skysight-inc/HackerNews huggingface dataset:
"Screwed" is not a binary thing. Key compromise is not an unrealistic scenario, here are a lot of things that can happen as a consequence. How bad the consequences are matters.

Let me illustrate by examples:

Instead of KCI, consider forward secrecy. As long as the secret key is maintained forever, you don't care about forward secrecy. However, we generally agree that forward secrecy is a desirable property. If key compromise doesn't matter, why does Tox bother to get forward secrecy? Because the outcome of key compromise matters.

Instead of GCM, consider with something like CBC+HMAC-SHA256 and GCM-SIV or HS1. All take some added data per encryption in addition to a key: either a nonce or an IV. In the case of GCM, a nonce being reused is catastrophic failure: trivial forgeries and quite probably ciphertext decryption. With the other ciphersuites, there is some other failure, but nowhere near as bad. Yes, you shouldn't have repeated the nonce, but the problem is that that happens, and the question is how screwed you are when it does. Why do we care about NMR crypto? Because the outcome of nonce reuse matters.

KCI is just another example. Yes, it only matters when something has gone wrong. But there is a functional difference between "the attacker gets to impersonate me" and "the attacker can pretend to be anyone to me" (KCI), just like there's a difference between "the attacker can impersonate me" and "the attacker can decrypt all communications, past and present" (PFS).

Just like PFS, not having KCI-resistance as a property is a choice. There is no downside to having it. So, it is as much of a vuln as not having PFS would be.
In general? Yes, Travis CI seems to be a very popular one. Many folks use Appveyor for Windows support AFAICT.
These strike me as good and interesting questions. I read the article after I read your comment, and I have one follow-up.

> The obsession with having an even split…

Does it strike you that the article is describing an obsession? It seems like a strong word, used pejoratively in this case.

To me, the article is described an unusual and thoughtful approach that led to surprising results.
Can somebody explain why poker is a big deal? I don't play poker and I don't see why is it complex for an AI. I can see why chess/go could be a big deal: there's definitely a solution to the game, but the space is too large for it to be computed, so you have to optimize somehow, which real players somewhat can. When computers were slow, humans did it better than computers.

Poker, I thought, doesn't really have any solutions, it is largely about luck, no one really knows what's going on, so aside from some probabilistic computations it is about guessing what your opponent thinks while not giving up what you think. Choosing and seeing the behavior. I would think that playing against AI is generally pointless, since computers don't worry. I mean, surely there are some general guidelines on strategy, since somebody plays better that the others, but following it shouldn't be harder for a computer than for a human, quite the opposite.

So, what is true?
This example is good but surely an edge case. Optimizing for edge cases is typically wasted effort.

I think a big question is why companies do it (there is a comment thread above tackling this).

A company's goal, in a capitalistic country, is to maximize profits, if you can prove that a 50/50 split does this (and getting there should be included in the cost), then great.
Isn't it possible (in fact trivial) to sniff the traffic generated by WhatsApp and verify that it is indeed the message transmitted, encrypted by the key on the device?

Has anyone performed such an audit?
It could.

I guess the point here is: Can there be a backdoor in whatsapp? Of course!

Is there a backdoor on Whatsapp as described on the guardian article? No.

Can the UX be improved to alert the smaller percentage of users that rely heavily on the encryption features when their communication is not being actively protected without disturbing the UX of the rest of the users? Probably yes,
Lesser HTTPS for non-browsers – daniel.haxx.se
Any open source project can allow you to verify binaries by making builds reproducible. The fact that most apps don't do this is indeed a security problem, but one that's far from unfixable.
> We’re mostly intrigued with 1:1 locomotion and agility

That doesn't sound appealing in many cases. As a game critic once wrote about the limits of realism: I am not a ninja.
The "green padlock" was not considered enough because users would not be able to differentiate it from a big lock symbol within the page. Thus we got HSTS.

(There was a time when browsers would color the entire URL bar yellow to indicate https, but that went out of favor many years ago.)

Moxie deserves respect for the web vulnerabilities he discovered and raised awareness about years ago, and for his general competence at cryptography. But in recent years he's shown himself to be willing to make catastrophic sacrifices to make security applications popular and viable for the "lay person".

If the "lay person" ignores the non-obtrusive key changes, and difference between single and multiple checkmarks (and the timing of them, whether single changed to double after a key change), and just trusts that "I heard WhatsApp is secure, so I'm good to go", then so much is sacrificed that there wasn't any point in the exercise to begin with. Except that real solid systems, with direct user control over key continuity, and fully open-source, are undermined by the confusion with these "lay person" super-convenient closed-source systems.
Would you similarly argue that perfect forward secrecy doesn't matter? After all, Alice should just keep her keys secure. If not, why?

