skysight-inc/HackerNews huggingface dataset:
None at all! Unless it were actively and carefully manipulated to undo your specific RNG (i.e. were not independent) which is absurd, you can use it as one source no problem.

Imagine you have six sources of entropy and they all suck except the third one, which is independent and works. All the others are actively working together to manipulate your result.

Then xor'ing the bits

a xor b xor c xor d xor e xor f

can be rearranged to

(a xor b xor d xor e xor f) xor c

and it is the exact same expression. (xor is commutative.)

But now it's clear that C acts like a "one time pad" on the whole rest of the expression, making it truly random.

Of course, if it's not independent, for example if A is reading C and set equal to it, then this argument does not apply.

But it is highly unlikely that this beacon could be specifically manipulated to target weakening a single specific user of it. For one thing it couldn't be done with more than one person at a time.

So we can ignore the possibility that it is not independent of your other sources of entropy.

Go ahead, go wild including it.

(I say this even though I place the likelihood that this beacon is backdoored and predictable to the government, at 200:1 in favor.)

Two techniques you can use:

1. Mix with other sources of entropy such as number of milliseconds on the system clock. Doesn't matter if they're weak - do this yourself.

2. Draw from the beacon continuously, discarding values when you don't need thsm. Don't just draw when you need it.

These two techniques will make it almost impossible to reconstruct the random numbers, even if the sequence were predictable by someone.

By contrast, only using this beacon mixed with a backdoored rng, without xoring by some function of the system clock yourself, and only drawing the number of bits you need and doing so every time you need them, will make your solution considerably easier to bruteforce if your rng is backdoored.
this isn't "no plans to support wayland" - these drivers are built to support wayland. It's the Xwayland translation layer they're talking about here, which (I think - my understanding is a bit thin here) is for running applications that are compiled to use X11 graphics in a wayland environment.

So: it could well be that this is an issue of resource allocation more than anything else. Over time, most applications should move to using wayland (or whatever window / surface library emerges as the clear winner, but that looks like wayland is the future here) for their graphics. A lot of effort into supporting Xwayland would mean work spent on a library that should be of limited utility - only useful during the transition between platforms (like the old carbon layer for OSX in the early 10.0, 10.1 days). Right? Or maybe I'm misreading it.
Latest BlackHat Arsenal USA 2017 Tools and Their GitHub Repositories [UPDATED]
How to split a three-way RAID1 array (SoYouStart)
Right now, we're in the middle of a change freeze and have just finished our major project for the year. I've spent the last few weeks going off on my own and documenting things, automating things, tinkering with things etc and I'm literally out of things to do. Sure the odd task or two crops up every couple of hours but in between them I have lots of free time - at least until next month when it all kicks off again.
Until you look at an officer the wrong way. Or their friend. Or someone else with the ear of the boys in blue.
This is a confusing statement since you /s

You don't need a address to send mail - sellers.

Personal use can be huge amounts - buyers

I can't see many dealers using dark markets above plausible personal use amounts since you get caught importing dealable quantities you are screwed, dark market or not (And the mail system will get a % of buyers). You might have a $1000 per week habit or be a $1000 per week dealer. Who's to say?
Because I want to cancel it.
> They learn something about the framework at the present time, which may be worthless after the next breaking change, and is not generally applicable to the web platform itself.

You are underestimating the appeal and intellectual stimulation gotten from learning something new regardless of merit.
The rest of the article amounts to a few points:

- Humans make mistakes, the tools should have been better

- The technology to make Ethereum safe doesn't really exist

- We should work to make that technology exist

- We should be happy this happened since it raises awareness about the problem

> In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open.

What?!

Listen, just because Valgrind exists doesn't mean you can't accidentally write a C program with memory errors. Just because Rust protects against race conditions doesn't mean you can't have bugs in your threading code. We're not even close to a world where tools can offer amazing protection.

> The developer here was Gavin Wood, one of the co-creators of Ethereum, and the inventor of Solidity, the smart contract programming language. The code was also reviewed by other Parity contributors. This is basically the highest standard of programming that exists in the Ethereum ecosystem.

This was an error made by the best of the best, reviewed by the best of the best. The tools that will save us from this madness don't exist. What does this mean for Joe Developer? It means he's not going to build something that he keeps anything of value on. The author's cheery "we'll be stronger for this!" attitude completely neglects the obvious chilling effect that this is having. If the guy that invented the damn thing can't protect his $31 million dollars, why would I even try to build something that could manage even hundreds of dollars?

