skysight-inc/HackerNews huggingface dataset:
This concept of retroactive back doors seems a new awareness.

Actual, non-retroactive, backdoors are built into a design.

The idea you can take an existing design and insert a backdoor that works retroactively really is not a backdoor but is a complete security failure and a bug in the original design.

"My design is completely secure as long as no one issues a retroactive backdoor." means the design is not secure at all.
Protocols solve problems. Whats the problem being solved?
If you have the source, it shouldn't be difficult to build binaries, should it?

If you are building a new Linux distribution based on Ubuntu, I don't even understand why you would want to reuse binaries they built.

This post would be more meaningful if it literally quoted from unfavorable license terms used by Ubuntu to actually prevent people from making derivatives. Saying that Canonical "appears to require" something is using weasel words.
> There is also no historical precedent where the notion of privacy has meant "secret forever"

Sure there is: a private verbal conversation.

There are plenty of ways for the government to record such a conversation if they know in advance that they want to do so. But if they don't know that in advance--as they did not with the San Bernadino shooters--then the only people who will ever know what was said in that conversation are the people who held it.

Historically, privacy meaning secret forever was the norm! It is only in the last few years, with text-based electronic communications, that law enforcement has come to expect retroactive access to all conversations.

It's a very dangerous concept that should require careful consideration and votes to create. Instead it got created by default because no one knew how to do info security well 10 years ago.
Oh sure, the more the merrier. Just pointing out that the "for the most part" is kind of a silly criterion.
not sure if it's just because I'm older and less into gaming, but civ5 seems markedly less fun as a game than civ1 and civ2 were. I just couldn't get into it, and I used to spend entire nights on the older games.
I got one of these new and improved gas cans. It was very similar to the old one, that worked, except it had some spring-loaded thing to close automatically. To put gas in my boat I have to hold this can with one hand and try to twist the stupid spring thing with my other. Doesn't work. I ended up getting rid of the spout and pouring the gas, sans spout, into a funnel.

So yeah, the workaround defeats every supposed advantage of the new design.
TLDR for what follows: Mandated backdoors must be a red line, but
this is not a request for a backdoor and actually seems pretty
reasonable. Trying to argue that the tech industry shouldn't help,
even in this case, is not only the wrong position in my book, but a
sure way to lose the bigger debate.

My views on the general encryption controversy are:

1. Everyone must be free to make their technology as secure as they
possibly can. There can be no mandated weakening of security,
back-doors, or other requirements to make the information more easily
accessible by law enforcement. On newer iPhones, Apple has patched up the flaw that the FBI wants their help with exploiting. They must continue to be allowed to do that.

2. The government must be able to demand, with a court order
predicated on probable cause, that companies provide any and all
information that they have that could be useful in circumventing their
security features. This can be everything from technical
specifications and threat-model analyses, to lists of unpatched vulnerabilities and code-signing keys.

3. It seems to me that American companies have a moral obligation that
goes beyond the legal obligations in point #2. They should be actively
assisting the government in recovering information, especially when
concerning issues of national security. In extreme circumstances, like
total war, this should definitely be legally mandated. I'm undecided
as to what the policy should be generally. On a practical level, it's
probably not feasible for the government to, e.g. start hacking around
the iOS codebase themselves, so just information might not be enough.

I'm not too troubled by this court order, especially given the
particular circumstances. The right to make products as secure as you
can, even from yourself and the government, is what's really important
to defend.

Trying to argue that the tech industry shouldn't help, even in this
case, is not only the wrong position in my book, but a sure way to
lose the bigger debate.

Disclaimer: These are obviously my own personal views and nothing else. They do not necessarily reflect the opinions, policies, or practices of anyone but myself.
I wonder if the algorithm to differentiate CEOs and VCs was novel. Well done!
>It is probably more accurate to claim the GPL was designed to be incompatible with an entire class of licenses that includes the CDDL,

It was designed to give and preserve rights for end users, it's not really a big mystery, and the actual rights which are given and preserved perfectly mirror that.

