skysight-inc/HackerNews huggingface dataset:
This was my thought as well. Recompiling your application for ARM that has already been accepted in the Mac App Store would be pretty straightforward. It would also mean that the only productivity applications on the device would be new ones - Microsoft Office and Adobe Creative Suite would probably never qualify.
"legacy application in the primary healthcare domain" <-- there are specific reasons why it is preferred to keep with the legacy platform. A lot of effort has been spent to make the system compliant with existing regulations. And switching to a new technology platform isn't a willy-nilly decision.

Ask the CTO about the regulatory and other aspects of the platform. For all we know, he may believe that more time will be spent vetting a new platform than would be spent augmenting an existing platform.

"He's aware that the existing platform has a number of problems" <-- in response to another poster, the CTO is aware of the level of garbage. When you work as a manager on a system like in health care, you have to worry first and foremost about the business.
I got the most value from Effective Java by Joshua Bloch when learning Java. It's not specifically for beginners, but teaches best practice that would encourage a beginner in the right direction from the start. I suspect there are many instructional Java books that would teach coding practices that would not be considered best practice today.

http://java.sun.com/docs/books/effective/
That is not what I'm saying, as you well know.
The thing is, though, that I find that my own drive is often affected by what kinds of people are around me. I got into CS on my own, but I noticed my passion for and skill in it developing a lot when I was around other people who were strong in CS.
Then who if not Matasano can perform such an attack for $500,000?

Let's say I'm in the market and this particular web site annoys me and it is hosted on EC2. I want to compromise that web site's crypto from a neighboring domU and my budget is $500,000.

You are saying I can contract with someone at that rate and it will get done? How long does that security company take to deliver? With your breadth of security experience and your claim that it's a $500,000-contract job surely you must know who will write that contract otherwise you wouldn't have said such a thing, right?
A few of these tips apply to mysql also.

Copy table from a tab delimited file. In mysql you can use load data infile which will do the exact same thing.

Indexes in memory obviously very important in mysql land too. Also when using joins make sure the columns being joined on are indexed.

Using innodb o_direct will prevent linux from swapping out the mysql process.

Mysql's default in memory table tables are very small which usually results in creating on disk tables, to prevent this increase tmp_table_size and max_heap_table_size. Alternatively you can specify mysql engine memory for in memory tables if you know how big they are going to be.
Of course they're not really holograms - they deal on the "pencil" ray level and not the wave optics level - even so... seeing the first 3D reconstruction of a light field (the apparent image of the lamp) must have been totally thrilling.

Film still has many advantages for plenoptic stuff. It's a large, single-use sensor.
Everyone always goes overboard with their reaction to any app removal from the marketplace. I don't see what the big deal is, I'm glad to see Google keeping the market from being too dodgey. All of these "oh well this is pretty much Apple" comments are silly. If you are doing something illegal, you can distribute the .apk online, anything else can go on the market without a lengthy review process. It's worlds apart.
Couldn't they automatically recompile x86/x64 .NET stuff to ARM on install or first run (some of the time)?
There is no regulatory framework for health IT systems in my country analogous to HIPPA in the US, nor is the system standards compliant in any way. We have some national health IT standards but we've not invested any effort to make our platform compliant.
If driverless cars start reducing the car road toll then motorbikes will start to look really dangerous:(.

I suppose we could get self driving motorbikes but that would be missing the point of riding.
The optimized version of the PyPY code is around 17x faster than the first version of the Python code. That makes your C++ code 8x faster than the PyPy code, but I consider any Python code within an order of magnitude of C++ good.
Play's new Scala template engine
.NET stuff is not native code. It's CLR bytecode, interpreted much the same way Java bytecode is. Some runtime environments do JITing, when the bytecode gets translated to native instructions.
> By default, all web browsers ALLOW execution of ALL code encountered since all browsers ship with javascript enabled. Similarly, allowing hidden and/or transparent elements ENABLES clickjacking by default.

Woah, woah, woah. There's such a huge difference between "they can run Javascript and maybe consume some CPU time" and "they can run native code and completely own my machine" that I don't even know where to begin. If you could do "eip = shellcode.ptr;" in Javascript, maybe this would be a logical argument, but really there's just a massive, massive difference here.
Since the OP is already familiar with Java it's my assumption he'll seek out the "right way" more naturally than someone completely uninitiated.

That's the route I went: 6 months of C at uni (as well as some assembly for PIC and Motorola micros) then learned Java on the job then freelanced for a while doing PHP. I found I was immediately able to discount popular open source projects of the day (osCommerce being the most memorable) as appallingly written just due to the fundamentally broken way they made use of object orientation (this was before PHP5), even though I didn't have that deep an understanding of the "big mistakes" most people make when writing PHP. In fact one of the first things I did in PHP was write my own framework, which was a good exercise and I still use it in production but I didn't know enough to make it good/usable for others so it never went anywhere.

