skysight-inc/HackerNews huggingface dataset:
Side-channel attacks like this are always a little hard to follow, and there's a lot of detail in here, so here's my best synopsis of the technical details behind why this works:

In many modern Intel CPUs (all Sandy Bridge, maybe Nehalem and Core 2 too, not Haswell) you can get cache bank conflicts, where two instructions try to read the same bank (cross-cutting segment) of the CPU cache in quick succession. When that happens one of the instructions has to wait for the other to complete, so takes fractionally longer.

If you trigger a whole bunch of these cache bank conflicts yourself, while OpenSSL is working, you'll get tiny delays in your reads from parts of the cache that OpenSSL is using. If you do this an enormous number of times, you can then look at the accumulated average delays in your requests, and work out how OpenSSL's memory accesses are distributed over these banks.

Depending on the value of one part of the secret that OpenSSL is using to sign or decrypt data (specifically, the multipliers used in the multiplication steps in RSA), its access pattern for the cache is actually slightly biased. This is the bug. Once you know which banks are most active, you know the overall access pattern, and you can use this to drastically reduce the number of possibilities for each multiplier. That gives you enough information about the value of the key that with some subsequent offline processing you can recover the rest (apparently doable in about 3 minutes on a high-end CPU).

The fix is to ensure that the patterns of cache access that OpenSSL makes are totally independent of the secret data being used. The latest patch effectively does this, fixing the bug. You can still use cache bank conflicts to work out which bits of the cache OpenSSL is hitting, but that's no longer useful information.

(I think this is broadly right; I'd love to know if there's details I'm missing though!)
From the recent Debian security advisory (DSA-3500-1) about this:

"Additionally the EXPORT and LOW ciphers were disabled since thay could
be used as part of the DROWN (CVE-2016-0800) and SLOTH (CVE-2015-7575)
attacks, but note that the oldstable (wheezye)[sic!] and stable (jessie)
distributions are not affected by those attacks since the SSLv2 protocol
has already been dropped in the openssl package version 1.0.0c-2."

So it seems that neither Jessie nor Wheezy are affected by this.
The US inherited an existing slave regime from the Caribbean. It entailed exactly the same cognitive dissonance required of soldiers in the British Empire as described by Orwell in "Burmese Days". So it looks Mercantilist to me.

I don't hold that debt is inherent to what we consider capitalism. I run the risk of a "no true Scotsman" fallacy with this, but debt is something we have because of path dependence, not because it's shown to be inevitable or optimal.

The fact that debt cannot be easily retired indicates that we haven't finished this as an institution. At the level of a debt holder, of course you can't do this. At the level of a general person living in society, the un-retire-ability of debt creates a common, sort-of pubic goods problem because it slows growth.

Classical and pre-Classical societies held debt jubilees. Could we? I don't know.
> and just generally how to think about the data
> but I am just not sure how to set up the dbs

Your pseudo sounds German maybe you can read French ? If yes, what you need is the "Merise method". This is the one true way to model your data as long as your requirements don't include a non relational database (NoSQL).

Sadly Merise remained a French thing and to my knowledge was never translated. It's old and unsexy, but it makes designing a relational database schema a breeze.

However I don't do web dev so I can't help you there. But I'm sure you will find plenty of web people here.
Seems like a verbiage quibble; like the whole argument boils down to his original difference of exponential vs true mathematical singularity. He recognizes that we'll see superhuman intelligence (AGI), which will very likely grow and grow; but that said growth may be slow, and even cap. IMO having a growing AGI is the real point, exponential/singularity is a side conversation.

Human intelligence grows slowly (as he pointed out); but our technology grows rapidly, as it builds on previous generations. Few computer programmers can build a computer from scratch (circuits to disks), but their contributions continue to explode the information age. So even if an AGI grows slowly, it's contributions will stack (and possibly exponentially) to _major_ effect.
Very interesting read, but also very sad. I think the local authorities in San Francisco are the ones that have to wake up and invest quickly into growing up the infrastructure to accommodate the influx of talent. Otherwise the exodus will hurt everyone and it's already happening (e.g. http://qz.com/627414/tech-workers-are-increasingly-looking-t...)
Note that the private key isn't actually leaked (as opposed to Heartbleed), so it wouldn't be necessary to revoke the old certificate and use a new key. Rather, DROWN uses an existing SSLv2 service with the same key as an Oracle to decrypt (usually secure) TLS connections.

