skysight-inc/HackerNews huggingface dataset:
I was initially sceptical that traffic analysis would be enough, but it appears that mainstream TLS does indeed leak a lot of metadata, especially with the typical structure of splitting resources across distinct servers (eg: static.example.com for images). I wonder if the security of something the size of Reddit might not be improved by simply having a large fleet of dns round-robin app servers that all deliver all content from one domain.

I found:

"Identifying Website Users by TLS Traffic Analysis: New Attacks and Effective Countermeasures"

https://hal.inria.fr/hal-00732449/

Does anyone know of other, recent research in this area? It's been a long time since I last looked at opaque data captures of TLS/SSL traffic.

I also found: https://tools.ietf.org/html/draft-ietf-tls-chacha20-poly1305... which states in part:

"It should be noted that AEADs, such as ChaCha20-Poly1305, are not intended to hide the lengths of plaintexts. When this document speaks of side-channel attacks, it is not considering traffic analysis, but rather timing and cache side-channels. Traffic analysis, while a valid concern, is outside the scope of the AEAD and is being addressed elsewhere in future versions of TLS."

On a skim of https://tools.ietf.org/html/draft-ietf-tls-tls13-11 I couldn't find anything new wrt. recommendations on padding with the goal of thwarting traffic analysis?

Anyone have any pointers on this?
unapologetically plastic!
Yes and that's how Amnesty references it, as an enabler of other human rights:

Encryption is therefore also an enabler of the rights to freedom of expression, information and opinion, and also has an impact on the rights to freedom of peaceful assembly, association and other human rights.
Doing that requires you to be able to see through at least some connections in the first place, in order to figure out which connections are from your target victim. That's why QUANTUM is a combination of packet sniffing and packet injection. If everything is SSLd then it's much harder to deal with cases where a users connection moves around.
Comments are shadowbanned too. Just log off on your account and then check your comments and submissions. Are they still all there?
It's ugly and bad value. There will be better options in 2 years.
"...skirts dangerously close to forcing someone to lie..."

Which opens a whole other can of worms. Telling a lie is not illegal. However the impact of that lie might result in loss to a third party - and that would need to be reconciled.
This is where I turned off and realized it was a joke.
OpenJet launches real-time booking platform for private jet charters in Europe
By establishing the canary, you are intentionally putting yourself in a position such that in the future you will be forced to lie or commit a crime.

That said, meta-censorship is pretty icky regardless.
"becoming the leading open source solution" is something you can say that doesn't mean much and is difficult to prove or disprove. There are a number of entrenched players, open source and commercial that provide a column oriented database:
http://www.timestored.com/time-series-data/column-oriented-d...

That's a short description of 12 alternatives I wrote up. Druid does look interesting, it appears to have got the architecture pretty spot on and I'm going to look into it more.
And just a tad offensive.
Ask HN: How did you learn at your fastest?
Think of when you learnt programming at your fastest. When you seemed to really learn rather than just solve the immediate problem (or learn to be resilient in problem solving).

What was the (apparent) magic ingredient which enabled you to absorb and use the information so much faster?

What are your tips for creating the perfect learning environment?
You can't because nobody from the community has stepped up to create Windows&Mac binaries of a plain MonoDevelop build.
Thats an overly vague line of thinking by which the CPU can be said to be invented by the Neanderthals because "someone must have though of it". Even in ancient athenian democracy egalitarianism was not a thing: only "the chosen" landowning male native citizens had a say in collective decision making. If anything egalitarianism probably became a thing since the french revolution.
Huh? GP will make an unsubstantiated claim and you'll double down with an unsubstantiated counter claim (in one line!)

Seriously: What, specifically, do you disagree with, in the context of your use case, and what is your use-case?
There's a link to a replay of the launch event on the Tesla Model 3 product page at https://www.teslamotors.com/model3 (the link is to https://vimeo.com/161138986 ).
The problem with the code you talk about is that they use libraries that are intended to create a new DSL, instead of fuse into the language itself.

