skysight-inc/HackerNews huggingface dataset:
Is anyone familiar with the RDP implementation on Windows and how it handles privilege separation pre and post authentication?

Niels Provos, Markus Friedl, Peter Honeyman released a paper in 2003 that analysed the number of privileged (8,391) vs. unprivileged (17,589) lines of code that are executed by OpenSSH [1]. These figures included calls to libraries such as OpenSSL and zlib. A key point from the paper: "Privilege separation prevents known security vulnerabilities in prior OpenSSH versions including some that were unknown at the time of its implementation."

OpenSSH has changed significantly over the past decade and I haven't been able to locate more recent analysis of the privileged:unprivileged LoC ratio in OpenSSH. For the brave, the source code provides a good indication of the current state of OpenSSH[2] and the amount and type of code executed in privileged and unprivileged modes.

Privileged mode is needed to open low numbered ports (<1024), read/process the private host key and fork new processes post authentication assuming the identity of another user. A great deal of effort and research has been put into ensuring that only the minimal amount of privileged code is executed. Where OpenSSH code can be executed within an unprivileged process, it is.

RDP appears to have a much longer and significantly more complex session initiation process [3]. MS12-020[4] indicates the vulnerability occurs during the pre-authentication stage (Client MCS Connect Initial PDU with GCC Conference Create Request [5]). Thus it appears the RDP implementation on Windows doesn't utilise granular privilege separation pre-authentication? How about post-authentication privilege separation?

Privilege separation is very important.

I rephrase the question (assuming Microsoft's implementation doesn't utilise granular privilege separation by default):

"Who could possibly be so stupid as to recommend or use RDP on the open internet knowing the implementation doesn't have granular and well designed privilege separation?"

[1] http://www.citi.umich.edu/u/provos/papers/privsep.pdf

[2] http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd.c...

[3] http://msdn.microsoft.com/en-us/library/cc240452%28v=prot.10...

[4] http://aluigi.org/adv/termdd_1-adv.txt

[5] http://msdn.microsoft.com/en-us/library/cc240836%28v=prot.10...
The MeeGo community effort continues at http://merproject.org

Used already as the base distro in the Spark tablet
I would love to see some longer-term measurements. I get the impression that this benchmark was doing a one time measurement. But the one big problem I have with cloud services is I/O performance over a longer time period.

We read so many times about very unreliable performance. Sometimes it's ok and sometimes it's really, really bad.

Without any kind of time period to continuously run a benchmark in, this doesn't really help. For all we know, the first placed service was just having a good day and the last placed a very bad one.
No. It means that for your comment, google will store each word, each pair of words, each triplet of words and so on up to 6 word long subsets. So if someone searched for 'Google makes no effort' then your comment will come up higher than a document which includes those words in a different order.

http://en.wikipedia.org/wiki/N-gram
I just downloaded your demo and am very impressed. I forced myself to type with just one hand and it was much easier than expected (typing this comment using it now).

Do you plan to have a mechanism for allowing the user to change the auto-corrected result on the fly? (Other than tapping caps lock to correct then switching back to 1-hand mode). I did get a bit flustered trying to type "world" during a test run.
That's a really interesting article. Too bad the <title> of that document is 'Test page', making it practically unfindable with Google, SEO-wise.
A function that yields instead of returning values results in an iterator. One does not need to define a class at all.
Out of curiosity, did you compare to any other baselines? I suspect you did a lot better than you think you did, because that particular baseline is actually very misleading for ranking/recommendation tasks (this is a common source of confusion for newcomers). Here's why, in two parts:

1) Say you estimate (as you propose) that a user will always give their average rating. This might get you good-ish error and ROC as a prediction task, but will give zero recommendation value because the prediction for a given user will be constant for all possible recommendations.

2) Say you estimate that a user will give the average score that the item has received across all users. Again, possibly good-ish in terms of prediction ROC and RMS error, but this offers no personalization (all users get the same predictions, i.e. you're basically just showing the default Reddit ranking).

