skysight-inc/HackerNews huggingface dataset:
Mostly neither (I wouldn't accept the premise of the question), but if one had to choose one I would say the second.

The Podesta hack was a social engineering phishing attack on his Gmail account. Gmail probably has the best security of any email hosting provider, and it's difficult to imagine what capacity any five eyes agency could have helped.
This is an invalid analogy for multiple reasons but for starters, you don't give an argument that this unnaturally increases the price of hamburgers.
Which is ok asthe people you know would understand that you are that type of person.

I would also pop up when someone reinstalled the app.

Would be rather annoying but it should be on as default and the first time it pop up give clear information.

Whatsapp is set to notify you when a key changes, this could be due to a change of phone or reinstalling the app. If you do not wish to receive these notifications click here.

Which would allow users who want it to keep and those that don't to turn it off after the first change.
Co-author of the OMEMO standard and lead developer of Conversations here. To answer your question one after the other.

> What do we think about this protocol?

It's the first encryption protocol that allowed me to actually use it on a daily basis. I regularly use my desktop client and my mobile client in parallel and switch between them constantly. OMEMO allows me to do that.

> Is it a good idea?

Yes. Compared to OTR the entire stack (that includes the XMPP layer) is properly standardized. This also kinda answers your questions regarding the OTR implementations. OTR had the problem that it couldn't do multiple devices and the behavior regarding multiple devices and when to start and end sessions wasn't defined at all.
All OMEMO developers are also in regular contact to coordinate behavior between the apps.

> Why are there three encryption choices
I would really like to get rid of OTR (and we will eventually) but we currently still need it for backwards compatibility with older clients (primarily Pidgin)
PGP servers a bit of a different use case. It doesn't provide forward secrecy and authentication but it turn allows for a server-side re-retrievable archive. If you get a new client it can automatically retrieve old messages. (In OMEMO the receiving must exist at the time of writing. It doesn't have to be online but it has to exist and announced the device specific key material)

In reality the choice isn't too much of a problem. You select it once per contact and that's it. It's not like you are getting new contacts every day.

> How is the server support.

The server requirements for OMEMO aren't too bad. However it is recommended that you do pick a modern XMPP server for other reasons (battery-friendliness, reliability). Have a look at this comparison list to see if your server supports all modern extensions: https://gultsch.de/compliance_ranked.html

> How is the support of group chat

Support for group chat exists and works fine once it is setup. However it has some limitations that make setup harder. Everyone has to be in everyone elses contact list. And the group needs to be setup with special parameters. (Conversations automatically sets it up this way, but you couldn't for example create the group with Pidgin and then expect OMEMO to work.)
The readme on the Conversations github page explains this in a little more detail: https://github.com/siacs/Conversations/blob/master/README.md...
Can confirm it's off by default on windows phone.
Fine, lets replace 'but' with 'and', so it gets double HN brownie points. :)
IBM's “Think” Motto in Chinese
This is gold.

I've seen so many of these, even on websites with lots of traffic. Websites have to be written taking into consideration the way it loads too, especially on mobile data.
I've found the Chrome DevTools feature where you can throttle bandwidth comes in super handy for this.
Yes, you can. StumpWM uses a keybinding system that is very much inspired by Emacs. You can bind any keypress to any action, or even another keymap in order to create multi-key commands.

You can easily define new commands by using the "defcommand" macro. Here's an example from my config file that creates a floating group (untiled windows) and starts Android Studio in it (or switches to it if it isn't already running):

(defcommand android-studio () ()
"Start Android Studio in its own group"
(select-group-or-create ("Android Studio" :float t)
(run-shell-command "~/src/android-studio/bin/studio.sh" nil)))

StumpWM isn't just about being a great tiling window manager. It's all about the configurability. Just like Emacs without any configuration is a decent editor, but can easily be challenged by other editors, it's the ability to make it behave just the way you want to that really makes it shine.