Apart from that, there isn't really much problem with Haskell's operators. There are only few in standard library addressing applicative and monad, and the de facto standard Lens library.
They're just games dude.

Adults are supposed to be able to distinguish fiction and fantasy from reality.
We'll never know, but I have to wonder if it was bitcoin related. And I don't mean like dark web, but like Mt Gox or other.
Can a government compel you to lie? Is omission the same as a lie?

It's an incredibly complex issue that your screenplay doesn't quite capture.
Why are you all arguing about fucking canaries? I grew up with this idea that there was a right to freedom of speech and expression. You're all playing their little games when you should be standing up for your right.
Yes, let's dig into it.
Kept up to date with SLE, if I understand the poster correctly, as in using the same versions and patches.
Humor is a great way to spread a message. Although China is an easy target. Try doing the same for putin or ISIS.
Intesting. ms_hook_prologue inserts 1 8-byte instruction ( lea rsp,[rsp+0x0]) instead of 8 1-byte nops. It executes much faster than 8 nopts if the function is not patched (no need to decode 8 instructions).
I see what you mean, but why does it matter? By the time you've read the explanation, you've moved past it, and no additional action is necessary, it's just of no interest to you any more, like the rest of the text you've read. Adding a collapsing mechanic would "require" you to take action again by collapsing the thing, even though you will never return to see it.
Isn't saying "No joke" in the headline kind of cheating, though?
Reading that, and the blog post linked to by sigmar, his stance comes across as rather belligerent; perhaps even childish. I would expect that if you wanted to communicate with someone who is privacy-conscious, and provides a public e-mail address linked to a GPG-identity, encrypting and signing your message to him or her is only civil and is to be expected.

I understand Moxie's criticism of existing crypto-tools, GnuPG in particular, and he makes some valid points, but dismissing anyone who mails you and uses GPG (because you have published your GPG public key) as nutjobs seems overly antagonistic. That to me seems at odds with the greater goal of facilitating easily attainable privacy and digital freedom for all.
> What is left to say about this? Does anyone have any new insights?

There is one thing that I'm really, really wondering about. Are large cities like London and New York basically screwed?

Let me explain: One large city with 10-20 million people is obviously far more vulnerable to terrorism than 10 smaller cities of 1-2 million each. Obviously Amnesty is correct that encryption is good for freedom of speech, human rights etc. Also, encryption is necessary for business/banking in a modern world. But let's not kid ourselves, terrorists can also hide behind encryption.

Terrorism is nothing new, and there will probably be more of it in the future. I'm not a law expert, but my impression is that the countries in Europe with the worst laws for privacy is the UK and France. Probably because that is where you find the largest cities: London and Paris. These people are scared/worried. I can see no other reason why they would enact laws like these.

So in the future, when there are more terrorism attacks, knee-jerk politicians (and their voters!) will probably want even more laws restricting encryption. This will make these places even worse for both human rights and business.

The industrial revolution basically created mega-cities. Is modern computer technology making them impractical?
5 reasons why I choose React-Meteor for my projects
Doesn't seem so, unless it's by the Chinese news agency itself: http://weibo.com/1699432410/DoUipcOni?from=page_100206169943...

Google Translate gives me: "Today is the West so-called "April Fool." "Fool's Day" is not in line with our cultural tradition, does not meet the socialist core values, I hope we do not believe rumors, do not spread rumors, do not pass rumors"

