skysight-inc/HackerNews huggingface dataset:
>There is no arbitrary time length requirement for security.

No there isn't, but it is about letting more researchers take a crack at it. With well-known competitions, you can expect cryptographers to take a look at it.

The thing is, I've heard of lots of new hashes in the past couple years but only heard about curl when the vulnerability was found. I'm not saying I was on the lookout for new hashes but didn't find any, but how do you except people to check it out when no one really knows about it? Even decades of time is worthless when you have no one looking at it.

>There are standard tests (like avalanche) all of which Curl-P passed.

That's basic homework, not the real test, which is analysis done by people. Give me some tets, a couple months and I can come up with a hash function which passes those too.

>Curl-P is based on a well-studied sponge construction, so it’s not an especially risky move

Sure, sponge construction, while new has been studied due to Keccak. But you should've used keccak, instead of creating a new one(As they're doing now)

> Curl-P also has the advantage of being extremely simple. This makes it easier to vet as the analysis can be done more thoroughly, as it’s not obscured through complex internal mechanisms.

You know what, I'm not a cryptographer, so I'll quote what a real cryptographer - Bruce Schneier has to say about that.

“In 2017, leaving your crypto algorithm vulnerable to differential cryptanalysis is a rookie mistake. It says that no one of any calibre analyzed their system, and that the odds that their fix makes the system secure is low,”

What do you have to say to this?

>However, saying it is not close to being ready is false (unless we must put an arbitrary year requirement on it as you seem to be keen on).

Arbitrary year requirement seems frivolous, because you don't see the cryptographers who work hard quietly till they have an attack ready. It is to give time for them.

Take a look at previous competitions, where attacks surface many years after first publication.
You're exactly right and that makes me feel sick about how ugly the world works.
i'm not sure deepmind would publish a paper in which they describe a winning high stakes online no limit holdem player. the ethics would be quite shady. for all we know, they might have already done that just to see if it works.
The C5 instance only went GA a couple weeks ago, it takes a lot of lead time to get results like this up and there’s been a few slight snags users have reported with the C5 instances that may impact getting fair benchmarks written.
I recently cancelled Met Life Car Insurance. My new insurance policy was paid in advance so my old one probably was too. Met Life sent me to collections for a $180 bill they say I owed after cancelling. My agent, a broker, cannot explain why I owe the $180 since I had likely paid in advance. I also can't prove that I don't owe because I'd have to go back through nearly 10 years of statements to balance everything out. I'm buying a house and can't have the debt show up on my credit so I pay the bill. Obviously I'm still a little pissed about it. This article is making me wonder if Met Life or my agent released my details to a similar company when I cancelled.

As a side note, I wrote a letter to the president of Met Life insurance on another policy that they had failed to cancel. The president's office responded with a letter that said they corrected the date and that I had no balance. That letter came on the same day as another letter showing that it had been cancelled retroactively but that I owed a remainder of $25. Their letters were in conflict with each other.
Just run it in a separate process with a seccomp sandbox, using pipe/socket IPC with a timeout (if it's some anti-DoS/intrusion thing, just fail allowing the request, since it's going to have false negatives anyway).

The IPC cost should not be significant compared to the rest of the web server code.

Can also ask them to do the work and provide a small open source in-process shim that sets up and talks to the sandboxed process.
i think his server is being hugged to death causing issues
What were the predictions in 1992 and what level of confidence was assigned to them (the IPCC reports are very careful to assign confidence levels)? Also, there have been many generations of reports since then; why focus on 1992, 25 years ago? As far as I know, their predictions have been pretty good - though not perfectly accurate, of course.

There is so much nonsense posted about climate science; it would be great if someone could back up claims, perhaps by citing the IPCC reports or some serious analysis of them (i.e., in a prominent journal).
Seems like this is the direction the industry is going, however the actual service here is much worse than MoviePass' (seemingly unsustainable) model. MoviePass is $9.95 for one movie per day.

FTA:

>...customers who pay a monthly fee of $8.99 will receive a credit for one movie ticket a month. Subscribers can also buy additional tickets for $8.99 each and get a 20% discount on food and drinks.
I think part of the reason why Google even decided to make its own phones is because of security. If you read about their BeyondCorp enterprise security architecture, it emphasizes smartphone security quite a bit and how devices without timely updates, for instance, will be banned from the network (Google's own internal network that is).

Given how bad most Android OEMs are at keeping their devices up to date, Google didn't have much of a choice, other than relying on iPhones, too, for its internal security.

https://cloud.google.com/beyondcorp/
In Apple & Xerox case, legal council was involved. Xerox actually got paid to allow Apple to see their PARC demos. And no source code was shared.

