skysight-inc/HackerNews huggingface dataset:
Ask HN: Resources on how to safely make use of cryptographic primitives?
We all know we shouldn't roll our own crypto and that it's best to use well tested, audited libraries where possible.

However, for those times when existing libraries aren't suitable (or don't exist), it's important to get it right.

Where can I find some resources on safely and securely making use of cryptographic primitives?

I'm thinking about signing data, authenticating signatures, encrypting data (both symmetric and asymmetric ciphers) at rest, encrypting streaming data, creating keys, managing public/private keys, generating secure random data.

A lot of existing resources I've found are geared towards understanding and implementing cryptographic algorithms. Virtually every platform provides these in some form or another. I want to learn how to safely use them.
> Would it have been more tasteful to have them included in the base game?

I'd say so. I mean, well, it's like having a game about the Eastern Front in WWII with the Soviets on one side and the Hungarians and Italians on the other end, with the Germans as DLC. It may make a killing in Hungary and Italy, but it's bound to give a completely deformed version of the truth to anyone who doesn't known much about the original events.
Disaster stories sell papers, but the situation is not a disaster story. Rather it is the standard plot for development of new things. People see possible scarcity and react accordingly, far in advance of the non-specialists of the press figuring it out. The scientific community is and has been responding well to the threat of running out of antibiotics. In particular, new advances in mining the bacterial world - a 100-fold enhancement in that mining - mean that we'll be flooded with many new antibiotic drug candidates in the years ahead. For example, see:

https://www.edge.org/response-detail/26701

http://www.popsci.com/ichip-new-way-find-antibiotics-and-oth...

Antibiotics Malthusianism has the same problem as all other forms of Malthusianism, which is that people work to fix the problems they see arising in the future, and resources are far from static as a result.
You can filter what you are syncing or create a db per user and declare interactions with foreign data in their own instance, which will be executed according to permissions in the backend.

What I actually want is MeteorJS with neither MongoDB or the JavaScript backend, or PouchDB without Couch, or Jaydata + ASP.NET WebAPI with more open source compatibility...
Great work! Quite annoying actually. I finished my own implementation in Python at about 10pm last night, this would have been most useful. I'm no C# coder, but it's nicely readable, and this is a much better write up than I'm sure I could do.

If anyone who hasn't tried doing this before, the "official" BitTorrent spec docs, namely BEP-3 (http://bittorrent.org/beps/bep_0003.html), seem little more than a vague blog post turned in to a "spec". However, somewhat conversely, this has lead to is a wealth of articles describing how to do it.

The three guides I used were:

- A 2 part blog post which has a bit of a Python bent http://www.kristenwidman.com/blog/33/how-to-write-a-bittorre...

- The unofficial specs https://wiki.theory.org/BitTorrentSpecification, and

- An incomplete Python client https://github.com/JosephSalisbury/python-bittorrent

I didn't know of the RFC mentioned in the post, that would have also been really useful.

A lot of BitTorrent stuff for Python is remarkably hard to find in all the noise of Deluge, the original client, and libtorrent wrappers, but none that existed were sophisticated (or at least well documented) enough for my experiments, they have different focuses.

I never went as far as implementing my own BEncoder library, a billion seem to exist in multiple languages and install any BitTorrent Python library and it seems to come with their own copy. (I suspect due to the way BEncoder was bundled in the original client, see: https://pypi.python.org/pypi/bencode)

I also found a Rust implementation which seems not to compile, but is useful as I'm trying to teach myself Rust https://github.com/kenpratt/rusty_torrent I think the work to get it to compile might be minimal.
IIRC FreeBSD was making some decent progress on the workstation experience before Apple released OSX. Once that happened, a lot of the people working on that switched over and the efforts kind of died down for a while.

I haven't used FreeBSD on a desktop for years, but I've been told it's getting a lot better recently.
Building a Twitter Bot with PHP and Machine Learning
I've always had it as "Looks Good To Merge" -- we use it every day...
The Nexus 6P is probably the nicest phone I've ever used, and I have had the full gamut of mobile devices.

Articles decrying the death of Android are a dime a dozen and have been so for years, and I am convinced that every outlet has a few sitting in reserve to toss on the front page on a slow news day.