As an example, I have built a Dbus integration module for StumpWM. It's a work in progress, but useful for daily work. It's nice to be able to exactly control which notifications are displayed and how long they stay on the screen (I'm looking at you, IDEA compilation notifications).

It runs inside of StumpWM and implements a Dbus notifications provider: https://github.com/lokedhs/dbus-test

The kind of flexibility offered by StumpWM is hard to beat, and combined with the ability to connect SLIME to it in order to have a REPL running in Emacs directly working with the running window manager makes it, in my opinion, better than any alternative.
I completely agree with this sentiment. I too develop for both Vive and Oculus and they're just so unfinished products that I'd never recommend anyone to buy them.

* Vive has huge problems with tracking devices. It needs to track 3 things and usually 1 has a problem and is not tracking properly sigh
* The coords are annoying
* FOV is too narrow
* picture quality is crap (low resolution)
* steam vr (as steam itself) is low quality software
* the device is heavy on your face, uncomfortable and makes you sweat (in the face.. nasty)
* lack of compelling content that has things just right (i.e. doesn't make you sick)

From developer point of view:
* openvr library can be confusing, documentation is lacking and it's married to steam :(

I think the author is overshooting the importance of VR. The next generation hardware will undoubtedly improve much and there's definately potential especially in fields like visualization work and gaming too. But lets be honest there's a whole bunch of basic "productivity" apps and light user content apps (think your average phone app) that really doesn't have much to gain from VR. Undoubetedly some of these will want to jump on the VR hype (once it comes) and quickly make totally horrible half-assed versions of their software for VR.
The Orange Pi PC is $15, roughly comparable to the Pi 3 performance wise, and doesn't require any of this hilarity to boot with open source code.
PR snake oil.

Fitness didn't come true with the Wii. Better be prepared to still go outside and have a life. Your body will produce vitamins as your reward.

Eyestrain is subjective, and this is far from an optometrist's prescription to treat any disease or disorder. Doctors recommend tooth brushes, but which is THE ONE TRUE toothbrush?

Psychology is not hard science. This technology can either harm or help, with no guarantee of either. Use as directed.
Tell your sister, Stallman was right
Moxie, what about showing a positive UI for users you have verified keys with? Something like the verified checkmark on twitter. I'm ok with this being client side of course, and possibly even lost if you reinstall the app (better than nothing).

I like to verify keys of my main professional contacts on WhatsApp, but it's hard to remember who you verified keys with, and then whether the key was changed since last time you verified it.
A 5 year old girl vs. CoderDojo
When I went online for the first time (nearly twenty years ago - time goes by pretty fast!), I did so on 14.4 kbit modem.

That was no fun even back then. After a year, I upgraded to ISDN, which was a lot faster (64kbit), but once I got to use a faster line, even ISDN seemed awfully slow.

And the trend continues to this day. Once one has a faster connection, one gets used to it in no time. And just like many companies and individuals have solved problems with slow software by throwing more/faster hardware at it, these days we solve the problem of web sites making inefficient use of bandwidth by throwing more bandwidth at it.

Which might not even be such a bad thing - I would not like going back to programming in an environment where I have to triple-check every variable to see if I can shave off a couple of kilobytes, either.

But even a fast connection gets clogged at times, and even on a 16MBit DSL line, I have seen pages looking broken because the request for getting the CSS timed out or something like that.

Maybe taking more care not to waste bandwidth should be considered a form of courtesy. People on slow/saturated lines will thank you for it, and people on fast lines will be amazed at how snappy that website loads. (And of course, there's always trade-offs involved; I do not demand web developers sacrifice everything else to efficient bandwidth usage; but it should not be ignored, either.)
This is exactly how I feel about the situation. These types of covert games have just decided to become overt in hopes of riling up populations; they've been going on since the birth of nation states. However, Russia didn't actually do anything particularly damning to the DNC: the DNC did it to themselves. If they weren't internally corrupt they wouldn't have had any issue.