And to that end, is it really better than a traditional system?
Do neural cliques have “dimensions”?
I'm not sure it's worse, since it requires users to type their password into a non- google.com domain. Whereas the oauth phishing, everything was on google.com so it looked legit.
.. and this wasn't even the first time. And this is all by design.
previous discussion: https://news.ycombinator.com/item?id=14807779
Even better would be if Android were to stop popping up its own stupid notifications. Since getting a new Android 6 phone (stock Moto G4 Play), I've seen:

• regular pop-ups explaining how to do basic things with my phone like swipe (thanks Google, I already know all of this, please get out of my way, I am busy);

• pop-ups in Google Maps trying to tell me where to eat (no Google, I do not want your paid recommendations that cover half the screen); and

• audio pop-ups (!) telling me how to do hands-free chat while I'm playing music through a loudspeaker (seriously… WTF??)

None of which I have been able to figure out how to disable.

These notifications make the interface seem unreliable, childish, and unrefined. Is there not someone at Google – like Jobs – who has the authority and charge to identify and stamp out these user-hostile behaviors, and the flawed internal processes that reward managers/developers who implement them?
Render Word to PCL and Display Document Title in TitleBar of PDF Viewer in Android
Evaluate people at their best or their worst?
I say this is a good thing. Bubble benefits no one.
I have never pitched a VC but this was surprising. A pitch that requires a specific person who hasn't yet been hired? What if the person is unavailable? This seems to be misleading specificity.
"Is there really such a thing as "unbreakable cryptography"?"

Yes. One time pads are unbreakable.

"Even after the aliens from Andromeda land with their massive spaceships and undreamed-of computing power, they will not be able to read the Soviet spy messages encrypted with one-time pads (unless they can also go back in time and get the one-time pads)." (Bruce Schneier, Applied Cryptography)
No. It's X11 implementation over Wayland.
So according to the numerous comments below asking the relatively similar question, it was difficult to run the business, partially because good teachers are hard to find and partly because the program is intense on the student and lastly because the money to run such operations is unsustainable in the long run.

There is a business model that works but the industry is still in an exploratory phase in trying to discover it.
I totally agree! We keep adding more layers to the web stack. Even Django and Rails themselves were added complexity!

I've actually built a solution to this problem called Statebus: https://stateb.us

It takes a unique approach to the problem — instead of building more layers in the web stack, it builds support for change directly into HTTP itself! It turns out that if HTTP supports changing pages, and keeping things synchronized, you don't need web frameworks at all anymore.
Looking at the most recent Steam Hardware & Software Survey, Linux share is at 0.72% and shrinking (a year ago it was 0.81% two years ago it was 0.89%).
Bears are very good Turks
I was surprised by this as well, when I think of Greenville and tech startup-ish companies, I think of the The Iron Yard. Are there any other companies around with that sort of strong presence? I haven't lived in Greenville for two years now but I've had thoughts of moving back there.
> The startup pace is fast, and you need to be creative, think on your feet, and come up with solutions as quickly as possible.

A more accurate description is: The startup risk tolerance is extremely high, thus it rewards quick and dirty over well thought out and solid.

This is often opposite to academic work, which needs to be well thought out and rigorous to an extent, though not necessarily in code quality. The code just needs to work for the experiment and be correct. It doesn't need to be maintained, extended, and debatably, communicated. This is also probably why startups tend to hire younger people, rather than older developers who've worked for places where the risk tolerance is very low and thus they take the time to make sure things are very solid.
I already pointed out multiple times, that Steam survey is useless for evaluating Linux gaming market. Why would Steam even need a survey? They have full stats available, but they aren't public.

And what's important is sales potential, which you can evaluate by sales percentages per OS for cross platform games. Steam doesn't publish such numbers. Humble Bundle does though.
The one that confuses me is AB 71. Aren't 2nd and 3rd homes basically rental stock? Owned by individuals and not the Irving Company if you care about that.
Lol, poniverse? Like my little pony?
Wow, that first story is just brutal. Poor guy.

I would like to hear his side of the story. Maybe he was like "what kind of ridiculous problem do these people ask, I cannot wait to get out of here"
= USD$480k according to https://coinmarketcap.com/ ... and about 1/30th of global Monero trading volume in the last 24 hours.

The source for assets seized is https://www.justice.gov/opa/press-release/file/982821/downlo... which also lists properties in various countries, vehicles, bank accounts, cryptocurrency accounts, etc.
> In the end, attacks like this are good for the community.

I'm sorry, but what a bunch of baloney.
I think you're vastly underestimating the number of deadly mistakes doctors and lawyers and other such licensed professionals make every day. Just look at Enron!

Maybe such a system would keep out the very worst programmers but I doubt someone hacking on Ethereum smart contracts falls into that bucket anyways.
Without speaking too much FUD from the X11 side the main issues facing workstation use cases are input handling and permissions. The current wayland party line is "just use dbus to communicate between windows." This is complete madness because it basically means that if you want programs to be able to work together and not steal each others keybinds they all have to depend on a message passing framework. Full disclosure I have done everything in my power to avoid installing dbus and having dbus dependencies, but it is getting harder and harder. That said, it doesn't matter what you think about dbus, it is completely unrealistic to expect that every piece of gui software written for linux to be rewritten to include dbus. This is basically going back to the days of cooperative multitasking and I think we all know how that ended, the overhead is just too high.
Agreed.