The mobile market is saturated, things ebb more than they flow right now, and some manufacturers will drop out of the game. I have yet to hear how this means that Android is in shambles.
Depends on if ignoring a high-assurance implementation is bad:

http://cps-vo.org/node/1577

Already bad if you wanted ASN.1 but can't get Galois's version. If you can get it, then choosing an ASN.1 alternative can be bad since it probably won't have a formal spec, verified parser, Haskell implementation, and so on. Probably a drop in correctness in some corner case vs whatever they made.

Note: I'd like to see them do a high-assurance JSON and/or XDR parser instead of just ASN.1. I know they did a Haskell-to-JSON library already. A strong one that extracted parsers or generators from a user-supplied specification with plugins for various programming languages would be nice.
I was toying with the idea of making it required to have some kind of ad-block enabled for people to read my blog.

Just some hand-crafted full page splash with a generic class name that would get caught by the most primitive ad-blockers.
If one is already using jQuery - https://jsfiddle.net/jw75xznb/

Yeah, it's incredibly crude but it is 3 lines and it took approximately 60 seconds.
Watched The Martian in the morning and then closed off the day watching NASA insert a spacecraft into Jupiter orbit. I'm on a NASA/JPL high right now!
Really hope Lenovo respond soon. Feel like I should leave my ThinkPads hibernated for now.
It would be cool to have a Bulgarian version of the US Government's 18F:

https://18f.gsa.gov/

They have public standards for government websites, server HTTPS configs, website user interfaces, etc. On GitHub!

https://github.com/18F
" this would have been most useful. I'm no C# coder, but it's nicely readable, and I'm sure this is a lot better written up than I could do."

I agree. I don't do C# but mostly can follow it. It also is well-organized presentation of much of a protocol all kinds of people keep re-implementing. They need the help more often than not. A great write-up.
I spent a month at one of the top US hospitals and I witnessed crazy unhygienic practices. The most common one is when the nurse assistant puts on gloves to clean the toilet and other items touched by bodily fluids and then proceeds to clean the food tray with the same gloves and often even adjust the IV lines. I got a lot of nurses angry by pointing this out (it must suck to hear someone else tell you that you're doing your job badly, but still). My mother caught a C diff infection. After that, I carried a clorhexidine bottle with me to the hospital and cleaned all surfaces that contacted food with it.
not the curve25519 based ones, the symmetric salsa based ones should be.
Includes an interview with YC's Qasar Younis.
Wow. It never occurred to me that optimizing for smartness might make the world worse
Starting with the X230 series of ThinkPads, Lenovo has used flash write protection to prevent "unauthorized" BIOS modifications. Owners of X220 laptops and below are able to reflash the BIOS to remove Lenovo's whitelist of WLAN/WWAN cards; the X230 models are currently stuck with Wi-Fi N and Gobi 3000 3G-only cards due to Lenovo's whitelist. Would this exploit allow ThinkPad owners to reflash their BIOS chip without desoldering and flashing with external hardware?
And basic math would disagree with you.

2.6 million people in the US will die every year.[0] How many of those die as a result of an act of terrorism? Of the 325 million people in the US, how many personally know someone who died in an act of terrorism?

The likelihood of dying from an act of terrorism in the US is 1 in 3.5 million.[1] The likelihood of dying from cancer is 1 in 540.

[0] ~325 million, annual death rate of 8 per 1k
[1] http://www.globalresearch.ca/the-terrorism-statistics-every-american-needs-to-hear/5382818
'Positive Results Are Better for Your Career'
More of Us Are Working in Big Bureaucratic Organizations Than Ever Before
Interesting bit form Lenovo's security advisory on the matter[0]:

> Shortly after the researcher stated over social media that he would disclose a BIOS-level vulnerability in Lenovo products, Lenovo PSIRT made several unsuccessful attempts to collaborate with the researcher in advance of his publication of this information.

