skysight-inc/HackerNews huggingface dataset:
At the same time there were predictions that computers would have more processing power than humans within 1 or 2 decades.

Those two things obviously don't go together.
They lost a lot of funding and VM escapes are a bit hotter than browser exploits.

Also, Firefox installs generally still come with Flash which is easier to exploit than the browser itself, and reaches a broader audience.

Officially, they claimed its because "Firefox security has not advanced in the last year" but that is just utter BS.
> We've known how to do it for a long time: just add a second signing key to every iPhone, and give it to the government. It's far from "impossible" to meet the requirements being handed down by US.gov with a reasonable level of risk.

But that's the whole argument. Everyone knowledgable about encryption knows it's not impossible to hand the government a key, they're claiming it's impossible to do so with a reasonable level of risk.

There's no such thing as a "reasonable level of risk" here. If the government has access, every human on the planet has access, so you might as well just give up on encryption entirely because it's doing nothing of value.

For example, here's what happened when we "just give the government a second signing key" to luggage locks http://www.computerworld.com/article/2983558/security/that-t...
One of the fantastic design choices in crawl (actually true for netball, too) is that it isn't balanced across all race+class combinations. Some are easy (mainly hack and slash power combos, like the gargoyle fighter) others are tough but trash you a lot about the game (tengu conjurer), and others are nigh impossible (mummy almost anything). If something is to easy, you can just choose to play a harder game, with less tolerance for mistakes. Eventually you start finding mistakes you weren't even aware of...
Thanks for your feedback! Well, that's why 2 months trial is there.

This is the thing which frustrated me a lot, as I am web developer. I hate creating this shit over and over again. So that's why.
Twilio SMS Inbound and Outbound Rails Tutorial
Hardware could still make users vulnerable. Intel, I think, was involved in controversy relating to backdoors and encryption [0].

[0] http://arstechnica.com/security/2013/12/we-cannot-trust-inte...
4096 bit RSA key is overkill and slow. 2048 is fine for years

You probably need to support TLS 1.1 for some older clients

Password entropy checks should only be used in a corporate environment. You'll lose customers in a retail environment. You should certainly encourage your customers to use high entropy passwords, but forcing them to will just lose you money.

Login throttling and IP banning is a waste of time. Login throttling will just DoS yourself. You need CAPTCHA or Proof of Work.

Synchronizing Token (CSRF token in hidden form fields) is better than CSRF cookies

Use a real HTML parser (*Soup) to invalidate XSS form input not regex
for a browser that hasn't been hardened much

This claim is oft repeated, but the only reasons people seem to say it is that multiprocess + sandbox is not in release Firefox (it's in Nightly/Aurora/Beta).

That doesn't necessarily make it true. There's been some blogs since about how the JS <-> C++ sandbox has actually been significantly strengthened, but people just ignore truths that don't fit their preconceptions.

IE/Edge and Chrome also have sandboxes, and they still get cracked every Pwn2Own.
It sounds like the problem is that they value convenience more than freedom. That is their choice and the only thing you can do is to explain that to them and to choose differently yourself.
There is also: "The offer [of a price for beating go champs with a computer] expires in the year 2000. Go programmers are hoping it will be extended for another century or two."

Edit: I think the reworded title reflected very well the spirit of that article as a whole, before it was reverted.
Though I doubt they started working immediately after pitch. I was also very interested in this point since my SO is a project manager and it rubs off.

So for all we know it could have been pitched in Q4 1994 and finished in Q1 1996.
Right—it's against the HN rules to rewrite a title to single out just one detail. That's a form (actually the leading form) of editorializing.

Submitters: if you want to point out what you think is important about an article, the place to do that is in the thread, on a level field with other participants.
Less impressive, but they moved a historic tavern in Auckland, NZ, recently to make way for a cut & cover motorway tunnel.

http://www.newshub.co.nz/nznews/time-lapse-video-of-birdcage...

