skysight-inc/HackerNews huggingface dataset:
I'm aware of your opposition to DNSSEC+DANE from previous posts here. Like others, I'll agree it's not perfect. Nothing is.

Verizon may sign the .com TLD, but that's fine: there are lots of registration providers that offer free DNSSEC support for you (eg gkg.net). Once you have that, you can convey your certificate hash securely, and thus you no longer have to pay some racketeering jackass company $100-600 a year just to get "*.yourdomain.com" in the common name field.

The current reality with DNS is that it's the wild west. All this emphasis on security and yet a DNS provider is entirely unencrypted and hijackable by anyone to send you to an alternate domain. If you haven't visited the domain before, even HSTS/HPKP won't help you.
I used the software, skype works fine it just doesn't have ads anymore and skype home whatever that is.

Msn domains are only subdomains that are most likely ads related

Watson is Microsoft report tool so "spying"

Hotmail no idea but I don't think you'd use the mobile website on desktop anyway and the domain is live.com now

Add to that, in the software there is a Open hosts file to see/edit it so you can remove whatever you don't want to block
I think the point is that hashing algorithms can be adjusted to scale with the increase in processing speed.
Cycript on steroids: Pumping up portability and performance with Frida
>But if I go from major version to major version, suddenly selling my MBP gets complicated, because I can only install the version that it came with after I wipe it.

That isn't true. You can install a fresh copy of the most recent OS.
It's api is based on mysql, doesn't share interals with it.

They had a deep dive into during the last re:invent.

https://www.youtube.com/watch?v=CwWFrZGMDds
Depends what branch of government, I suppose. For the NSA, sure. For anyone who works where most data is public or FOIA-able... I guess your biggest concern would be if Microsoft's spying managed to compromise the security of the network itself, which one would hope Microsoft is supremely motivated to not do, because they want you to use their products.

Nor am I confusing Microsoft with the government, but merely recognizing that in a backdoor model, the most interested party is probably the government.
The problem isn't that you have to pay to get DNSSEC signatures. The problem is that you have to trust the same entities as you did before, PLUS a bunch of new ones.

Why are we beating around the bush with this? DNSSEC is, on its face, a key escrow scheme. Why would we even consider adopting it?
LSTMs
It sounds like we're well balanced then.

Markets are efficient.
I totally agree, but in cases like Republic with a Crowd Safe, none of those options seem to apply unless I'm missing something. My question was for crowd funded smaller companies that have low potential of an exit - in those cases how is a crowd funding "investor" going to realize a return?
I use ABBYY for Linux:
http://www.ocr4linux.com/

Everything about it sucks, cost, anual page limit license, I can only run it as root for some reason, but the OCR quality is superb.

here's the scripts I use if it's useful:
https://github.com/cove/scanbd
> I have a game server written in Go.
Game engine != game server.

> Why not? I expect my typical GC pause times to be 1 or 2 ms under Go 1.7. But if my server had pause times of 20ms, I wouldn't care, so long as it didn't happen more often than once a second or so.

We're talking about client-side latency here. You've got 16.6ms to do everything in a game engine. Even 2ms is 1/8th of your frame and a significant amount of work. 20ms is two missed frames which is really bad.

The types of engines where work stealing and task based architecture are prevalent are usually of the AAA variety, where performance is critical and the scenes are either very complex or very large. In this space GC based languages have been limited in scope to gameplay scripting and even then are usually very fast(Lua or equivalent).
AFAIK, it doesn't. It will proxy all images through its own servers (and thus hide your IP), but it happens as your browser requests it and is not cached.
This sounds like sarcasm, but yes: solar collectors in close orbit around the sun, huge flying parabolic mirrors focusing solar energy that's already 7-10x more dense than it is at 1 AU, beaming that energy to receivers sitting in orbit around the Earth (perhaps at Lagrange 1 and, via L4/L5, L2 to reach the night side of the planet), relayed in to near earth orbit satellites, and being beamed down to many surface locations at safe intensities that might well be used to boil ocean water, driving steam turbines and producing fresh water (and salt).