[0] https://support.lenovo.com/us/en/solutions/LEN-8324
Android malware has infected 85M devices and makes creators $300,000 month
Congress is spending $400M on a ship the DoD doesn't want
The Mayans sort of did this: https://en.wikipedia.org/wiki/Haab%27#Wayeb.27
FBI completes Clinton email probe, recommends no criminal charges
Here's a list of possible solutions:

1. Ask for referral from people your trust, like your friends.

2. Buy locally in a physical store with a good return policy.

3. Buy from brands you trust.

It used to be Walmart, now it's Amazon; people will impoverish their local economy to save 50 cents.

Things I bought recently:

1. A rake. I chose the 5$ more expensive one that looked more sturdy and was made in Canada (where I live) instead of China.

2. A old generation smartphone. I chose Motorola G because it's a well-known brand and it had good reviews when it launched, two years ago. It's also got one of the longest battery time.

3. Jeans. I bought Lois Jeans at a local store because it's the last barnd I know of that is still made in Quebec.

Buying is also a political action.
FBI Statement on Clinton Email System
Glovo - Senior Front-end developer - Barcelona, Spain - VISA, ONSITE

Glovo is a Barcelona based start-up that is transforming the way consumer access local goods, enabling anyone to get nearly any product delivered in less than 60 minutes. And all through our Glovo’s app!
Nowadays, we are in Barcelona, Madrid, Valencia, Milan and Paris; but we are growing at full speed and our goal is to conquer as many cities as possible. The sky is the limit!
The way we manage our company is built in the belief that by giving a WOW service to our clients, we will be able to change the delivery market, and how we do it, is paying attention to all the details.
Glovo is like a new personal courier available to everyone that runs your errands immediately and on demand.
If you share our belief, and have a passionate heart, then we need to listen!

Senior Front-end developer. Javascript, python
Details are here: https://glovo.recruitee.com/o/web-developer
New Niger Delta Attack Claims Two Lives
It's less legislative work for them to do it this way (and more work for the programmer). What you want is less work for the programmer and more work for the legislator.
I wish webassembly was already here. I honestly can't wait for more language choice for targeting the browser DOM.

I believe this will bring a revolution in client side apps on the browser. Ultimately fulfilling the goal Java aimed for, but never succeeded at reaching.
A van is driving around London to try to get startups to move to Berlin
> "Not a category that provides any meaningful utilitarian value."

The point is membership of the EU is not what qualifies a country as European. Even if it's stating the obvious it's worth stating as some people seem to think being anti-EU is being anti-European.

Furthermore, the EU is not the only pan-European organisation. Heard of the Council of Europe?

https://en.wikipedia.org/wiki/Council_of_Europe

Or the OSCE?

https://en.wikipedia.org/wiki/Organization_for_Security_and_...

Both are important pan-European institutions, and neither of them require their members to be members of the EU.
If it comforts you, I used an upside-down SNES gamepad for a few years before ever touching a mouse. And today I use my mouse far more than any game controllers.
Which is actually owned by Amazon. But I don't know how much they cooperate internally.
Fedora 24 – It isn't for everybody, but then, it doesn't try to be
Raiden Network – High Speed Asset Transfers for Ethereum
America the Beautiful
(another author here)
I doubt you will find this specific anomaly in US or even Turkey (at least I see nothing in my graphs for 2014 Turkey presidential elections). I'd say this type of falsification is a reminiscence of the purely fictional Soviet elections with their 99% turnout and 99% for the only official candidate.
A similar pattern is seen, e.g., in Azerbajcan 2013 presidential election (dozens of precincts reporting identical, albeit in this case non-round, percentages for the incumbent).
Is actual artificial intelligence the next frontier for AI in games?
Cancer patient receives a 3D-printed jaw
You're absolutely right. It's the people involved that make or break the codebase, and transitively, the project itself.
Statement by FBI on the Investigation of Secretary Hillary Clinton
I'm not pretending I have the facts of what happened, but your rebuttal to "From what I can tell, she tried running away, they tried to stop her, and she fell to the ground hitting her head." is a quote of the person suing the TSA. Not an unbiased source in the slightest.

Presumably there are multiple angles of security footage to show exactly what happened.
An easy way to consider the combined effect of the timezone and DST is that solar noon for the western edge of the Eastern timezone is ~1:50 right now.

