skysight-inc/HackerNews huggingface dataset:
I used to use vim for everything - from writing simple notes and todos to bash script to complex web applications. I had (well, I still have) configured different set of plugins, huge .vimrc etc. But year ago I decided to try using IDEs again and honestly, I don't look back. Currently I'm using Atom (people complain about it being slow, but I have powerful machine and honestly speed is not an issue) and PyCharm. For me it's just more productive and everything works out of the box. BUT: I'm still using vim keybindings/shortcuts in Atom, PyCharm and even Chrome (https://chrome.google.com/webstore/detail/vimium/dbepggeogba...). For me, vim is a powerful language for text/code operations and movement but I'm not so sure it works so well as a IDE (emphasize on Integrated; I had it configured with a lot of IDE-like features, but it was hacky and it took a long time to achieve 10% of what IDE gives you from the start).
Here in Brazil there are websites which will give you info (address, telephone, mother's name, even salary) on basically anyone. They take it from CADSUS, i.e. the SUS (publich health system) registration system, which is available for every public hospital to do queries, but those hospitals receive a default and very common username/password combination which they usually don't change. They also take info from credit protection agencies such as Exparin (presumably some employers sell access passwords).

It's completely nuts. I always give fake or incomplete information to everyone, private or public (and you must give info for practically anything here). If it's absolutely necessary to give real info, then I never update it.
That's true. I read Carnegie's book as a teenager and for a long time tried to be the best listener, which I think I became. I asked thoughtful questions and rarely opened up myself. That's not the way things work. In my experience, one needs to have interesting stories before other people open up.
I believe it's true for Spain also, so parties can spam us with voting propaganda. The information was also sold to commercial spammers too. It was detected because small errors in spelling, not present in other records, were reproduced.
This proposed design comprehensively ratifies Linux's nonsensical legacy random/urandom division; for instance, it maintains a "512 bit emergency entropy level" in case urandom becomes "stressed". It appears to be motivated principally by concerns about the quality of entropy being fed continually into the LRNG --- which is a nonproblem.

This is silly.

There are three problems a kernel CSPRNG needs to address:

1. It needs to seed itself reliably and not provide output when it's not securely seeded.

2. It needs to re-key itself regularly to provide forward secrecy and recovery from attacks.

3. It needs to be performant enough to be used in applications to the exclusion of all other RNGs.

That's it. Once problem (1) is addressed, there is never again for the uptime of the system a concern about the quality or "level" of entropy in the LRNG. DRBGs like this document proposes are effectively stream ciphers (in fact: Salsa20, the new hotness in bulk cipher designs, is essentially a hash DRBG --- and, in the BSDs, a [crappy] stream cipher was the RNG). "Entropy" keys the cipher. The idea that you can "run low" on entropy is the same as the idea that you can "run low" on key. No.

Kernel CSPRNGs do need continually updated entropy pools. But not because their original entropy is depleted! Rather: you want your RNG to be updated so that its "key" changes regularly, so that if your system is compromised transiently, you'll recover.

And, of course, the division between /dev/random and /dev/urandom sabotages goal (3) --- arguably the most important goal. Almost every time you've read about some crypto randomness catastrophe --- from Debian commenting out their RNG and reducing SSH key space to 16 bits, to Bitcoin wallets coughing up private keys by repeating nonces --- you've been reading about userspace RNG failures. People use userspace RNGs because they think the kernel RNG is too slow. And they think the kernel RNG is too slow because they use /dev/random, which obstinately refuses to provide output when --- wait, I'm not dignifying /dev/random: it refuses to provide output at random.
Spent a few hours on Drupal 8 and disliked it a lot. Will stay with D7 and will try Backdrop. Drupal should really make Drupal 7 simpler instead of overly complicated, otherwise its user base will shrink rapidly and eventually make Drupal itself unsustainable.
For one, it should never have a publicly accessible IP.
That link's info is so stupid. They say they know who did it, but they won't say because they don't want to alert the guilty party before the investigation is over. Guess what? the people who did it know they did it!