Religion is a non starter for me but I would like to find some community groups doing good things with good people.

I know about meetup.com etc but I'd like to have ties with something a little deeper. Preferably something without political and especially without supernatural overtones.

I see there being a big need for this in the modern world.
Seems like an productized implementation of Hyperlapse: https://www.youtube.com/watch?v=SOpwHaQnRSY
Yes, so you end up having to select a person that is mutually agreeable between the parties or something, and that person is then responsible for judging the evidence. In my experience the problem has been that finding a mutually agreeable person is quite difficult, especially when one side makes a pre-emptive threat to make false allegations about a judge that rules against them :(. I literally ran into this problem in rbtc: https://www.reddit.com/r/btc/comments/589nlj/someone_asked_m...

(although, again, zk-snarks and formal verification might be workable, but only in situations where all parties can forego making false accusations about who backdoored what or who has secret knowledge about formal verification holes or whatever...)
I agree with your summary but does it not demonstrate a lack of thorough process control?
> This isn't a bug

Boo hoo. Did I say it's a bug? I said it's a security issue. It's also an exceptionally stupid thing to have as standard behavior without warning. It demonstrates poor priorities and ideas about safety on the part of LastPass.
hey I could help, please email me at convnet@protonmail.com
Ask HN: What happened to Visual Thought?
I was looking around for a good graph drawing program recently and I realized that there still doesn't seem to be anything as slick, easy-to-use, and cross-platform as Confluent's old Visual Thought from the early 2000s.

I understand the company went under, but how could that happen? Visual Thought had a lot of fans even back then. Surely they could have just supported it profitably as a crisp, well-designed, cross-platform diagramming tool that emphasized ease-of-use and graph-drawing.
RocketFuel sold for 125M dollars
It's a risky game. We've had a major accelerator application, proceeded to an interview, they requested our business plan which we promptly sent to them. Then they went silent and stopped taking our calls or answering emails. We moved on, only to discover that their alumni for this batch included a similar company that was shameless enough even to use complete sentences out of our business plan. I avoid everything that's linked to that accelerator or people from it since then.
Or work move to countries without red tape around the job. Unlike masonry, software is easily shipped.
> $80K/year...in freaking Ohio

I don't get this sentence, is this good or bad? I grew up in Ohio and for the majority of people I know there, they would be absolutely thrilled at that salary. The cost of living is nowhere near SF levels.

The "freaking Ohio" part, yeah I can understand that for a lot of parts of Ohio, but it's highly dependent on where in the state you're talking about.
EditorConfig is awesome, especially for a distributed remote team. I've standardized everyone whom I ever worked with few initial project settings and EditorConfig is such one must-do item. Been using it (I think) for the past 5 years or so.
Great read. Thanks!
This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion:

> The problem is that his programming toolchain allowed him to make these mistakes.

Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wallet-not-a....

...but hey, if this ends up making Ethereum better, more secure and more robust as a result, then that's a good thing; it probably does need a different better language to express code in.

Just remember...

> certainly you should not store any money in a hot wallet that you’re not comfortable losing.
Yes, exactly like My Little Pony. We currently manage the largest collection of MLP fan sites in the world, utilising dedicated server infrastructure to run our enterprise-level Proxmox cluster. We do have some experience with IT :P
Huh. The Factorio community also ran into hanging downloads, and it also seemed to the devs to be caused by checksums[1][2].

I think they had much the same solution, mix a random number into the packet. (They use UDP, so they didn't have the benefit of TCP timestamps.)

[1]: https://www.factorio.com/blog/post/fff-176

[2]: https://www.reddit.com/r/factorio/comments/5rvkyp/friday_fac...
FWIW, the lawyers in this thread tuned out at this point. Nothing is very simple in law, but the ambiguities of criminal conspiracy are reasonably distant from the situation you've described. Conspiracy requires communication in order to agree to commit a crime. Positing a kind of thought that communicates doesn't really muddy the waters much.

I don't think the philosophers engaged, either. Redefining thought to be imperceptible denies everything we actually do know about the biological process of thought, so it's not clear the discussion leads anywhere worth going.
Also, I really loved Warehouse 13 too.
To be honest, I can put up with the less than graphics. What really got me was the regular hangs that would happen. I spent a fairly long time trying out different things to debug it, and eventually reported the hangs to the DRM list. While they were helpful, their answer was to update my kernel. It worked, but I am not comfortable having to run at head just to play old video games.
https://arstechnica.com/security/2017/03/potent-lastpass-exp...

for a real link to the same article
2048^3 – 2048 in 3D with pure HTML and CSS
I am going to go out on a limb here and say it has nothing to do with the code school business model but instead by the for-profit colleges that bought both the Iron Yard and Dev School (which shut down recently).

