skysight-inc/HackerNews huggingface dataset:
Well, the Go implementation of P-256 is meant to be constant-time, even if we don't get a hard guarantee that the compiler won't screw that up somewhere somehow. On the other hand, the generic implementation of the other curves is almost comically vulnerable to timing attacks---compare [1] to [2].

[1] https://github.com/golang/go/blob/master/src/crypto/elliptic...

[2] https://github.com/golang/go/blob/master/src/crypto/elliptic...
Postmark pointedly uses shared IPs - for transactional email - I would be interested in thoughts on their rationale.

https://postmarkapp.com/blog/the-false-promises-of-dedicated... (Edit to add url)
This is either a descendant, or not, of a story first published in Astounding Science Fiction (now Analog) in 1946 by "Dalton Edwards" entitled "Meihem in Ce Klasrum."

Link http://english-zone.com/language/mayhem.html. Eg:

In 1946, for example, we would urge the elimination of the soft "c", for which we would substitute "s". Sertainly, such an improvement would be selebrated in all sivic-minded sircles as being suffisiently worth the trouble, and students in all sities in the land would be reseptive toward any change eliminating the nesessity of learning the differense between the two letters.

In 1947, sinse only the hard "c" would be left, it would possible to susbstitute "k" for it, both letters being pronounsed identikally. Imagine how greatly only two years of this prosess would klarify the konfusion in the minds of students. Already we would have eliminated an entire letter from the alphabet. Typewriters and linotypes kould all be built with one less letter and all the manpower and materials previously devoted to making "c's" kould be turned toward raising the national standard of living.
The curve describes the (approximate) outcome. It doesnt prove or disprove how brain processes work. What we do know is that the outcomes are related to both these curves and simple ratios.

For me it seems logical that the brain (as a well established pattern matching machine) is probably doing something far more primative than calculating exponential curves. But if thats your view i cant disprove it.
Containers rated more secure than conventional apps (Gartner research note)
No, consistency is what matters. If you can get away with working with localtime then there's no reason to opt for the faux-universality of using UTC instead.
Show HN: Pokémon Go server status
Paralyzed Muscle Movement Can Be Restored Through Repeated Stimulation
Google employees formerly were not allowed to use React but now are after the patent grant was changed (in response to their feedback). I know of several teams at Microsoft using React Native, so I assume there's no concern there either.
Make WordPress Work with Instant Articles
How a Technical Co-Founder Spends His Time: Minute-By-minute Data for a Year
I don't know if anybody thought the same thing but it was so nice to see the pocket monster people hunting a Vaporeon after what we saw in Nice.

The crowds of people in the videos were so completely different it is hard to put it into words.

https://www.youtube.com/watch?v=_hUdj7mgpHw

More of this please!
I work on React.

I'm not a lawyer so I won't try to paraphrase the license -- I actually think the wording is pretty simple already -- but to be clear, only the patent grant might terminate if you were to sue Facebook; the BSD license that the code is provided under remains valid regardless.

The author's claim that Google and Microsoft employees are unable to use React is false. I know there are teams at both companies using React and React Native. (It is true that Google was not happy with an older version of the patent grant, but we updated it in response to their feedback.)
Yes, replace all (no longer) patented gifs with (not so) patent free h264, vp8, and vp9 videos!
I resemble that remark...