Also, the note says that the info is on "Amazon's sales portal" WTF?
Extra details would indeed be interesting.

There are known global climate impacts linked to single volcanic events e.g. Tambora in the 19th century, Krakatoa, etc.

"All" you have is START 1, which resulted in an 80% reduction of nuclear weapons. In addition there was a fair amount of behind the scenes assistance from the US in helping clean up the somewhat precipitous situation the USSR left itself in with the nuclear weapons - granted they started removing them months before the collapse.

The public debate changed subtly after that report. The folks arguing - as you appear to be - that a nuclear war wouldn't be that big a deal, got a lot quieter.

"I’m not afraid of nuclear war. There are 2.7 billion people in the world; it doesn’t matter if some are killed. China has a population of 600 million; even if half of them are killed, there are still 300 million people left." Mao Tse Tung, 1957
Because they're very different things. But even if they weren't, it's not really a useful question - assuming the desired result is to reduce gun violence. See above comment again:
"Because it's its own category of violence. Like any other category, it's not a matter of 'deserving', but rather just a statistic category so we can discuss and analyze it."
That's definitely closer but he hasn't been charged with anything on it. The only charges are for (unrelated) securities fraud.
15- 18% AC annual avg. capacity factor, orders
of magnitude better than East Coast installs

Huh? It looks to me like the east coast is only ~30% worse than SF? http://www.c2es.org/docUploads/Solar-1.png
They're fine. They're sane, straightforward, relatively simple constructions based on hashes, HMAC, and ciphers running in CTR mode. You could make a CSPRNG more complicated, but there's not much reason to.

The stuff that extends the "state of the art" beyond SP800-90A tends to be system-specific and feature-based. For instance, the "estimators" in the LRNG are an extension to SP800-90A (and a bad idea). Rolling over seed files are another extension.
Yeah, well you'd be wrong. Anyone who's spent time around guns would instantly recognize the difference, and training a computer to do the same thing isn't even hard, it just takes a lot of patient work.

The most important difference here is a gun is pushing a projectile out and a car isn't.

Differentiating between cap guns, starter pistols and fireworks might be a little more hazy, but it's still not the same thing as a backfiring car.
Every kernel CSPRNG that continually collects entropy is effectively mitigating damage from a compromised generator. This isn't something specific to Fortuna.
The way to get someone like that help is to have a court order it. Always press charges, you are not smarter than judges and hospitals.
Holy shit, I keep removing MacKeeper from my parents computers. Every time I visit. And my dad always gives me a guilty look and says "I shouldn't have installed that again right?"
Raised in U.S. without legal status, he attains the American dream – in Mexico
Any organization that hires these security muppets in the first place is not one I'd put any trust in whatsoever.

If some awful, unfortunate thing does happen on their watch I honestly hope the first thing they do is get the hell out of the way so professionals can handle the situation.
The amount of energy and land required for this plan, and keeping in mind that most of that area is in conflict zones or less than stable. Also there's potential impact to deep sea habitats (that are still very mysterious). Good job thinking outside the box, but I don't think this is viable.
> Yeah, but that's theater performed by low-wage employees.

The status of the people who act out these policies is much less important than who is setting these policies. And it's not low-wage employees who are setting these policies, it's high level bureaucrats, the same bureaucrats who will be in charge of your fate should you report wrongdoing to them.
Which is the key. Plenty of ISVs make Linux binaries, but nobody was interested in Interix binaries.
To clarify, the students were doing so during school hours, presumably on school property, possibly even using the school Internet connection or school computers.
Google's starts new incubator for employees – Area 120
The Internet has started the great fragmentation of pop knowledge and I'm not sure how to feel about it.
Thanks for the info. It is something I have wanted to look into.
Ask HN: Quantify OpenGL draw times with points rendering massive overdraw
Hi folks,