And the account seems to be "verified" by Weibo.
Sadly a lot of tools make it harder to work with beziers than necessary. Recently I checked half a dozen open source tools - and only a single one allowed locking the tangents at the points connecting 2 bezier curves. That is trivial to code as you just have to ensure the connecting point and the 2 control points before and behind it form a straight line. And without that using beziers is so much harder because that is the only way to have a smooth curve when connecting bezier-segments and fixing that manually is rather annoying.
Good lord that blog makes for tedious reading! It is like he is on a one man crusade to overturn decades of irreversible missteps with the practice of OOP. Rather than trying to fix an unfixable wrong the author should simply get on board the Actor-based Programming bandwagon instead which is almost entirely aligned to Alan Kay's original thoughts. Being "hung up" on ideologies, especially those which are decades old, is not a good personal development strategy.
Linking the FreeBSD base system with lld
Global Sewage Treatment Plant Market: Trends, Opportunities and Forecasts
So which 2006 skills besides C and POSIX are still unchanged today?
http://www.internetslang.com/_2FS-meaning-definition.asp
From my point of view, all dynamic languages usually used by people without CS background.
> The real question is, "So a canary died on a service I use, now what?"

Actually, I think you do the same as when an actual canary dies in the mine - you get out. If we look back at what we know about Lavabit, basically a compromised Reddit (or any other web service) might be doing who-knows-what with targeted javascript and what-not. Of course, "Evil Reddit" could already be doing that as a private entity -- but I think it does shift the degree of trust a lot, from a) "probably mining personal data for financial gain through advertising etc", to b) "certainly mining all data at the behest of a mad anti-terror juggernaut that's been out of control for decades".

I might choose not to use the service a) for a lot of things, but I certainly wouldn't want to use service b) for anything.

Now, if I was the NSA/CIA I'd of course try to fund social media and messaging startups through shell corporations, and I'd be surprised if they don't do that. In that respect we go down the "you can't defend against a nation state actor" line of reasoning. But if warrant canaries became enough of a problem, something that could lead to a real exodus of users for something like Reddit -- that might give these corporations enough incentive and reason to challenge the practice in the legal system (The government is forcing us out of business).

Another aspect of the canary, is that while people might not now stop using reddit (or logging in to a reddit persona that's associated with animal cruelty, native American rights activism or other terrorist activities) - it still serves as interesting indicator on continued government overreach, and encroachment on civil liberties and free speech.

As evidence that more and more "town squares" and cafes are fitted with microphones and cameras "for security reasons" surface, the fight against illegal surveillance (can) gain(s) momentum.

So maybe what you should do is not just step away from reddit, but take to the streets.
In the case of violating the gag provisions of an NSL, that's a 'Fast Track' to an 8x10 cell in an institution not necessarily of your choosing.

Do feel free to write your representatives and complain, but don't try and sweep this all away under "right to freedom of speech and expression". National security is far more nuanced.
I'm not familiar with reddit's set up. But given that a NSL means that anything and everything can be given over to the NSA by reddit, does this mean that it's not hard for them to do this now?
In the article it is also mentioned that it is important so that you can't have a thread that has "partially" executed your no-ops wen you replace it/them..
That's pretty much the same context, but I think the demo is lacking. For example, clicking on "magnetic" replaces it with "B", which confuses me even more. There's also at one point a link on "be", which is just baffling. What is there to explain about "be"?
I do understand this choice when judging Signal purely as a replacement for WhatsApp etc., but even then I wouldn't design a protocol based on the requirement of a mobile phone number and one of the two dominant mobile operating systems (and thus a smartphone).
"At a hacker space, when you walk in, you've got to assume people are trying to crack (your computer). They can't help it," he said.

Poor little hackers, they have no self-control.

Also, isn't it standard practice in the US to present audited financials to an annual general assembly? With $300k in the bank, you should be able to afford to hire a CPA, no?
Very nice library!

I think that the "no collapse" thing is the right way to go. It's simpler, and really no cognitive load... you can ignore any text in the article you want :-).

Also, when you go back to the page, it's all collapsed again anyway, so the next time you read it, you don't need the expounded bits, and it's all compact.

It's also just prettier to not have a bunch of lurking controls.
An emoji is worth a thousand words
>the vast majority of manufacturing job losses have been due to automation, rather than competition from abroad

The reason why this lie is so commonly repeated is that technology makes a better scapegoat than the American elites for declining standards of living.