I use MailChimp to keep in touch with customers. They love it.
Yes, although the Church of GNU is pure, even St. Obnoxious is a mere moral and guilty of the same original sin as the rest of us.
You forgot to mention that the "60s musician" is Elton John.
The article is about censorship, not the story being censored.
Gladwell is a well-known hack and has a terrible reputation in journalist circles for the shilling he did for tobacco companies while being paid handsomely for it.
UK Man Found Not GUILTY of Sex Offense Must Give Cops 24h Notice Before Sex
I think investing in "propaganda" would be a good start. However, we don't need to do that for any other part of the government which really is a smell.
Fairly obvious to HN readership, but not to the general public or to lawmakers, judges, and juries.
This seems like the open source licensing equivalent of mutually assured destruction with nuclear weapons. If Facebook were to aggressively pull the rug out from a competitor because of React licensing, I think the effects for the industry as a whole would be far worse than the threat some startup posed to them.
DDG has many sources of information, and applies its own layer of spam filtering as well, so they are not at the mercy of Yahoo's censored data.
He adds "Elton", which is enough to guess or search for an identity.
Also can't touch computers and fridges etc. with internet connection.
Just curious, do you know which specific teams at Google are using it or just that there are some?
s/resemble/resent
First image released from world's super radio telescope
Not altogether different from tech. today. Ie. Year 1 nobody owns a light bulb, so sell an incredibly efficient bulb. Year 10 everybody owns bulbs so cheapen the product to increase sales. While today we have incredible free service to grow market, then when the market had matured and growth falls and lock-in is complete reduce service to monetize.

Somethings never change.
I read everything I could find on the Anti-IF site and didn't understand what the mission is exactly.

I have a similar problem, in that every time I try to understand the perspective of functional-programming advocates, I find that the authors always seem to illustrate their points with examples like this:

match :: String -> Boolean -> Boolean -> String -> Bool
match pattern ignoreCase globalMatch target = ...

If I'm already literate in Haskell or Clojure or Brainfuck or whatever godawful language that is, then chances are, I'm already familiar with the strengths of the functional approach, and I'm consequently not part of the audience that the author is supposedly trying to reach.

So: are there any good pages or articles that argue for for functional programming where the examples can be followed by a traditional C/C++ programmer, or by someone who otherwise hasn't already drunk the functional Kool-Aid?
Not sure, sorry. I know that the Firebase team was interested but I'm not sure if they ended up using it.
> I'd love to see what ways of programming tend to be most effective with production teams.

The one the whole team understands and can agree upon.
White rose is fascinating -- his obsession with time comes across to me as a very insightful attribute to associate with a hacker in a Confucian oriented society -- I wonder if social hacking a great harmony society would tend to involve a lot of precise timing attacks. And the name is great -- perhaps referring to the anti-nazi protest movement in Munich -- a subtle reference to an existence proof for the possibility that a "hacker movement" could be deemed "correct" to oppose the existing paradigm in which its embedded. And it's great that he's Chinese -- we are so conditioned in the west to think of "Chinese hackers" as only and always state sponsored black hats. How strange that preconception given how noble a calling we should perceive there to be for "hackers" operating domestically in China -- to tweak at what we perceive as an often overly authoritarian regime. It made me feel a startling lack of examples in western media of "good guy" Chinese hackers. The realization has me always looking to find ways to try to establish trust with the white rose character. Not sure if he should have it, but I hope he is revealed to deserve it.
https://news.ycombinator.com/item?id=12106452
How does extradition apply as there is no person to be extradited? The feds would also not be able to legally search because of this little thing called the fourth amendment and the fact that there is no court sanctioning the search.
Here's some more discussion from a previous HN submission:

https://news.ycombinator.com/item?id=8985541
I'm not riled up, just curious.
This article paints a very dire picture for the future of Intel.

It is very telling that an organization as capable of Intel was not able to foresee the decline of their profit engine and pivot correctly before they had to take drastic choices like mass lay-offs.

I wonder what the future for the semiconductor industry holds if Intel falters. I think we'll see a dominance of x86 chips for the next 5-10 years but in the mean time there's a lot of ground for others to cover.

Perhaps we'll see competing organizations started by these jilted ex-employees of Intel. I think that Intel is wrong to discount the experience and ability of their older employees.
The function here has a simple continuity, so there is no risk of narrow peaks beyond some computable threshold. The challenge is the high dimensionality.
Ha! Did not expect this.
You can go a long way without Ifs in a pattern-matching language like Prolog or Erlang, too.
Automation and the Gig Economy
"censoring the whole world in obedience to the UK injunction"

Google censors the whole world to avoid annoying the Pakistani government and Islamic pressure groups; no injunction required.

http://lee-phillips.org/youtube/
Stallman doesn't seem to know these things, though. Perhaps he's so far removed from society as a result of his arcane computing choices that he's been unable to remain cognizant of the way the Internet works now?
Spy or whistleblower? Should Obama settle with Snowden?
Wait. Stop. You are writing your own crypto.