Such a system could provide energy dense power to the entire solar system (skipping the steam turbine step for most locations, and going pure solar electric), up to large installations for entire planets, and down to individual spaceships.

I'm not suggesting we'll do it tomorrow. But within a hundred years, if we get and keep our shit together..?
Hey Elon Musk still sleeps in his sleeping bag at Tesla's production lines so... Chief Cook and Bottle Washer is never out of style.
Sure it does. You can see this from diagnostic commands (Innodb status, mutexes etc)
Infosec has struggled with 'good is better than perfect' - where good advice that is practical for most people is criticized for not being perfect practice that is often impractical.

Thankfully, now that there is a lot more public awareness of infosec practices - driven in large part by there seemingly being a big infosec story every week - a lot of the best practices advice has been loosened towards the more practical.

In terms of password management, I agree with you completely - the default advice should be to use an online password manager. I've got my partner and most of my family using Dashlane and with near 100% unique password compliance.

That type of adoption with regular users would never have happen had I stuck to "keepass, diceware and 32 character unique passwords" level advice.
They still push you critical updates that can break your computer a well know blogger had his mbp ethernet card "die" and few days later work again he found out that the breaking a repairing were from critical updates pushed without his knowledge.
You're right -- a company with $25M in assets and 500 unaccredited shareholders is essentially forced to go public. That's why traditional security instruments are poorly suited for investment crowdfunding. We created and open-sourced a derivative of the YC Safe called the Crowd Safe to solve for this (more at https://republic.co/crowdsafe).
It wasn't optimized for "people like it", it was optimized for ease-of-use and discoverability.

You could simultaneously hate it with a passion, and also be 3 times more efficient at editing a document while using it, and that counts as a success.
I'm starting to question whether or not Apple still notifies users prior to all renewals...

I have a handful of monthly subscriptions through the App Store, and currently, none of them notify me of the renewal before it occurs (I've checked my spam folder).

When I first subscribed to an app a couple of years ago, I received notifications before renewals (that sub was a 6 month or 1 year term, I don't recall exactly).

I also have an app that has offered subscriptions for almost 2 years. From end user reports recently (there weren't many issues about renewals until more recently), I'm getting the impression that Apple doesn't notify about upcoming subscription renewals unless the payment method Apple has on file is out of date, as we get quite a few emails asking about how to update payment information.

We would certainly be interested in finding out what others (both end-users and app developers) have found in their experience.
What do you do when you're traveling and don't have a laptop handy, but need to log in to Gmail on a public computer to email your family? Or just if you're traveling and have a phone (but not a laptop), and need to access your banking account?
> But if we take it as convivance and proper productive discussion of different, potentially opposite ideas, HN is not all that good.

I agree. But how could it be made better?
You wouldn't beam energy directly from near-solar orbit to the surface of the Earth; you would relay it to orbiting receivers around the planet, which would in turn beam it to the surface, and reaching the night-side as well as day-side.
The Future Isn’t as Scary as You Think (with guest Kevin Kelley)
A fully random 8 character password, using uppercase, lowercase, and digits, should still be OK today if hashed with bcrypt (or similar or stronger scheme).

I searched around and found someone posted some hashcat-ocl benchmarks done with a Titan X about a year ago, and it could do 14440 bcrypt hashes per second. So let's calculate how many "Titan X * days" are required to brute-force such a completely random password using that character set:

>>> (26 + 26 + 10) ** 8 / 14440 / 3600 / 24
175005

If you assume the best GPU today is twice as fast, and that someone has 8 of them in a rig, that's still 10 thousand days to search all possibilities, which means 5 thousand days on average until the hash collision is found.

For a typical user account, 5 thousand days of crunching by 8 of the most powerful GPUs on the market, is pretty good.