Both of these baselines are vastly inferior to even really stupid models like "how many times have I upvoted stories from this submitter" in terms of recommendation value, but the latter is (if I recall from my own experiments) much worse when evaluated on the basis of overall ROC.

I would strongly suspect that a correctly implemented NB or S1 would vastly outperform either of the two baselines in terms of actual recommendation utility (even though when you look at the baseline's ability to predict actual numbers, they might be comparably good in an RMS sense).

The moral of the story: one must be very careful when trying to quantify the performance of learning systems; actual utility is often difficult to evaluate merely by looking at standard statistical measures of accuracy.
Thanks. That's a decent explanation. :) I did read the Hacker News Guidelines but apparently not well enough. I definitely missed this: "Resist complaining about being downmodded. It never does any good, and it makes boring reading." Apologies, all.
Ralph lauren polo mens shorts, ralph lauren polo mens shorts, polo ralph lauren
ralphlaurenpolosaleukoutlet.com offers the world of ralph lauren polo sale in mens,womens and children clothing,The latest cashmere sweaters,shirts,hoodies,jackets.You can pay less money to purchase ralph lauren polo big pony here
Well @ is taken by decorator syntax. I like the python way however (probably due to using python a lot). Special methods are special so it does make sense that they look different, and python all ready the convention that underscores in front of them function name indicate the function shouldn't be accessed directly, and that is true for special methods. When was the last time you called __init__ directly (discounting uses inside another __init__ method)? Most likely never. I guess it's personal preference, but that naming convention saves me a lot of time when calling die on an object; I know I can basically ignore anything after the first name beginning with an underscore.
How to Speed Up Your Windows 7
yeah we need a new way of powering our ships. for it to be affordable. the only cheap and responsible way i think would be to use solar thermal power and use molten salt storage onboard.
> This keystroke analysis though... it ignores two possibilities. 1. is that some incident effects keystroke length like an injury.

But it's a suggestion that something might be wrong, and that extra checks are needed. The article mentions using a webcam or sending a security guard around to check. (Obviously, this only works for internal office security and is hopeless for people working from home)

> 2. Is that the individual's keystroke method could be learned from their activity elsewhere, like their security question answers can be learned, and an intermediate device used to change the unauthorized user's keystrokes into those that match the authorized user.

I'd be interested to know how much data someone would need to build a successful keystroke-impersonator. And then where would they capture that data?

And there are really big problems with passwords; they're asked for in all sorts of places, and people don't bother using secure passwords even in the important places.

There's not that much research about passwords, especially considering how much money is controlled with them.
As long as you can boot / wake up your machine with it, fingerprint scanning feels pretty much like not having a password, since it's about the same effort as pressing the on button
downloadable archives of user comments
Not really. One is on video (and presumably audio) from a bunch of different angles, and even a tiny accidental mis-statement or contradiction is grounds for them to arrest you.

Watch the linked video. It's a VOLUNTARY interaction. The only legally prudent thing to do is to STFU.
Looks just like another programming introduction using Python. I fail to see the connection to SICP.
I'd like to see the measurements displayed as IOP per dollar. What is the cost of the benchmark?
well they were released from the same point in space, and since they are similar objects traveling nearly at the same velocity, its not that surprising. im sure nasa calculated for it, and towards the end of the video there looked like a ship on the horizon for pick up.
Data on SXSW Apps “Real People Use” - from ‘Thumb’
Strategies for writing a book - content, structure, notation, typographic style
Your HTTP headers alone per requested file is probably 1KB - 3KB is still tiny.
Your password doesn't have to be "6tFcVbNh^TfCvBn" but it can be something like "The quick fox jumps over the lazy brown dog." and still be strong with the added benefit that it's more memorable.