AES keys are 256 (or 128) bit, fixed size, and should be random-looking data. The code here uses [32]byte intentionally so you won't use anything else.

If you have a password instead, that is NOT suitable for use as a key directly, whichever the length, because it has low entropy by definition. So you want to stretch it (and whiten it) with something like scrypt. It's a bit of the same argument as password hashing.

Also, you don't want to discover what happens if you have strong patterns like padding in your key (it should be fine, but it's the kind of attacks that come before a full break). And you don't want to cut short a password longer than 32 characters.

This is the issue, btw: https://github.com/gtank/cryptopasta/issues/7

Don't copy-paste crypto from HN.
Something about horseshoes and hand grenades.
I'd love more data on this too, but I do think it's worth pointing out that it's pretty uncontroversial that the more control flow paths you have, the harder your code is to reason about. That's the basic assumption of the notion of cyclomatic complexity, after all.
You're presuming that Wheeler would have behaved exactly the way he has without the criticism that was leveled at his appointment. I'm not sure that is accurate.

I do not at all regret my assumptions about Wheeler or my criticism of his appointment. He has been much better for consumers than expected, but he has hardly been perfect. There is still no real competition in the US for broadband. Broadband innovation has been basically nil for most US consumers. Broadband and wireless pricing are both at gouging levels for most US consumers as well.

So while, yes, he has done some good things for consumers, it has largely been in the form of protecting the status quo rather than pushing the needle.
I'm not sure how either of these would help:

- validation: Fundamentally, to be able to trust the input, the server needs to validate it in its final state. The only reason validation should be done on the client is to reduce the latency from the time the user inputs the data to the time the validation result is reported, so the user can fix their input faster if it fails validation. Sending it to a URL before form submit doesn't make sense when the input will have to be validated after form submit anyway.

- autocomplete: It's unlikely that implementing this in native code will be faster than in Javascript. It's not significantly faster to make an HTTP request in native code -- native code is more advantageous for heavy computation, graphics, and multithreading. And yet, it's easy enough to make HTTP requests from Javascript that an autocomplete attribute wouldn't add much value.
I know! That's why I am asking. I have found surprisingly difficult to find a package that does this.
There's a really good Stephen J. Gould essay on exaptation titled, "Exaptation - a missing term in the science of form"
I get what you're saying, but that's definitely not what good writing means in the context of, say, poetry, or literary fiction. Programming is best compared to technical writing or cookbooks, I think.

I realize this is one of those irritating "actually," replies, but what can I say, I'm sensitive about this topic. =)
I think that perspective of exhaustion with contrarianism is part of the problem. There an excellent quote, which is "the amount of energy needed to refute bullshit is an order of magnitude bigger than to produce it."

It is really really easy for someone to write some BS (online or in print). Books and newspapers do it routinely. Blogs do it every day. And of course people on online forums do it every second. Unless you just write "You're wrong," it usually takes a lot more effort, volume, and words to refute the BS.

So yes, it is often intellectually easier for people to be contrarian, but only because there is so much BS out there to refute. And it still takes more effort and volume to do so.
I think I used it correctly. I assert that MailChimp is not spam :D

I ignored the rest of it.
DDG uses it's own crawler and algorithms
Interesting article. When I have trouble falling asleep, it often seems as if there is part of me that wants to fall asleep, but it is stuck and the part of me that wants to stay awake is keeping the sleepy part from getting what it wants.
The human brain is an amazing thing, and the particularly amazing thing about it is that it's a very general-purpose thinking and learning machine. It's this generality and the ability to learn that allows people to become programmers, entrepreneurs, physicists or mathematicians, and large amounts of time spent practicing is what enables the specialisation.