I don't see anything that would substantiate your claim of them being 'deliberately' incompatible with any other licenses (anything you can point to ?), in fact they've fixed incompability problems in GPLv3 with other licenses.

And of course both MPL and CDDL came along much later than GPLv2, with which they were incompatible (MPL 2.0 in turn rectified this).

>can be simplified to one guy thinking GPL incompatibility is a good feature.

No, I don't think for a second that it was 'one guy', again Sun management had absolutely zero reason to allow Linux to incorporate ZFS and DTrace and every business reason not to, in fact from a business standpoint it would have been crazy to hand over ZFS and DTrace to their main competitor.

>but that does not stop people from distributing it as a kernel module and that is how filesystem code is loaded these days, so it is a non-issue.

I'm not at all sure it's a non-issue, this is a Linux kernel module running in Linux kernel space, I'm pretty sure there is a strong case for this being considered a derivative, that said I hope it won't be an issue since having ZFS in a native capacity with minimal effort is a boon for Linux.
This looks neat. I like the 404 handler showing a spec!

The title confused me as I expected something to help me write a CLI app... If anyone else was thinking that way I highly recommend looking at pyinvoke.org or Argh.
My favorite part -

> This friend recommended nvd3.js, presumably because you’re not making real graphs in 2016 unless your graphing library is <something>.js and requires at LEAST one other <something else>.js as a dependency. Everyone looks at you like “what, you DON’T already use <something else>.js? Jeez say goodbye to your Hacker News karma. Just apt-get install npm && npm install bower && bower install-” NO STOP IT THIS ISN’T WHAT TIM BERNERS-LEE WANTED”.

edit: as huckyaus mentioned in a different thread, author did http://swagify.net/ as well. In completely unrelated news, I'm changing my handle to [Tr1Ck$h0t][LEGIT][60x7]$$$C30C0DER$$$, that will make me really popular among the cool kids.
Pyramid also has scaffolds which layout the project in an intelligent way based on some assumptions. Pyramid can be as batteries included or as out of your way as you desire. In the end there isn't a Pyramid way (The Rails Way) there is just Python.

Also the debugtool bar is excellent for tracking down defects.

The last time I check the Pyramid code base had 100% test coverage.

I look to the documentation as a work of art and a standard for all of my opensource libraries.
I highly prefer Colonization to all the Civilization episodes I have played. Colonization feels more focused, more tangible, and yet still manages to be a great management game with credible threats with multiple parties: natives trying to fight back for their land, other European powers trying to establish successful colonies on their own, and ultimately the royal power you will fight against to secure your Freedom. The tension gets really high, really quick. And there is no "shortcut" you can take to have a technological advance versus your enemies.
Thanks. Your comments (and whalesalad's) helped make this clearer for me.

A simple (and I think common) situation may illustrate what I took away from your comments:

- You create a CRUD app in Django with two types of users: staff (who use the admin interface to modify anything) and regular (can create/modify their own data, but only read other people's data)

- The staff make a mess via the admin interface, so you decide to add some type of undo thing. You look around for an existing addon that does model versioning, but people still spend time reverting changes back.

- You decide you need some business logic (changes going through some review/approval process) and are scratching your head about how to do that in Django.

I can see then why "I look back on any apps I've built / worked on that a) started off as a CRUD system and b) are still going and most of them are a mess."
Ugly isn't the problem. It is the poor error catching, erratic memory use, several ways to do one thing due to a lack of features in the standard libraries (regex), etc.
On a microcontroller with only 64k of RAM, the last thing you want to have to do is round up to 4k pages for sizing things.
"Moving huge amounts of data from hither to yon" is not a specialized role at Google. Anybody with solid C++ skills can find a way to work on that.
Because they are a really crappy approximation of how good someone is.
This is like saying that the Windows codebase is incomprehensible and thus C / C++ must need better syntax.
https://news.ycombinator.com/item?id=11127862
The Push for Supply Chain Transparency [in Food]
Do you still hold the same position if we replace the United States / FBI with China?

