skysight-inc/HackerNews huggingface dataset:
If /all/ the instruments are incorrect, you might be boned. However, there's gobs of instruments that can be used to paint a partial picture: GPS can be used for altitude and groundspeed in a pinch; there's accelerometers and gyroscopes in place to monitor heading, attitude, and acceleration; and all of these systems are redundant too.

Worst case, add power, level out, and hopefully you'll be stable for a few minutes while the pilots catch up to the airplane.
I don't see how implementing (correctly) an already known one-way hashing function (SHA/MD5 for example), and then using this to form part of a basic challenge-handshake protocol is not better than sending the password over the wire.

In this way the attacker would be unable to gain anything useful from seeing the challenge or handshake packets, and the only remaining vector is some form of keylogger.

Or am I missing something here?
One more point in addition to the other comments here: Whenever topics like Apple come up (as in your example), a lot of people for whatever reason are instantly emotionally involved (either that, or it attracts the emotionally involved ones). I believe the emotional involvement prevents a lot of productive discussion from happening.

Choose nearly any other topic and I would overall expect better discussion and less apparent subjectivity.
> someone

It's a grouponspiracy all the way down, man.
You're comparing two different assembly languages and calling conventions. x64 != x86.
Ask HN: Has Google search quality abruptly went down *in the last week*?
I just realized that I started rephrasing queries and extensively using quotes in past few days, or maybe a week. Very sudden and noticeable change in the search quality. Simple queries that worked now return irrelevant stuff in first page. Also the word matching appears to have gone "fuzzy" - first few hits routinely do not include all or exact words from the query, which is not how it was before.

Has anyone noticed something similar? Or am I seeing things?
What is the penalty under this law when the government or its agents lie to you?
How do I translate assembly to binary?
Lagoa Multiphysics Engine
Instalyrics is cool looking and the interface is nice, but it failed horribly to find lyrics to any of the songs i tried. Songrabbit just works for me.
Under the heading That attack sounds complicated! Surely, you're better off with crypto than without it?

"Any attacker who could swipe an unencrypted secret can, with almost total certainty, intercept and alter a web request. Intercepting requests does not require advanced computer science. Once an attacker controls the web requests, the work needed to fatally wound crypto code is trivial: the attacker need only inject another <SCRIPT> tag to steal secrets before they're encrypted."
bitchin!
This has been answered million times: besides the historical reasons (which are extremely powerful), it's performance. Performance not as in how fast would it take to calculate this, but performance as in what is the worst case scenario for calculating this. Think Garbage Collector, mostly. But also think ability to control exactly how the data represented and stored in memory. Tighter storage == fewer cache misses. Market moves away while fluffy managed data travels from RAM -> cache -> CPU.
Making up lies is an interesting way to get your point across.
I think it's a mistake to classify all subpixel-level renderers as ClearType. There are different styles of subpixel rendering, some of which look better than others with large @font-face fonts.

The system described puts Windows 7 and iOS in the same category, which is a really bad idea IMO.
Someone here correctly commented how this post showed Reddit level discussion and team based upmanship. You cannot trace the level of influence in a one-dimensional number line, of any two successful people or companies. Who has had more influence, Facebook, Twitter or even Friendster? pg or avc? Such questions are stupid, just like Erdos-Bacon numbers. They are good for friendly banter, but don't have any real meaning.

I replied to nirvana about how the word inventing does not mean anything. And yet he and you kept on debating on minutiae. Many techie people from India look up to MS and Google as opposed to say Apple or Amazon, partly because their influence is more apparent, so I understand your affinity for them. But attributing invention or success to something which can be attributed to random events and network effects, is a bit off by standards here.

I did not down vote anyone, just making a general comment. Things are never so black and white, grab a good book, read some scientific (non-CS) papers, you will probably have a broader perspective. I would recommend starting with the massive bibliography at the back of The Black Swan (Taleb).
From the article:

"Any attacker who could swipe an unencrypted secret can, with almost total certainty, intercept and alter a web request. Intercepting requests does not require advanced computer science. Once an attacker controls the web requests, the work needed to fatally wound crypto code is trivial: the attacker need only inject another <SCRIPT> tag to steal secrets before they're encrypted."

This is strictly true from the perspective of cryptography. Crypto is always concerned with the strength of crypto from a mathematics point of view.

However, much of that worldview falls down in the real world. In the case of hashing a password before it goes over the wire (even the simplest salt-free MD5), which is crypto-logically naive and "considered harmful," you are providing a general barrier for people that are FireSheeping in a cafe. Many would-be attackers are thwarted by what crypto-nerds would see as silly.