I'd say, also, in general the "ambience" in the PHP community has improved immeasurably. If you're using ##php as a resource, and modern articles and frameworks to learn from, you've got a far better chance of not falling into the n00b traps than you did 5 years ago.

As a side note re: RoR - I just can't take a framework seriously that would settle for an ORM tool that doesn't support composite primary keys. Same with Django. They're toys as far as I'm concerned.

I've not used RoR commercialy but I have used Django and found it's "opinionated" nature very frustrating - felt far too detached from the "real" HTTP and there were several instances where I wanted to solve a problem some way that was perfectly reasonable in terms of performance and security but Django "wouldn't let me". I assume it's the same with RoR although I've never had good reason to find out.

IMO if you're saying "get a solid grounding SQL" that is not compatible with taking up rails (or Django).
3D Printing Conserves Earliest Communications Tech
To your last question: yes.

To your inevitable followup question: no, I'm not going to talk to you about it.

To your overarching point: if you are on a cloud platform that promises you will never share hardware with any other company – which virtually nobody is – you are still at greater risk simply being on a nanosecond-timeable switched network with your attackers. But local crypto timing attacks are far more powerful.

Nobody bothers with this stuff because simple application-layer attacks are so simple that there's little impetus to develop and mainstream the attack techniques to exploit them. You're naive indeed if you think that's a gauge of how practical those attacks are.

I wonder where your stridency on this topic comes from. I've read all your comments here --- I mean all of them, on HN period --- and I haven't been able to discern what background you might have in software crypto security. You're here saying something that contradicts virtually every other software crypto person I know, is why I wonder.

You talked earlier about "all the papers you read being theoretical" (I'm paraphrasing). What papers would those be? Because I'm a little familiar with this research (we pirated it gleefully for our virtualized rootkit detection talk several years ago), and, relative to the crypto literature at large, x86 side channel research is striking in how non- theoretical it is; to wit: most crypto papers don't come with exploit testbed how-tos.
Do you have any estimate as to how long it would take to rebuild the platform and shake down the bugs (to the extent that the existing platform functions)? I ask because, if you try to look at it from the other side, it may actually take much longer to rebuild than to patch.

If that time is short, maybe you should try to do it on your downtime :)
That doesn't help with what the GP is talking about, as by design there cannot be more than 21 million bitcoins.
The article doesn't make its case very well. The core problem people are presumably worried about is safety, and saying it they have a "good safety record" is hardly enough to reassure the senators, etc. who would presumably be responsible for relaxing restrictions.

For example, what about edge cases? Suppose the Google car does just fine in normal driving conditions, but in a blizzard w/ 26 mile per hour gusts of wind (as I drove in recently), or when a tractor trailer flips over on the road in front of you? Humans have a certain intuition that allows them to do bizarre twitches in extreme situations (even including supernormal strength) that presumably no machine intelligence will be able to approach for a long time (if ever).

Or what about the possibility of someone hacking the car? Could a worm engineered by some hostile government take millions of cars off the road -- or, worse, cause them all to steer into the median and cause mass damage and thousands of instant casualties?

It is, frankly, irresponsible not to consider edge cases like these when drafting legislation, and while I'm all for gradual introduction and more testing, the author of this article has convinced me that senators sitting on their hands not doing anything are probably acting on the interests of the people much more so than those who wish to simply hand over driving and navigation functions to machines as soon as possible.
Thank you, sir, for the coinage 'avoid-prison coupons'. (Your comment is currently the only source Google finds for that particular phrase.)
Angry Birds sold 10 million copies on iOS alone in under a year. I highly doubt the majority of them would rather play a platformer that has been done to death over the last 25 years.
So your NDA allows you to acknowledge that a side-channel cryptographic compromise is possible but not give any details? That's a really funny NDA. I call bullshit.

Or did you violate it to tell me 'yes'?
I dont personally work with postgres but you've convinced me to buy this book.
I use it for time calculations (timezones, differences, etc.)
Quit your job if you can. The real problem is that you don't trust the CTOs judgement and you're looking for shortcuts to communicate a very simple concept. I'm not a programmer but I got your issue with the project after reading the three paragraphs you posted above.

If you can't turn the above text into an conversation of very short PowerPoint deck you're "shouting at the winds". By the way your lack of respect may not show up now, but as you work on the project and resent it — that will show up over time (and if nothing else make you depressed).

By the way as a point of pride if I can't explain the "business why" of doing something wrong to a programmer then I've failed as a manager. Because if my programmer has any pride in his/her craftsmanship they'll resent me through out the project and self sabotage.
I didn't pull that number out of the air; I gave it a good 30 seconds of thought.