I'd like to request a couple of your GPUs cycles for quick experiment regarding drawing time for a massive set of points causing high overdraw. Originally I planned to evaluate the influence of the data type used for vertex attributes on drawing performance, but then I noticed a quite counterintuitive behaviour with my GTX980: Drawing time goes down as viewport vertical size increases.

https://github.com/datenwolf/pointoverdrawbench

Since the program relies on OpenGL-4.3 (due to use of a compute shader), and I ATM don't have immediate access to AMD GPUs, figures for AMD would be highly appreciated. Tomorrow at work I'll test for various NVidia GPUs between GTX680 to GTX Titan X.
I don't have any idea, and any guess I'd make would be... lacking. I will say one thing however, which is that they would certainly have unlimited access to substances to abuse. I'm not sure what the life expectancy of an opiate addict who could afford a lifetime's supply really is. It may be that we're starting to find out, but then, maybe not.
> misconfigured..

> MongoDB server..

unheard of
Of course, I was just wondering if Prince could be made to fit this model, despite seeming to deviate from it.
Looks great. Just started playing with Electron and this one wil be good for learning. Bookmarked :)
I want to assure you that the compiler does not exclusively use the ISO language standard to define the behavior of internal components of the implementation.
> They're fine

Thanks. Does it matter which one of the three is then selected? Only one can be a default.
I think it's a good thing. It implies that what counts as popular culture is becoming more complex and nuanced, and not as directly orchestrated by a few corporate interests.
That looks like more of a grammar.

A specification would describe, among many, many, many other things, how big an int is and what happens for overflow, etc.
https://www.youtube.com/watch?v=zj_3vYo2gF0
https://www.youtube.com/watch?v=c9tkAV4nDCo
> That's all well and good for some opinions; I'm not advocating being polite to, say, neo-Nazis who are denying the Holocaust or advocating genocide. But people rapidly expand X to "whatever I disagree with," and the result is that we treat disagreement on legitimate, reasonable issues that people will naturally disagree on as equivalent to endorsing genocide and believing that the Holocaust didn't happen.

This is the core problem: what is "legitimate and reasonable" and what is closer to neo-Nazis (to pull your example)?

Painting a target on myself here for the sake of illustration: I am a Christian, and I believe in the literal truth of the Bible. This means, for example, that I believe homosexuality is a sin. (which, for the sake of clarification, does not mean that I hate other humans who are gay).

Where does that put me on the spectrum from "legitimate, reasonable issues" to "neo-Nazi"? The answers to that vary far and wide, and the way I get treated online varies accordingly.

I've been treated as another person at the conversational table ("so why do you think that?", "what does that mean for how you treat others?"), and I've been told I'm "objectively a terrible person" (and much worse) for believing what I do.

The problem is often less "how do I treat people who have reasonable disagreements with me" and more "what constitutes a reasonable disagreement?"
Reading most thread of llvm bugs so far about there "undefined behaviours" I see a pattern.

Llvm goal is performance over correction. stop.

If old code breaks, it is you played with fire, correct your code to eliminate these undefined behaviours. Stop.

We made wonderful coloured warning to help you. Full Stop.

Well on one hand I get the point, people played with fire. Code should be "correct" by standards that are emerging, but I can predict one thing : before the new "correctness pattern" that enables lots of awesome robust high performing code spreads, there will be chaos.

My first self interrogation is in how much time llvm team can build a completly correct stable compiler without any surprises? It it takes 2 decades, it will be a lot of chaos involved...

My second interrogation is can the code that "is incorrect" per LLVM standard be obtained without rewriting the source code (I guess not), and how much will it costs before all the code is being "corrected". Do we even have the man power to do it?

You see, some C code may be used everyday but are so complex hardly any developers even well paid like to look at them. (openssl, gnutls, libpng, zlib, dhcpd, bind...). And with platform specific ASM, we may discover that code has lost portability, and it may take a lot of time to discover that it is already happening.

Don't we risk another strike of bad news one day like discovering old software/libraries are behaving differently and need to be rewritten and that no one want to do the same effort as libressl especially since some software have a LOT of dependencies on C code (I do not think to loud of PHP or python, or Perl).