Pricy, but I'm glad they kept the landmark.
"Bottom line. Try not to overdo it (on company time). At the end of the day you need to ship it."

What kind of abusive management structure has this guy thinking he has to work for performance issues on his own time? I shudder to think what company he's working for or what manager has instilled such a sense in him and I truly feel sorry for him that he thinks this way.
Maybe it would have been more insightful to ask Game engine engineers and AI researchers than an astrophysicist.
Dwarf Fortress RAWs since release
HTTP is not a contract; there are no "terms".
I can't view this, just loads a "create a LinkedIn account!" page. Is there a better link for the article?
Yes, instantsearch.js is built on top of React. But it's not a React component yet.

See https://github.com/algolia/instantsearch.js/issues/920
This appears to have become the standard way to fund blockchain-based companies.

Storj is using the same approach - https://storj.io/
Easy money if it were true, as there's both official bug bounty programs and a black market. Unfortunately for you, it isn't.
Way to go dad. I'd be very proud if that was my father standing up for me and as a father I'd be very proud if that was my daughter.
Open-source software benefits everybody and is economically the most efficient solution (the wheel does not get reinvented; instead, you just clone and fork).

One scenario could therefor be that open-source development is financed via taxes, meaning we should pressure the government to initiate that.
Yes, open-source hardware would be the next step.
http://pastebin.com/hWxg8ywJ
Netflix Joins DMCA Takedown Bandwagon to Frustrate Pirates
Copying to here the comment I made elsewhere[0]:

There is so much right with this article, and so much wrong.

Firstly, it's not the Common Core he's fighting, but the implementation of some of the testing. Assessment is hard, really hard, really really hard. Making sure someone actually knows something, as opposed to going through the motions in which they are well drilled, is nearly impossible.

But secondly, 9^9^9 is not the largest number that can be represented by three digits. There's Knuth's notation. Oh, perhaps they haven't learned that yet.

And there's the dilemma. Arguing that all the other students were wrong because they didn't use something that they hadn't learned, we can also argue that his daughter was wrong for the same reason.

Education is hard, assessment is hard, and arguments like this don't actually help.

========

[0] https://news.ycombinator.com/item?id=11322756
I'm still really curious why anyone should want to do that. Can you explain?
Representating negative numbers in computers: 2's complement
A touchscreen phone named Neonode N1 had slide-to-unlock 2 years before iPhone.

http://9to5mac.com/2011/10/25/slide-to-unlock-patented/

But the point is, it is a very trivial way of interacting with a touchscreen. It is, in fact, one of the few ways one can interact with a touchscreen.
Url changed from http://www.theregister.co.uk/2016/03/17/https_is_not_enough_..., which points to this.
I guess I have to agree with that.
“A fairly complex riddle”: Write Medium headlines that 'click' with readers
The bad thing about this project name is, if just glancing, it can be misread in a funny way. Like an automotive startup or more questionable establishment.
Nice idea to generalize this. At my last job we did a lot of this automation against k8s on GCP using make and bash scripts calling gcloud and kubectl. A general use framework for promoting docker images to k8s services could be quite cool.
Mostly went over my head, but an interesting read nonetheless.
TLDR: Helicopter parent pretentiously humblebrags about how his daughter is the only one in the country to get a 100% on a standardized test, since no one else answered "9^9^9" (I am guessing this was a "none of the above" answer) and how he had to get a lawyer involved to make the scoring organization mark his daughter's answer correct and everyone else's incorrect.
Thanks for the comments. We are still looking into the legal ramifications in different countries and territories as they vary quite widely.

The selling of the DVD's and then offering access to the movie is based on the concept of movie rental. We would own a rental copy of the movies which you would have access to under the monthly payments.

This would however mean gaining deals with the major studios and so it may return back to the initial concept which means that it is more like iTunes match for movies.

The Prices are per month.

Thanks for the heads up about the Kickstarter project. Looks interesting.
Sydney. Haskell.
The problem is how credit cards work.

the companies take a fee out of the "store" for every payment. This in turn means the payment has to be large enough to cover the fee and still allow profit.