I personally go for 9 or 10 character passwords that include some symbols too, but are a bit less random ;)

Anyway, the biggest factor is to use a unique password for every account, because you can't guarantee that none of the websites you use didn't totally fuck up and accidentally put the original password somewhere, nor can you guarantee that they won't be hacked to the extent that the passwords are intercepted during sign-in.
Tech needs to decide which master it’s going to serve (2014)
I’ve been contributing to LibreOffice since it early months and have been asked nicely if some of my patches can be used by AOO to which I agreed and they were used. To date no one ever from TDF or LibreOffice ever complained or threatened me over doing that.
Markets are efficient. The value of a large selection of cheap goods (that even indigents can afford, mind you) is higher than the value of certain jobs.

Even if you are right 10 years from now (and you won't be), it will be because it increases net economic efficiency.
For the most part, because they pay attention to it, and because their business success depends much more critically on it. Look at the Lastpass hacks -- they were breached, but there was approximately no impact to their users, because their security model for password storage is sane. In contrast, consider, say, the Adobe breach, which leaked 150M passwords that in many cases could be matched to their cleartext quite trivially.

Most password managers worth considering do not store the users' passwords unencrypted (or ever touch them unencrypted). Instead, they use a master password known only to the user, followed by a computationally expensive key derivation (PBKDF2 or similar) to create an encryption key, and encrypt the passwords with that. They then use a different derivation path to handle authenticating the user to their servers.

It's a very reasonable architecture unless you're on the extreme end of paranoia. Notably, I have about four passwords I don't store in my password manager. But I'm very happy trusting it with my bank and financial stuff.

The reality is that getting people to use a good password manager with randomly-generated passwords, regularly, on all of their accounts and devices -- with 2FA for the important stuff -- is far more important than the slight extra security risks from using the online components of the good services.
Those are pretty neat. A decade or so ago I visited one being built on a 10' wide foundation ring of bearings. The motor to make the living room follow the sun wasn't installed yet so two us pushed this 30' wide flying saucer house around.
Latest Intel, AMD chips won't support Windows versions earlier than Windows 10
Paris climate deal: US and China announce ratification
The Global Consciousness Project
The Intel LINPACK distribution contains, besides the library, a sample benchmarking application using it, and that happens to be a very intense and "real" workload (solving systems of equations, i.e. scientific computation.) There's plenty of posts on various PC enthusiasists forums about how to run it correctly. (And plenty arguing that it's irrelevant, mostly because their insane overclock seems fine but instantly fails this test. There's a good reason most doing "real" scientific computing don't overclock; a lot of CPUs just barely pass this absolutely realistic test with stock speeds and voltages.)
Modern Software Development, Analyzed
Help 1/3 of all US K-12 schools use software at Clever (YC S12)
… an external library that is really easy to add. One line to Cargo.toml (plus another, “[dependencies]”, if you don’t have any dependencies already), one line to src/lib.rs and one line importing the appropriate trait to any module you wish to use `.par_iter()` in.
I can see how LO benefited from the original OO greatly, but AOO? Sure, LO has ported a bunch of stuff from there, but they wrote a great deal more from scratch (unsurprising, since that's where all the dev resources were).

And, aside from abstract good feelings, what benefit would having two forks of the same product, with no clear difference in philosophy (like you have with the BSDs, for example), serve? Sure, the licenses are different. But if LO guys cared about more permissive licenses, they would have just dual-licensed their own codebase.
WHISPER CHallENGE
STORY TIME: ACID REFLUX and COLIC
Formulae for Integer Factorization
Free as in Freedom Episode 0x5C: Basic FLOSS Concepts: Licensing 101
The only complicated part of this method is securing the key, and the key is definitely required or you may as well just save it as plain text.

You sync your DB across multiple cloud services, and to decrypt you use a weak master pass and strong key.

I've been struggling with how to move that key around.

.1) Put it on a USB drive or hide it in your filesystem.

This is cumbersome and losing the drive could be disastrous. It's also trivial to scan a filesystem for key-like files.

.2) Use an authentication dongle.

This one is better but requires third party hardware in most cases, and is slightly expensive.

