skysight-inc/HackerNews huggingface dataset:
A kernel CSPRNG needs to:

1. Seed itself reliably.

2. Do nothing unless seeded.

3. Re-seed itself regularly, for forward secrecy.

4. Have good performance.

How difficult is #1? It's as simple as gathering 128 bits of entropy. If you have 128 bits, you an expand them into an infinite sequence of random numbers, securely, forever.

I think this is the essence of your comment. The topic is important, so it's worth being clear.
Back when I took an interest in malware analysis I got the book Practical Malware Analysis and must say it really was brilliant. Analyzing malware requires knowledge of a range of different technical areas, and the book introduced them well. The best thing though are the malware samples supplied for analysis after each chapter so you can test your new skills, and then the detailed walk-throughs of how each should have been analysed in the appendix.

You might need some additional help with assembly. Personally I looked at the "megaprimers" on securitytube.net and then the Intermediate Intel x86 series of video lectures on opensecuritytraining.info.

Proper study of the material takes time and I never got through it all. Perhaps I'll get to return to it.
Why use such a thing? Array languages are very powerful for dealing with high-dimensional data. R, matlab, octave, and Julia can all do this and are satisfactory for most people. However, proponents claim that languages such as K are much more expressive.

The APL family gets a bad rap for being "read-only", but I think it's mostly because they've fallen out of favor and have become unpopular. People who have experience working with these languages can encode/decode incredible amounts of information to/from a few lines once they see "phrases" and "sentences" instead of "my cat chewed the 56k modem line". We don't write Integral() in calculus when we want to take an integral, so why not have similar shorthands in computation?

Here's the vocabulary of the sister language J for comparison:

http://www.jsoftware.com/help/dictionary/vocabul.htm

"The one-page thing":

http://code.jsoftware.com/wiki/Essays/Incunabulum

Naive K-Nearest Neighbors implementation:

https://github.com/wyc/snippets/blob/master/j/knn.ijs

Community:
https://www.reddit.com/r/apljk/
Sublime vs. Atom – who will win the editor's war?
Which one do you prefer and why?
Specifically, the reference card here is describing "k6".
That isn't socialism nor what socialism purports to be.

Socialism at it's core can be distilled down to how labor relates to its means of production. That's it. If workers themselves own and manage the facilities and materials necessary for employment, that is socialism.

Individual liberty and free markets are not contradicted by the tenets of socialism. It can and has been argued that individual liberties can be strengthened through such a system. Market economies are what much of socialist thought revolves around. Again, socialism is defined by how labor relates to the means of production and that is it.

Neither of the two are required for a functioning capitalist economy. Freedom of speech, religion, movement and association aren't guarantees and is down right outlawed in much of the world that's implemented a capitalist system. You'd be hard pressed to find a single truly "free market" in practice at any point in time.

Yours seems like a judgment stemming from an ideology rather than one coming from a historic perspective. You aren't doing yourself any favors intellectually if you want to continue claiming Nazism is a socialist ideology. It is hard to have a historic discussion with someone whose arguments are based on a feeling rather than documented history and accepted definitions.
https://www.metacademy.org provides plans for learning certain technical topics.
Has anybody made a set of patches to give linux the BSD behavior (block until seeded, then never block again)? I run into issues with /dev/random regularly and while I can patch every single application, that feels like playing whack-a-mole compared to patching the kernel.
Interesting. Would the re-keying process require a source of fresh entropy, if it's to be non-deterministic?
A good question. Older versions of K had if and while as syntactic sugar. You could always do without them by using cond and adverbs. K5 did away with these syntactic forms, and for whatever reason Arthur decided to put them back in k6.
Thanks again, this looks like a lot of good stuff. I've actually read Lucifer's Hammer (several times if I'm totally honest), I had no idea he was involved in that.
Most PhDs are doing well economically
VS Code and Atom are nice but I keep coming back to Sublime for speed. VS Code destroys Atom in that department but Sublime beats them both and with the number of files I open in a day that counts for a lot.

Edit: Wanted to add that VS Code can't open multiple projects either.. huge issue.
Should I sign this “Assignment of Inventions” agreement from my future employer?
Link to the agreement text: https://ybin.me/p/6d0d1a26aa31c1c5#CvPe4IDX8m0OOTiUvOOLpQKcXwJ7w5n/h7pPyUnvA1c=

Some background: I'm being hired to work in a research group for a corporation. This is my first job where I'll be developing software for someone, so I don't know what is standard in the industry.