The sum of said payment is likely to end up being above most people's "no worries" threshold. Never mind that now the card info is in yet another potentially hackable database.
The Forgotten First Principle of Software Delivery
You cannot compare bytes on a disk with a gun. People don't die from transferring data.
Well, yes. Assuming the story is true in the first place. And if we believe the story - might as well, the guy is out there with his full name in view - then he did give them the option.

Now about whether or not it is true or not, a girl in my class was the only one to get a particular test question right (math as well). The problem was that that test had already been administered to all the other classes and nobody got it right so it was decided to drop that question from the final grading. And then she answered it right. That test comprised 10 questions, with a 'base' of 1 point for showing up so she actually scored an '11' on a scale of 1 to 10. She had to fight for that too, this stuff occasionally does happen.
https://safepaste.org/

This is what I get (20Mar2016; 4pm ET)

SSL Error

Your connection is not private

You attempted to reach safepaste.org, but the server presented an invalid certificate.

You cannot proceed because the website operator has requested heightened security for this domain.

You cannot visit safepaste.org right now because the website sent scrambled credentials that Opera cannot process. Network errors and attacks are usually temporary, so this page will probably work later.
And why didn't Google/Motorola fight the very existence of the patents?
Perfect Bottom Navigation for Mobile App
It's really a shame how things like that that are handled, from where I stand. Turns it into the closest parallel to the cool kids table that used to exist in highschool that I've seen in the decades since then.

Also, if you're a 2 and only at a slightly higher base than I am, you're "somewhat on track" from the conversations I've had, as far as pay per level for us normals :) That being said, I really botched my negotiation when coming in and didn't push my position, which left me coming in at a 59 from an industry position with greater responsibility, and role seems almost harder to change than pay from what I've seen.
Where they're talking about the small, randomized packs of items... it almost sounds like they were intending a CCG in video game form originally?
The #1 rule is, stay cash-positive: don't spend more than you've got in the bank to cover the bills, but be willing to defer the payment and continue income in the interim, because .. after all .. nothing feels better than having all bills paid and still having a net positive every month, to save away ..
This seems like the same as termbin.com to me.
By the way. If you aren't well versed in web application security, don't just blindly follow guides likes this, especially when dealing with headers. You really should learn about the technologies

> Strict-Transport-Security: max-age=63072000; includeSubdomains; always

I agree. All sites should be using HTTPS only and HSTS is a great thing, but if you blindly follow this guide you might break your subdomains that don't support HTTPS (third party or whatever crazy situation you have). The same thing goes for HPKP which tptacek suggested below.

There's a right way and a very wrong way to use HPKP and if you go mucking with these headers without fully understanding them yourself you might break your site for a ton of people.
So backstory: first we went with "omnikube", but that name was already taken and caused some early and funny confusion (see our issue on local development). But monokube and hyperkube were already taken, so localkube was our compromise.
80% isn't any better than 0%.
By income-averse, I mean those who are averse to generating the incoming required to pay the current bills, and alas this is a subtle but simple difference between solvency and debt. I never really carried much debt, between payments.
But I sure did borrow a lot, to cover my monthly budget.
What has that got to do with Hacker News?

Wonder why you haven't mentioned ETFs which are much safer than investing in individual stocks which may realize a 100% loss should the company file for chapter 11.
BTW. here's the list of CRAN packages they claim they can already run (i suppose install and run, maybe not yet tested). Anyway this is impressive:

https://bitbucket.org/allr/fastr/src/dcae74ecaaf3291f93ae2c0...
It is incorrect to use:

rc = subprocess.call(["ls", "-l"], shell=True)

It means a different thing. OP should use either:

rc = subprocess.call(["ls", "-l"])

Or:

rc = subprocess.call("ls -l", shell=True)

Note: there is no need to use the shell or even to use the external processs in this case.

