skysight-inc/HackerNews huggingface dataset:
If it were as fun as it looks in the movies, then there'd be a lot more people doing it.

Heck, planespotting is a hobby for a lot of people, but that doesn't make it interesting.
In some cases, not letting them know they've failed is nice. But the most common case to look out for is, if your auth/crypto process involves multiple steps, don't return early from it, or do anything that alters its runtime significantly. This leaks useful information in many situations. The course at http://crypto-class.org is better than me at explaining this stuff, and starts on Monday.
Running the risk of being an armchair psychologist, I think it's pretty well established that RMS likely falls somewhere on the autism spectrum, or at least has some sort of behavioral condition that leads to behavior like this, as well as his documented social quirks.

Which is to say that I think he's probably mentally stable, but a bit strange by everyday standards.
People that build crypto after reading Applied Cryptography are doing a fine job paying for my kids college education, so I agree with you and encourage everyone to do likewise.

If you don't happen to like my kids, well, first, screw you, and secondly: buy _Practical Cryptography_ or _Cryptography Engineering_ (really the same book) and burn your copy of "Applied".
Any chance you could add a database description, e.g., the date range of coverage?

"This database covers all HN content from YYYY-DD-MM to YYYY-DD-MM." Something like that. A user might wonder: What is the earliest content? How frequently does it update? Etc.

If this is already documented somewhere my apologies for not being able to find it.
Wouldn't this attack be better eliminated by fixing the timing leak that is potentially allowing people to guess valid MACs on packets?

The reality is that you probably can dick around with things in your deployment and your app to make timing attacks prohibitively expensive/annoying; if you understand that you're not eliminating the timing leak, but rather masking it, you can take advantage of the additional measurements required to unmask the leak to give your MAC enough of a buffer to last for its whole useful lifetime.

But when you do this, you're really playing on the razor's edge of what we currently know about side channel attacks on crypto, and you're probably going to end up putting more effort into your workaround than you would in just fixing the underlying bug.
I don't think apple actually claimed that it came from apple. They just claimed the trademark to it.
i think i'll steal your idea and launch a social network for overweight hipsters who like weird socks. weird sock social networks are just too mainstream. If it doesn't work out we'll pivot into a social price comparison sock search engine. keep building, keep shipping, change the world!
Smash Networks Coming This Summer | Smash Networks Blog
Paranoid much. I'm not sure that the advice that article gives 'stay underwater while raking in the $' is really possible if you have a 'runaway success' on your hands.
I traveled overseas for 3 straight years long ago, and with the exception of when I had my own locked apartment, I kept my passport physically on my body at all times. The comment above about developed countries is provocative. I know very little about Argentina, but I believe in the 1930's it was considered on par with European countries and North America in terms of development.
Possibly, although it depends on the lifetime of the link and the size of the tag (e.g. SHA-1 is 40 chars, each case requires mean of 8 guesses, so whole thing only requires 320 requests).

Better to have resistance as baked into your crypto as you can, rather than relying on a firewall further up the stack. If the data itself is resilient, no implementation will be able to defeat it efficiently.
It also helps to establish your market and discover what the audience really wants. It's great market research where you can have your potential customers give you feedback throughout the process.
There are tons of things I would like to do, that I could afford to do, but that I still won't do if I have to bear the whole financial risk myself. I'm sure that's true for a lot of people.
Of course fencing, especially at the higher levels, is much more a sport than a form of combat. I'm only intimately familiar with saber, but there the rules play a very important role. Having the right of way changes everything, and a lot of blade contact is about getting the right of way rather than actually preventing your opponent from doing something. If you have the right of way, you don't care about being hit as long as you hit your opponent sufficiently quickly after that--I don't think real sword fights work that way :).

All this makes fencing more fun and interesting, but also more of a game. This really affects the tactics people use.

Also, foil works the same way with a very similar set of rules about the right of way. There are some minor variations, but the basic idea is the same--if you have the right of way, you get the point even if you hit after your opponent. Epee is different, with no right of way, but I never really liked it so can't comment much. If anything, it seems epee is less focused on footwork than saber, but it could just be my inner saber biases showing.