It's still a good idea to not share keys to limit the exposure for future attacks.
Not as misleading than the titles are the introductory sentences of the press release:

"Democracy and models of social market economy are being challenged worldwide. At the same time, the influence of religion on political institutions and legal systems is on the rise."
The vulnerability here is tricky to exploit but actually simple to describe.

There's a padding oracle in the form of RSA used by both TLS and SSLv2; by repeatedly sending permuted versions of a ciphertext to an SSLv2 server, you can gradually discover the plaintext†. Both SSLv2 and TLS have countermeasures for this attack.

But SSLv2's countermeasures are sabotaged by the crappy ciphers it also supports. In both TLS and SSLv2, the anti- padding- oracle trick is that the server detects bad messages and then generates a fake message to continue running the protocol with, instead of aborting (which would reveal to the attacker that the message was corrupt, thus enabling the padding oracle). But when SSLv2 does that, the attacker can detect that it did, because the cipher key lengths in SSLv2 are so short that they can be brute forced. The attacker knows when the SSLv2 server replaced its message with a fake one, and thus has a working padding oracle.

The big problem here is that people run old SSLv2 servers with the same RSA keypairs as their TLS servers. So you can take messages you captured from the TLS servers, and, with some very clever message manipulation owing to an older Bardou paper, make them intelligible to SSLv2, and use the SSLv2 padding oracle to decrypt them.

It's a great, great paper. The Bardou "trimmer" stuff was news to me too! :mind-blown-emoji:

The top line takeaway on DROWN for most people seems to be "export ciphers are evil". I think: (a) boring! (b) misses the more important point.

To me, the real problem here is RSA. Virtually every system on the Internet that does RSA uses PKCS1v15 padding (DNSSEC, which is only now being rolled out after nearly two decades of standards work, uses PKCS1v15 padding!). Moreover, RSA directly exposes an encryption primitive, unlike DH+signature forward-secure protocols, and RSA ciphertexts are surprisingly malleable.

To me, the real takeaway: RSA is obsolete. Stop using it.

† We walk you through this vulnerability in our challenges here: http://cryptopals.com/sets/6/ --- start with #46
The article makes no mention of Piketty. It does however mention the "new Dark Ages of modern Feudalism" and that societies "are still living inside the 'Matrix' of this culture" which is naive hyperbole; my reference was to the article not Professor Hawking. However, being a skilled physicist means nothing about one's understanding of economics, and any physicist could tell you this. It is very dangerous to just take someone's extrapolations as truth because they are "smart".
Teach your kids the value of money with your own family currency
The UK is always five years ahead of the rest of the West when it comes to codifying the destruction of their citizens' privacy into law.
a bit like file sharing then
>And even if they had lived to see today, their standards would have immediately readjusted to want more.

This is not true of many tribal or "uncivilized" cultures. Conspicuous consumption, luxury, and economic advantage/inequality as moral value systems are taboo for close knit tribal communities.

>Before our white brothers arrived to make us civilized men, we didn't have any kind of prison. Because of this, we didn't have any delinquents. Without a prison, there can't be no delinquents. We had no locks nor keys therefore among us there were no thieves. When someone was so poor that he couldn't afford a horse, a tent or a blanket, he would, in that case, receive it all as a gift. We were too uncivilized to give great importance to private property. We didn't know any kind of money and consequently, the value of a human being was not determined by his wealth. We had no written laws laid down, no lawyers, no politicians, therefore we were not able to cheat and swindle one another. We were really in bad shape before the white man arrived and I don't know how to explain how we were able to manage without these fundamental things that (so they tell us) are so necessary for a civilized society.

-Lame Deer
a very simple and well written version of the thoughts I've been having around Wikipedia.
The 1st gen iPhone didn't even have 3g, was that really worth it?
Yes, as long as one of the server that shares the keypair has SSLv2 enabled.
bid2mow.com - while working full time at a manufacturer.
Xamarin Acquisition Promises an Integrated Mobile-Development Offering
Approximately 7,000 residents [1], but over 400,000 employees. [2]

[1] http://www.cityoflondon.gov.uk/services/environment-and-plan...