I am currently working on a software, that they know of, that could compete with some parts of their company. I am planning on continuing to develop and market this software in my own time. What do you guys think?
In my opinion, text editing should be done in a GUI instead of in the terminal, so I've used Sublime Text for years. I recently switched to Atom since it's finally tolerable to run on my laptop performance-wise. gvim and emacs gui don't really work for me since they're too complicated to install and develop plugins.
I think the whole USA should be a gun-free zone. That way, no one can commit any more crimes.
Further evidence towards a Dystopian, totally militarized future
I'm happy to hear that you were able to make a series of choices that made you happier! I hope that you didn't feel attacked by my comment -- the "needless/useless" comment was intended to be with regards to my own situation, not a prescription for others. I think it's an easy trap to fall in to, wanting to prescribe your own beliefs upon others and make the world in your own image ("if only they'd all just listen to me!"), but ultimately ineffective.

> Ironically, I've also been able to be a more effective advocate for all genders because now I'm in the "boys club". By that I mean, pointing out when someone is treating men or women differently just because of gender, but also helping highlight when someone is expecting different treatment just because of their own gender.

That's awesome! I like to think that I'm still an effective advocate for equality despite not identifying as genderqueer or taking any particular pains to present a certain way. As a logical extension of the beliefs and decisions described in my original comment, I try to do my best to set a positive role model by making myself happy while presenting as $GENDER rather than genderqueer. Be the change you want to see in the world, and all that.
This is only true if there is a fixed pot of money to use on salaries. This is usually not the case.
No. Modern CSPRNGs based on DRBGs are relying on fundamental crypto building blocks like block ciphers and hashes. A single bit difference between the previous state and the new state after the addition of any entropy whatsoever completely scrambles the RNG state. Obviously, you're getting many more bits than one out of your regular updates from the entropy collection subsystem.
Yep, he explains that already in the post.
Gentoo Tesla – T2 Edition
Has anyone offered a better patch? I'm genuinely curious and don't know.
I'm pretty sure you're joking, but honestly jokes like this hurt the discussion because Poe's Law really does seem to be true.

EDIT: also, for the record, I upvoted you and did not flag you.
The evidence is in the hearings, just watch them. The transcript search doesn't work for me (paywalled).

Also see page 4 of this document (which I already linked to):

http://democrats.oversight.house.gov/sites/democrats.oversig...

And in the congressional hearing there was one family facing a $350,000 price tag for their Daraprim cure which insurance refused to cover altogether because of the price hike, and Turing refused to help. The family did eventually get the medicine they needed, but Turing left them out to dry.

I'm fully aware Turing states "nobody falls through the cracks", but it's a blatant and audacious lie and there are dozens of experts testifying as much. You'll also find expert testimony in the linked videos. Many hospitals stock one or two bottles of Daraprim so they can immediately help walk-in patients. So now when somebody can't get Daraprim through insurance the doctors beg nearby hospitals to fedex the pills they have in stock from before the price hike. This supply is quickly running out.

The sales volume of Daraprim dropped by 80% or so as a result of the price increase, and the Turing executives state that thanks to their actions availability of the drug has broadened. A clear contradiction. Less volume means sick folks simple have to go without, which can have very serious health consequences.

Heck, even the Massachusetts General Hospital stated, and I quote!

This is a critical matter, visible at the highest levels of our
Infectious Disease Department [...] Daraprim’s new price on their
inpatient pharmacy budget, which they have determined to be
prohibitively expensive. Against their clinical convictions
they are currently switching patients to Bactrim.

Observe that patients who are now forced to use the inferior Bactrim do not deal with Turing at all, which means there is no application for Turing to reject. Translated into Turing's bizarro PR language: "nobody falls through the cracks". In the real world we understand that people not getting the medicine they need is a problem.

Watch the hearing videos (especially the Subcommitte on Aging one). Read the actual filings and other primary sources, not the PR spin.
> Who knew the "apocalypse" was just another 1-percenter meme, and that the self-styled "free-thinkers" walking around believing it

Interesting thought, that's never occurred to me before. It does seem strange now that you mention it that everyone expects their neighbors to turn into flesh eating monsters when the lights go out though, particularly when there's so little evidence to support the idea. It would be interesting to trace it back to its roots to see how it got started. Maybe it's an ancient holdover from the Bronze Age Collapse.
The Casper API is the only one that works with the latest Snapchat API changes, but it is a paid service.
https://developers.casper.io
What's "a better patch"? We need to have a shared understanding of the problem before we can evaluate solutions.
Can't you see the pattern here? Even LLVM devs are incapable of doing what they are requiring from random regular developers. If that does not motivate to address that kind of craziness more in depth in a systematic way to restore safety and defense in depth, I don't know what will.

- Programmers can and do emit substantially simpler code if they have a guarantee from the platform's implementation of <feature x>.

- Programmers think they have such a guarantee. (I don't know a single programmer around me who knows the complete list of undefined behavior, myself included)

- Compiler injects bug -- and LLVM/CLang seek excuse in the "technically not a bug" completely useless answer.