You can't jab a pitchfork into technology.

You can jab a pitchfork into the American elites who formulate trade policy that ships jobs overseas.

This misdirection and the anger it fomented is largely responsible for the sudden rise of Donald Trump.
How to plan successful functional testing?
That was a tiny quote from an evidence-laden argument. Google Books sometimes doesn't show this in incognito mode: (https://books.google.com/books?id=99E4aIjgryoC&pg=PA183&lpg=...)

The reason why soundbites win is because, "The amount of energy necessary to refute bullshit is an order of magnitude bigger than to produce it."
[linux-kernel] New syscall: leftpad()
Setup Gradle for your Android project like a boss – part 2
> more and more "town squares" and cafes are fitted with microphones and cameras "for security reasons"

I'd be really interested in hearing more about this.
JotForm is overtaken by crazy balloons
Dine’s AI System Had a Major Freak Out. All Pictures Were Changed to Animals
Exactly what Steam is doing with its badger system
Is that really any different that promoting a startup's product? Somebody has to try new things and shut down a large percentage of them. I'm surprised HN is so against it. Perhaps google should distinguish services that have long term commitments from those that don't?
Anyone who didn't preorder right after the announcement is going to be waiting longer than a year, probably more like three years from when the Chevy Volt is available to when they get their Model 3 if they were to preorder the 3 right now.
It's funny content!
April Fool's day historically derives from the day of misrule, whereby the social order was inverted and for a day a lowly fool took the throne of the king.
Groups is the last resting place of the USENET archive. Deleting it would be a tremendous loss!
I can relate. Just short before this happened i started using Instagram, the only reason was because it really was chronological and therefore a perfect social marketing instrument.

I've immediately stopped all my activities there tho.
It appears these restrictions haven't done a great deal to stave off exploits.

http://venturebeat.com/2015/12/31/software-with-the-most-vul...
In my experience (I've been using Fedora as my primary desktop for approx 8 years), breakage is more rare than that, like once every few years.
still a dupe: https://news.ycombinator.com/item?id=11403420
Rust: Innovative new way for clean error handling
Iframe problem with CloudFlare
i try every possible method to insert iframe with cloud flare but nothing work

please help me get our of this
<a href="https://vidhya360.in">my Result</a>
Kayak Arcade

https://www.kayak.com (redirects to https://www.kayak.com/arcade/)
From the trenches of those Dojo Members seeking to regain control of our nonprofit... In my opinion:

The last executive director was brought in to fund raise via grants and sponsorships, and failed miserably, instead raising that $400K ($300K + $100K stolen), off the backs of it's members by doubling membership fees, and converting a quarter of the Dojo into a private VC incubator.

He also wasn't an entrepreneur or a hacker, but more the slick politician type, and killed the Dojo culture, driving away most of the best volunteers and people, by ending member voting, spying on members, and banning anyone he didn't like (at the slightest of excuses at times). This and the previous board ignored members complaints, until he let the corporate status lapse, and there was no corporate veil for the board to hide themselves behind.

And now we are at war with this board, trying to gain back control that existed as a gentleman's agreement between the founders and the members, but wasn't written in the bylaws because clueless lawyers were consulted.

Also - the $30K number is a made up number by the most recent board member, who bought his board position, and is the most responsible for harassing the recently resigned whistleblower member. There are few to no records kept of the purposes of expenditures. If all unaccountable expenditures were added up - it'd be double or triple that $30K number...

Lesson: Bake your culture into your DNA, or when the good King era ends, the bad king era will begin...

Kind of blows my mind that in Silicon Valley - the Valley of the Disruptors, Hackers build an organization utilizing 100 year old feudal corporate antique autocratic bylaws.