And in the end, the Macintosh was a huge leap beyond the Alto, that really didn't work much like it at all.
I saw the pics of the 15 years old mock computer that was sent to the scammers, and the first thing that came to my mind is: if the scammers had kept it, they could make good money reselling it now as a piece of internet lore. I guess the internet has corrupted us :).
>95% of our test code mostly just exercises its own mocks.

How much time and effort goes into testing and otherwise validating the mocks?
Bitchute.com is just another centralized system, that happens to offload some of their costs onto their users. Using webtorrent is cute, but no conceptually no different than what early Spotify did. They still control what you're allowed to see.
Thanks for clarification. I never thought hard about how flutes work.

Still, based on your explanation, I feel that a fully-mechanical device that has hundreds of configurable tones and is operated through pressing a button should be feasible for easy mass-production and/or even 3D-printing.
Is the site broken for anyone else? I see {{ STATE }} when I get into the page and a bunch of template variables in the page. None of the controls work and I have disabled my adblock, https everywhere, etc.

EDIT: Never mind, false alarm
I have no idea what lawyers actually think but the fears I hear about generally don't come from lawyers. The most common fear I think is "we'll be forced to release our closed code!" But no, my intuition is that even with willful violation of something licensed under e.g. the AGPL which is supposed to force such a thing on a SaaS company, the worst case is something like: the company is hit with the maximum penalty for copyright infringement and will have to shell out a few hundred thousand dollars and someone goes to jail for a few years, and the company has to immediately stop distributing/serving products with the software on them until the software is either legally licensed, legally distributed, or replaced.
If I read the comment right (a big if, I'm terrible at interpreting sentences that end in the middle with storm of dots and an implication), then he/she is implying that obviously we never considered running code asynchronously.

If so, this implication was inaccurate.
It seems as though the cinema is finally entering a secular contraction. Home video hardware is getting cheaper and higher quality. Content going straight to netflix/hbo/hulu is getting better. And sitting in front of a movie sucking down 32oz of sugar water and fat soaked popcorn doesn't sound quite so appealing these days.

I'll see the new Star Wars, no doubt about that, but besides that I can't remember a time in my life when I went to the movies less than I do now. For the same price, I can get a nice meal out and watch a movie at home.
It's basically a measure for people interested in your project.

If people are interested in your project then that's a good indication that you're doing something right or at least solving a problem people care about.

I personally like the metric and do use it on my judgment if I should use a project or not. It's like a first filter.
Making Transaction mutable usually means its internal state is not 100% controlled by its implementation. The consumer of a Transaction object might be able to manipulate its state in an expected way (e.g. calling mutation methods in an unexpected ordering) and makes it invalid. So the unit test suite you write for Transaction will never cover all cases. You need to test Transaction in the context where it's used as well, e.g. the Account example. That means when you're writing tests for Account, you are actually testing Transaction at the same time. That's probably why it feels more like an integration test than a unit test.
> My objections to GMO crops are more around an aversion to industrial scale farming, monocultures, corporate-controlled seed stocks, and ultimately authenticity in the food I eat - not the health effects of the food itself.

Those are also (except maybe “authenticity”, since it's not clear what that concretely means; but I suspect it still applies with any coherent operationalization) at least as much of an issue with modern non-GMO crop development, including modern corporate industrial-scale organic agriculture

“GMO” is a distraction.
Linuxkit/kubernetes: minimal and immutable Kubernetes images built with LinuxKit
>The foods you eat have been genetically modified for centuries via breeding techniques

This is my go-to whenever people start talking about organic products. This article does a good job showing what crops used to look like:
http://www.businessinsider.com/what-foods-looked-like-before...
> I'm an American too :). "Driving is a privilege" is covered on the first day of every driver's education course.

Actions speaker louder than words. If driving was actually a privilege rather than a right, we'd be quick to revoke it on bad behavior, and we wouldn't enshrine car-first street and road design everywhere.

> Because the United States has comparably poor public transit infrastructure and the vast majority depend on driving for their basic livelihood.

You realize that right here, you're explaining why it's a right, not disputing that it is a right, yes? By your own admission now, we treat it as a right.

Yes, our very built environment enforces driving as a right. And whose idea was it to create communities where one was required to drive to live a normal life? Did we arrive in North America with wide roads and parking lots already laid out on the earth?

> Americans are more attached to cars (and largely for good reason--there aren't better options in most places).

Yes, we collectively decided to become attached to cars, because we saw them as a better way. And for some things they are, but there's a rather long list of negative side effects that have come along with our love affair.

> I've never heard "war on cars".

It most frequently pops up anywhere there's a serious movement to rebalance transportation towards a mix of modes, rather than focusing solely on private automobiles. Here's some examples:

- https://grist.files.wordpress.com/2011/01/warvauto.pdf

- http://www.economist.com/node/1155093

- https://mises.org/library/war-cars-war-workers-and-poor

- http://www.heritage.org/transportation/report/washingtons-wa...