But the interesting part is they all started out with essentially the same hardware, and I don't believe there is any part of the brain where you will find a 'natural' aptitude for entrepreneurship, or programming or whatever. Evolution just gave us a general purpose tool that can be moulded to whatever purpose.
Great read and serving 2500 hits/sec for $15 is awesome! Even better: in Digital Ocean you could have a snapshot of your server and if needed deploy another node in minutes.

Off-topic: how does rebuilding the blog's menu/index works with Jeckyll? Say you add one entry under home/foo/bar and you have hundreds of pages. Will it actually re-create hundreds of html pages to update the navigation? Or does it use some sort of HTML include/JS magic?
Also, 80% (often 90%) are reads and 10-20% are writes.
That might be a useful tactic but it would require a lot more work to implement than current/existing solutions...

Let's say a remote mail server connects to mine to deliver an e-mail purporting to be from example.com (your business, which has an EV SSL/TLS certificate for the example.com web site).

The first thing to be done is to somehow verify that the mail is legitimately being send by the company. The best way we have to do this presently is via SPF and DKIM. We query DNS and the IP address of the remote mail server is listed in the TXT RR, so the SPF check passes. We query DNS for the key that the mail is DKIM-signed with, and that passes.

Now what? At minimum, we have to do another DNS query for the A RR for example.com, establish a TLS connection to example.com, retrieve the presented certificate, verify the certificate is valid (date, hostname match, etc.), verify the certificate is chained to a trusted root, and -- somehow -- check that the presented certificate is an EV cert. I don't know enough about EV certs to know if there's an easy, programmatic way to verify that a cert is EV vs. DV, etc., but let's assume that there is. There's also revocation/OCSP, etc., checks to be performed. And so on...

What you're proposing might work. That is, a company with an EV cert is probably unlikely to be sending out blatant spam, but I don't know of any existing tooling to do these types of checks. If it existed and were easily integrated, I would at least be willing to test it and see what the real-world results were (and it would be much more likely to become an acceptable tactic to use for distinguishing spam from non-spam). A plugin for amavis and/or SpamAssassin would probably go a long way towards making this happen.

All that said, do CAs publish lists of EV certs? It would be relatively easy to import a list of domains with valid EV certs and then say "if mail from one of these domains arrives with a valid DKIM signature, assume it is not spam".
Ah, okay, I found this: https://en.wikipedia.org/wiki/Automatic_meter_reading

Looks like there's some variety in how meters broadcast, though. Is there some way to tell by looking at the meter which technique it uses? Do you support both DSSS and FHSS?
It would be nice if the author provided some actual evidence for sweeping claims like "modules are far better than objects" and "the world is converging on ML as the language of choice". If there really is evidence, that would be great to hear about. If there isn't then these statements seem a bit self-serving.
Title should be changed to "Cheat at Pokemon Go from your mac"
Ask HN: Build services for compiling iOS apps?
I don't own a Mac computer but am using a cross platform framework which generates XCode project files. Can I pay for an external service to compile these for me and perhaps release them on TestDrive or the App Store?
An internet search yields some results, but I'm mainly asking for your experience of possible pitfalls for setting up remote build systems for this platform.

Much like https://unity3d.com/services/cloud-build, except I am using Nativescript, not Unity.
Wow, I completely missed that (largely because I assumed a Go implementation could not guarantee constant time), sorry about that and thanks for looking deeper than I did.

On that note, how much of a guarantee is there in the Go implementation? I assume in most cases it's going to be constant time, but isn't that a little harder to guarantee when compared to the asm version? And if not why not just use the Go implementation everywhere for consistency?
> Everybody who does PL theory more seriously probably knows that, but I didn't realize how close type inference and prolog-like systems look.