Don't tell me we can't smart phone app, wisdom of the crowd, self govern our own hacker asses.
I think there's a big difference between what that tweet says and having "banned April Fools". But what do I know :-)
Internet access (Right to Internet) is also tool, yet it is highly linked to other fundamental human rights(1) (right to free speech, right to development, right to freedom of assembly), so encryption , imho, should be treated of the same manner as enabler of right to privacy. How good is human rights alone if tools to ensure them were banned?

1. https://en.wikipedia.org/wiki/Right_to_Internet_access
This is wrong.

The drastic increase in land prices has been driven by untaxing land (e.g. prop 13), allowing the stream of rents derived from land monopolization to be privatized.

That, combined with rock bottom interest rates (driving down mortgage requirements) and opening property markets to wealthy foreigners has driven up the cost of property in coastal cities precipitously.

If interest rates and property taxes were jacked up, property prices would fall once again just as precipitously as they rose.
The Xeons support much more RAM.
I wish people would be more clear about what they mean: http://senseis.xmp.net/?GoProverbs

I.e. write "Golang" instead of "Go"
> However, scientific study on this topic has been inconclusive.

I remember reading of a study comparison that found that in the USA, where serif fonts are the norm, that serif fonts are more legible. In Europe, where sans-serif if more common, sans-serif was found to be more legible.

So, yeah, you get good at what you practice.
Donald Trump?
The Chinese authorities obviously take lying much too seriously to allow any jokes about it. As is appropriate for such an important instrument in their tool chest.
It's not. This has been reported previously on dates other than April 1st.
Do you do what gov says? Weibo is way too old school in China, you should check out how people really post on wechat.
Given that they had to get them into a lab and use specialised equipment on them I'd guess the low number of participants was more due to budget than experiment design
Nobody is arguing with that. But it's also very wasteful to build an earthquake resistant house in a geologically stable area. You have to talk it over.
Ask HN: Is it stupid to store GB's of data without a DBMS/DS/etc?
I have a small website/personal project and very limited money.

I'm trying to work out a way to keep it alive and well for the longest time possible and using as little money as possible.

It basically gets data from an external api, transforms that data using some node/python scripts and save that as json files. Then I use the data in the json files to generate static html pages. As I save the json files with the specific data I need to generate the pages(kinda like a view), there's no querying needs other than key/value.

I'm divided wether to keep going with the file system or use a database/document store/whatever.

I'm running it on a small 512mb DO vps and I want to keep the costs as low as possible, so ram and general systems resources usage should be kept at minimum.

I have a lot of data and most of it is kinda redundant, so it's not a big deal if some of it goes bad/is lost. So I don't really see an incentive to use a proper database/document store/etc. But it feels kinda wrong to deal with GB's of data all sorted in lil folders saved as json files. It may be just prejudice I got from reading too much stuff about big data, trendy dbs and such. But it also may be some technical debt I'm failing to see right now that may be a giant pain in the near future.
Maybe I'm too tense in these days of tensions.
I think your second sentence has got it: Google is not a startup, and it should distinguish between startup like experiments and things they are making a long term commitment to. And even then G+ shows they won't be perfect, but they can at least try.
NixOS 16.03 released
The headline is rather clickbaity, it is all based on a tweet from the news agency, it is not a government edict.
I don't know what you mean by hierarchy, latent parameters, or compactness. It models with Turing machine which are very general and can simulate other Turing machine that are unboundedly huge.

The biggest issue is that an agent can't model the universe as merely a set of inputs, outputs, and score. But there may not be a better way, it's quite a difficult problem.
And how that proves that the April 1st is banned? The "fool's joke" here is just the article title, itself demonstrating the spreading of inaccurate information, which is day as usual for most of the media anyway. Really a bit of meta.
In what way? As with the microphone and GPS, chrome prompts the user with whether they want to give the website access.

I could see a need to be able to run a web app in a sandbox mode though, where it has only ephemeral access to storage and no access to the Internet.