Political parties and government shouldn't have anything to hide, so what do they have to fear, right? That's what they say to us.
You know what, I am going to go against the grain of supposedly intelligent people on HN. Your personal vehicle committed a traffic violation. Your license plate was captured. The vehicle is registered in your name, and thus you are liable. Unless you have reported the vehicle stolen, you are responsible for the vehicle.

This kind of shit is a waste of taxpayer money. I don't agree with automated ticketing. However, if it is clear that the vehicle was speeding, and it is clear that it is your vehicle, and there is no stolen vehicle reported... give me a fucking break.

Maybe it wasn't actually you. But you know who you gave your car to that day. You know who was speeding in your car. Either get them to cough up the cash to you, or deal with the fucking fact that you trusted someone else with your car - clearly, someone who doesn't deserve to be trusted.

I hate cops. I hate stupid laws. But more than that, I hate people who look for loopholes to absolve themselves of personal responsibility. Don't fucking loan out your car if you're this type of asshole.
Kenya Will Shut Down the Internet During Elections 'If Things Get Out of Hand'
IMO Ruby does a pretty good job hosting a bunch of different programming paradigms and techniques in a consistent way. Whether or not that's ultimately a good thing in a language, I don't know, but I can believe it has benefits in an educational context. Add to that the popularity of the language in general, and it seems like a decent choice for a "boot camp" style education.

If there's a real argument to be made for the pedagogical merits of Javascript, I'd love to hear it. There does seem to be a sizable job market for relatively inexperienced Javascript developers, though.
The web has moved on from progressive enhancement. Current practise is client-side HTML rendering.
I think they got their act together a while ago. More importantly, part of the reason they got in so much hot water is they didn't use the Pi's GPL compliance technique of moving everything interesting into a blob running on a totally undocumented core. Everything important runs on the ARM core. (I believe some of the newer SoCs have an embedded core for power management, but apparently it's OpenRISC-based.)
while U.S. citizens convinced their employers.

During WWII the government imposed wage controls.. but fringe benefits did not count as wages. And with a shortage in labor because of the war, employers used health insurance and other fringe benefits to attract workers.

The unions jumped onboard later.

https://en.wikipedia.org/wiki/Health_insurance_in_the_United...
While I have no idea what caused your problems at the time, I can assure you that it's nothing like that today. There is zero delay anywhere in it, and it's as fast it can be (in other words, I don't know of anything in it that, if made faster, would even be noticeable)
Excuse my ignorance here, but is this something that can become a class action against the city then? Why not find all the people given traffic tickets without due process and probable cause? That would actually get some attention no?
Criminal liability does not work that way.
It's related because it's Apple, and I can well imagine that a fire caused by a faulty iPhone battery, killing dozens of people and downing an airplane, is going to be a pretty costly lawsuit to fight/settle along with this anti-trust suit?
Man and I am sick of the word "GOD" appearing on my money.

It's on the fuckin' money!

You want to talk about faith being shoved down people's throats, the Christians are the worst at it.
To be fair, the market is considered occasionally but a for-profit site isn't going to go out of its way to cater for those people with little money.
They could probably shut down his account for terms of service violations.

Actually kind of interesting to imagine what a state could do if they owned twitter or a similarly large social network.
Clojure and Atom Editor Setup
>What evidence would convince you that it happened?

Exact thought process they used to figure out they were russian hackers would be good. I need to understand. Screenshots, ips, print outs do not explain\prove anything.
> The option does not exist, and should not exist.

I also think the option should not exist, but according to The Guardian article [0], the option exists: "In WhatsApp’s implementation of the Signal protocol, we have a “Show Security Notifications” setting (option under Settings > Account > Security) that notifies you when a contact’s security code has changed."

[0] https://www.theguardian.com/technology/2017/jan/13/whatsapp-...
>This kind of shit is a waste of taxpayer money.