[2] http://www.cityoflondon.gov.uk/business/economic-research-an...
I am pretty disappointed in the printer shown in the clip. All the designs are really just a single layer. These 2D designs could certainly be made by a skilled hand without much effort.

The "impossible" designs from future 3D-printers will probably be cool, but the technology appears to not quite be there yet.
That's the main idea of wxWidgets - it doesn't have its own GUI backend (wxUniversal really doesn't count) but uses other native frameworks such as win32, cocoa gtk and now QT too. So it will probably look nice and native in say KDE environment.
Data Tool to analyse Union Budget 2016-17
I explicitly said that the 10x claim was nonsense. I expect 2x-3x.
There Will Be Netflix on Mars
"Such third-party scripts include browser extensions (adblockers...)"

ROFL, soon all the annoying garbage ads will be written in React. Yay!
Many countries have successfully implemented high taxes. Even the US had very high taxes at one time. Although there was lots of tax evasion, the distribution of wealth was much more even and CEOs were paid much less than they are today. A basic income is totally possible and would vastly level the distribution of wealth.
Or better, change the completion to should the description there when typing "make <tab>"
Code4Good -- https://www.engageSPARK.com - "Twilio for Non-Techies" | Cebu, Philippines | Adventure Fellowship

engageSPARK, a not-for-profit business, is an engagement platform that empowers NGOs to dramatically extend the reach and effectiveness of their pro-poor programs. Customers tell us that it’s the easiest to use self-service solution to easily and quickly launch comprehensive messaging, surveying, curriculum, education, and decision tree programs focused on developing countries via two-way SMS, Voice IVR Calls (roughly 40% of the world’s poor are illiterate), and Missed Calls in 200+ countries.

Customers such as International Rescue Committee, Innovations for Poverty Action, MedAir, Mercy Corps, and US Institute for Peace use the engageSPARK platform in countries around the world to make social change in the areas of Agriculture, Health, Finance, Elections, and Disaster Planning & Response. We've already changed the lives of more than 30,000 people living in poverty and been used in 50+ countries.

Adventure Fellowship: https://goo.gl/YA8ENR

Our stack: Go (GoLang) Microservices, Python/Django, Java, Docker, Redis, Thrift, PostgreSQL, CouchDB, Android

Located in tropical Cebu Island, Cebu City is the second largest city in the Philippines. It’s a safe place to live with a variety of malls, restaurants, shops, beaches, and activities such as scuba diving, running, hiking, rock climbing, and snorkeling. It has a busy international airport with cheap flights to domestic and regional destinations. Check out Google Images: https://www.google.com/search?safe=off&site=imghp&tbm=isch&s...

Email us at Jobs at engageSPARK.com
Indeed, and I'm definitely not complaining that Win8 SP2 is a free upgrade from Win7+ ;) Still, only holders of existing Windows licenses qualify for it - "Windows for free" is something different, IMNSHO. But you are quite correct that an average consumer would see this distinction as pointless nitpicking.
Tomologic (http://www.tomologic.com) - Stockholm, Sweden - Senior
Software R&D Engineer to Optimization SaaS Startup - Full time, onsite
only

The challenge: Optimizer, our SaaS delivered core product, is
utilizing heuristic algorithms to deliver the highest possible packing
quality for the sheet metal industry. We already far outdo
conventional packing strategies, but we aim to reduce the time to
production, and increase packing quality even further.

You will be a part of the Optimizer R&D team that develops the product
together with the product owner, quality and platform operations. Our
main language is Java, but several of us came on board with only C# or
C++ skills. Other tools and technologies we touch on a regular basis
are, among others, Scala, Git, Jira, and Jenkins. We believe that you
have software design bragging rights, but also hope you can share some
fabulous failure stories.

At Tomologic, you will work side-by-side with some of the smartest
scientists and engineers in an innovative, energetic, and
team-oriented culture. We strive to be a flexible and fun workplace.
Tomologic is privately owned with solid backing from industrial
investors.

To apply, please send an email, with a CV and cover letter, to
jobs@tomologic.com
Mixlr | London, UK | on-site

Mixlr[1] is an audio broadcasting company, providing rock-solid and professional live audio services to radio stations, bands, artists - and tens of thousands of other content creators, each and every month.