- Sane projects actually disable all that kind of crazyness (adding -fno-<everything> options every now and then) so all that kind of cute optims are useless in the real world (either dangerous, or completely disabled)

It's actually reasonable to have a platform that e.g. gives you 2's complement arithmetic or defines the result of shifts, or allows unaligned access, because mainstream computer hardware does provide those guarantee. And at least half of C programmers are not even aware those kind of stuff are technically forbidden, (historically often because of other architectures, some obscure, and not compiler optimizations, btw). More knowledgeable people who know about the spirit of the standard (1) can also be bitten by compiler revelation of bugs because compilers devs are doing literal and insane interpretation. Bug ensues, including security holes.

(1): Let me remind you about the definition of undefined behavior: "behavior, upon use of a nonportable or erroneous program construct or of erroneous data,
for which this International Standard imposes no requirements"
One keyword is nonportable and it is clearly not considered enough. So yes, there are numerous constructs that are reasonable to expect on a given architecture when we do not learn the compiler manual by heart, but some people don't give a fuck about the principle of least astonishment when they can gain 1% on a synthetic benchmark.
There is nothing human about chatbots. They are glorified menu-in-text-form delivery mechanisms. NLP technology isn't at the point where they become even slightly human-like when off-the-rails.
Self-immolating cars: a new take on traffic management
I'm not sure what you're getting at. Yes, University is the perfect place to confront things that are hard to think about. Discussing gender issues is in vogue right now across the section of society in which I'm a participant -- no one is literally forcing me to engage with this issue, but it's a common enough discussion that I end up having to deal with it more than I'd like to. I'm not suggesting that other people shouldn't have the discussion I'm just giving my own viewpoint on a matter I've spent a lot of time thinking about.
> But you think that he genderqueer folks invented this obsession with gender identity?

No, I do not think that genderqueer folks invented this obsession with gender identity. It's very unclear to me how you read that meaning from my original comment.
There's certainly not an unlimited amount to spend on salaries; as long as a company is not willing to spend 250k on everyone, but is willing to spend it on some, this could be true.
It's generally the other end, where there is 'not enough' code. Early systems needed to be like this because there was very little memory for your code and people would often do things use calculated jumps based on some register value. Not to mention the joys of self modifying code.

This all sounds cool until someone actually hands you "Mel's" code: http://www.pbm.com/~lindahl/mel.html

PS: Beginners or Evil people, would also get into horrid messes by trying to get something that sort of works into something that almost worked.
Nice post.

I never really thought about evaluating a z-transform at a particular value, so I tied together some of the various solutions with derivations and greater generality here:

http://bit.ly/1WQ0Zkn
Postpone the deadline for Parse database migration
That was my reaction too. I looked into it, the MacKeeper security researcher is Chris Vickery. In December 2015, while not employed by MacKeeper, he discovered a database of 13 million MacKeeper usernames and passwords [1]. MacKeeper then hired him in January 2016 to create a "Analytical and Security Center" [2].

[1] http://krebsonsecurity.com/2015/12/13-million-mackeeper-user...

[2] https://www.linkedin.com/pulse/mackeeper-chris-vickery-launc...
I just sorted by latest, yet I'm seeing 2014 news...
As a counterpoint, why do pro gun-control people always assume that violence would cease without guns? Guns do not motivate people to commit crime, only give them the means to.

People in general are pretty clever. If you take away someone's means to do something without addressing what motivated them to do that thing, they're likely going to figure out a way to do it anyway. (See: censorship, DRM, drug prohibition)
You can easily predict the output of a system from its input, if said input can only take a few possible values, by simply trying all possible inputs until you find one which matches the output. The extra step of hashing the pool into a key to a keystream generator does not prevent that. If the key has only a few possible values, and you can observe enough of its output, you can brute force it.

If, for instance, the pool has only 256 possible values (8 bits of entropy), perhaps because the system just booted and almost nothing has been added yet to the pool, there will be only 256 possible keys, and only 256 possible output streams. If you have enough of the output (on average around one byte), you can try the 256 possible pool states, and see which one would give you the same output you have. And since now you know both the pool and generator state, the system's entropy is now zero: it's completely predictable.

The only way to prevent that is to never output anything, until the number of possible states is large enough (like 2^128 or more) that brute forcing is not viable. Which AFAIK is what the new getrandom() syscall does.
But it is still an auction, right? As in, if the starting price is less than the market price it should still get bid higher and there won't be a market irregularity?
Surely the solution there would be to make it a compile-time option. Enable threaded jobs, or process jobs.
I was about to add that web apps could fix all those with more browser features, but somehow I don't think every web browser vendor implementing their own proprietary payment/share/identity API is what readams had in mind (they are certainly not going to agree on a standard any time within the next 5 years).
Read and practice No More Mr. Nice Guy. That book was a true eye opener. Get into a weight lifting program (with a coach, NOT by yourself), it feels great and it gives you a long term goal outside the dev bubble.

