skysight-inc/HackerNews huggingface dataset:
There are basically three kinds of ciphers:

* The kind, named "AES", that are implemented in hardware on a bunch of different mainstream platforms.

* Ciphers that were designed to be fast on general-purpose CPUs (for instance: that have good multipliers) and are thus cycles/byte competitive. Salsa/Chacha is the best-known example here, and currently only one with widespread use (this used to be the bucket RC4 was in).

* Ciphers that nobody uses unless a government mandates it.

There might be a case for having two bulk cipher specs, one for hardware acceleration and one for software. That's how eSTREAM did it.

There's really not much of a case for standardizing, or really even adopting, other ciphers.

Things are different in signature-land, or key-agreement-land, or even hash-land. They're definitely different in AEAD-land. But for bulk encryption primitives, we may be at a happy place already.
https://news.ycombinator.com/item?id=12763501
Sure, but how is that any less secure than other installation alternatives? As the site owner, I could swap out a valid package for a troll package at any moment to any subset of users I wanted to if they're not validating the contents of it...
If that arrangement were legal and accepted under leases, which it isn't, the value of a lease would appreciate significantly and housing prices would rise accordingly.

And what's to stop the landlord from putting that apartment on Airbnb permanently?
This is true, but in fun hypothetical talks with various tech friends over the decades, we often talked about in relation to Internet services in particular, taking down services and such can actually help with hacking (i.e. stealing data) efforts. How? Why? Firstly, probing as the article mentions does yield plenty of valuable intel which is the core for espionage.

Secondly, we often joked that companies have such flawed backup and response procedures that triggering these things has a funny effect. More specifically, a lot of times in our experiences, we saw things like backups, up-scaling servers, etc. go noticeably unmaintained or poorly attended. A lot of people, especially years ago never did a great job of testing their backup systems, failovers, scaling, etc. and kept them up-to-date and secured as well as the main stuff. It's more interesting in some ways in this world of containers and VMs. One would assume things are updated, patched, and deployed exactly inline with the mainline stuff, but that's not always the case. It often takes only one slip-up and this is where a ton of people make mistakes for so many reasons. And sometimes it's easier to manipulate the protection systems to be the vector itself than the systems they are protecting.

That is to say, messing around with services sometimes can be a way of creating an open front or back door. Especially if there's malware and things that can be planted that will be less likely to be caught in the panic or otherwise deployed as a result of the panic response.

Of course all of this is more unlikely, but it's fun to think about in the same way stupid schemes that are similar in heist movies are fun.
And leaves itself open to huge injustices.

Like the fact that the HOA can lien your house for as little as $100 in dues.

And can then sell your house out from under you.

If you're _really_ unlucky, they'll sell it to a landlord who sits on the board of the HOA, and the board of the HOA will accept the sale for less than half of the market price, with the landlord buying the house being one of the deciding votes...
Google will be your enemy, and one who knows you a little too well
I had this conversation with a person on reddit just the other day. After I pointed that there is no difference between piping a script directly into bash and downloading a package and installing it, they told me that they can audit a script/package they download and that they have personally audited every bit of code on their linux box. The kernel, gnome and metasploit.

I got to thinking what it would take to do such a task, and mainly what I came up with was a whole damned lot of time. Assuming a person can read, understand and remember 5000 lines of code per day (which honestly I think is way more than is realistic), it'd only take 8.5 years to audit the linux kernel. Add in all the other stuff and I figure something on the order of two decades. And in the end you'd be running two decade old software or you'd have to start over.

At the end of the day, security comes from the personal and corporate economics of reputation, profit, and prison avoidance. Do your best to get your stuff from people who you judge to be trustworthy and rely on their own self interest to not be malicious and to do their best to protect their repositories. And rely on others to be good citizens and report the bad shit that happens to them so that things can be cleaned up.

Now I'm not saying to throw out security best practices, but people should be aware that the quality of their systems are built on trust in human nature and self interest.
Digital Media Recommendations for Kids
> - Finland (yes, Finland) is increasingly worried about Russia. They violated their air space, and they're questioning Finland's independence. Finland shares a long boarder with Russia.

Finland isn't worried, they have had stable relations for half a century as both sides agreed to not mess with each other. They have even refused to join NATO because it is actually safer for Finland and vice versa.

Cowboys with missiles stationed on Russia's border making hyperbole statements (like you do) - now that would be a real threat. (the same was also true the other way around with the Soviets stationing missiles in Cuba)
I'm CTO of an edtech company and I'm quite excited to see this list- outside of specialist VCs like Reach and Learn Capital, the typical level of understanding of these nuances by investors is shallow. This will up the game.

