skysight-inc/HackerNews huggingface dataset:
You can of course do network analysis and say "this looks TLS encrypted with X algo" then dive into those packets and then say "this looks end to end encrypted with X algo".

You can also look into a binary application and study jumps, where the private key gets loaded into memory etc etc.

I am with you on this, there is tons of low hanging fruit you can do on a binary application, and I do a lot of this sort of thing myself.

Making sure an application at a high level seems to do what it says on the tin is a great phase one audit of something as a baseline, and should be done even on open source projects.

Trouble with closed source tools is you either have to do this over and over again on every new binary released, -or- you can look at the diffs from one release to next and see if any of those critical codepaths have changed.

You also -much- more easily evaluate bad entropy in key generation if you have the source code. People think they are clever all the time using silly approaches along the lines of random.seed(time.now()+"somestring") and it is much less time consuming to spot those types of flaws if you have the code.

This is why I argue you need both whitebox and blackbox testing when it comes to mission critical security tools, and a clear public auditable log of changes made to a codebase so review can continually happen, instead of only at specific checkpoints.

Again, some people may not care about that level of rigor and just want to share memes with their friends instead of journalists communicating in the feild. I tried to be pretty comprehensive with the list, and welcome recommendations for new objective criteria to include.

It is currently roughly sorted by security. Usability is subjective and people can work down the list to the most secure tool they feel they can comfortably use.
Great point! I think the GP's intention was to note that the designer could choose to partner with a manufacturing place to provide pre-made kits for these (like UGears does).
Would be interested to see if I can be of any help. I think I have seemingly opposite problem. I go to various parks with a small board which says "Not any professional. But if you want you can have a nice short talk. No commitments."
That assumes you "only" have to deal with the static mass of $5.8 trillion debt. It gets even more complicated when you have to deal with the factors that have been building that debt in the first place.
Wouldn't addressing the causes of the debt build-up have an even harsher impact on the economy?
I can only think of product managers deserving such high salaries for customer facing products. They can act as translators between end users and engineers. Having worked on purely backend ML code, I find PMs to be mostly clueless about how the product is built. Even after spending years on a product they may not understand simple things like names of different components and what they do. Even during quarterly planning meetings, which is the PMs time to shine, half of the ideas on the table can be dismissed for being impractical and the other half require some data collection to dismiss. At least for backend work I think a Tech Lead can do all the tasks of a PM.
Nodejs might also be a good option. It’s comparable to go on a core for core basis, and IIRC GOMAXPROCS is 1 on GAE.
i took a compilers course once in ocaml and asked the professor about fftw and he didn't know about it...

i was like

DUDE YOU MUST SEE THIS IS THE COOLEST APPLICATION OF OCAML COMPILERS EVER
Trending indicates it is continuously developing. So we started from nothing, went to dreaful, then to bad, then got better. Now we have Trump.
U.S. online giant Zillow launches first Canadian property listings
Put yourself in his shoes, do you prefer to go after the stock or have him do something desperate and bring a rando with 'cofounder' power to your business? Don't know the specifics, but I know better than to judge quickly.
please don't tell me you believe Google apps are superior in any category than their alternative

Brave it's superior to Chrome

Nine/Aquamail is superior to Gmail

Poweramp/Retro etc it's superior to whatever Google has

just for categories you mentioned
I hope your friends read this! Sounds like you value money - just business - incomparably more than friendship. Why?!
This looks like a super interesting project, but the website is (intentionally?) confusing and I don't get what it does.
Nothing new to add, just wanted to say How I Built This is a fantastic podcast. :)
Somewhat related: I've always enjoyed that the matrix multiplication algorithms with the best theoretical time complexity, are completely impractical for use on real-world matrix multiplication problems.

Wikipedia describes why people use the Strassen algorithm in real-world implementations, despite its inferior asymptotic time complexity [0] :

> unlike the Strassen algorithm, it is not used in practice because it only provides an advantage for matrices so large that they cannot be processed by modern hardware.

[0] https://en.wikipedia.org/wiki/Coppersmith%E2%80%93Winograd_a...
Yes. This way the users know to protect themselves as quickly as possible. It's not like they made the app easier to hack with the information in the article, anyone who looks at the app will see the data.
Actually, that's not the purpose of [citation needed]. Adding a death date without a reference is very close to violation of [[WP:BIO]]. When I created [citation needed], I didn't envision it to be used for just adding any old data or information into articles, especially this sort of thing.
> The Soviet leaders were omnipotent enough to plunge half of the developed world into 70 years of darkness and decay.