Password-less authentication will be great once the machine can recognize my face and voice and know it's me.
The one thing that file sharing sites excel at is finding niche materials by certain artists, such as b-sides and live shows or covers. Some of that stuff is quite excellent but almost impossible to find in a music store or on a music site.
Online Video - Its History & Future (Fear & Loathing in Hollywood)
well they are similar objects, undergoing the same forces, and they were released from nearly the same spot (from which they were both traveling in the same direction) the difference is mostly from the forces due to slight differences in tumbling motion when interacting with the atmosphere. just try thinking about conducting the same situation with out an atmosphere. the objects would follow the same trajectory from the moment they were released back to the ground. I'm sure nasa has to try to calculate the specifics/landing location, you dont want SRB's falling on property.
Thanks for the link.I read that it is used to hack into web servers and the phf bin along with other cgi-bins are becoming more vulnerable.
Wow, very interesting and well written! Ipads are amazing.
thanks! I'll look into these.
No, I understand that. I'm just unsure whether there's a parameter that can make my terminal hang or whether it's completely irrelevant due to the USB connection.

In my Lua code, for example, I have to pause a bit every line, otherwise it hangs. I'm wondering if that's normal.
I put a pure CSS drop down navigation thing on http://www.lfgss.com/ a few weeks ago and the users love it for being usable before the page has finished loading.

I love it for reducing some of the need for maintaining JavaScript for this kind of thing and that it works better than jQuery tabs (reflows on smaller screens).

The result is that I'm now looking at CSS for more things.

I would recommend making the drop down element an anchor though, rather than mucking around with adding cursors to try and get the interactivity communicated.
School of JavaScript
Rails' new seamless integration with Amazon DynamoDB & S3
Tools to reduce the burden of tautology are workarounds. You can rely on tools to make the worst design/language less painful, but it's not an argument against avoiding tautology.
Manchester United vs Wolverhampton Wanderers live Premier League March 18, 2012
Enjoy Premier League match Between Manchester United vs Wolverhampton Wanderers match. Please do not miss the today’s great match between Manchester United vs Wolverhampton Wanderers. i hope you will get so much fun by watching this very exciting match between Manchester United vs Wolverhampton Wanderers live Premier League 2012 online streaming,Watch Premier League Manchester United vs Wolverhampton Wanderers live online on 18th march 2012 . Manchester United vs Wolverhampton Wanderers match is the very exciting Match of the Football 2012 which will be kick off at March 2012 .
Muguls Vbulletin Massen PN Sender 2012
> the focus is on the object rather than the process

From a business apps point of view, this is exactly it. You might find that methods are subordinate to objects, but in the business domain itself, the objects themselves are manipulated by processes. It's a whole other layer above the OO layer, and failure to realise this means you either end up with lots of FooManager classes, or you push overarching responsiblities back down into low-level objects that don't really want them, and find you have too much coupling and not enough Demeter

(Of course, you might be writing FooManager classes with this upper layer explicitly in mind - in which case fair enough and you'll probably like DCI. But I think there's still a lot of mileage in plain ordinary functions that don't have to belong to anything)
On a side note, home server has seemed like an excellent project with huge potential that MS as a whole has basically shunned and abandoned.
Odd. I know plenty of liberals/Democrats/etc who call it Obamacare. They don't mean anything negative by it. It's a hell of a lot shorter than call it the "Patient Protection and Affordable Care Act".
We pay ourselves $36k/yr. We wanted to do $24k, but our accountants said this would be an issue. $3k turns into $2.2k after taxes, UI, etc.

I think I want to bump this pretty soon; I spend more than my $2k/mo take-home on car payment + gas ($1k+), food ($500-$1k; I buy expensive/healthy groceries), exercise ($200-500/mo), (free rent), minimal toy/entertainment budget, etc. -- if I didn't have savings and credit, living on $2k/mo would be a big distraction.

Founders making $120-150k+/yr early seems like a distraction too, but I don't think $60-90k/yr is totally unreasonable in the Bay Area.
I thought the same but in my experience, I've rarely, if ever, had the need to search for email. When I did (super rare), I found that the search function in gmail was mostly busted. Sometimes it would omit results for email that is clearly there that match specific queries or filters. I'd have to try several different methods and even manually going back at times to get the email in question. In the end, having it overloaded with email was more of a pain for those instances where I needed to find a specific email.