Apple sells tens of billions of dollars of iPhones to China every year. If Apple provides assistance to US law enforcement but not to Chinese law enforcement, that's going to be a disaster. But if Apple provides assistance to Chinese law enforcement, that's a different kind of disaster.
Emotions are not a requirement for strong AI. I frankly would not waste any time with them. I just need an AI that can learn and solve problems at the human level.

I'm not naive enough to think that it can be solved in a short time. I do think that it is worth it for a person to spend the rest of their life working on it. There is just nothing more exciting than AI in my opinion.

Just imagine the possibilities...
The case against tipping in the US
> If you reload the page you’ll see approximately fifty-bajillion network requests go off as Facebook desperately tries to load all the junk that it needs to display facebook.com.

I like this part. As a developer I've often looked at the network usage of large websites / web applications and it's always surprising to me just how...unoptimized it is as far as network connections go.

I mean Facebook loads decently enough and all I'm just surprised the first load isn't condensed into a small, handful of network calls to save on latency.
Yes all human trials have to registered in advance - this is why we know how many have published results or not.
Are you recommending that people switch to Ada, or Pascal, or what? Your pastebin seems to strongly favor Algol-likes. It would be nice to see some more substantive reasons why people should be using an Algol-like language in 2016. Just saying that C was originally hacked together to be expedient doesn't quite make that case.
Antinomies of Nationalism and Rabindranath Tagore
Did you ever play 4? Was the best one, IMO.
Yes this is true - I think you have are supposed to have two years after the trial ends to publish the results. This study was more than 5 years later so I don’t think we can blame reviewers or editors for the delay.
I think it should be called iTerm 3. George, thank you SO MUCH for your work on this excellent app.
Honest question; are you able to recall or extrapolate all of the rotations on the fly in a 45 minute time slice? For what metric it is, I've been succeeding well enough at comparable positions for nearly a decade since then, and in that time I've met a single engineer who could have pulled that off without prep, I likely still would have trouble with not leaving some bits out.

I don't ask this to be dismissive, I just find this expectation that an RB tree is "well known" to be incongruous with the skill sets I've seen in a large number of thriving industry engineers in the roles that would have been relevant to me. (Thus my "high theory/deep algo" exemption statement, specialists who really have to get that deep I might expect to be familiar with something like this offhand) Broad knowledge about the algo, sure. To replicate the finer points of the implementation ad-hoc? I'm skeptical; and even if you can, the correct answer in most positions sans my exemptions would be "use a library", and as such I tend to prefer interviews that ask more relevant questions.

Keep in mind, this whole point was initially stated to contrast the RB tree question to many more "typical" interviews, and suggest that these outliers are just that, outliers; They certainly have been in my experience.
Most people who use a work phone do not use a personal phone. This phone could have evidence to implicate their neighbor (http://abcnews.go.com/Blotter/san-bernardino-shooters-neighb...) in a crime.

I see nothing "disgusting" about the FBI's behavior here.
It's an interesting idea, thanks.
If your doesn't work, do you upgrade your CPU or re-write your code? Sure, if your code sort of works but is maybe only 50% as efficient as you want, go ahead and upgrade your CPU.

But if your code is O(n^3) and just doesn't ever give you an answer, upgrading your CPU is throwing good money after bad.

The current system and people are not able to solve the problem, even after spending >$22k per homeless person per year. How much more do you suggest spending, and why do you think it would make any difference to outcomes?
If the founder and CEO sells all his stocks 20+% of "his" public company like some did the other Friday, you definitely can guess his emotion (eg NEWR). Then the other day, when the company stock drops to half the value, you can guess his emotion and different emotions from surprised stock owners.
That's a good point. The nginx module can rotate, but I don't know of any built-in support for rotation with respect to exif. You could also use lua and the lua imagemagick bindings and probably see much better performance though.
I've always had a theory that everyone would hate the taste of wine and other alcohol if it didn't give us a buzz. In other words, our brains make us like it to get more.