However there is one glaring absence: I don't see a recommendation to show provable academic results. You could follow all of these snd still have an ineffective product that doesn't actually advance student learning. Hopefully that will change as schools demand more data driven results from their vendors.
I was actually told by one company I worked for previously to not respond to candidates I interviewed. Needless to say I'm not working for them anymore.
Tourism resulted in 45 billion spending. That number even ignores figures from people that travel there to do deals with companies, etc.

https://en.m.wikipedia.org/wiki/Tourism_in_New_York_City
Things will never be perfect as it is a huge company, but thanks to Satya teams are working a lot more together
anyone try the phone numbers?
How is this different than say, brew install <whatever>?

I'm trusting someone to serve me a piece of code to run either way. Brew, or the people that provide the https cert for the given endpoint, right?
Amusing list. I would like to share it but the unnecessary use of "retard" is a bit upsetting when there are many other appropriate terms (fools, dangerous idiots, whatever)
I used OpenDNS for a long time. I eventually switched to Google DNS mostly because its IPs are shorter and easier to remember, and I didn't use any of the power user features for OpenDNS. I remember the page full of ads and to be honest I don't begrudge it. We all expect everything given to us for free these days, and then we don't even want the company to make money showing us an ad on the rare occasion that we mistype a URL. It's hard to get paid these days.

Ironically, those unrealistic expectations are probably a significant factor in the growth of data mining and resell; how else is a free-to-use website that doesn't have any ads (or whose users mostly block ads) going to get paid? You may say "not my problem", but it affects you when you leave the company no option but to resell data on the behaviors they observe from you.
Airbnb profits from high volume and turnover, just as landlords and Realtors get their cut every time there's a turnover in occupancy. Interestingly, this is the root problem at both ends -- from people living in poverty (Portland's sidewalk tent campers who get shuffled around), those suburbanites affected by the housing "crisis", and those who can afford to own in any upscale hip-n-trendy neighborhoods where Airbnb rentals are desperately sought. Those rooting for turnover are usually those who profit the most from it.

Sure, people travel and need to rent rooms once in a while. People like to rent while they're young and mobile, but the two use cases need very serious and separate delineation from each other. Airbnb is pushing them more into "overlap" territory. Airbnb's expansion into "subletting" was the kicker.

So, long story made short: it's an interesting economics problem I've been working on solving in my spare time, as a very long and iterated side project with Ecosteader (ecosteader.com). Some of the details emerging need a better format for communication; however, the most clear thing to come from my research is that people need to _own_, and they need to be able to transact with each other directly. Middlemen (Airbnb is the middleman here) taking significant commissions is part of the problem.

But the middlemen problem has sort of an obvious solution: to tax rental income so aggressively that it's just not an appealing source of investment to people who invest in rentals. Use the tax generated from over-inflated rents to build properties for sale, and/or figure out a way to use that money to grant-deed land on which people can build. This last option seems the more fun opportunity to me, and is what I originally had in mind building an eco- site.

The homesteading movement needs to come back, adapted a bit for the 21st century.
I do remember something about a virus that patched the computers it infected. White hat virus!
It's important to note that this is an RFC which has been proposed, and there's likely to be a good deal of discussion and revision before it's merged/adopted as the official 2017 roadmap.

The conversation can be followed/joined/whatever here: https://github.com/rust-lang/rfcs/pull/1774
grep

More seriously, anything not phoning home with traffic patterns for things that 'might be attacks'.
You do realize brew itself has an installation method like the post describes, right? :)
This is a better link, as it will include the discussion: https://github.com/rust-lang/rfcs/pull/1774
> If you attempt to read the script in your browser first, and everything's great, then go pipe to bash, the server can send alternate content based on your user agent.

If you can't trust the site to give you a safe installer then you can't trust the rest of the sources it gives you either--you would need to audit the entire package. Virtually nobody is going to do that. Singling out the installer as uniquely dangerous is security theater.
This reads like he really liked the Nexus book trilogy. https://en.wikipedia.org/wiki/The_Nexus_Trilogy
Even some of the language is the same. The theme of the book is 'running a kernel over neurons'. It is even an open source kernel.
Sure, it is. Just like the future Democratic Party America.
It's not illegal to have TTL that short but it certainly feels like violation of some implicit contract between users and provides. Of course the root cause of this is the horrendous hack of using DNS for CDN routing. It doesn't have to be that way... I wrote a recent article about this very issue here

http://www.infoworld.com/article/3133104/mobile-technology/w...
It boils down to "Is there any type of attack that can compromise `curl | sh` without compromising a download from the site? I can only think if one - the download allows for md5 check.

Also the language is too condescending to be taken seriously. Not to say that the tone has anything to do with the argument. And this probably matters less in the software world. But if you want yourself to be taken seriously, you either need to be Linus Torvalds or learn to disagree respectfully.
Was it ever in doubt?