The example shows the usability issue in the API. Newly designed C++ API shouldn't copy such errors (if it has the same behavior). A list argument with shell=True should be rejected.
Web server security is pretty narrow portion of all security fields.
For Knuths notation you also require symbols. Writing 9^9^9 only uses digits.
I am a user of GitHub. In part to protect against potential credential leakage through XSS and similar, and in part because I rarely actually need to log in to GitHub for the things that I do with it, I'm rarely logged in to my GitHub account. This change has a significant impact on my "workflow".
If we allow that then I could represent a larger number with customFunction(123) and have it return (9^9^9)+1. The kids haven't learned programming? Too bad I guess. Mark that girl down to a 99 score please.
Oh $DEITY. That can't be possibly right. Are they serialising all FD creation thru a single mutex?? Why they can't just close all sockets that need closing after fork?

Also the FD mutex that need to be taken before each read and write is nasty (is it just to prevent a race with close or is it for something else?), but at least that won't usually require any syscall and on sane applications could be optimised with a Java-like biased lock.
A TOS on a different page that you didn't present before sending any "content" such that there is an opportunity to either accept or reject the offer is not a contract. Contracts are not a "gotcha" that you can surprise people with nor are they established without an understanding by both parties of the obligations that would be created by a contract (the "meeting of the minds").

If you present reasonable[1] terms first, then receive some type of notification that the terms were accepted (as you say, signature is not the only option), only then will a contract formed that could obligate someone to not run an ad blocker.

[1] unconscionable or misleading terms are unacceptable and can get the contract - whole or in part - thrown out.
A side note, why is he bragging about "carrying a 3.82 in Biology with a leaning towards pre-med", that's not a mathematical subject. It would seem that in the end, didn't he lost the battle, because his daughter didn't follow maths all the way.
> i always felt these probabilistic models were a conflation of correlation and causation

> What do you mean?

the example from the post of weather events is a simplified version of what i mean

the collected data expresses that there is a probability of 50/50 rain versus shine

the first string of possible outputs is scattered and more random than the real data, so weights are introduced to nuance to the output and the second string is more closely representative of the data

but this introduces a relative psuedo causation, what the author refers to as stickyness

it's reminiscent of the monty hall problem(o)

altering the state of the model causes its probability to change relative to a specific potential, but only within the limited scope of the probable space

choosing one door causes the probabilities associated with the state to change but the system itself is unchanged by the choice

and what you see with the weather is a simulation of the collected data stead the underlying system, which i feel conflates correlation with causation

(o) https://en.wikipedia.org/wiki/Monty_Hall_problem
The Two Original Sins of the Internet
Even if that was the case, which I don't think it is, Microsoft shouldn't be asking for stuff like FAT32 royalties.

Think about it. Microsoft is asking for royalties for making devices that work with Windows. How crazy is that? Imagine if Google charged accessory makers for hooking into Android devices. I don't care if others do this sort of thing, too. It's just wrong.

It should be an anti-trust issue, especially when you have a dominating OS like Windows. What are other companies going to do - make mobile devices that don't work with Windows?
Love articles like this. Learned some surprising things from it. Thanks to greenyoda for the others.
By the same logic, hacking is just sending bytes over a network, so it can't be illegal. Unfortunately for you, the law is smarter than that.
Always happy to be wrong, as it means I've learned. Thanks.
In 1997 the most powerful computers were perhaps being used by astrophysicists?
Directed graphs are also a great way to create scripted dialogues and quests for games. Visually, a DG for your game dev is quite powerful and makes it very easy to reason about what's going on in the game story. I don't think the same can be said for coroutines hard coded in c++. In addition, it's easy to find a cycle in a graph, I'm not sure the same can be said for a coroutine.
Here's a site to give some interest: http://twinery.org/
Tigers 'starved to death' to make $500 aphrodisiac wine with their bones
> If the government has access, every human on the planet has access, so you might as well just give up on encryption entirely because it's doing nothing of value.