(I've made the same point in more detail here: https://news.ycombinator.com/item?id=13395294)
That's odd. It would be nice if branches could be tested with the build bot.
> Death and Taxes. Not Death, healthcare, vaccines, education.

Well, correct as far as healthcare goes, even with the ACA "mandate". You can choose not to get insurance, and you get some extra taxes in return.
And there is much better documented data (from Picketty's database) that shows that return from capital is as high as the gilded age.

I don't think you can really blame employees for presentism, I think it's generally more difficult to make part-time work arrangements in the white collar world, whereas at the lower end of wages, where it benefits capital owners, blue-collar workers are forced to be part-time...
YC Research project idea: Figuring out how to throw a wrench in the cogs of internet mob mentality and hypersensitivity.

There's a few ways to go about this, and some are beautiful.

One idea would be to create an entire network of fake professional personas, build social media presences for them, and eventually have them say something carefully crafted to both be perfectly defensible yet enough to draw the ire of the internet outrage machine. Then, have them be fake-fired much to the angry mob's satisfaction.

After this goes on for a while, conduct some data analysis, permanently naming and shaming everyone stupid enough to righteously attack and ruin the life of a fictitious persona.

The chilling effect is then reversed: engaging in vicious mob mentality against complete strangers might just earn them a higher ranking on the dumbass list.
Before we get the inevitable "Why are you using Adobe Reader?!" Plenty of rich PDF forms, including those used by the US government, require the use of "real" Adobe Reader to work correctly.

Without it you can still fill in the form but validation is complete, signing is missing, direct submission doesn't function, and dynamically generated content (like QR codes) don't work.

Adobe Reader is pretty mandatory if you are doing anything more with a PDF than hitting the print key.
Another thing that's not clear to me: Is the receipt confirmation from Bob (used as the basis for the double-check) signed by Bob?
Android apps can also contain native code. Indeed, WhatsApp includes such libraries, to help with Curve25519 encryption, video encoding, voice over IP, and other functionality.
Myth is that all you need is free electricity to get rich on Bitcoin. Reality is that a decent miner has about a 9 month break-even, after about 2 1/2 years will be worthless, and you will have made 25% or so on your original investment. That's with free electricity.
I've volunteered at hospitals when I was a teenager. The guys with the Cadillac plans got the same medical treatment as everyone else but they had a single bed penthouse suite closer to a hotel in accouterments than a hospital, a larger meal selection, insuite TV and telephone.

You do a disservice by calling everything you don't agree with cadillac coverage. Clearly you've never had it.
Why naked mole rats feel no pain
I think LIDAR is essential - at least for any cars to achieve L5 in the next 4 years.

[which I also think will happen]

I think it will become cheaper - probably to ~$1-2k in the next two years.

And even if it doesn't, we aren't expecting self-driving cars to replace the fleet of cars on the road, we're expecting to increase utilization % of cars. So we won't need as many vehicles, and the cost per mile will still be much cheaper.

But GTA V is scriptable. We'll be able to simulate LIDAR in-game within a few months, if desired. So... all-told, I'm pretty excited about the possibilities here.
FWIW, it takes 12 years of residence to become an Indian citizen
It's a conclusion I can definitely see a spook coming to. Neutralize the leverage of blackmail material by making it public. The political fallout for Trump is secondary to ensuring he can't be manipulated by a foreign government.

I've often wondered if Hillary can released all of her emails (no redactions) at the outset if she'd be president today. It would have removed the leverage of political adversaries. Or at least it would have been 1-2 weeks of bad headlines, instead of the constant drip of negative press. Radical transparency can change the equation.
President Obama's final ask
Pasteur's Quadrant (2012)
Truth table printer written in TXR Lisp:

http://stackoverflow.com/questions/29963269/boolean-expressi...
Rust uses https://github.com/rust-community/bors which maintains a linear queue of PRs which can only land after being rebased onto the commits before the PR and subsequently passing tests.
follow the fucking money.
Can you give us some examples of places that do it better? And what the truly human costs are of the Australian approach? What is the Australian government doing that harms the species itself in ways that your undisclosed preferred locations don't? Give us something to go on rather than vague expressions of displeasure.
OF COURSE their lives have value. This isn't a moral argument. I'm not arguing that we should NOT provide universal coverage to everyone.

What I'm arguing is that the ACA, as written, has established a non-sustainable model for healthcare in this country. It's done so at a huge risk to future populations and seems to try and legislate an outcome instead of working with stakeholders to solve the ACTUAL problem: rampantly rising costs for healthcare.

HOW do you explain the crazy high costs for care in this country relative to almost every single industrialized neighbor? What are the factors for that high cost? Overconsumption? Regulatory capture? Lifestyle factors? Perverse incentives? Administrative overhead? PROFIT?