.3) Bluetooth/NFC to your device.

This can be intercepted at extended ranges as proven at defcon etc. Though is admittedly the most convenient method. The data can be signed, but I haven't seen anything out there that implements this well just yet.

.4) Timed one time passwords, PushBullet etc.

This feels like a bonus feature.

I'm not sure how to go about this. You lose or leak the key then you're screwed.

Is there a wristwatch or phone app with signed credential sharing based on wearer input, compatible to a standard?
Exactly. It is made easier if you store the hashing algorithm and parameters used against each user record. As you increase the parameters, or change the algorithm, you can update user passwords on login.
There's a lot of negativity around recurring payments but I'm excited about this model both as a developer and a consumer particularly on iPad. There's been a race to the bottom in pricing in mobile app stores, where a one-time payment equivalent to a cup of coffee can be seen as too expensive for an app costing tens of thousands of dollars (or more) in engineer time to make / support. Maybe as a result of this there's no shortage of micropayment or advertising based mobile games but the productivity space is not very competitive with Mac/PC where people don't blink at paying 10x that cost up front.

If this can establish a middle ground where more app categories can find a sustainable business model including long term support and updates that could be very interesting, especially now that many apps might want to include cloud-based features where committing to support forever in exchange for a one-time payment might be a risky proposition.
It's an unfortunate side effect of FSF's fascination with being uber-precise around terms like "free" and "open". Because English doesn't offer sufficient nuance here, and Stallman really, really hates it when people get the implications that were not intended, he had to go look for, or create, a word that would be unambiguously "free as in freedom" (by FSF definition of freedom, anyway). And so he did - with the unfortunate side effect that no English speaker outside of that community knows neither the word nor the meaning.
> Worked well for Marijuana's temporary scheduling.

Are you saying that this same process has been used to permanently classify Marijuana as schedule I? That means you're implicitly claiming a few things:

* That the DEA issued a temporary classification on Marijuana that would've expired after 2 years.

* That the DEA has the power to - by itself - schedule a drug permanently. (If it went through Congress, that's a different process)

* That the DEA has the power to schedule Marijuana freely. In particular, there are no treaties forcing it to be classified a certain way.

* That the DEA used its power to freely classify Marijuana, and chose to label it as schedule I. (As a consequence, they could relabel it at any time.)

I don't know the history of marijuana or which of these is true or not. If all true, I'd like to see a different government agency do the classification(maybe the FDA? or some Congressional committee?) and the DEA do the enforcement.
License spectrum diagram
Wikipedia has an exhaustive article[1].

https://en.wikipedia.org/wiki/Entity–attribute–value_model#E...
Good question..
Git 2.10 has been released
Some other bits:

- Always profile first! Then go for low-hanging single-thread fruit. If you also parallelise later you'll get a multiplicative effect with speedup.

- Use task manager/activity monitor/top frequently to check what CPU usage your program is actually getting. If your code is using N * 99% (for N cores) continuously then you're doing fine. You should be suspicious if your usage has spikes, implying e.g. an IO bottleneck somewhere.

- Rule of thumb: parallelisation alone will at best give you a linear speedup. Super-linear speedup is possible, but only for very specific problems like linear algebra and even then it's usually some weird memory trick like you get more stuff happening in L1 vs RAM.

- Build some intuition for how fast your code ought to run. I've chased down many bottlenecks only to realise that the thing I thought was the culprit was actually extremely fast (I'm sure we've all done this). http://norvig.com/21-days.html#answers , but also make your own measurements of time required to save files, modify images, zip things, etc. You can catch this definitively by profiling, of course, but it's nice to be able to guess where to start prodding.

- On the flipside, learn to recognise when things are embarrassingly parallel and act accordingly. Here a profiler won't help you. Sometimes you're just lucky and you can get linear gains for free.