Sometime towards the end of last year, I decided to wipe my entire email record (which was a lot) and start from a clean slate. Since then, I made an effort to delete any unimportant emails instantly, file the important ones I think I may need to keep, and tag temp emails that needs to be there but would be deleted once they serve their purpose (for example, online orders for items shipped).

For several months now, I've managed to keep my entire email account under 50 emails. It makes managing it much easier and great for emails I would need. This of course is base on my habits. I never really have a need to pull up the majority of old emails and leaving it there is just unnecessary clutter (personal opinion).
http://www.wired.co.uk/news/archive/2011-07/19/space-shuttle... has the 30 min raw footage
I think most of the comments here are taking it too far. Not using classes in some cases is not equivalent to stopping using classes altogether. Classes are yet another tool in the programmer's toolbox. Sometimes the tool makes sense, sometimes it doesn't. The trick is to know when. But jumping to absolutes is surely not the right way to go about it.
Please do not blame "package managers": Windows Installer is a package manager in many ways comparable in scope to dpkg, which given your premise immediately disproves that they are the cause of the problem you are talking about; the issue is not package managers, it isn't even centralized package distribution systems like APT: it is that the ecosystem of libraries and protocols that make up the Linux desktop have horrible binary compatibility issues that distributions seem to make even worse through the usage of "rebuild the world and update all the dependency relationships while we are at it" policies.
there is something fundamentally different, you can choose not to update a native appp, you can also choose to run an old verion. you can also continue a native app if the creator decides its not worthwhile, or google buys them out

chrome is the exception not the rule
Thorium nuclear reactors are weirdly underdeveloped. There are lots of advantages to them, so it's a shame that we're so behind with them.
Installing Apache2 With PHP5 And MySQL Support On CentOS 6.2 (LAMP)
Nokia Lumia 719 Price and Specification | Techno18 - Indian Technology Blog
Do you have a source (video, transcript) to that talk of Alan Kay in Germany?
成人用品
How to re stream shoutcast radio stream using php or any other language
How to re stream shoutcast radio stream using php or any other language, I want to re stream shoutcast radio feed as shoutcast radio feed configured on low bandwidth system in a small town. and the re streaming server will be in some cloud server
Why software sucks?
Why do facts lean left?
Wouldn't that render any limit on the number of shareholder meaningless?
> "The quick fox jumps over the lazy brown dog."

I honestly can't tell if you're joking. Just in case you're not: that's a horribly insecure passphrase.
We were also told that paying any developer less than 82k/yr (who is not a founder) puts you at risk of him being considered a non exempt employee, and thus needing to pay overtime, etc.
Agreed--I'd love to see this as well.
My password is * * * * * * * * * * *
This is a huge annoyance for me, as is providing an example in the terms of 'A', 'B', 'C', and 'D'.

PHP's manual is terrible for this. It's not just a naming problem, but a total failure to explain the purpose of that concept or function with a proper use-case.

class A {
public function a($a) {
$this->a = $a;
}
}

class _A extends A {
}

class B {
public function b($b) {
$this->b = $b;
}
}

$foo = new A;
$bar = new _A;
$baz = new B;

....

Another thing is stuff like this:

Array.sort(function(a, b) {
return a - b;
});

Firstly, if you're a beginner, that means absolutely nothing other than an array is being sorted. Secondly, if you do know what it is, it fails to explain what else you might be able to do other than sorting from lowest to highest.
Julian Assange to run for Australian Senate
The Way to Go (golang)
That's false, it's a fine configuration for a slave database server where you don't care if it goes down after a year or two. In production you could make it a RAID 10 if you cared, but if we're just trying to get a sense for the numbers, RAID 0 is cheaper/easier. Or you could just do a single SSD as a baseline, but I would think that those who care enough about performance to go SSD are probably going for a RAID.
>I've still yet to see anyone explain why it was necessary for armed police to arrive by helicopter at his house in order to explain they had an arrest warrant for him

He's an international racketeer-er. We're not talking about some harmless geek who made a website for christ-sake, this is a dangerous criminal who has destroyed an entire industry by allowing people to share.