More interesting questions include whether Turkey or Saudi are dictatorships.
Mixed-use, with retail and office space closer to the bottom, hotel rooms and residences towards the top.
The headline conceals the subtext of the piece, which is that the author feels the courts did Venezuelans a favor by acknowledging what he says residents have suspected for over a decade: Venezuela has been a dictatorship for some time now.
Monospaced typefaces have never been good for readability.
Ockham's razor aka Law of Parsimony
How do you say Streisand Effect in Korean?
Venezuela'a foreign exchange reserves stand at less than $12 billion [1]. They pay over 15% of that this month to bond holders [2].

This makes no sense until one considers that the bond holders might be regime insiders. Venezuela is a state structured to maximise the transfer of wealth from the many to the few.

Shockingly, as recently as 2004 Venezuela boasted fair elections [3]. The degree to which Venezuelans are to blame for their predicament (and the related probability that they will recreate it in spite of aid) is a difficult moral question.

[1] https://www.stratfor.com/analysis/venezuela-new-roadblock-re...

[2] http://www.chicagotribune.com/news/sns-wp-blm-venezuela-602c...

[3] https://en.m.wikipedia.org/wiki/Venezuelan_recall_referendum...
If you need to choose between multiple solutions, the simplest one should be considered first because it will be easier to test it (falsifiabilty criterion).
Trivial, small example: the bug is the prover accepts all inputs.
If Venezuela is a dictatorship, oh lord, what a wonderful dictatorship! They don't invade any country like usa do.
Well, Krebs sees this as an extension of the attacks that took down his site a few weeks ago after he wrote about this research. So he wrote about it, attackers take down his site. His co-author Doug Madory speaks about it, attackers take down Madory's employer's site.

Krebs indicates in an update at the end that a source had heard rumors in criminal channels that an attack against Dyn was being planned.

Doug Madory's presentation was on the agenda for NANOG and so attackers would have had plenty of time to know about it.
The Turkish situation is tragic and complicated, but is there any doubt that Saudi Arabia is a dictatorship?
My I have a request?
My friend, after seeing the images, she asked if it is possible to make Borobudur becomes a scary place.

Here is the link: https://en.m.wikipedia.org/wiki/Borobudur

Thanks
I'm the "head fred" networking/infrastructure guy at an ISP. I want to avoid, as much as possible, peeking at my customer's traffic.

In my personal opinion, an ISP should be a dumb pipe. I'm providing you with the ability to send/receive "n" bits per second; I don't care whether you use it to participate in e-mail discussions with your church group or stream pornography and play online poker.

Are you certain you want ISPs to be responsible for monitoring all of your traffic and what you're doing online? Do you really want somebody else deciding -- at their own discretion -- what is "acceptable" for you to do online?

I'm very pro-privacy, pro-encryption, "pro-Internet freedom", etc., but the next guy may not be.
For the last 60 years or so, few of the world's worst dictatorships have. In fact, the worst instance of the USA invading another country was sparked by the rare instance in which a terrible dictatorship did attempt to invade another country.

Few would praise the Union of Myanmar, for instance, despite its hermetic demeanor towards the rest of the world.
What exactly is that standard?

Google is a massive company that provides immense value to billions, and they do much of this for free (monetarily to you as the end user) while providing advertisers a great platform that allows for efficient matching of products to consumers. That is a fine standard for a company in my opinion.
Hiiiinnnnndsiighhhttttt!!!!! Yeaaaahhhhyeahh!

Anyway, for them to take the github.com nameservers out of the mix they would need a completely separate domain name; would you know to look there?

You can delegate subdomains to other providers, but the NS records are still present in the servers listed in the registrar. So, you'd already need multiple DNS providers.. And you wouldn't have been down. Just sayin. I'm not sure anyone rated a DNS provider of this status getting hit this hard or completely as high enough risk to go through the trouble.

It's easy enough to look at a system and point out all the things you depend on as being a risk. The harder part is deciding which risks are high enough priority to address instead of all the other work to be done.
> 1 in 19: lack of IDEs (1 in 4 non-users)

I expected that to be higher actually, but that's still the only reason I don't use the language. I've come to rely heavily on IDEs. Whether right or not it's a huge factor in my decision to wait for the language.
Security is not pass/fail. What threats are enabled by this method? Are there mitigations? Are there alternatives?

It would be a mistake to group all curl pipes. Does it require elevated privileges? Is it served over TLS? Does it do any signature verification? What the heck does the script actually do?

Different levels of security are required depending on trust. I trust Debian's repository, so I feel less need to audit packages. But a random startup promising ponies? I'd like to at least skim what I can, then throw it in a jail/vm/container to test.