No, it's not. The guy has the right to defend himself. If the system is so bloated that it generates that much cost it's not his fault.

Want to save taxpayer money? Reform the system but don't deny people the right to defend themselves from legal accusations.
Reading something like this makes me sad.

We have a teacher at a law school that wastes everyones time by appealing a traffic ticket because the legal basis isn't sound enough.

Did the city issue a ticket to someone whose car was parked at the time? That would be something you should appeal!

Did the city issue a ticket to the owner of a vehicle instead of the driver, because they have no way to identify the driver? It sounds like this was the case. In that case, the proper thing to do is to inform the city of the identity of the actual driver.

But to launch an appeal because you don't want to pay your partner's or your kid's speeding ticket... that doesn't sound fair.
The issue isn't the traffic cameras or people getting away with crimes. The issue is that the government is not operating in a way that is legal.

The people give the government its power and when it doesn't follow the rules that the people set down for it then we don't live in a democracy.
I remember reading a study somewhere where elementary school students were taught abstract calculus and were... basically fine with it.

I wonder how much we underestimate children's understanding of the universe. Though I bet we overestimate along other axes as well
I remember when I upgraded to a 14.4k modem and boy was I pleased after dialing with a 9600 baud for years.
well if they allow me to use my own keys this will not be a problem.
I would recommend laracasts[1]. I have learned tons of solid PHP principles, code structuring techniques...

1. https://laracasts.com
I doubt the pi foundation are remotely concerned with how open the soc is as it has absolutely no impact on the core uses of the pi. They're smart people and would have made a different choice were it the case.
But people in UK do get oramorph, which is a liquid oral morphine.
Google’s new compression method will save you data, starting with Google+
He answers his whys near the bottom
Oh no, it's not. It's really a good thing that wherever you go now you know you can charge your phone with anybody's charger or computer. The iPhone is a minor special case.
It's pretty well known that opioids for short term pain pose little risk of addiction; but opioids for long term pain are a bad idea.

For long term pain opioids don't treat the pain, and they risk addiction.

That's why we have things like "Opioids Aware": http://www.fpm.ac.uk/faculty-of-pain-medicine/opioids-aware
Humane websites
I think the economic, military and political power behind NATO would consider a military confrontation that might escalate into a third world war if they determine that without such a war world events would lead to an existential threat to there existence.

A four or eight year Detente between the United States and Russia combined with an integration of Eurasian defence strategy could see a dramatic obsolescence of an organisation that is no longer politically relevant nor operationally capable to fulfill its mandate.

Currently both of those trends are moving forward.
"For staff workers."

Who are non-staff workers? That site has some very strange turn of phrases. Like: "How staff workers live, work, and communicate." Without too much explanation. Isn't this just work scheduling with a work Sharepoint portal? How does it help manage how I 'live?'

Plus then the infographic which is obviously all teenagers (?) doing the pledge of allegiance (?).

The product itself seems acceptable even if quite pricey ($4/user/month for shift scheduling gets pricey after about ten users compared to the competition). I am just pointing out how freaking strange the landing page is, blurbs, and iconography. Feels like they're recruiting for a cult.
There are many ways to corroborate evidence from 3rd party sources. It's done in courtrooms every single day.

Take, for example, the leaked emails. They can be shown to have DKIM signatures which are signed by both Google & Hillary's email servers and these can be validated. Or in the physical world, you can show that people were in the right place in the right time. You can find multiple, named witnesses who have proof of being in the right place at the right time and other corroborating evidence.

Sure, it will be disclaimed as being faked. But then you end up like Donna Brazille:

- First you show her denying this:
https://www.youtube.com/watch?v=Izl0e4xvgGA

- Now you show a DKIM validated email:
https://wikileaks.org/podesta-emails/emailid/5205

- Now you show how to perform the validation:
http://blog.erratasec.com/2016/10/yes-we-can-validate-wikile...