We've done very very little with the ACA to tackle these problems head on because every problem seems to be owned by an interest group that is incentivized to keep that problem alive.

That's the point I'm trying to make here.
> Source code can be verified

But how often is that really done? And to be honest, it can be quite hard to spot critical bugs or backdoors, just look at http://www.underhanded-c.org/
https://medium.com/@thesoundofnonsilence
Indeed, it's almost as if web application expectations and requirements have gotten significantly more complex in 10 years time.

Microservices don't reduce technical complexity. If anything they add to it. 10 years ago I didn't have to worry about container orchestration and all that comes with that. New problems present new solutions.

I definitely recognize that the transpilation era of JavaScript feels incredibly bloated. It is exacerbated by the overlap with a lot of the tooling. It's exponentially worse when you try to understand solutions to problems you don't have yet.
I wouldn't be so sure it's an edge case.

Would you want to work somewhere that nobody shared any interests? Maybe a language barrier? Perhaps a place where you would be bullied? or be talked down to constantly? If you had to choose between a place like that, or a place that you would "fit in" better, which would you choose?

It stands to reason that the "best" candidates are going to have a choice in where they work. Hell, even "slightly above average" candidates can often have a choice between multiple offers. So when you are looking for talented individuals, you are going to either need to pay more, offer some other benefits, or will need to ensure your workplace doesn't make them feel unwelcome.

Personally I think of diversifying your employees like buying a pingpong table for the break room, or paying for lunch a day or 2 a week. It's a small price to pay, that can pay off big time when hiring. And that seems like a big enough "reason" for me to want to do it.
There's "no way in principle"? How is this whole story not evidence to the contrary? The person who found this didn't use WhatsApp source code.

Why do you feel that there's no way to verify closed-source software?
Of course, it's an entirely reasonable thing to think.

A good parent spends more time with their children than anything else.

And I've dropped the ball on work stuff when I had more important life stuff to handle.

And I'd skip using some contracting firm (or anyone/thing else) if I thought they'd take off for greener pastures as soon as they found a better client.

Combine those things and nobody reasonable will enter into a critical deal with a new/upcoming parent where that person is in the critical path. It's not PC to say this, but you'd be a fool to discount it. And If that person doesn't prioritize their children you probably don't want to deal with them simply because of that.

fwiw, the same logic applies to anyone with any non-business focus that outweighs their business focus. From cancer to marathon running. This is your life too and blowing your chances on misguided charity doesn't let you take the time to raise your children or nurture your sick spouse.
It would be a war if all these people were allied together. Neither the engineers nor the outlets mentioned here are allied parties. They're disparate across the board.
So, Vox has an article where they go in depth about what's behind the wage gap [0], and they ended up reaching an interesting observation about pharmacists:

> The wage gap for pharmacists has shrunk significantly because the profession has changed.

> In the 1970s, pharmacies were primarily independent and self-owned businesses. A single pharmacist might be responsible for keeping his or her shop open. The pharmacy would need to be open typical business hours; the owner would need to be available to do that.

> Now large chains own most pharmacies. And while you might get nostalgic for the mom-and-pop shops, you should know this change has been undeniably good for female pharmacists’ earnings.

> The majority of pharmacists are now women. And their wages have grown faster than those in other professional roles, like lawyers or doctors.

> Bigger pharmacies hired more pharmacists, and customers essentially saw the workers as interchangeable. Most patients don’t care about seeing a particular pharmacist — they just want to make sure they get the right medication.

> This meant it wasn’t important to be around 9 am to 5 pm — a shift from 6 am to 2 pm would do the pharmacy just as much good. And nobody accrued higher hourly wages for working exceptionally long hours.

And speaking of doctors, the article has this to say:

> You see this shift happening elsewhere too. Primary care doctors, for example, have shifted away from running one-person practices to joining larger, multi-doctor offices. In these situations, doctors become more interchangeable: When I go to my medical practice in downtown Washington, DC, I usually just want a doctor who can solve my problem — and I care less about which doctor is doing that.

The short version is that the Walmartization of professions has resulted in them becoming more amenable to women. If you want to correct the imbalance, a lot of programmers who think of themselves as auteurs are going to have to accept moving to a shift work model where individual professionals are interchangeable and might as well be anonymous. Startups are going to have to suck it up and accept that environments where employees are expected to work more than 8 hours per day are actively hostile to anyone responsible for rearing children (another thing the article points out: most child-rearing in the US is performed by women, even when both parents work).

[0] http://www.vox.com/2016/8/1/12108126/gender-wage-gap-explain...
FYI: indent those lines a few spaces for proper formatting.
I'm the submitter. I usually find it helpful to vary the hyperparameters to see how they change a network's performance, and hadn't yet done that for LSTMs. This one had a few ideas for where to start, so I saved it for later. Your paper looks like a much better reference, though.