How is curl piping beneficial compared to grabbing the script, giving it a quick read, then executing it? Convenience is all I can come up with, and convenience often seems to be at odds with security.
A country with one of the greatest oil reserves in the world, fertile land, good climate, access to the sea (world trade) and no military conflicts for a century was turned into a population of homeless people hunting dogs and cats on the streets in order to not starve to death - only possible with Socialism.

I remember how ten years ago people on my university (in a Western country) were trying to convince me that Chavez's version of Socialism is the future for humanity. And when he came to give a speech he was celebrated like a pop star.
Very surprised to see all the (or any) Airbnb negativity here. I've been living in an Airbnb for about 2 months now (as a tenant, not a host) and plan to continue doing so indefinitely. The experience is infinitely better than renting from your typical rental company (and at a comparable price, with Airbnb's monthly discounts), and I don't think I could ever go back.

Unfortunately, this just sounds like NYC is making it more difficult for visitors to come check out the city, which is regrettable at best.

Hopefully this bill does not also apply to long-term Airbnb rentals also.
What is DDOS and why was Twitter down all day?
Many of the safe-harbor laws protect a service only so long as the service is neutral. If they can make a good-faith argument that their mechanisms are used only to neutrally remove content based on good-faith assertions of copyright infringement, OK. If anyone can make a case that it's used as an editorial tool based on the opinions or ideas expressed in the removed content, well, that's the ballgame. YouTube suddenly has a negative value because losing its safe-harbor status will allow it to be pummeled into bankruptcy by lawsuits.

So maybe before you come rushing in to post your "ha-HA! Literally no one in history has ever considered that this is a corporation, or pointed this out, or had exactly this discussion, I must smugly educate them on that fact" lecture next time, you should do your homework first?
Just three years ago: https://twitter.com/mmflint/status/309124649244057600
I'll take the contrarian point of view and say that it's probably not worth it to invest a lot of time into Chisel at the moment. There's a lot of pain points around things outside of the "application logic" like clocking and synchronization. I've also heard that gate level debugging is a pain, but I haven't actually gotten that far in a Chisel project yet. The language definitely seems interesting but it's probably not ready for prime time just yet.

If you're interested in a higher level hardware language, I'd highly recommend MyHDL or PyMTL. Both are much closer to Verilog (for better or worse) and give you higher level semantics.
Unrestrained equality leads to dictatorship. Unrestrained liberty leads to dictatorship. Democracy requires a balance between equality and liberty, and the political pluralism that is inherent in the vying for power.

Partisan fanatics who breathlessly wait for the total victory of their side would do well to remember this.
As is too often the case, the "it's official" in the headline really means "it's not actually official, but this makes the headline more provocative". The article goes on to describe the remaining fig leaf of a supposedly independent judiciary.
> Arpanet was about time-sharing. Time sharing tried to make it possible for research institutions to use the processing power of other institutions computers when they had large calculations to do that required more power, or when someone else's facility might do the job better.

Arpanet is distributed shared information for science. Nuclear technology is science. Surviving science is a war that requires nuclear insights. Therefore, the Arpanet was developed for surviving nuclear war.
When a third party is involved there is a degree of accountability. A proper package repository would require everything to be logged and signed.
Dude is wrong on the Internet. More news at 11.
Where is the worldwide leftist intelligentsia that supported this totalitarian regime from the beginning with wet dreams of "21st century socialism"?

They are all quiet now and will surely soon claim that things went wrong there and misrepresent the original intents of the "revolution".

It's time to recognize that, once again, socialism resulted in the same results that it has always achieved: hunger, death, lost freedom. And this is not because "things went wrong". It's by design.
I don't think there's any kind of actual conspiracy going on; it's just that this argument is a convenient political soldier. If these companies were censoring the other side politically, it's the other political side that would be deploying it.
The airspace above New York which you could encapsulate with more walls is worth quite literally hundreds of billions of dollars.
It could go either way. In the US, everything tends to favor the business and decisions tend to be more capitalistic. I think government interference would be minimal in the US.
I would also suggest taking a page out of Apple's playbook and providing some official sample apps like https://developer.apple.com/library/content/navigation/#sect.... Reading the books is one thing, but seeing the patterns actually used is another. You don't need as many as Apple, only a couple really, but make sure they are well written and straddle a couple of use cases. And like go crazy with the idioms, I want to see the most idiomatic Rust code.

When learning a new platform, it's always frustrating having to hunt for good code. I actually find these similarly important as docs (maybe even more because I tend to reference good open source for much longer than docs).
Hopefully in the same place as the worldwide right-wing intelligentsia that so actively supported death squads in central America just a few years prior to Chavismo.
The authors of these pieces almost never get to write their own headlines.