Please read a history book.
Any suggestions for quickly doing the following: When I clone a former repo on GitHub, I want to also add the original repo I formed from, as the upstream remote. This way I have the original repo which is mine and the upstream repo which is the original. So far I've been doing this manually.
Aren't mercenaries also essentially encouraged to be war criminals by the Geneva Convention ironically? They are always unlawful combatants. They receive no protection from it and thus are encouraged to be brutal indirectly. While a seminal work the Geneva Convention had its own politicking embedded within like the bias against expanding rounds which are useful in a situationally tactical and ironically slightly humanitarian way by risking less overpenetration.

There are some good arguments against mercenaries incentive wise as being bad for peace. Ironically Military Industrial Complexes have even worse incentives - an amoral actor (out to maximize gain and indifferent to suffering not inflicting it gratuitously) might want to start a war but it should be one they would win and survive. A MIC with the same lack of morality would care only about generating demand and not victory as seen as early as Civil War profiteers who sold shoddy goods. On the other hand one advantage a MIC has is they are content with cold wars and stockpiling. The underlying problem war for profit is sadly ancient - before there was such a thing as a MIC many would fight openly for the sake of plunder and profit.
I believe China is about to tank as hard as the Russian empire. There is going to be a revolution. What the trigger will be remains to be seen, but it can be just about anything. Most likely it will be something within that we see as inconsequential.
This isn't a courtroom. It isn't a murder trial. It's a conversation and I see zero reason to rebut speculation wondering what really happened to someone's late mother, as if they aren't allowed to think out loud and must prove X beyond a shadow of a doubt.

Comments of that ilk on HN are something of a personal pet peeve.
Or maybe, now that everyone's enraged that a journalist was brutally killed, it is a good opportunity to ask the sticky question "OK, what do we do when an American does something similar?" Because now it's a bit inconvenient to claim the difficulty of realpolitik and how your sound sleep at night is sustained by hardworking ex-soldiers murdering people in Yemen's streets.
My point about "understanding the code" and the burden of additional information to retain is about the semantics applicable to the language itself, not about the tooling that we have build around it for development.

Lisp started with some core simple ideas to which were added many others. For some like the dynamic scoping, simple idea that it is, it has complexity interactions with the rest of the language. These interactions increase the knowledge burden that must be retained at all times to be able to make sense of what you are reading. This burden is on top of any knowledge burden you need to carry in relation to the application you are modifying or maintaining.

This is about what are the things you design as part of your language, not the things you do with your language. This was what I was trying to somewhat humorously write in my first comment. As I look back over it, I failed to make that clear.

Lisp had the beginnings of "wow", but then it took a wrong turn down into a semantic quagmire. Scheme started to fix that and later Kernel was another attempt.
Does context.background() works ?
There was a discussion the other day that the Bump team merged into Google Photos, which is certainly a creditable application, but not maybe as distinctive as Bump was.

Sort of tragic that the company folded, could have been a nice lifestyle app for someone I think.
I'm an experienced programmer and I want effective visualizations. I strongly believe that domain-specific visualizations are the way forward to real progress, even if we haven't created a practical one yet.
I loved him because he was a proper guitar geek. Owner of a lot of vintage stuff and really a good player too. A lot of people wanted him to buy and revive Gibson.
There are a lot of ugly actors out there, so no matter what scars you have, don’t let them get in the way of your passion. Heck, get famous and someone will ask for a body mod to look more like you.
Learning While Sleeping; the Challenges of Inequality
"Spear Operations Group, according to three sources, arranged for the UAE to give military rank to the Americans involved in the mission, which might provide them legal cover."

"Aside from moral objections, for-profit targeted assassinations add new dilemmas to modern warfare. Private mercenaries operate outside the US military’s chain of command, so if they make mistakes or commit war crimes, there is no clear system for holding them accountable. If the mercenaries had killed a civilian in the street, who would have even investigated?"

In this case the questions have easy answers. Some country recognized the individuals as having a rank in their military, and they were on a mission sanctioned by that country. Thus it is the same as if any other soldier from that country had committed such actions (accident, target, otherwise).

However that does highlight other questions.

What is a country?
What is the distinction between warriors:
* for a country in an official capacity?
* Is an external entity fulfilling an official contract acting in such a capacity? (Historically, yes)
* for a country in a resistance capacity?
* for an entity not recognized as a country in any possible capacities?
* fighting for their own sense of honor/justice?

In the easy cases it might be possible to judge the relative morally correct side by the actions of those involved. In an absolute sense if all were to suddenly act in ways perceived as good and respectful that would be good overall. In another the minimum required force to remove the unjust from the power to inflict that upon others would also be justice. Yet it is also important to ask why they have this power and are tolerated; solving those issues is surely the longer term justice.
I actually looked at this before making my other comment. You’re absolutely right about the salt. One of the go benchmarks is basically pure cgo using vector intrinsics. It naturally blows idiomatic JS out of the water. So you might get those kind of results if that’s the kind of code you’re going to write, but it’s far from what I consider idiomatic. Another language’s proponent would be fair to point out that most languages have C FFIs.
Period-true as in from 1970s. There were attempts to build fuzzy Prolog dialects in late 1980s, although it seems not particularly successful.