From designing and building powerful broadcast apps, to seamlessly distributing live sounds to millions of listeners, our team delivers indispensable solutions that are trusted and relied upon worldwide.

More info: http://tech.mixlr.com/jobs

[1] http://mixlr.com

---

Current engineering vacancies:

* Backend Developer http://tech.mixlr.com/jobs/backend.html

* Frontend Developer http://tech.mixlr.com/jobs/frontend.html

* DevOps Engineer http://tech.mixlr.com/jobs/devops.html

* C++ Developer http://tech.mixlr.com/jobs/cpp.html

---

Current product/community vacancies:

* Product Manager http://tech.mixlr.com/jobs

* Community Manager http://tech.mixlr.com/community.md
Well that adds up, Middle East ends with Turkey, where after Europe it begins. Now we could debate which "border" is inclusive in respect to Turkey.
The pragmatic answer would be, after looking at the map, to put Turkey to the ME side.

If you don't agree to the pragmatic argument and take Turkey to the European side, you don't really have an answer yet. It'd just modify the question slightly: Suppose you "include" Turkey to "Europe", now what borders should we use for Turkey?
The current border that arbitrarily cuts across the map? They're mostly the result of the Treaty of Lausanne (1923).

That's akin to saying: we reject the current (arbitrary) definition of Europe (mostly a consensus among "Europeans"), in favor for an arbitrary definition made by the Europe's "big boys" to chill a bit after WWI.
Also I wouldn't call Turkey's current borders completely uncontroversial, a big part of eastern Turkey could as well be part again of a future resurrected Kurdistan. Would you then include the Kurdish parts also to Europe? So you'll end up anyways to draw borders around cultural or ethnical "regions".
Thus to get back to my original point, given that we still subscribe to the line-drawing-game, I'd suggest to draw it before Turkey and call it a day.
FOHO: Fear of Helping out in the Philly tech scene
This is tech site. If you are see something you don't understand, you should just google it.

As a tech person I encounter things every day that I don't know about, and I google many of them.

Why should "non-tech" people be protected from the chore of googling ? Isn't that why people come here – to encounter things that they don't know about ?
boxed.com | Edison, NJ or NYC | Full time | ONSITE | VISA transfer

Boxed is one of the fastest growing presences in eCommerce. At our core, however, we are truly a technology company that provides the best online wholesale experience.

We are a tech-driven team and utilize open software and hardware to solve real problems. We have lots of toys to play with, i.e.: raspberry pi, double robotics, irobot create 2, etc. Checkout our github (https://github.com/giddyinc) and apply from https://www.boxed.com/careers/?gh_jid=146428 if interested.
Land value tax. It's actually extremely capitalistic in my opinion. It trims the fat of speculators, forces people to use land effectively or pay the price and in general cuts out dynastic wasters.

http://www.landvaluetax.org/what-is-lvt/

Can't reply to you - one of the mods has disabled my ability to post (haven't posted in an hour and get "you're submitting too fast").

Or perhaps the thread has been closed down. Who knows.
Data Visualization Advice for Scientists
8800gtx could do more than 2x the fps compared to 7900gtx so in theoretical perfomance the difference was likely even bigger
haha, trying to make something look organic by using a machine, which in the end makes it look like it's made with a cookie cutter.

I'm sure you could do much more interesting things with a food printer, like:

- actual structures with chocolate or sugar

- designs that would be to tedious to do by hand (I'd recommend using paths, not shapes to be filled as input data)

- semi-mixed flavors or flavor gradients

- print on to soup

- print from higher above, letting things fall organically

- dithered gradients on the plate

- play with speed to thin things out organically
Yup. WxWidgets was probably the least useful graphical development environment I have used. In particular, many of the GUI elements don't expose their inner widgets. For example, when I used it, I wanted to change the font of a label in a tabbed window. The tabbed window widget provided no access to the font object at the C++ level- I suppose you could subclass, but that wouldn't propagate tot he Python generated classes.