I base this on my early hatred of the taste and the later liking. I know this isn't much evidence but I think it could possibly be true.
Had that as required reading in a religious studies class. Got yelled at for complaining that if taken serious it was advocating for the extinction of the species.
Let's Unlock the Set-Top Box--For Real
iTerm is amazing. But it's incredible how many people I see that have the old (unsupported) iTerm installed. Presumably having heard that 'iTerm is da bomb' and not realizing they were referring iTerm2. The old iTerm is way inferior to OSX's Terminal.app, so it kinda sucks seeing these people crippling themselves without even knowing it.
A Tale of Two Treaties: Marrakesh and Beijing Both Make Their Way to the Senate
Legendary iPhone hacker weighs in on Apple’s war with the FBI
Have you tried plugging an Android into a Mac?
I didn't take any of that too seriously, it's obvious they had a great time with the project and I thought the write-up was quite funny.
Yeah, I'm pretty sure I linked to your post. I was going to use your script before I realized I could do everything with plain old nginx.
Sid Meier's Civilization V

You've Played 786 hours

Last Played Today
http ASICs?

(Or does that even make sense, given that undiscovered exploits might require a hardware upgrade?)
Might want to throw a disclaimer on the end there?
Set-Up Branch Office in Vietnam
Santa Clara County Weighs Surveillance Reforms to Enhance Oversight
Not all of them. Their neighbor is a suspected accomplice and is currently being investigated.
The post needs to be read in the context of the series of which it forms a part, eg. http://mjg59.dreamwidth.org/38467.html
As a front end engineer, I fell in love with Slack first time I used it. The UI is well crafted. Those buttons & their states...
Computers use binary under the hood, but we layer abstractions on top of that to make programming easier and more productive.
Posting from an hour ago is currently #3 on the front page:

https://news.ycombinator.com/item?id=11131321
the truth is sometimes expressed better simply
Irony being that the real shooters were 3 tall white dudes from Craft Intl.
200 chip definitions everyone should know
China Capital Flight 2.0: Lose a Lawsuit on Purpose
The Power of Paranoia
aren't you comparing apples to oranges? S3 is an object store (and non POSIX.. Also only eventually consistent).. GlusterFS is neither of those. They simply solve different problem spaces
There is a huge amount of social pressure on women to grin and pretend that to be the case. My wife and I work in the same profession and are similarly busy. But she gets 10x as much flak for the same things (blowing off parent-teacher conferences, etc) than I do.
Chinese Mobile UI Trends – 2016 Update
EFF Defends Live Action Role Players’ Right to Criticize Patent Suit
Since you mentioned that you don't want to be limited by price, Tableau is a tool that has been really great for analyzing data. The slice and dice capabilities allow you to truly explore your data.
Search and seizure is a fundamental government power. I doubt any modern state would be viable (i.e. maintain its monopoly on violence) without it. In the US, we have procedures and standards of evidence that the government must meet in order to exercise that authority. That's not the case in China.

So yes, the Chinese government should absolutely have this authority; they wouldn't be much of a government otherwise. They should also absolutely have protections against unreasonable searches and seizure. The lack of these protections is the problem, not that their government has search and seizure powers. A tech company operating in China has to make a choice between subjecting itself to Chinese law, or not doing business in China.

The same goes for policing in general in authoritarian regimes. The Chinese police state is undoubtedly evil. But I'd bet that most of the time, they're going after your run-of-the-mill crooks that need to be policed in China just as they are in America.