I'm a little surprised it got so many votes, too. I would've liked to see discussion on the Spatial Transformer Networks paper I posted yesterday, which seemed much more useful.
CloudFlare Gets Caught Out by 2016 Leap Second
Ask HN: Any good resources to learn Mac OS programming?
I know iOS and many things overlap, but I can't seem to find specific Mac OS courses or resources. Can you point me to some?
Low-Wage Workers Are Getting a Raise, and Economists Are Getting an Experiment
I think that, regardless of whatever moral or ideological viewpoints one may hold, this should still be lauded as an interesting experiment in a situation that's most definitely a minority case in this industry. People should just accept this as an interesting case study and keep an open mind, regardless if they think it will have positive or negative outcomes.
Both points seem plausible to me.

On the second point, while I wouldn't say "most spicy dishes are healthy"...I might agree that spicy dishes are on average, healthier than some other flavor affinities.
Here's my understanding of this attack vector:

* when the client is compromised, you're screwed anyways, so let's assume the client behaves as expected.

* now, with "proper" e2e, and Alice and Bob verifying key fingerprints, their messages can't be read even if the server gets compromised.

* as it stands now with WhatsApp, AFAI understand, the server could be compromised to take Alice's message, send it on to Bob, but withhold the "delivery receipt". It could also pass back Bob's answers, and so Alice could have what appears to be a normal conversation - except that Alice only sees single ticks, instead of double blue ticks.

* then, the server could send the "hey ho, new key" message, and Alice's client would re-encrypt and re-send all messages that it thinks haven't been delivered yet, the ones with a single tick. After that, it would display the "key changed" msg to Alice (if she had set that option).
> verify the open source code

The argument here is that open source code can be verified where closed source is explicitly non-verifiable by nature.

> but that the binary was built from this code

Doesn't code signing address this? If not could you explain (for my own learning)?

https://en.wikipedia.org/wiki/Code_signing

> that your operating system and every layer below it is also trustworthy.

Yep, this is the last major piece for true security in my mind. Although there is some movement in the open hardware space as well as USB mounted OSs (http://gizmodo.com/try-the-super-secure-usb-drive-os-that-ed...).

> I stand by my claim that using software written by a malicious developer is game over in the vast majority of contexts.

Sure...perfectly accurate...but in the context you are implying that WhatsApp is malicious. To which I think "hackuser" was interpreting as "closed source is malicious" and therefore offering open source (and by implication Signal) as an alternative.

Might just be a miscommunication moment :-)
You might want a redistribution program, just like I don't want healthcare to be a right, but none of that changes that no politician will speak about their support for some healthcare policy in those terms. It would be electoral suicide if they're from a competitive district.
The minimum requirements are a Bachelor's degree or some ridiculous amount of work experience. That's actually very selective (30% of adults have a BS or BA, 10% have any graduate degree), and 12 years of work experience is a lot of experience.

There is also language in the legislation that displacement of American workers is disallowed.

It's pretty clearly meant to be for companies to hire very skilled talent for which there is no American source.
The pg_rewind Improvements in PostgreSQL 9.6
For $8,000 this startup will fill your veins with the blood of young people
If you took all the time you spent writing comments like this and spent it instead on questioning why the norm for other companies is 10-90 or 20-80, we probably wouldn't be having this conversation quite so much.

Part of the reason why this announcement is significant is that people frequently argue that it is impossible to build a gender-equal team. This shows pretty clearly that it is possible. I don't think this is equivalent to saying that all companies need to be exactly even in the end.

> The men that don't get jobs because of these new 50-50 splits, where do they work?

Do you think there is a shortage of tech jobs? If the end state was equal for men and women it seems more likely to me that plenty of people would still be employed, but the best jobs would be going to the best people rather than just the best men.

Does all that make sense? I'm genuinely curious about why equality is uncomfortable for you.
Any good alternatives for people who need acrobat features?
Excuse me, "go up by a larger factor year-over-year than had previously been the norm."
Do you usually access your problem app though spotlight?

If so, you could try creating a space icon linked to your problem app and give the space icon a name that will cause it to appear above your problem app in spotlight results, then search for it in spotlight a few times and see if you can get the space icon to appear in Top Hits when searched.

The principle behind all of this is to get the space icon to appear in your app launch flow where the icon of your problem app used to.
What about...Walmart, Glencore, Phillip Morris, Blackwater, Palantir...
How would a renter feel if their rent increased because their landlord was unable to take a mortgage deduction? In other words, is the deduction implicitly distributed pro-rata to the supporting renters via market force?