It is my belief that for-profit schools (in these cases Apollo Group and Kaplan Test Prep) have looked at code schools as potential cash cows devoid of the complications of both federal financial aid and the gainful employment entanglements associated with the "type" of students that typical for-profits schools attract. While for-profits seemed like a perfect fit for acquiring code schools (and I'm sure led to handsome paydays for the founders), these businesses brought bloat, inefficiencies, and baggage that could not operate in the fast-paced and nimble environments they bought into.

I can't speak for these two code schools but I heard from a reliable first-hand source that when Dev Mountain was bought out by Capella Education, the founders "checked out." What checked in was a bureaucracy that was more concerned about asses-in-seats than providing a bleeding-edge, entrepreneurial-driven education. If you look at the reviews of Dev Mountain by recent students there is no doubt whatsoever that this is what happened. Is this possibly what befell Iron Yard and Dev School? I can't say. What I can say from decades is that when you sell out to a for-profit school, you are very well dancing with the devil.
The EVM might be Turing complete but you can still have languages that compile down to only some tractable sub-set of the possible EVM programs.

The interesting question is whether a language can be design which allows the important domain-relevant requirements to written down in an understandable way and also proved rigorously.

So far neither lawyers nor programmers have done a very good job of this in their respective field. Watching people trying to do it in both fields simultaneously sounds like popcorn time to me.
https://yumefood.com.au - a wholesale marketplace for surplus food. We use Vue and it's serving our needs really well.
From the question without even reading a thing, why would any set of events follow a gaussian?
From Intel's perspective, everything went perfectly.
I've been hearing this for over 10 years.
How is C used in mobile? Do people write something in C and then cross compile it to Java?

Sorry for the newb question.
It's interesting that people on that forum are calling him a liar for claiming to drive a Porsche etc. Reading it myself I was like "wow this guy is a liar, what a tall tale."

But then in the indictment (or whatever the correct term is for the legal document linked in the parent comment) they seize a Lamborghini and a Porsche and various villas and several big piles of money etc.

Color me surprised.
They want everything to hit a Bell Curve because that is the only thing they remember from statistics class.

I've had debates that not everything comes out as a Bell Curve only to be called an idiot for claiming that.
It's not as contradictory as it sounds. Many such practices are fairly well know to general audiences from causal reading of articles just like this, but the practices often aren't identified as such by those who are subjected to it, or if it is identified, the practice works regardless. Take for example here on HN the large number of people who dismiss many of the practices of social media likes but get upset when their post is downvoted.

Such practices have a major effect on people regardless of how aware they are of what's actually going on.
I love how the assumption is that the problem is with the interviewee rather than the startup - so confident of this, in fact, that they feel obliged to write a blog post asserting this.

Defensive anyone?

Notice the assumption here, that their 20-minute task is a perfectly reliable indicator of how the interviewee would behave in general.

The interviewee was right to leave them without saying a word.

God I get sick of the smugness. You can cut it with a knife.
A house in Tahoe you use 3 weeks a year is not really rental stock, and it's not clear what benefit the public gets from your 2nd home that would justify a tax subsidy
No need to hear it. You can observe the growth.
Russian YouTube serves Putin
What, do you type with your hooves?
Now, having read some comments, do not get lost in your assumptions (which implies you should know your assumptions). It's really that simple.
You don't do that. Each one is usually allocated on its own, and you keep a pointer to each. Though you could store them contiguously if each contains a length member or they're delimited in some other way.
For example: my router/AP/modem combo-box — which is the standard one that Comcast has been giving to all subscribers — when reset or power cycled, will forget the WiFi key. It just gets reset to the factory default. Every, single, time. And it's just they key: the SSID doesn't get reset. It's not the first modem I've had, either; its predecessor was the same make, had the exact same behavior.

I suspect it's because I'm using an actual key, instead of a passphrase, and nobody else does that. (Or, at least, not enough for Comcast to notice that the problem is them.)

The old one got returned b/c it was routinely dropping IPv6 packets. It took a while — multiple vists from multiple technicians — to convince Comcast that the symptom of "100% packet loss over IPv6, 0% packet loss over IPv4" was not a problem with the coax cable.

The predecessor of that modem got replaced when it had extreme difficulty forming IPv4 connections: almost all SYNs never got a SYN ACK, but in the rare case that they did, that connection proceeded with 0% packet loss. I highly suspect there was something going horridly wrong with its NAT processing, but that's a guess.
I found Enpass rather unfeatureful. It doesn't even have an option to use multiple vaults.
Only if they're really random. See Venona.