> If I implement Lisp in Prolog, the interpreter may be Prolog, but the programs it then evaluates are Lisp.

But it does not implement Lisp in Prolog. It implements a domain specific language in Lisp in a time proven manner. Googling "DSL Lisp" will give you probably hundreds of references. I did it before for my own projects and my "languages" even had no name. I could call it VARLANG-22 or whatever, but unless I told you all you'd see is some Lisp code.

> I don't see why unification would be an impediment in implementing any heuristics or scheduling algorithms.

It does not bring anything to the table there, because that's not how those systems work. Not every project is a first order predicate logic expression, as incredible as it sounds.
Scientists chase mystery of how dogs process words
Not an idiot. "Less knowledgeable about details of how a country other than your own was governed more than a century ago" does not deserve the label "idiot".
Assuming you’re not actually in the military...if there was sufficient evidence I believe you could get prosecuted on your return to the US. The mercenaries in the article got UAE military ranks to avoid this.

18 U.S.C. §956 - “Conspiracy to kill, kidnap, maim, or injure persons or damage property in a foreign country” - https://www.law.cornell.edu/uscode/text/18/956

Conversely, if you’re a foreign citizen but you murder a US citizen while abroad, that’s a crime in the US and you’d be jailed if they could ever get you here.

18 U.S.C. §1119 - “Foreign murder of United States nationals” - https://www.law.cornell.edu/uscode/text/18/1119
Stories like yours and the grandparent comment give the impression that there is little communication actually happening in an interview. I guess if it was an at home assignment given in an email you might not know what the interviewer wanted, but in an actual in-person interview why wouldn't you just say "Well, you could do String.reverse(), is that what you're looking for[?], or would you like me to implement a solution without using String.reverse() or some other way?"

And on the other side, if the interviewers are looking to identify whether a candidate knows about String.reverse() and the candidate starts writing out some 20 line algorithm on the whiteboard, why would you just sit there and watch instead of being like "actually, we're looking for something else, let me ask it a different way; do you know how to reverse a list using the standard library? We're looking for a one-liner here, not an full algorithm implemented on the board."

If your story is true, then apparently there are at least some interviewers willing to just sit there while a candidate writes out 2 completely different algorithms on a whiteboard without interrupting and communicating what they actually want. Such an interviewer is either socially incompetent or trying to make a fool out of the candidate. Either way it doesn't reflect well on the company.
That equivalence does not follow. The counterpoint is simple: can people figure out how to get burner numbers? Yes, they can: there are a myriad of services for doing so. And, importantly: journalists already know how.
Autonomous electric air taxi service to arrive in New Zealand
Seven Square Miles
You are generally legally required to pay some tax on overseas income of that size. https://www.irs.gov/individuals/international-taxpayers/fore...
ChuChu TV is responsible for widely-viewed toddler content on YouTube
Why does everyone seem to make the same mistake? DO NOT roll your own crypto.
I don't know about DSPs, but the general concept is (https://en.wikipedia.org/wiki/Profile-guided_optimization)

The ATLAS BLAS/LAPACK library also uses a similar technique.
I don't agree. Maybe if they just reported it instead of sending the data. That implies malicious intent.
I want to offer a counterpoint: it’s restrictions that make us more creative. There’s a reason why all of our most famous and ancient writers use some kind of line metric.

Being bored forces you to work within your restrictions to have fun. Just observe your toddler with a “dumb” toy versus and iPad.
If you really believe that, then you must understand that 99% of a loaf is better than none.

Docs, Hangouts, YouTube. All very difficult to censor. Its whack a mole, complicated by https. Information wants to be free.

Standing on principle here denies them that 99%. Are you going to make that call for them, or should they make it for themselves?
I see more and more propaganda about china recently than before
Thought experiment: If Sears had had access to modern e-commerce targeting algorithms a century ago, is it possible that some of the progressive effects of the catalog might never have been realized? Imagine algorithms identifying poor and black customers and promoting products that were already popular for those demographics, making it harder to discover other locally-unavailable products like musical instruments.
The Sears bankruptcy wasn’t inevitable
I haven't read either, but from you saying you 'think they copied' it to rococode saying 'there don't appear to be any signs of plagiarism' seems quite a gap. What makes you say they copied it?
Moving everyone off-planet, no. Getting a presence up there, and creating off-planet production sites on the other hand, would be quite handy on the other hand. That way we could reduce the impact industrial production has on the planet.
I use mnemonic devices (Rhymes, non-wester geography, latin or greek history), with really long strings: (https://xkcd.com/936/)
The system works pretty well. Zero password reuse. Always Remember, Can't be compromised with a password manager... the problem is the companies and their poor security! (LinkedIn, Experian)

I'm really looking forward to the days when we don't have passwords anymore.