- https://www.youtube.com/watch?v=k8Lo0ieyQtQ

- http://torontosun.com/opinion/editorials/editorial-torontos-...

- http://www.qchron.com/opinion/editorial/war-on-cars-also-a-w...

Having lived in Seattle, it's definitely something that's popped up a lot recently as the city has been adding bike lanes and investing heavily in transit, e.g. https://www.seattletimes.com/opinion/citys-vision-for-a-carl...
This is interesting, but it needs more data input for a more accurate picture for those who own a house, or hope to own one soon. Particularly those in the Bay Area, where the 10k SALT cap wouldn't be too difficult to run into.
All of the people who would get jobs if it wouldn't cut them off of their free/cheap housing and food stamps? You either qualify for subsidized housing or you don't (at least in my state).
It looks like that until all the javascript loads. The site is currently being hugged to death so it takes a minute.
It's a little lost in another comment thread (https://news.ycombinator.com/item?id=15862584), but I'm definitely excited about solutions like Patroni and Stolon that have come along more recently.
Cloud-hosted Mac build agents for CI/CD pipelines (preview) in VSTS
Anyone knows if Secure Boot on these laptops are locked down, or if they allow users to add additional keys?

i.e. can we run Linux on these?
Slightly tangential, but working for a small software company (<20 employees) who writes Line Of Business code for very large enterprise customers in the health care industry, we at times offer source code licenses, but at the very least (and this was my original point), our license as a vendor also includes source code escrow in the event of our collapse. We haven't really had anyone request a pre-sale source code review.
It has been out for like 3 minutes and the price has already gone from $6.95/month to $8.99/month to $9.95/month.
KubeCon recap: Day 1
Farthest supermassive black hole discovered
A geocaching app written in Node.js and JavaScript
If you generate 10k test cases that find edge cases you wouldn't have normally found, that's value. If the framework is deterministic and always runs the same 10k test cases, that's generally valuable as well.

I'm not aware of anyone currently looking to ensure their test cases our generated using cryptographically random data.
All business is a variation on this. If you're wanting to be a business person in a "nice" world where its not all about manipulation and sleight of hand then you can do that but you won't be mega successful.

Read up on Bill Gates Windows license contracts that the hardware manufacturers had to sign .... genius.

Truth is all in how you tell the story.
Although Wilson titles his piece The Early Stage Slump, he correctly goes on to say that this is a return to normal, that we believe 2012-16 was a bubble in early-stage funding.
How does this take on Moviepass? MoviePass lets you watch 1 movie per day, whereas this is 1 movie per month with a very modest discount on concessions.
Ah finally! XSLT for the JSON age :)
I agree it's not how it happens, but if everyone was aware of and valued the approach then maybe someday it will happen.
Being a child rapist is not 'having an alternative sexuality'.
California will burn until it rains and climate change may keep future rains away
Introducing Cairo GL ES v3
I really feel it doesn’t make much sense to generate assembly any longer. It’s much more reasonable to generate IR (for example for llvm). Then you get free optimizations and at least some portability. It’s probably easier as well to not keep track of registers.
Save 20% on a $10 soda!
I think their ideas about a business model are hogwash.

Even in places where the movies are $6/month, they would need huge numbers of people to sign up, and use the service 0-1 times per month, month after month..

That doesn't seem realistic. Even with their new contract model, I don't see this working.

I don't see how they could possibly survive without inventing a new revenue model.

In the meantime, I'll keep enjoying my VC subsidized movies :)
I agree with you. I think "the world is flat" fits into my second sentence... do downvote things that don't contribute to the conversation.
Yeah, now the concessions will only have 240% markup. Wooo.
I’m a security engineer at a large financial organization and we audit all 3rd party products most of these audits include a code review.

This is a compliance process and it’s controlled by the SEC.

All of your suggestions would make the company that I at least work for to simply walk away from table.

This has happened more than once and all of our contracts contain a clause that if the application does not get a pass from our application security team the procurement would not continue.
Couchbase Ecosystem at LinkedIn
Yeah, but it's so satisfying to see what you've produced.
I had the same uneasy feeling about determinants when I was studying linear algebra at the university. Years later I found Sheldon Axler’s “Linear Algebra done right”, and I loved it!
Simplifying the Management of Kubernetes with Docker Enterprise Edition
>> They should be more considerate of other developers who use .dev internally like them.

> Why? What do they owe anyone?

Your attitude is the root cause of so many problems.

The have a moral obligation to not be jerks. If you're not aware, one of the things jerks are known for is acting selfishly with no concern for how their actions affect others.