At this point, they can deny however they like. It only makes them look more guilty.
Write to your representatives. Under current law (nationwide as far as I am aware), it is not not illegal to own a car that breaks the law or lend your car to someone who does so. Further, in this case it was specifically alleged that the poster himself sped, which is not true. He even got the charging officer to admit that there was no evidence that he committed the crime that was being charged.

The issue here is not traffic tickets. If the legislature wants to pass laws that work as you describe they are free to do so (up to public opinion). However, that is not the law. The issue is that the judicial system has drifted away from the law, and it is much better to fight this drift while the immediate stakes are still low.
Do you not understand that a city's mayor is not allowed to make up new forms of law without constitutional protection, or do you think that's unimportant because the amount of money in this case was so small?
My point especially applies to web apps. I just loaded facebook.com, and it took 228 requests, 8,825 KB, and 17.0 s. Scrolling through the page is laggy while a stressful amount of muted videos start playing and mouse-hover events start firing.

Compare this with mbasic.facebook.com, which is 22 requests, 107 KB, and 1.48 s. There are some small UX problems with basic HTML Facebook that I would recommend they improve on (placement of links/buttons, omnipresent header), but overall it is a much better experience for me since I feel much more in control. Same with basic HTML Gmail vs full Gmail.

My point is that it is absolutely possible to not give in to shitty bloated web trends driven by the expectation to increase popularity, while making a quality, profitable website.
>Purdue has known about the problem for decades. Even before OxyContin went on the market, clinical trials showed many patients weren’t getting 12 hours of relief. Since the drug’s debut in 1996, the company has been confronted with additional evidence, including complaints from doctors, reports from its own sales reps and independent research.

Someone involved in this is getting shot into the Sun, right?
Right, it's meant as a summary of everything to date. They've covered pretty much everything before.
Automata by Example – build cellular automata just by clicking around
Surprised they haven't back-channelled a suggestion he moves to a jurisdiction less hostile to the US, like Ecuador for example. They get all the benefits of the above while not needing to worry that FSB will break him or get something useful.
I have seen something similar on Ryanair.com - this is why I chose React instead of Angular when I was looking for a new frontend framework
There is no sane reason which would explain why you should not have bought a Pi. Open or not it would not make any difference to more than a small room full of people. A bunch of people spent years designing hardware and negotiating with people to get the Pi built at a low cost and it's become the best selling UK computer ever with over 10,000,000 sales. It's succeeded at what it was supposed to do; provide an educational platform for kids.
But there's a reason for hiding password input: [ed: making shoulder surfing a little harder]. Or unlocking a computer that's projecting to an audience. [ed: see also citizenfour where Snowden uses a blanket when typing in a pass phrase].

This is indeed not about password "theory", because experience shows that actual system (in)security happens where computer systems and users interact.

Using a common subset of keyboard layouts for different languages (limiting the character set), being workable on touch screens, are important for security. And using passwords at all is working around "bad platforms".

> The 11 bits of entropy refer to a dictionary of 2K words to choose from. The reason to type full ones is you're not hamstrung by the "no common prefix" limitation, which allows larger (and easier to remember) dictionaries.

From playing with this, I'm not convinced the tradeoff of using a big dictionary whose that cannot be enumerated by a short unique prefix (to reduce length) really adds that much - just like increasing the character set beyond 26/36 helps all that much - because you only gain a bit for every doubling in size.

My idea is for the mnemonic to form an actual "story" (in a secure way) - in the hope that it's easier to remember :
"boy flies angrily away" than "correct horse battery stapple".

A) that may be wrong

B) You still need too many words in order to encode a "high enough" entropy
It's possible to discover this without looking at the code at all, possibly even by accident, because it's going to be obvious to anyone who changed their keys that messages were automatically reencrypted to the new key when they receive them. That doesn't mean that issues which aren't user-visible would be found, and it took a long time for anyone to spot this one.