You're better off just using qt: they put a lot more work into making it a useful environment, it runs a lot more places.
Location: UK

Remote: Yes

Willing to relocate: No

I'm a published front-end developer with plenty of backend chops. I've currently got a limited number of hours to work on React and React Native opportunities, or general JavaScript consultancy.

http://careers.stackoverflow.com/colinramsay

Email: hn [at] colinramsay.co.uk
Openvote | San Francisco, CA | ONSITE | Product Designer

We are looking for a talented product designer to work with us to build Openvote, the first crowd-voting platform for elections. We aim to make politics more inclusive and transform how campaigns work.

You will shape experiences over web, mobile, and touch; working with engineers, fellow designers, and closely with our CEO. You will take ownership of Openvote’s interaction and visual design—laying a foundational layer for future designers to work within.

Must Haves:

Excellent interaction and structural design ability.
You turn user needs and business goals into clear and compelling experiences. You’ve seen users struggle with your solutions, learned and adapted.

- Foundational visual design skills.

- Ability to take ownership of projects from start to finish

- Humility, maturity, lack of ego. You want to help grow a collaborative, optimistic, and supportive culture.

Nice to Haves:

- Strong visual design portfolio.

- HTML/CSS/Javascript chops. Ability to code the designs you produce for Web

- Experience working with data to inform design decisions. You can separate signal from noise and define metrics that matter.

- Qualitative user research experience. You can speak to anybody and everybody to identify needs, pinpoint hurdles in an experience, and use low resolution prototypes to get quick feedback towards a final solution.

Email sean@openvote.com
An iPhone Is an Extension of the Mind
Looking for an opportunity to build something awesome with experienced devs on hard problems, especially in (not limited to) the realms of journalism/media/education.

Location: Eastern US
Remote: No
Willing to relocate: Yes
Technologies: Front-end/Node/React/Go/Clojure/C++
Email: maxbittker@gmail.com

Maxbittker.github.io
Sure, relatively speaking but in considering the population explosion since the industrial age, there are more people in absolute numbers living in poverty. As shown by the demographic economic paradox, poverty and overpopulation are closely related in a negative feedback cycle of exponential proportions.

https://en.wikipedia.org/wiki/Income_and_fertility
SEEKING WORK

Location: UK

Remote: Yes

Willing to relocate: No

I'm a published front-end developer with plenty of backend chops. I've currently got a limited number of hours to work on React and React Native opportunities, or general JavaScript consultancy.

http://careers.stackoverflow.com/colinramsay

Email: hn [at] colinramsay.co.uk
Common Lisp in fact has type expressions with set operations.

$ clisp -q
[1]> (typep nil '(and symbol list))
T
[2]> (typep :foo '(and symbol list))
NIL
[3]> (typep '(1 2) '(and symbol list))
NIL
[4]> (typep '(1 2) '(or symbol list))
T
[5]> (typep 3 '(or symbol list)

I.e. I can in fact talk about sets of objects, in a formal way, with the Lisp system.
Yeah, but the The City is a tiny pebble in comparison to London. I'm sure there are plenty of places in London that size that are dominated by one industry (though none with their own laws.)
Truebill (YC W16) | San Francisco, CA or Washington, DC | ONSITE
https://www.truebill.com/

We're a YC company (in the current batch) looking to hire engineers #2-5. We're building the subscription management platform. You may have seen us on HN a couple of weeks back. This is a great opportunity to make a big impact at the company.

We're looking for front-end, full-stack, and back-end. If back-end, it'd be great if you could wear multiple hats for now, including assisting with DBA-like and ops-like duties. Experience scaling large-scale webapps/services is a huge plus.

Stack: React, Relay, Node.JS, Postgres. Open to other stacks for back-end, as most of the back-end is in event-driven background jobs.

If you're smart and love solving problems, email me: jobs+hn@truebill.com
Location:Charleston, SC
Remote:yes
Willing to relocate:yes
Technologies:JavaScript,Objective-C,iOS,C#,Unity3d
Résumé/CV:https://linkedin.com/in/xyclos
Email:xyclos:at:outlook:dot:com
The Importance of Flexibility in Agile Development
I know you didn't mean to do it, but because it's easier for people to snark about attack names, or react to snark, than it is to discuss a complicated crypto attack, this tangent about attack names takes up a pretty big chunk of the thread and really cruds the discussion up.

Whatever you might think of the name, this is bona fide important crypto work; it's one of the more interesting TLS attacks ever discovered. Please try to be careful about distracting from the important stuff with silly stuff like naming.