In general, the weakest point of crypto in today's world is the human element. RSA Security got hacked not because the algorithm was weak but because someone installed a back door in RSA's network for the hackers. Once you get passed the point where it is more effective to attack sideways than head-on, the crypto has done all it can do.

That being said.. just use SSL. It moves that gauge enough that anyone trying to get your users' information isn't going to bother direct attacks.

Edit:

What I meant by the 'salt-free' MD5 is that of a challenge-handshake response. The challenge is sent by the server and the client responds with md5(pw+challenge). The salt would otherwise need to be sent in an insecure manner that would provide only marginal more security than a challenge-handshake. This was unclear and I apologize.
Superacion personal
Category
Microsoft Windows	N	Y
Unix-like - Genetic UNIX	N	N
Unix-like - Trademark / Branded UNIX	N	N
Unix-like - Functional UNIX	Y	N

this comparison is disturbing.
Also, grandparent assumes the choices are JS crypto and sending passwords in the clear, ignoring the SSL/TLS option.
I think the audiences are not as different than you think (I use both). CoffeeScript is for anyone wanting to write in a more expressive language.

ClojureScript offers that and even more without requiring people to fork ClojureScript. For example I got my pattern matching library working for ClojureScript - http://dosync.posterous.com/advanced-pattern-matching-for-ja.... match looks deceivingly simple, it's a fairly involved extensible optimizing pattern match compiler implemented as a macro.

EDIT: a fun example of how expressive pattern matching can be - here's a pattern for checking red black tree balance and the incredible output - https://gist.github.com/1177437
Here's a feature request: show a real-time stream of the searches people are doing. Reading some of the comments here, I'm intrigued as to what comes to people's minds when they try this service out. For example, I searched for "Under the Bridge" by Red Hot Chili Peppers. Why? I have no idea.
Thanks Revorad - Usaura actually looks a little slicker than the one I remember, and there wasn't a signup or signin, the one I saw just went straight into tests you could do.

I wonder whether it was a usaura test that someone posted and I just went from one test into the next. I'll keep digging around and post here if I find it...
How to Investigate URL in Details to Prevent Internet Scam
1 and 2 are fixed. We'll work on 3.
Let me preface this by saying that I'm very ignorant about this subject.

>What's the intrinsic value? Why is Bitcoin unlikely to be worth $0 in 10 years?

Why does a currency require a value as anything other than a currency to be expect to have value?

Bitcoin offers a useful service. There's is no reason to believe this service will stop being useful in 10 years. Therefore, it's reasonable to expect a demand for Bitcoin in 10 years, making it worth more than $0.

>Because it is spectacularly unlikely that gold will be worth $0 in 10 years

Isn't most of gold's value based on its demand as a currency? If people stopped buying gold just to trade and store value, wouldn't current gold owners lose immensely?
> Or am I missing something here?

You're missing the real solution: SSL/TLS.
Timing attacks and other side-channel vulnerabilities.
Yes, the point and comment count display seems to be the common consensus among the community members. I am considering this as an option.
What barrier? If you're sending password hash over the wire, and the server allows access based on this hash, the hash is essentially the password. Firesheep, BTW, steals cookies, not passwords.
Boy, you'd think anything with an (int32) cast would get seriously eagle-eyed during a 64-bit port...
A good explanation of Latent Dirichlet Allocation (natural language processing)
Rebel Discovers Qaddafi Passport, Real Spelling of Name
AOA != pitch
Kingsgate Consolidated - Wongan Hills
Suggestions for the D 2.0 Programming Language
Thanks for your work on pandas, I'm looking forward to being able to stick with one language for most of my data analysis tool chain.
During the stall and plunge of Air France Flight 447 into the ocean, the plane's angle of attack "was not directly displayed to the pilots".

Seems to me a fatal design flaw bordering on ridiculous, to create a user interface that is not displaying this critical piece of information.
Groundspeed is not terrible useful.
I splurge too much on food. Everything else is either saved or invested.

I am a 20 years old who have it better than most. While everyone is accumulating debt, I am learning tons on the job while sailing by with a modest start in saving and really lucky investment.
This makes a lot of sense, and meshes with my own experience. I've created a lot of programs that collect data using Python/Ruby/similar and then use R for the analysis.

While using two languages is an overhead, it feels like it plays to the strengths of both sides.
Under the "Really? Why?" section, start with the first point:

If you don't trust the network to deliver a password, or, worse, don't trust the server not to keep user secrets, you can't trust them to deliver security code. The same attacker who was sniffing passwords or reading diaries before you introduce crypto is simply hijacking crypto code after you do.
"There are three misconceptions embedded in that common objection, all of them grave."