I think the (utter non) popularity of UTC for setting meeting times sort of points to people not being ready to switch to a single zone (they have had access to the convenience for decades).
Location: Moscow, Russia

Remote: No

Willing to relocate: Yes

Technologies: JavaScript, Typescript/ES6, Backbone.js/React, node.js, grunt/Gulp, D3

Résumé/CV: http://goo.gl/zWsyoe

Email: g.polush.kin@gmail.com

Github: https://github.com/proll/
BookMyShow raises $90M led by Stripes Group
Thanks. May be next time I should describe myself as Social Democracy then.

Most people hate socialist. Which I describe myself as being one. I am all for national healthcare and education. If it wasn't Obama I would not have known there are countries without healthcare. Same goes to education. Although tuition fees for university is debatable.

I could not understand why even healthcare is on socilist side. May be capitalist should also get rid of Police, fireman etc these kind of public services?

But I am all for free market with hopefully minimum restrictions.

what exactly is left, what exactly is right?
Humans have several millennia of evolution "touching things" for tactile feedback. Mice on the other hand are a relative (and quite useful) hack compared to that. It requires training and a different mental dimensional model to use. To a child growing up with modern touch screens, a screen without touch is the aberration and "broken". Mice may not disappear entirely, but certainly more and more screens in our lives will support touch interactions, even on desktops and "non-mobile computers", simply because it requires less training and feels more natural ("touch the button" versus "move the mouse to the button and click" may not seem that different after decades of mouse usage, but are very different experiences to an untrained person). There's a sense already today that kids growing up with tablets find mice strange and annoying ("Why can't I just touch that?"), and it's easy to wonder watching today's kids if mice will last for more than a footnote in history and in increasingly small niches that require "headshot precision" like games and maybe CAD.
FBI to recommend no charges for Hillary
FreeBSD has the "pkg" system now, which has binary distribution with dependency management.

Of all things, the lack of a distinction in Fedora/RHEL of "requires vs. recommends" is frustrating, coming from Ubuntu.
TSA agents are not police officers, despite what they may tell you. There is no reason to bring racial nonsense into this.
Is It a Leap Year Right Now?
Most likely not; the flash protection is not done by the firmware, but by the Intel Management Engine and a public key burnt into silicon (Intel Boot Guard).

The current exploit only runs far later, after the validation is performed. So unless you manage to mangle the code execution flow of the authentic firmware to the point that it skips the whitelists, you can't get rid of it.
Read the note that I wrote, please.

I add it again here:

[0] Sure, there's an attack on occasion. But you're more likely to die choking on a soda watching GoT.
"To be clear, this is not to suggest that in similar circumstances, a person who engaged in this activity would face no consequences. To the contrary, those individuals are often subject to security or administrative sanctions. But that is not what we are deciding now."

In other words, "don't think that because Hillary can get away with it, you can, too."
I don't use a DE, but I've used the tiling WM i3 for years:

https://i3wm.org
They do. Sort of. Amazon Vine is the system you're looking for, I don't believe the reviewer gets paid directly but they do get the thing they've reviewed for free (presumably they could then go on to sell on Ebay or indeed Amazon itself). Amazon also points out it was a Vine review when you're scrolling through which is great as it means you can more easily ignore the biased reviews.

https://www.amazon.co.uk/gp/vine/help
Why not make it distributed? Git is distributed
While NaCl/Sodium does simplify the crypto aspect in particular, it's dangerous to assume that it entirely solves the broader problem of writing secure code. Implementing anything securely is hard enough before involving crypto that the level of expertise required doesn't change all that much. (Most catastrophic vulnerabilities in security software aren't directly in the cryptographic implementations.)

Even using NaCl, one needs to understand enough of what's happening under the hood to properly reason about the security of the whole system they've built.
I think this exploit requires local administrative access. If an attacker already has this, you're pretty screwed to begin with.

In other words, while this could definitely make an attack more damaging and harder to remove, it doesn't seem like a reason to stop using a computer that has decent software and physical security.
They all come to prepare moving stuff over to the eu :)
I got the impression that Xamarin was going in that direction?
Learning how to raise cattle on floating ocean platforms in a country with 2/3s of its land threatened by ocean flooding sounds like a solid plan.
Yes. DST reduces the risk of car accidents, and the rate of robberies and violent crime.