It's a pretty extreme position to say that you trust Apple to be able to keep secrets better than the FBI/NSA/CIA

> because it's already happened to luggage

I don't think this is actually relevant. This "vulnerability" being introduced by the TSA is completely irrelevant: wants to get into your luggage they can cut it open if they have to. Luggage locks have always protected against the threat model of "some rando rifling through my stuff" not "dedicated attacker who spends time ahead of time making devices to get into the luggage". The TSA doesn't and shouldn't care about people having copies of TSA luggage keys, it pragmatically doesn't change anything.
I can take a guess on the exhale. If you're slowly exhaling there's less (no) chance you'll accidentally inhale.
Agreed, although I'm not sure how much #4 matters for a "CRUD" app written in Angular - there's nothing worth seeing until JS runs :-)

... other than a div that says "Loading..." for half a second to a second. Yeah, not great, but it's an app (HUGE government form), not a marketing flyer.
Strong Bad has your back: https://www.youtube.com/watch?v=_SctWtK2h_w#t=2m17s
And remember that it was only relatively recently that they asked for it in the first place. And yes indeed I think it also includes Chrome OS too nowadays.
I dunno, someone was asking why the downvotes, that's all I could think of. I agree it's nasty to highlight the words like that.
Just redirect gpg's input from the file?

gpg ... < hello.txt | curl ...

Its stdin will be the file instead of a pipe, but few programs care about the difference and fewer still in such a way that you'd prefer to use the pipe.
Wow! Australia. Myself is México, Java.
It's just something I consider ever since the Coq theorem prover. Gotta think of how they might perceive and spell it. Yours aint so bad. Just a smirk at worst. Wait, worst will be if a speaker misreads it on a slide deck. Memorable moment for audience. :)
And that is before we even start on the "design patents".
Hobbit's Netcat turns 20 years old today
Idea for YouTube :)
Eric is cool1 month ago
Nudity=0%
Sexuality=0%
Bitches, Ass, Boobs showing=0%
Fame=100%
Talent=100%
Great Work=100%
Beauty=100%﻿
They use the word 'boilerplate' too liberally. A 10-page app with a bunch of screens you won't use is just an example application.
KnowYourMeme [1] is surpisingly high quality and informative sometimes. "pwn" apparently has origins going as far back as the 60s, but I had to guess it's mostly popular these days due to the brief leetspeak phase of the early 90s, where it was a more pointed, edgier way to write "owned".

[1] http://knowyourmeme.com/memes/owned-pwned
I think the main argument is that most customers, and certainly enterprise customers, will pay for software even of the source code is available.

Also requiring all software to use an open source development model is probably not necessary for security purposes.
China Has a $590B Problem with Unpaid Bills
For the time, that was a pretty good sized team. Id did most of their early games with Carmack, Romero, Abrash, and a few different artists/level designers.
By a nonprofit foundation. The clients are tested against each other, and the spec is modified if there are any discrepancies due to misunderstandings.

If the community ever loses confidence in the foundation's leadership it can transition to another arrangement.
It is actually pretty easy, stackless generators desugar to a switch statement. MS implementation of their C++ coroutine proposal already demonstrates that. The problem is that, as currently specified, it requires memory allocation which can't always be optimised out and that has proven conttentious with many.

Edit: s/watch/switch/
Wow. The title would make me guess "not using base-10" but then these comments seem to let you use operators.
This was covered ad-nauseam when Apple release Swift.

I guess Apple was thinking the same thing as Google was thinking when they named Go? That the existence of a very obscure language with the same name shouldn't be an impediment?
Good idea short-term.

Long-term, it should be financed via our taxes (best case: international agreement).
I mean - not that hard to reason about. And it wasn't rather hard 15 years ago either.
It's not Apple keeping secrets vs. The FBI/NSA/CIA keeping secrets. It's secrets being kept that Apple willfully lacks the means to access vs. secrets being kept that Apple has been compelled to develop the means to access at the behest of the FBI/NSA/CIA.