My vision is not 100% and when I code for a few hours my eyes get tired and it gets even worse. Fira Code helps! Thank you, tonsky <3
One of the author's first arguments is a common one, but one that I think is an oversimplification: That after WWI art started depicting the awfulness that Europeans had suddenly been exposed to, and therefore became "unpatronable" in the traditional sense since it wasnt pretty pictures of lily pads anymore.

Look up fin de siecle Vienna if you aren't familiar with it. Decades before the war, artists in every discipline were pushing in weird directions (not necessarily in a bad way!).

I think its important to recognize this. Then more than now art was an important aspect of everyday life, and I dont think they write in history books that "many people in Austria and Germany were going batshit crazy" was an important part of the classic WWI "powderkeg".
Certicom did the same thing. The argument given was that these companies have less access to data interception, therefore the impact of a maliciously-generated set of parameters is lower. That's absolutely crazy.

The real danger of including Dual EC in any system is the risk that it adds to code. Now instead of having to include a large, easy-to-detect passive decryption backdoor, an attacker only has to change a few bytes. Sometimes just a pointer value. Once you do that, Dual EC is often ridiculously easy to attack:

http://dualec.org/DualECTLS.pdf
"Officials with both companies have criticized fingerprint requirements as overly burdensome and unnecessary. Drivers working fewer than 20 hours a week are critical to the reliability of their services, they say, and requiring them to visit an office to be fingerprinted dissuades many from signing up."

Is there any legitimate opposition to fingerprinting? We are required to visit a government office every now and then to do lots of things. Got a driver's license? You visited an office for that. Got a passport? Same thing. Got your car smogged/safety inspected? You visited a government approved garage/office for that.

This idea that somehow visiting a government office will cause the world to stop is a beyond far-fetched. It sounds like some weird anarchic wetdream.
I suspect that it's possible, but would require an impractical number (1000) of ligatures in the font.
Once you move away from keyboards and mice, USB devices in general are flaky. And USB based debuggers are hella flaky unless you have a supplier with enough $$ to throw at the problem. The Atmel Debuggers (but not the programmers) are an exception.
You're missing the point people! Don't record other people who are renting your house, or tell them you're going doing it. Detecting and disabling a camera on the network (and assuming it's on the same subnet as any wifi you are authorized to use) is ass backwards.
CISA Passage Proves Need for Combination of Encryption and Peer to Peer Networks
It would be like, like a wiki, but before the admins go off the reservation.
In your analogy, is it the rape or speeding that's equivalent to forcibly disconnecting a wifi client?
Why would you defend such shitty, fraudulent behavior and attack the customers who were lied to? It reflects poorly on you.
Show HN: Adblock to Bitcoin Wordpress Plugin
Very true—what libertarians should do is promote common‐law marriage, which is permitted in 9 states. Unfortunately, over time fewer and fewer states have allowed forming new common‐law marriages. And in those states where it’s still possible, same‐sex common‐law marriage has always been illegal. So “get the government out of the marriage business” still requires active effort to change the laws.

https://en.m.wikipedia.org/wiki/Common-law_marriage_in_the_U...