For example: http://www.businessinsider.com/robbery-rates-drop-daylight-s...
FBI says it won't recommend charges in Clinton case
It is awesome that you are still going on.

Do you make a living on open source or it is something to keep you engaged.
Most people wake up with just enough time to prepare and go to work to arrive on time. They go to bed at whatever time gives them enough sleep given the time they'll wake up.

For your example, imagine it takes you 30 minutes to get ready in the morning, and 30 minutes to commute. You wake up at 8AM, leave at 8:30, arrive at 9. You get done with work at 6PM and return home at 6:30PM. You go to bed at midnight, giving you 8 hours of sleep.

Without DST, the sun rises at 5AM and wasted on you for three hours until you wake up at 8AM. You then return home at 6:30PM and benefit from 30 minutes of sunlight at home.

With DST, the sun rises at 6AM and is wasted for two hours. You get 90 minutes of sunlight at home after work.

Yes, the total amount of sunlight is the same either way, and you could rejigger your schedule to take advantage of it. But people don't.
it's used more generally than in code. eg design doc review you'd say "LGTM" to say that there are no suggestions.
I looked up a few things to check if they are worth buying.

Nope, no real discount. Already priced in :(
They used to do that.

Then trains were invented, and it became a pain-in-the-ass when every damn city had 12:00 noon at a different time. And then time-zones were invented and life became sane for the east-west travelers.
At this point I would go so far as to say that the time zone system is an archaic hack. If we want to do things with respect to sunrise and/or sunset we can just do that and use UTC for everything else.

Note that solar time can be determined with a small algorithm based on latitude and longitude that can fit in small embedded devices. The only remaining question is; what location should be used?
In my experience, most pricing "errors" come from the listing owner/creator changing the SKU or quantity set on the listing. When this happens, it takes us a few days to catch up with the listing or remove it entirely if we think it's low quality (meaning we think it's a pack of 100 and it's really a pack of 10). This can become even further complicated when a listing changes right as velocity comes on for it as well. We basically have to forget what the listing did before so we can price it accordingly moving forward.

Pricing can also be a direct result of a velocity + stock calculation. If we are running low on FBA stock and don't have a good supply for the item ATM, the system may use a not-so-great source price on the item to calculate what it will cost us to refill stock. Sometimes items move around, or we lose suppliers for items, which cause the system to adjust the price accordingly.

If you are searching from Amazon proper (not our store) for those items in question, it is very likely Amazon won't show you our listings on them because of the price delta.

I would note we definitely utilize customer feedback to constantly improve our system's accuracy.
T450S user here. What exactly does this mean for me? I get it's a security issue, but that's about all I understood...
Manual means "a thing operated or done by hand rather than automatically or electronically, in particular." It is very strange to me that you've decided the manual means: non-dynamic tracking of object lifetimes.
And then there were 15 competing standards.

I really, really want one single thing to succeed, but since the major distributions have decided to up and go there own way, there is no standard, and I don't see how we will be in a better place by adopting these.

Nix and Guix are awesome, but even there, we have two competing tools that operate similarly.

Do we need Torvalds to step in and throw a gauntlet?
I don't think there's an ideal size. I've started scripting away problems using Greasemonkey [Firefox] or TamperMonkey [Chromium]. A sample Greasemonkey script that changes the font size on this page:

// ==UserScript==
// @name example_fontsize
// @namespace com.kludgecode.hn.example
// @include https://news.ycombinator.com/item?id=12036162
// @version 1
// @grant none

// ==/UserScript==

/* Select Comments */
/* Make $target easily accessible for interactive debugging */
window.$target = document.getElementsByClassName("comment");

for (var i = 0; i < $target.length; i++)
{$target[i].style.fontSize = "15pt";};

Replacing:

// @include https://news.ycombinator.com/item?id=12036162

with

// @include https://news.ycombinator.com/item*

Will change ~font-size~ on all the pages for individual stories.

Good luck.
The most likely outcome of this for me would be that I would quit and go backpacking. :)