Your argument is a good one though. I think there is a real danger of accidentally building the infrastructure for a future totalitarian regime. It's also a good political argument when it comes to international issues, like Microsoft's argument that the US government can't force them to hand over data that's stored in Ireland. I'd like to see Microsoft win the case in court, but I suspect that the government will win. US court orders are binding even when they require you to break foreign laws. But the government exercising that authority in this case could totally undermine US cloud data providers, so I suspect that Congress could be persuaded to restrict the government's authority here.
Not the greatest, but I did this a few years ago… http://www.zazzle.com/iTerm2
Right, that's life, and I'm fine with that, but also fine with people wanting to know.

Any chance you're the same eggy from SE?
so this is why I always get disconnected from Messenger!
The StackOverflow Tech Interview Process
The CA system, for better or worse, doesn't work that way. Even if your cert is not from a domain-validating CA, that doesn't prevent the attacker from getting a cert from them. And I'd bet that pretty much all root CAs are domain-validating these days.

If by "DNS hijacking" you mean seizing control over the account with the registrar to change the delegation, or the legitimate DNS servers, I don't think there's a strong reason to worry about that more than someone seizing control of your account with your SSL provider, or your webserver, respectively. (It's possible to secure the former two at least as strongly as the latter two.) If by "DNS hijacking" you mean attacks on the unauthenticated DNS protocol, CAs are sort of supposed to query DNS from multiple locations to defeat that, although I don't think there's a strong rule about this. I'm not sure what Comodo's and Let's Encrypt's specific practices are.
It uses Thread-Per-Core architecture where Netty/Reactor use thread-pools to process work and have dedicated threads for selecting from network.
May hut am cao cap, chinh hang
author here: This is way more then Flask/Bottle, I understand what would make you reach that conclusion, but if you look here https://github.com/timothycrosley/hug/blob/develop/ARCHITECT... You can see just how much it adds that really are core concepts that can't be done with simple decorators on-top of Flask.

Highlights:

- Automatic documentation
- Type annotation based validation and transformation of input fields
- Directives to inject more data (like request data) into existing functions in a safe and reusable way
- It's easily twice as fast at handling requests as Flask, making Flask a rather horrible base for any competitor
I want the first "stable" release to be 3.0.0, which is lexicographically before 3.0.0-beta. Admittedly this is only a limitation of Sparkle, but I just haven't prioritized modifying Sparkle above fixing real bugs.
> If you have the source, it shouldn't be difficult to build binaries, should it?

You'd think, but no - there's no guarantee that the shipped binary packages can be built with the shipped toolchain or shipped dependencies.

> If you are building a new Linux distribution based on Ubuntu, I don't even understand why you would want to reuse binaries they built.

Because it's entirely unnecessary? Building the entire archive is a huge amount of effort.

> This post would be more meaningful if it literally quoted from unfavorable license terms used by Ubuntu to actually prevent people from making derivatives. Saying that Canonical "appears to require" something is using weasel words.

The terms are at http://www.ubuntu.com/legal/terms-and-policies/intellectual-... - I probably should have linked them, I've just been writing about this enough lately that it's easy to forget that people might read a single post without context.
Practical programming is still a craft, not a science. Feelings often count enough to mention.
author: Hug actually does make it super easy to write a CLI app, you can see an example here: https://github.com/timothycrosley/hug/blob/develop/examples/... and a full explanation of the concept here: https://github.com/timothycrosley/hug/blob/develop/ARCHITECT...
> Using this scheme also kills any "1 byte, standalone, variable width integer" capability (unless you're storing partial values in the first T/L byte, but then that limits you to a much lower max value for one byte).

You can get the best of both worlds. The way to do it is: separate continuation bits (1's) from data bits with a 0. This gives identical encoding-length characteristics as what you are calling "vbytes" (1 byte can encode 0-127, 2 bytes can encode 128-16383, etc) while still front-loading the continuation bits.
Why Apple needs to make such a big deal about privacy but Google doesn't