I arrived at it by:

* modding our bill rate up to that of a contractor who specializes in hardware crypto (we do not, but I know the bill rates of several people who do),

* guessing the amount of time it would take me to implement e.g. Aciicmez (something I can do reasonably because we did BTB timing for virtualized rootkit detection), and

* breaking it up into hours x bill rate.

If you can name 3 people who specialize in adversarial hardware crypto review†, then you know there are at least another 3 who will do grey-area projects of similar sophistication (say, for a company's competitor).

Can you name 3 hardware crypto testing specialist firms? I know there are other people on HN who can. Are you one of them?

† (I can: 83f633acea3a6ca594ea85ae552445369058ded1)
I quite get you're arent't picking up a fight :) I understand your points and agree we are picking different environments for investment. As I said, in Europe when you get at 0 when your are 67 (max!) is then covered by state retirement.

Your point made me think about geo difference BTW. It is now clear to me how much the US needs more performance from you to ensure retirement. BTW feel free to tell me if you want to follow that thread per email... I'd be glad to.
This comment doesn't make any sense. I'm not sure you know how NDA's work.

I asked a specific question in my comment that you haven't answered yet.
It would take a long time to rebuild, certainly over a year. I'm not even certain how we could approach refactoring the existing system without unit tests - classic asp is very primitive.

I'm aware that rewriting systems is a big business risk, but I think we have reached a point where maintaining and developing new services on classic asp is a greater risk to the viability of the company.
Please name any javascipt "sandbox" that has a perfect security track record.

That's the real point.

Sure, javascript can be useful and even beneficial, but the key is making a decision on whether the risks are worth the rewards. The same is true for ANY code you decide to run.
I'm curious if you were inspired by Jef Raskin and the ZUI
Hacker posts part of decompiled TrustDLL of Comodo partner
You can make the very same argument for images -- remember the libjpeg and libtiff vulns a couple years ago? You can make the same argument for CSS -- remember the type confusion in Webkit a couple months ago? I'm sorry, but you are completely off base here. That is why you're being downvoted.
Since I have executed one with my employer yes I do.

For example if you asked me directly if such an attack was possible I cannot answer you due to my NDA even though I have personal experience with the matter. You seem really eager to answer that it is though.

All of the NDAs I have signed have never said anything like "you can't say how, but you can say that we pulled it off". In fact most of the NDAs I've signed have been along the lines of "you don't talk about Fight Club".

Can we deduce that you are willing to violate your NDA to write that you have observed such an attack or that you never executed an NDA regarding the specific attack? Yes.
Your analysis makes sense without the tortured analogy to PC fanboyism. Macs are not in asset bubble, they are a product people enjoy, and pay a premium or aesthetics or peace of mind or lack of competition from an equivalent product, not because they hope to trade the Mac for something else later.
Novel approach, but I'm curious how many networks let 445 smb over tcp out? Enterprise networks sure shouldn't, my office doesn't, my house doesn't though admittedly most people won't be configured this way. But don't big carriers like comcast also filter common microsoft ports like this and 139 because of worm and exploit activity?
Uh huh. Unfortunately, I have spent years building up a resistance to Iocane powder.

I'd still like to know what x86 side channel research you're writing off as "theoretical".

And I'd like to know why you so stridently believe this is a nonissue.
Bare in mind that you also need to somehow do a brain scan with enough resolution to map every single connection if you want something functional. Also, what are you going to do about the sensory inputs (sight, hearing, nervous system). I'm sure it can't be good for a person's sanity to suddenly get completely 100% disconnected from the world.

And while a 1:1 map of the brain would maybe be feasible to do at the moment or in a few years, but very expensive (although getting ever cheaper), it's kind of like the straw-man AI researcher's answer to everything : do a neural network, repeat training set and hope that it computes what we want. Trying to flaunt your lack of knowledge and trying clever ways to avoid solving the problem yourself is just asking for trouble in so many ways.

In the end, the point is that AI is a software problem. Adding hardware will allow you a more stupid approach in solving it, but effective solutions are those that matter most.
Devise and Cancan are User Authentication middleware for Rails

Check out https://github.com/ciaranj/connect-auth I can't vouch for the effectiveness, but it seems to be under active development.
Even if so, it is not going to excuse someone from increased scrutiny that leads to further evidence.
How I'll manage my next founding team
I liked Rails better before the Rake 0.9 hiccups exposed the magic.

Now everyone is writing articles to explain the mess. Here's one from Wyatt Greene:

http://techiferous.com/2011/05/the-no-nonsense-guide-to-mana...
"The only place I've used it in months is on Facebook iFrame applications where otherwise avoiding it would cause a larger page to load in a smaller area and get cut off."