Think about what the 'S' word means for a minute. That's right, it means that if you are born into privilege and work all of your life to expand your empire, you're still equal to the untouchables! Everyone knows that some people are just more important than others and deserve a more comfortable life. Comfort is not a right, it's a privilege. Entertainment - even more so.

Now think about how our society could crumble in the space of just 45 minutes if someone were to start sharing. They have whole arrays of ICBM-mounted share-bombs. If one were to be launched, over ten million people could see a film before it's release date. I hate to bring Hitler into this conversation, but that's the closest comparison I can make. These sharers are everywhere. They're like terrorist cells - completely distributed and probably hiding somewhere under your kitchen counter, ready to pounce on you with talk of a fairer society at any moment. One minute you're cleaning a plate, the next you're a dirty Communist. The threat is ominous, dark, scary, twisted, demented and will make you wet yourself at night (water-proof bed covers for only $19.99 at BedWorld this weekend! - Ads by Google). If none of that strikes a nerve, think about the children.

Ladies and gentleman, we have a serious threat on our hands. The terror level is being raised to amber to compensate for this. Please remain in your homes and have your papers ready until an officer is able to verify your allegiance with the pepper test. Those who do not cry when sprayed are not witches. Remember that. (Be sure to catch Premier Obama's anti-sharing speech on CNN this evening! - Ads by Google.)
That specific example might be flawed, but the principle is sound; a keyphrase is easy to remember and has plenty of entropy.

"I used to smoke Kings cigarettes under the bridge" suits me a lot better than "3D5g!§x&".
Show HN: Video2NFO.sh
If I'm not mistaken, Dreamweaver uses a lot of custom JS code to generate pages and usually prefixes it with "MM_".

I've had the displeasure of seeing one of these functions recently, and let's just say it's not pretty JS.
Using vim for the last 10 years or so.

Had switched to TextMate for about a year in 2005 when started doing Rails, but went back to vim quickly afterwards.

Tried to switch to sublime2 lately, but its far far from being ready. may be one day.

Vim is old. Way too old I'd say. And has absolutely hideous extension language, horrible internal API and looks like crap. Sadly nothing still comes close to replace it for me.
I don't think you need voting data. Rather, answer the question: "what subreddit is similar to this particular subreddit". Then you use the degree of overlap in subscribers as a distance measure between subreddits. Use a tf*idf like approach, so popular subreddits are weighted less.

Then the similarity of r/programming to r/coding would be based on two numbers:

b = number of people subscribed to both r/coding and r/programming
n = number of people subscribed to r/coding
similarity = b/n
A friend of mine started to reverse engineer the API, that the DB-Navigator App uses, as it covers pretty much every public transport in Germany and at least trains (and sometimes trams and buses) in all of Europe. It can even give you a route to Pjönyang, North Korea. I don't know how successful he has, though.
Very nice!

I've been very interested in mobile bus times, so I built better mobile sites for live bus times from:

Oxford - http://www.oxbus.co.uk

and

London - http://londonb.us

They both harvest live bus arrivals data from the relevant providers, then send it out based on the user's location - basically, it's a really quick and easy user experience when you're out and about and want to know how long until the next bus at a nearby stop.
Your editor is such a central part of the workflow that I really can't see how you can choose something else if the one you like better costs just 50$. You will be using it for countless hours, so if you really liked TextMate more then vim I'd say go and buy it.

That being said, I use Vim, and I do have licensed TextMate. In fact we have bought 6 licenses for TextMate but not using them as we all switched back to vim.
Is programmer really profession for youth only?
Hypernotation: default data locations, „RDF methods“ and CURIE magik