Google shouldn't have been allowed to buy a gTLD like dev in the first place. But, since it has and Google only plans on using it internally, it should only use it in ways that don't break existing usages.
You are confusing “fake” with “low quality”.
Transportation systems get people places. Cars get people places fast, and are so much more effective than the old methods (horses or walking) that their increased danger is worth it. They just need to be safe enough. Equivalently, it's so much easier to tabulate voting results with computers that we just need to make it reliable enough.
Tether: The $1B mystery near the heart of the biggest Bitcoin exchange
Another possibility is they're worried you'll go out of business. In that case, they don't need to see the code right now. You can set up a code escrow agreement in case you cease to exist.
The Murray, Cox book really is the best book on this topic. Criminal that it's out of print.
I was getting hit hard by robodialers for over a year. After a few weeks of picking up then immediately muting the call until it disconnected it's gone from one or more calls a day to about one a week. It could have been a coincidence, but it seems to have worked for me.
The calculator shows people who make a lot of money 1million+
and very little money < 50K will have a bigger federal tax bill.

they'll only be able to deduct 10k of the prop taxes too
All of these are reasons someone might conserve capital rather than deploy it.
The presumption here is that you are a team of Kent Beck's. Mine isn't.

Yes, with a lot of work and time, we can come up with very good abstractions so that all code is easy to understand and follow and unit tests are all we need. But we don't have that time, nor often the skill needed. What we need is a running product, today, for our customers.

Integration tests are a crutch. Some of us need crutches. And I don't feel like I should be ashamed to need one sometimes.
Confirmed. Posting this here rather than a new thread... https://www.reddit.com/r/NiceHash/comments/7i0s6o/official_p...

They owed me (edit: was myself) ~USD100 , being a week or so away from payout. I'm only mining to an external address - so that's only lost if they go out of business then I guess? Didn't like the thought of mining to their own wallets after trying it once before.

I hope they recover. I really like their software.
Esp. if you are actually trying to spread confusion.

It's a depression ass state of affairs no matter how you slice it.

I sometimes wonder if a truly impartial AI 'judge' can solve this; but even if we achieve some form of advanced AI that could act as that judge I can imagine some people would still fighting tooth and nail because, of course, the creators of the Ai have somehow influenced it's 'thinking' and therefor it is invalid to them.
I find it interesting that the most notable names from P0 team aren't native US citizens.

Even with dual citizenship they won't get clearance easily to work for NSA.
It would be lovely, but this hypothesis is not confirmed by our observation.
I'm the writer of this post! I absolutely agree with you.
Concessions are how most theaters make any money. What do you suggest instead?
Doesn't have to be perfectly accurate - it only has to be in the ballpark of the correct amount and with low deviation. In voting, a method with consistent +/- 1% error is better than a method that generally has +/- 0.0000001% error but can be trivially hacked to produce +/- 50% error. Elections aren't usually decided on a single vote, and in those rare cases, you can recount stuff few more times to be sure.
There's a lot of technical focus here. For me, it's about the money. If a client is going to pay me £3m to use my software, you're damn right they can review our source code. As the amount of revenue/profit declines, so too does my desire to expose my business to the risk of a source code review.
I love calculators. What I haven't seen yet is a calculator that shows you where the money originated from. How much of my tax deduction is new debt, vs money stripped from Medicare, Social Security, College Graduate deductions, etc. It's not enough to know how much more I am getting, but where the money originated from.
Would be nice to include a field for long-term capital gains. Removal of the state income-tax deduction changes the effective tax rate for those gains, which would help someone decide whether to realize those gains in the remaining weeks of 2017 or else to keep holding.
Most cases are settled out of court or aren't publicized.

https://sfconservancy.org/docs/2010-07-27_dj-opinion.pdf interesting read
Uh yeah, that's my point. Running code from some random server on your machine without verifying it first is a terrible idea.

We really need to start seeing the internet as a dark and scary place again. There's too much blind trust nowadays.
It's technology and it's revolutionary. Both of those things tend to break all known patterns. Look at when corporations were invented or any other major tech revolution.

It could well be the first example of something going so high. It's unlikely but I wouldn't say it's 100% sure to crash.
The “no” isn't warranted, because the grandparent didn't say honesty which previously existed had eroded, but that the expectation of honesty had eroded. Consistent dishonesty with that becoming more transparent is one explanation of that observed effect, not a refutation of it.
http://www.politifact.com/truth-o-meter/statements/2015/jun/...

It should also be noted that the data set they used only include mass killing with guns, and not mass stabbings. Those also happens, including here in Sweden a year ago at a school. But if you don't like that data then bring more and we can discuss.

https://www.cdc.gov/nchs/pressroom/sosmap/Firearm.htm

Two things pops out. First that the variance is massive within the united states. The second part is that 63 percent were suicides. It is very doubtful that a single correlating factor accounts for the variance.
his github project if you want to run it locally: https://github.com/brockwhittaker/House-Senate-Tax-Bills/