I completely agree with this article, but why do so many security researchers try to write like cartoon samurai?
Ask HN: Minor vs Major in CS
I hear all the time on HN about people succeeding in programming without a CS degree, but that's only recently become a reality for me. I realized I wanted to major in CS in my sophomore year, and I've been taking CS courses since then. Unfortunately, because of the lack of course offerings and prerequisites, the only courses available have been Introduction to Programming and CS 1 (and CS2 this semester). Because of this, finishing a major in CS in by the end of my senior year will be almost, if not entirely, impossible (not from a difficulty standpoint--the classes just won't be offered), which is when my four-year debate full ride runs out.

Should I stay an extra year/semester and get a major in CS, or get a minor in CS instead?

If my fifth year was free as well, should I finish the major?
This looks more like a good "like" button
Let me know what you think about it:
http://ompldr.org/vYTNsdg/hnlike.png
It's easier for an attacker to passively observe a stream than to actively inject specifically tailored code into it.

At least with JS Crypto, amateurs with Wireshark and Firesheep probably can't steal your stuff. But since that's all the protection it offers, it shouldn't be advertised as anything more ("This NOTEr 2.0 App uses AES-256 in JS over HTTP to provide NSA GRADE security and privacy!"). In that sense, it probably causes harm to use JS crypto, but JS crypt isn't absolutely ineffective.
The logic exists too, but it's stored in binders full of easily-updated paper checklists instead of hard-to-update computer software (hard-to-update because FAA certification takes time).
I built high-performance (~1ms) trading/pricing systems in Java and while Java performance is comparable most of the time there are key areas where it's non-competitive, for example garbage collection and socket I/O.

I used various techniques to get around these such as forcing GCs to happen during quiet periods and making kernel modifications to default socket parameters, but it's definitely non-trivial.
Apple Store in NYC - protected against Irene
This seems to happen whenever Javascript crypto is brought up. It's crazy. SSL a little bit of work and it costs $ to purchase a cert (but not very much). It's a bit more CPU overhead on the server but most people have cycles to spare. For the most part SSL should be no big deal.

What am I missing here? Are people to cheap to purchase an SSL cert? Theoretically the PKI is only as trustworthy as the CAs but that can't be why people are acting like SSL/TLS isn't even an option.
This article would have been more interesting if there were a list of things he did wrong, and examples of other large companies doing the same things and how it screwed them over.

Otherwise, the saying comes to mind "In Theory, Theory and Practice are the same. In Practice, they are not."
Probably because it's fun? If you spend half your day reading papers on fully homomorphic encryption, I think we can forgive a little levity to compensate.
Do you realize that there's RGB, BRG, vertial-RGB, vertical-BGR possible subpixel layouts in LCDs?

http://www.lagom.nl/lcd-test/subpixel.php

Does your script take that into consideration?
Socket.IO 0.8.0 out with support for Firefox6 WebSockets and Chrome betas.
Check Out this Insightful Interview with Founder of Listgeeks - Max Zerrahn
One of my ideas in this space was post-pay micropayments. Instead of asking for money up front and then allowing people to spend that in a trickle on individual articles, you would count views to stories by people (logged to user table or just using a cookie) and then guilt-induce people to donate.

"You've read 46 articles over the last month. Contribute $9.20 now (20c per article) - we'd really appreciate it."
Challenge-response hashing in JS is MitMable and likely to have implementation errors.

SSL has defenses against MitM attacks, and is implemented in very widely-deployed libraries, so if there's an implementation error you'll hear about it before it's used on you.

The drawback is of course that you need to have a signed key. That is the price you pay for MitM resistance. We're not supposed to use self-signed keys (which are free), even though they are strictly better than JS challenge/response hashing.
Just in time for the Node.js Knockout 2012!
This might be good if I didn't have to keep clicking next like a top 10 list.
It can be used to identify when pitot tubes have failed (200kt difference?), and to know that if altitude is stable and the pitch is reasonable that the airplane is in a relatively stable state aerodynamically.

That said, I'm not an aeronautical or control systems engineer, so this is just speculation.
Stanford Vascular Surgeon Invents New Surgery Technique
It would be interesting to see this exported as a PDF. Apparently, you can export individual pages, but not as a whole.
Thanks for replying, good luck with your venture!
Something like this maybe?

http://jsfiddle.net/dwynings/6Fm9M/1/
I am going to make one more request for a single page version. Or for instapaper to pull down the whole thing in a more intelligent manner.
Can you imagine that "20 years ago" (for most of us is too early to be programming at this level) you missed this thinking it couldn't possibly be anything but 32 bits for the purpose it was written for?