Of course there are unit test, but there are so much of them, some tests (like for python on freeBSD with curses) have been disabled, because "no one has the time to fix them". It is ofc a bad example in this precise case, but in the context, it feels like a growing ghettoisation between the CPU/OS/langage with lots of eyeballs/investments, and the old/poor market. Especially non company backed open source software. A smell of obsolescence by attrition of resource to report bugs/rewrite code.

As a normal former experimental physicist I can feel a transition coming, it smells of chaos and instability, and the question is always, how long, how smooth before the new equilibrium if ever we reach it, and what will break in the process? And well since transitions are transitions, we may reach a new equilibrium, but nothing guarantees it will be reversible, hence some stuff may disappear in the process forever.

I don't know why, but I guess the most vulnerable ecosystem to the changes to come is the non commercial open source.
they never decided to call me a local translation of "Dave."

I had a German friend in England called "Peter" and everyone always called him the English pronunciation of "Peter" no matter how he introduced himself. Maybe it's different with an English name in a non-english speaking country, since the 'correct' pronunciation is often known thanks to TV and movies.
Yeah, looks like reporters can't figure out that "Amazon" means more than a website to buy things from.
I always wondered what this effect is called. It works amazingly well.

You need to be aware of the related effect which is helping someone when they can't return the favor is an very effective way to create an enemy. The cognitive dissonance created by a favor that can't be paid back is resolved by revising their opinion of you in the negative.
You are missing the point.

You are thinking "expensive" is equal to "more money". Expensive, in this context, means far more than money. For example, risk. Sometimes company-ending risk.

I said "R" is expensive because it is often packaged with uncertainty. You have no idea if something is going to work or if people will even be receptive to the product.

Take SpaceX's landing rockets as an example. Hard and very expensive research. Lots of details nobody will ever know about. Lots of failures before success. And then, even with success, you have to make it repeatable and reliable.

One the "R" is done, "D" or building and scaling is, in relative terms, cheap.

Sure, it can cost billions to tilt-up a factory to build hard drives. Yet, you have a product and you have a market. You have an opportunity. You didn't have any of that before.

Wright Brothers: Hard and expensive R&D requiring YEARS of dedication. Once everyone knew you could build such planes (and how to do it) the "D" was cheap because it was done.

Sikorsky and helicopters is another AMAZING example of that. Helicopters got launched because of the Sikorsky's hard work and the unbelievable involvement of none other than Sergei Rachmaninoff (as in the pianist and composer) taking a leap and investing in the "R" that allowed Sikorsky to complete his work [0].

"R" is very expensive, in more than financial terms, that's why the Chinese copy rather than innovate.

That we are allowing them to get away with it is, well, disturbing.

[0] http://www.sikorskyarchives.com/Igor_Sikorsky_&_Sergei_Rachm...
The Kentucky gun owner who developed his own count of gun violence in the US
Most popular links in Hacker News comments, 2006–2015
Linux RNGs: where refusing to XOR in additional hardware randomness into the output stream is not just a defensible opinion, but the dominant one.
this looks like a really interesting paper, thanks for posting it.
How would it change the client code? If you use Fortuna to implement /dev/{u,}random, then the client code can just carry on opening that and reading as many bytes as it needs.
>The problem with only accepting "reliable sources" is that that leads, essentially, to only parroting what is frequently heard in the mainstream media

That is the whole point of wikipedia...it parrots the sources without trying to determine what the truth is. If you accept that limitation, wikipedia works very well.

> I think it's a mistake to claim mainstream publications are de-facto sources of truth

Wikipedia specifically does NOT attempt to get to the truth:

https://en.wikipedia.org/wiki/Wikipedia:Verifiability,_not_t...