NOTE: And they said I would never use Latin!
> In the easy cases it might be possible to judge the relative morally correct side by the actions of those involved.

In fact this is extremely easy. Any person who murdered another person has done an immoral action, no matter how many layers of bureaucracy it's been dressed up in.
No, I don't think you're following me. You don't tcpdump and look at the packets (that would be silly; even horribly encrypted messages will look fine in a pcap). You don't even "study jumps, where private keys get loaded into memory". You take the binary and lift it to an IR and audit that.

People who do a lot of binary reversing vuln research were doing a version of this long before the we had modern tooling; you don't look at each load and store, but rather the control flow graph. People were auditing C programs, by manual inspection, in IDA Pro before there even was a market for secure messaging applications.

And that's just manual static analysis! Professional software assessors do a lot more than that; for instance, Trail has been talking about and even open-sourcing symbolic and concolic evaluation tools for years, and, obviously, people have been iterating and refining fuzzers and fault injectors for at least a decade before that.

This isn't "low hanging fruit" analysis where we find out, like, the messenger application is logging secret keys to a globally accessible log file, or storing task-switcher screenshots with message content. This is verification of program logic --- and, I'd argue even more importantly, of cryptographic protocol security.

"Bad entropy in key generation" is a funny example. Straightforward binary analysis will tell you what the "entropy source" is. If it's not the platform secure random number generator, you already have a vulnerability.

The problem with your chart is that there is no real rigor to it. It's just a list of bullets. It's obviously catnip to nerds. We love things like this: break a bunch of things into a grid, with columns for all sorts of make-me-look-smart check-marks! But, for instance, there's no way to tell in this chart whether a messenger "audit" was done by JP Aumasson for Kudelski, or some random Python programmer who tcpdumps the application and looks for local-XSS.

You can't even neatly break these audits down by "did they do crypto or not". The Electron messengers got bit a few months ago because they'd been audited by non-Electron specialists --- that's right, your app needed to be audited by someone who actually understood Electron internals, or it almost might as well not have been audited.

Given that: what's the point of this spreadsheet? It makes superficial details look important and super-important details look like they don't exist. You didn't even capture forward secrecy.

People who pay a lot of attention to cryptographic software security took a hard bite on this problem 5 years ago, with the EFF Secure Messaging Scorecard. EFF almost did a second version of it (I saw a draft). They gave up, because their experts convinced them it was a bad idea. I see LVH here trying to tell you the same thing, in detail, and I see you shrugging him off and at one point even accusing him of commenting in bad faith. Why should people trust your analysis?
It's true that for any given problem, learning how to fix it probably isn't worth the time. I've found the long-term benefits of taking the time to learn how to fix every problem I've run into (and importantly, understand what the things I'm doing to fix it do) to be very worth it, though. Over time I've had to google how to do fewer and fewer things, and when I do still need to google something it takes me much less time to understand the answer and how to apply it.

As a polygot developer working in multiple languages, editors and ecosystems, git has been the one tool that I'm always using, and that makes it always worth investing more time into learning how to use it better.
What graveyard shot? All I see is ads.
The prohibition on providing the software as a service appears to conflict with, or at least be trivially bypassed by, section 9 which states that to run the software you don't have to accept the terms of the license. Section 9 conforms with the law as written: running the software, and making the copies needed to run it, are explicitly not an infringement of copyright (USC Title 17 section 117(a)(1) [cornell.edu]). If I don't have to accept the license to do something, I'm not bound by it's terms merely because I do that something.

https://www.law.cornell.edu/uscode/text/17/117
The Chinese government only holds 6% of US government debt. Selling it wouldn't cause a recession and financial crisis.
Nobody is arguing that it's not ok, but consequences always exist regardless of conditions.

In this case, it's not about the FAA. An military base can choose not to prosecute once they investigate, but don't assume that they are just fine with strangers landing. Emergencies can be staged and, as stated, if there are sensitive combat and intel operations ongoing then it will be a serious incident.

This is no different than calling search and rescue to save your life, and then getting a bill afterwards. Still an emergency, and still has consequences.
The point there is that Big-O notation also implies that the growth has given shape above some large-ish n. And metrics like "number of operators" or "number of bussiness requirements" rarely are so large that this makes sense.

And in fact approaches to system design that try to make the code size independent of number of bussiness requirements and their possible changes in future lead to exactly the kind of "complexity worship" discussed in TFA (various ad-hoc turing complete VMs that interpret code represented as rows in bunch of relational tables and what not).