That said, never assume, because "dict.cpp" stuff happens all the time, except its modern web-incantation is usually called "copy-pasta."
Google on underscores vs. dashes in URLs
Having a high judge: contestant ratio is good for everyone; judges have less work, everyone gets evaluated by a few judges, and it takes less clock time. More work for Gerad and visnup, though
I'll admit at the time I posted my comment, I wasn't particularly well versed in the history of computing. Thanks for the links, they are insightful.
Yes. The Java and C# standard libraries are actually much larger and broader than the C++ standard library + STL (and possibly including Boost).

(fyi, I mostly program in C and C++ these days, but used a lot of Java when I worked in telecommunications)
Japanese Scientists Create Touchable Holograms [2009]
It's only a little easier. There are three scenarios I've been able to come up with:

The attacker triggers some kind of bug or odd mode in a router. That router happily floods packets to the wrong places, but still only accepts them from the right place.

The attacker can decrypt your WiFi plaintext, but not in realtime. You've already received the response from the server by the time the attacker can craft one for you.

The attacker is afraid of getting caught (he possibly needs to be on-location, and can't work through an intermediary), and is therefore restricted to passive methods.

As it happens, all three of these are pretty unlikely. They aren't impossible, but why put forth a large effort for JS crypto when you could put forth a small effort for SSL?
I found this quote as telling as it is hilarious:

> Just as all programs evolve towards a point where they can read email, and all languages contain a poorly-specified and buggy implementation of Lisp, most crypto code is at heart an inferior version of PGP.
IPhone jailbreaker lands job at Apple
Is that true though? Rockstar has a reputation for turning out great games and being one of the worst places to work.
I'd add a "mentee manifesto" too, since mentorship is a proverbial two-way street. I actually wrote an essay on that topic from an education perspective: "How to get your Professors’ Attention — along with Coaching or Mentoring" (http://jseliger.com/2010/10/02/how-to-get-your-professors%E2...) because I noticed that some students systematically make mistakes they may not be aware of when it comes to seeking mentors or advice.
I've had this problem as well, but I don't perceive it as a rapid change. Rather, I'd say that the quality of Google search has gone down dramatically over the past couple years, and continues to go down. But yes, there have been a couple cases this week that have left me scratching my head. It seems like searches for 'uncommon_word common_words...' now consider 'uncommon_word' to be optional. The case I remember was searching for "chagall russian oven" hoping to find a Marc Chagall painting that I vaguely remembered.

Contrast https://encrypted.google.com/search?q=chagall+russian+oven with https://encrypted.google.com/search?q=%2Bchagall+russian+ove...

I was bothered to find that many of the results, including the top one for Wikipedia, did not include any mention of Chagall. Perhaps even more embarrassingly, several do not even include the word 'oven' but presume that I had misspelled 'over'. I find that I need to use multiple '+' signs in many of my queries to get decent results, seemingly I sometimes even need to use +"quoted phrase" just to find something that includes "quoted phrase". Suggestions of the 'Perhaps you meant' form are great, but automatically switching my query is not a service.

I suppose that Google makes more money with sloppy search than in catering to the likely small number of people who would rather get the results for their exact query than for a best (popular) guess. But it would be nice if there was at least be an expert level configuration option for "Treat all search terms as required".
People like this creep me out. Thank god we live in a society that has free choice of work.
> If this was remotely legal, Google would have done it 10 years ago.

While legal issues may be the reason Google didn’t do this, it is hardly possibility. I don’t see value in a comment like this. If you have more information or insider knowledge, share it.
FWIW Bitcoin lacks processing fees.
It's likely bravado from college days. I remember overhearing many conversations at school where students would brag about pulling their second all-nighter in a particular week. I could only think that they were doing something wrong. If your work load is requiring you to stay up for more than 16-18 hours a day, then you're either doing too much or you're really inefficient.

A metric of success, to me, is being able to make money while you're asleep. You'll never escape the chains of the cubicle if you don't work smart.
Do you want to sell sugar water or do you want to change the world?
Robot teaches English as Second Language
Media Core | Launch It Now
kindle native version should be much easier to read than trying to view html/pdf on the kindle, and you've supported the author
"You could use SSL/TLS to solve this problem, but that's expensive and complicated."

This was true 5 years ago not anymore. Get a free certificate today from StartSSL.com or @$7 from RapidSSL.com

I haven't seen anyone using "Browser Cryptography" except some newbies, anyone doing that needs to attend some good classes about security.
I mostly agree with the gist, but it's not really the Javascript that's the problem. It's trying to do crypto in code downloaded over the network. Implementing crypto in a Flash/Java/Flex/Silverlight/other flavor-of-the-month applet has all the exact same problems. Well, you might have a secure RNG (doubtful), but apart from that the problems are all the same.

Likewise, it's probably possible (though very difficult, and still not a good idea) to have good crypto in JavaScript as long as it's either server-side or built into the client.
Better browser caching
The Best Heart Touching Sms Collection