- Think about what level you want to parallelise. If you know that your single threaded code is as good as it gets, can you get away with running multiple instances of it? Often it's far simpler to write a wrapper than explicitly paralellising low-level code.
Cinnamon might be another worthwhile thing to try.
Poof will spoof location of your iOS device for Finding my Friends in the world
Have you ever dealt with actual non-techies on this?

In a week we learn, via HN, of the Last FM top 50 passwords (usual suspects, no surprises), and that 50% click on any link sent them moving the needle at all is more important than getting it to great.

I've come across many intelligent, successful, professionals who still reuse passwords, who still use child's name + random number for important things. Is using a book or online service a terrible idea compared to using steve36 for his domain registrar? What you call terrible at least moves the needle away from zero.
I'm not sure MATE can be treated as "Gnome2 under a different name" at this point. While it started as a fork, they're doing some pretty massive refactoring, like gradually moving to Gtk3.
Why does everyone make such a huge deal about a warrant canary when LE is clearly aware of them and a true gag order would obviously preclude you from removing any such canaries?
> let's admit it, one-time software purchases seem to be going the way of the dodo.

I don't think one-time software purchases are going anywhere. In fact, the more apps switch to ad-driven or subscription pricing, the easier it will be for (unique, interesting) apps with non-subscription pricing to market this to their advantage. I expect subscription-based revenue in the App Store will dry up for the vast majority of apps once users get over the novelty in a few years.

Plus, some software simply cannot be subscription based by definition. Most non-AAA games are finished works with only maintenance updates in their future. Who would want to subscribe to that?
This is great news. China is and needs to be a major player in all climate change negotiations.
Always been curious about what occurs "behind the scenes" in situations like this. Strange how airlines (and the flight attendants!) aren't held more accountable. Would have assumed the FAA would want to look into any in-flight medical emergency.
I understand the context, but 'fugitive slaves' bothers me.

I'd like to think more in terms of 'people who escaped slavery', as no one is inherently a slave - it is only a condition forced by someone else, and so a 'fugitive' is too from the perspective of a slave master.

If someone were held in slavery, then escaped into hiding, and then slavery were abolished, would they still be responsible for their 'crime'?

It is written that 'slaves were captured from west Africa' (not in this article, but in general topics about slavery) - No! PEOPLE were captured and ENSLAVED.

It's a simple change in how things are phrased.

Edit: I'm being highly pedantic for a reason. The way we phrase ideas and use language shapes how we feel about something. If we can feel a more human connection to these events, I believe we can have more empathy.
> println( System.exec( "tasklist.exe" ) );

Oh yeah, that would be pipe for Java, possible for a JSR?
[video] Introduction to Docker on Nutanix
This would definitely reduce the kafka slide, but it won't happen while public is this complacent.
>> The "enemy", lest we forget, is MSO, not any of the OO implementations.

If the purpose of the "war" is to increase userbase by stealing users from MSO, then having a single implementation that is broadly supported and has brand recognition is vastly preferable to the current situation with two forks, one of which has the branding, while the other one has the features.
http://wikimapia.org/26461282/Walter-Ray-Lockheed-A-12-Oxcar... covers this plane's crash site
and some pictures here:
http://www.dreamlandresort.com/info/crash_a-12.html
What makes public land not wilderness?
What a sad, disheartening tale.
With regards to the kit which was not aboard the plane, I have a few quick questions from anyone in the know.

Missing were:

- Aspirin

- Nitroglycerin

- Masks

- Fluid cleanup kits

- Airways

I'm assuming the latter three are one-time-use. I'm assuming the former two have expiration dates. Does anyone have info on how often these items might be used aboard flights and/or actually reach their expiration dates?

I'm asking specifically to see how much money is saved by not stocking up and simply assuming that the resulting lawsuits and fines are cheaper than keeping kit stocked. I simply can't attribute this kind of neglect to human error. Someone has to have done the math on this.
Gmail is the only password that you need to memorize. As for banking, not being able to log in without my laptop hasn't been an issue, but I can always call my bank with the weak phone password (but which includes voice detection software) and once authenticated have them do most types of things.

You're right though, it isn't perfect.