> When I'm in a relationship I feel insecure that she really likes me.

You shouldn't feel that way if she already chose you.
"why mathematics don't have to do with experience" is too strong. Nothing you just said implies that math isn't intimately connected to empirical predictions in some way. What it shows is that contrary to Jules' earlier statements, there's no statement by statement correspondence--for any given mathematical statement, you can't find an interesting empirical prediction you associate with it.
Registering with a party in the US always struck me as crazy. Can't they at least uphold the fiction that people vote on the merit of issues?
Hopscotch is one of the few tour libraries that can jump to steps on a different page and (mostly) perform actions on behalf of the user.
It is not the particular situation people are upset about (well, at least me). It is the reasoning, especially in the context of "you shall not write undefined behavior according to the standard even if it should makes sens given the computer you are actually programming" that is usually sent on us regular programmer by compiler authors... :/

Yet they do exactly the same thing, and pretty much casually. And I actually don't really blame them for doing it. Everybody makes mistakes. But I blame them for the double standard, the risks, and the attitude. The problem in the first place: engineering is also about mitigating the fact that mistakes will happen, often mitigating even the mistake of others, and the modern approach in regard with undefined behavior does not help and is even ultra-hurtful for that. I don't see how stability will emerge with that kind of thought process.
I can't speak about SpaceX, but with a number of prior/current NASA contractors it is pretty mundane. The key isn't some awesome framework or "new" technology. In fact, you'd probably be dumbfounded with the technology restrictions and how little they are using current technology. Overall their success comes from process, methodology and time. In addition, most of the time you are engineering for failure, so when failure happens recovery is possible. You can read about the flight computers aboard the shuttle (and Apollo) and how they handled things with them, there are some really interesting articles about it.

In more specific, I'd say 80% of the success comes from fairly rigid processes, including the coding standards and testing methodology. Like with C/C++ standards, you'll find a lot of restrictions on what you can use in the language, how you can use it etc. Here is the JPL's C standards, around flight and embedded type projects (they happen to publish most of their standards) http://lars-lab.jpl.nasa.gov/JPL_Coding_Standard_C.pdf

And traditionally there has been significant separation of teams, e.g. System Engineering doing requirements analysis and development, Software Engineers building the software and Testing Engineers writing software and procedures to make sure software hits all the requirements and it doesn't fail.

At least from what I know and have experienced you also will not see flight or "critical" software changed and flown (or actively utilized) within any short period of time. As time is a major factor in the testing/simulation regime to make sure things work properly.

My guess is that even at SpaceX, critical software components in flight today have been completed and tested for months and months before it hits a real flight. Doesn't mean they may not fly it in a passive mode to see what decisions it would make, but it wouldn't be in control. I am sure non-critical components and ground based software has a slightly less rigid process, but probably still fairly tough.
As far as I can tell the article is worded poorly. He doesn't work for MacKeeper, he is the researcher that found a similarly exposed database of 13 million MacKeepe users. http://krebsonsecurity.com/tag/chris-vickery/
On Functional Programming:
I'm the author of the blog post. You're right, it requires n^2 binary digits (and I mention this at the end of the article). The formula isn't, and isn't meant to be, a good way to find Fibonacci numbers -- it's more of a fun curiosity.
Nice writeup. I use these filters quite often (especially the particle filter). Very powerful tools.
I don't think it does that at all. You have rights to the space above your property, you have severe limitations on your right to modify the make up of the molecules that make up the air.

Would private ownership provide some means to prevent poisoning that atmosphere?

See: http://www.ecfr.gov/cgi-bin/text-idx?SID=99f0bd4d8deafa1761d...
Drupal 8 is simpler. I've done stuff in it already that took many add on modules in d7.
Stop watering it down by calling it "gun violence" and call it what it actually is: "Murder" or "Attempted murder". With a gun.

What's needed isn't "gun control". You can have that.
What you need is "bullet control". (And a sense of humanity).
With all respect to the very smart author of Riemann, as a practical matter, its use of Clojure is simply not a hurdle most SRE types are going to overcome to use it.

ElasticSearch is a great search engine. It's not a CEP or SEP. I don't mean to discourage its use, but for this purpose it's not a good fit. It does make sense to tee incoming logs to both as they suit different purposes, but I'd delegate pattern analysis to the latter.
You'd have to correct for the biases. Not only in probability, but subsequent calls are also not independent.
I implemented the same in Haskell a while ago: https://github.com/xyzzyz/FibBinet/blob/master/FibBinet.hs

With yours, both make interesting comparison of how similar problem is solved in different languages.