Yup! This is more to do with a very specific part of type theory - ie. 'type reconstruction' (more commonly referred to as 'type inference'). One of the most notable examples of this is the so-called 'Hindley-Milner type system' which can be proven to decidable. Here is a good explanation of the constraint-solving algorithm: http://jozefg.bitbucket.org/posts/2015-02-28-type-inference....
If statements are code smells in languages that are not strictly imperative. Is an if statement literally the only option? If not, that's a "Bad If."
Microsoft Orleans – An approach to building distributed applications in .NET
The articles from Chuck Jazdzewski made my day. I sometimes wonder what the early members of the Delphi team are working on today. Thanks for sharing the link!
Earn Crypto-Currency by Chatting
... Kafka is so good Microsoft paid $26B for it :)
>You do realize that not all water goes to the plants you're targeting, right? Some of it will run off and/or water other plants that you're not harvesting. That was my point about the water.

Yes. And that does not matter at all, which is what I said.

>The burden of proof is on you to prove that virtually all gardeners have sprinklers (the automated ones, anyway... we were discussing automated irrigation systems).

You said they don't have irrigation systems, not that they aren't automatic.

>And even in that case, you need to get rid of the nitrogen build up somehow: either frequent water changes, or bio-filtration (which is a form of aquaponics).

Trying to pretend normal aquatic plants existing in a normal pond is the same as your aquaponics system, and thus your system "wins" is disingenuous in the extreme.

>Sure, it's cheaper when you have organic waste available for free in a convenient fashion (i.e. not something you have to haul from your city's waste center).

How is hauling it from your city's waste center more expensive than your $500 setup exactly? A truck rental is $20.

>If you want to grow fish and veggies in your backyard, aquaponics really is the best choice.

For some people it may be, but this insistence on making unsupported sweeping claims reeks of snakeoil salesmen. I grow fish and veggies. It costs me $0. How would your system be better?
I'll bite :-) In the US, healthcare costs for a family of 4 with constant/heavy utilization can be anywhere from $0 to about $30,000, mostly depending on income. The actual care received is comparable in any case.

Of course any analysis which only looks at personal spending on premiums and out-of-pocket expenses without also looking at tax rate and the percent of those taxes which also went to healthcare costs is, I think, fundamentally flawed. For example, "Healthcare should be free for everyone!" †To be funded by a new 10% income tax.

Finally, without also adjusting for public-sector healthcare R&D costs as well as cost shifting to countries more willing to subsidize private R&D, then... well, what exactly are we even comparing? ("Healthcare here is so cheap, we pay generic prices for all the latest wonder-drugs! So glad we benefit from all this great R&D everyone else is funding!")

In short, your data point tells me nothing about what people in NL are really "spending" on healthcare, as well as to what extent the "lower" costs of healthcare in NL could be a result of freeloading on other nation's R&D.
Unfortunately, as illustrated here and in many other places:

http://www.bloomberg.com/features/2016-obama-anti-business-p...

The democratic party belongs to the 3rd category and the republicans can't pick between 3 and 4. For most parties worldwide the same goes. 1 and 2 only occur in the movies.

Also, worldwide, a majority wants :

criminal punishment for non-standard sexuality

non-equality between the sexes

no free speech (a large majority is against free speech as it exists in America)

and very significant minorities want to kill

freedom of religion

equality between people of different religion

...

The obvious problem is very simple: internationalism/globalization is a slight benefit in the short term, and a long term disaster.
Why age in software is bullshit
That's a little unfair. Dan Brown gets everything wrong.
Indeed, I see connection attempts everyday from mail servers on SES, Mailchimp, Sendgrid, etc., that are blacklisted. That mail will never get delivered to my customers, even if it's 100% legitimately non-spam.
Not if their paycheck depends on not understanding it.
> The two big psychological negatives of city living, social isolation and social threat, are already well studied in mental health.

I'm not familiar wit the the term social threat. Is anybody able to elaborate on the meaning on this term in the given context, or link to an explanation.
That is not what constructive is.