Which would be the "target" attribute's intended purpose, frames that is.
This works in several different ways. Let me give you an example:

1. Amazon. I started using Amazon recommendations at some point to point me to new movies to watch. At some point I had a temporary infatuation with old black and white movies. This managed to overtake the recommendation system completely. When I now go to Amazon to decide what movie to download next, I get 80% black and white movies back (which I then download and watch). My point is this: I now only go to Amazon, if I want to find some new classic movies to watch.

2. I used to frequently visit Reddit, had an account and had a heavily altered front page with customized subreddits. Then at some point I got fed up with the empty echo chamber, deleted my account and instead started (mostly) lurking on Hacker News, because it gave me the illusion that it made me think more. So I left a personalized system for one that isn't personalized by me, because I ended up being disappointed in my own modifications.
And I worry about the case when it will become more blameworthy for a human rather than a computer to operate a vehicle.
The Mach kernel uses messaging as its core component, that is what it is built on. Messaging means it becomes easier to share state since it is all messages anyway.
Nice work.

A few notes:

"Button" label should say search or go.

There is no "results not found"

It is hard to tell if it is doing anything, maybe add a animated icon showing it is working.
Hilarious to watch you fight for HN all over the place then throw it all out the window when someone questions you.
Gas + Commute = Bad: Before and After the move to Seattle
The more popular comments are on top already. Comments that people do not like are lighter in color. That seems to resolve the popularity issue, since right away the popular comments are on top.
Only the the actual implementation code (and subsequent compiled result) is under copyright, anyone is free to write an independent implementation that's not based on any of the original copyrighted code.

(There is of course the possibility of patents covering the innovations in the SNES, but that's a separate issue from copyright, and I have no idea how software patents in Japan worked around the time the SNES got released.)
And I would point out that the same query, given to Google, returns a suggestion to search for 'number or Linux users', which is what I was thinking. Google doesn't know much, but it knows enough to get me where I'm going without having to think, or type, much. Isn't that what it's all about?

I understand the geeks downvoting me, though. Wolfram Alpha is 'really neat' and 'really neat' is what we like.

What I don't understand is this idea that hammering a nail with a toolbox is a smart way to do things.
You're trolling, whether you mean to be or not. You can't name an anything with a perfect security track record. And this time, you're trolling in service of a stupid argument: that we can have either an insecure Internet-as-we-know-it, or no Internet-as-we-know-it at all. Well, no shit.
Is Cryptocurrency a good idea?
Interesting, I don't have time to dig into it right now, but I'm always interested in cool dotfile stuff.
I'm always happy to see new devices like this because I think that having a single phone act as the central computing device for all of our electronics is a good direction to move in. That said, if I can plug my phone into a television and watch tv over Netflix, plug my phone into a tablet and surf the net, or plug my phone into my laptop and access the internet then I'm only paying for one internet connection. The alternative is to be paying for a cable package, home internet access, and then two 3g plans. I don't think that I'm being cynical when I say that there are major corporate interests against making this possible and we'll have to see how they play out. In my opinion the increasing move towards lower 3g caps isn't about current network usage but is actually about setting a precedent for the future which is incompatible with paying for only one data connection.
I'm not sure how you'd determine that; I guess you'd need a definitive and complete transcription of correctly-dated works. The OED is not a few man-hours work, and even they hesitate to be definitive :)
API Technology – OData
I don't even know what this means.

I asked more specific questions in my comment; you aren't answering them. The only important question: why are you so strident about x86 side channels being a non-issue?

Because I'd watch chip vendors not even figure out how to secure MSIs under their IOMMUs and question whether just-plain-old- software security was a reasonable expectation under virtualization. You on the other hand seem to think it's so solid that the microarchitecture doesn't cache crypto artifacts.
A lot of automatic transmissions plain aren't that smart; I can think of several I've driven that were too conservative about changing down on a hill which made the cars much less responsive than they should have been. Also there's the old chestnut about autos being less fuel efficient / less powerful: http://en.wikipedia.org/wiki/Manual_transmission#Benefits

Either way, I don't think the prevalence of manuals in Europe is entirely (maybe not even mostly) about not giving up control to the machine.
Ver Triunfo Del Amor Capitulo 156 | Be Smart with Gravelrecords.com
@apievangelist: I'm not sure if there's something temporarily wrong, but most of the links in the article go to empty holding pages, and there's very little Qwerly-related info.
Are you sure? He government can try to tax everything and use my PlayStation and house in Ohio to settle a debt to a Chinese citizen, but if it ends up destroying the US economy, there won't be any new wealth creation to tax, and that is where most government revenue comes from.

It is far more likely that US government will do what it and every other government always has done: either inflate the currency or default or declare war or some mixture thereof.