>A single Google search will bring you face-to-face with the evidence

A single google search informed me that a wiki-PR company had been systematically investigated and then banned. Looking at the individual edits (e.g. on Naomi Campbell's page) shows that most of them have been reverted, proving that wikipedia works. (There will always be way more wikipedia editors than PR people for any particular article).
Right. The problem isn't the text protocol, it's the loose RFCs and implementations. Ultimately, "text" and "binary" are not different things; text is a subset of binary. The difference is that for some reason, many developers wind up allowing human-friendly text protocols to be flexible in terms of parsing. There's no technical reason for this, as a text protocol can easily be defined with requirements just as strict as any binary protocol.

I think with HTTP specifically, the problem is that implementations came first. There were already multiple implementations in the wild before the RFCs were written. Thus, the spec was written to accommodate the implementations rather than the other way around.
I'll just say it was a very hard problem in imaging. A solution involving the confluence of hardware, optics, software and real-time FPGA-based very high resolution image processing. We even had to go as far as to develop manufacturing techniques that involved assembling electronics in a vacuum chamber.

Given the application I can't say any more than that.
> The compiler is the implementation; it cannot cause "undefined behavior".

The compiler is only part of the implementation. So is the standard library. So would be a processor. An implementation as a whole, perhaps, cannot be said to cause "undefined behavior", but I think it's correct to say it's parts certainly can.

If a preprocessor took valid C, and emitted valid C that could be fed into any other complete freestanding C implementation, would it not be accurate to say that this preprocessor introduced undefined behavior if it replaced, say, memmove(a, a, s) with memcpy(a, a, s) - sans any guarantees about which compiler it would have the emitted C fed into?

When it's LLVM IR invoking glibc's memcpy instead of a memmove, why is that not "causing undefined behavior"? Because it's not a C program? And if I misinvoke it via C++, is it only undefined behavior because the C++ standard references the C one? What if I use C# to invoke memcpy, which doesn't?

> An implementation is not bound by the standard in its own use of the standard library functions.

This is all well and true from a theoretical sense, but an implementation is bound to it's own standards as a means of achieving a conforming compiler, and in this case those standards are clearly documented to mirror the standard's standards. These standards are being violated, leading to possible future misbehavior when combined with other optimizations which may leave the code behaving in indeterminate ways - and, for that matter, current misbehavior in the form of triggered "false" positive valgrind checks.

> The implementation can use a function like memcpy in ways that would be formally undefined if they occured in user code; its implementation of memcpy just has to harmonize with that use, so that the intended behavior is ensured. This is because implementations can add their own requirements to areas that the standard leaves undefined. For instance, an implementation can add the requirement to its memcpy that the copy may overlap, if the destination has a lower address. Then, the implementation can generate code which uses memcpy that way, or make internal uses of memcpy from other library functions which use it that way. It's just using its own (possibly not publicly documented) extension.

It can do these things, if the implementation as a whole is coordinated in this way, but I would hope for sanity's sake it would not. And in this case the implementation as a whole has not been coordinated in this way.

Invoke copy_forward from memcpy if you like, where the former has fewer preconditions - but to write code that relies on an implementation's memcpy having fewer preconditions than the standard, even if you control the entire implementation, sounds untenable. Someone will forget that your memcpy has fewer preconditions, and write optimizations, debug checks, etc. which misassume additional preconditions that are outlined by the C++ standard. They will also also accidentally write code assuming fewer preconditions in another context where they're not guaranteed some specific implementation's relaxed preconditions.
> No it doesn't. What is even going on in there?!?

It's quite clear to me, but I've been programming Ruby for quite a long time. Conversely, I have the same reaction you're having when I look at a lot of "modern" javascript. So I'm not sure the problem is with Ruby as much as they way some programmers try to be clever, no matter the language.
Wondering too, how did you make friends in NYC? I'm finding it difficult.
How about existing home theatre systems, ideally several working together to create a false triangulation.
Does anybody have contact details for Chris? My wife is a journalist in Mexico and looking to get in touch. I have the admin@databreaches.net address
no, this is a treasure trove of AMZN links.
It's not misconfigured, this is how mongo is intended to work.