Fencing, while awesome, is a poor proxy for actual sword fighting. If you were actually facing something sharp, you would be much more worried about getting hit at all and so would probably parry more.
But if important is hard and unimportant easy, than there might be better reward/work by working on unimportant stuff.
Do they do better because of a lack or male interaction, or because they aren't going to be challenged as much? Because sooner or later, they have to leave academia and wake up to the realities of the real world, where Dave isn't only being a dick in meetings but is trying to take your next promotion to become your manager.
Earliest search I've been able to perform:

hn -d 02-19-07
and yes, I hope chromebook wont have a problem working with external mechanical keyboards, right?
Man Cured of AIDS: ‘I Feel Good’
Absolutely New and Free Photoshop CS6 Tutorials
Huge number of professional and free Photoshop CS6 tutorials have come up which has made mastering this latest version of Photoshop extremely easy and quick.
I think the difference is that you choose which sites to go to.

That's not a difference. You choose to own a phone. You choose to leave your phone on the hook. If you don't own a phone, if you leave your phone off the hook, you won't get unsolicited calls. Further, you don't get to know which sites have ads before you go to them. And finally, a Safeway card doesn't know you walked into a 7-Eleven, or a bookstore, or attended a concert.

I think there is a place for ads.

No argument. Ad networks simply need to find a business model that doesn't depend on breaking a DNT law. It's their responsibility to do so if they elect to sell ads. Privacy should not be involuntarily sacrificed in order to support their business model.

assume mozilla _is_ trying to make the web a better place, and now consider why they aren't lobbying for a law.

OK. Because they lack sufficient intelligence. I doubt that is the case, so I'll revert to my view that Mozilla is not singularly focused on "what's best for the web".

Simply because Mozilla, or you, or I are unable to create a business model for ad networks that is not dependent on invasion of privacy, and simply because ad networks are disinclined to change their existing business model, does not mean a DNT law destroys ads. It is not Mozilla, or mine, or your responsibility to save ad networks that stubbornly refuse or are incapable of identifying a non-invasive business model. But it is Mozilla (the "what's best for the web" Mozilla, anyway) and mine and your responsibilities to oppose businesses and business models that invade privacy.
Most shooters don't bother making you deal with recoil either though, or the weight of the gun.
what's wrong with hashing (message + secret) instead?
Pandora Reaches 53.3M Active Listeners & Adds Mazda To Auto Partners
Oh come on. I'm sorry, but how can you be older than 12 and not understand how this stuff works?

Would Steve Jobs have come to any of our funerals? Doubtful. That didn't stop literally the entire front page from being filled with articles about his passing.

They're celebrities in our little community. For better or worse, people want to know when painful, wonderful or otherwise-interesting things happen to celebrities.

Check out a copy of "People" or another celebrity gossip magazine next time you're at the grocery store. Same thing, but for a different community of people.

You may be immune to celebrity-fascination, but most people aren't and that's just how the world is. Get over it.
مشاهدة مباراة ايرلندا وكرواتيا بث مباشر 10/6/2012
Read the second comment on the link.
He's been secretly reprogramming and binding parts of himself in a new form of encrypted-typed FORTRAN 77? OH GOD.

Skynet is here everyone.
I do the same, sort of. I just use RCS on a local machine. Who cares what other people think?

Any chance we could get a glimpse of this booting? Maybe a YouTube video?

Is it easy to do static linking? I'm quite happy without shared libraries. And I don't mind being hated for saying so.
It's not so much that the header is stuck there, it's that the logo hangs down further than the bar. While reading the post, several times I started reading a sentence only to see the middle of it and having to adjust the scrolling. Also, it breaks the space bar... I can't just read a page, hit space to get the next page of text. It forces me to scroll with my mouse. Very annoying.
Thanks, have a look at my following answer to withinthreshold's question
While it is a very broken analogy, after reading your post I did get a better understanding for what he was going for and it gained a bit of entertainment and mild insight value. Thank you.
Brilliant idea. I think this is pretty awesome.

However, from my (brief) usage of the landing page, I don't quite understand who will be doing the delegated work. Will it be some intern, or will it be your team? Who is your team? More specifically, what are there skills and what guarantees do I have?

Also - I can see potential problems with undergrad students submitting assignments to be done. Any idea how to regulate that kind of stuff and ensure you aren't just helping someone do something that they aren't allowed to delegate (or is this not your problem?).

I'm sure the details will be clearer with time, and for simple tasks this could work quite well.
You mean as in a better design? This was designed by me and I am not that good designer. Will try to make it better
It may be relevant if his following appearances - as it looks like he was on the tour - will be affected by this. I.e. if he will be unable to appear at the next planned event, people would want to know what happened. I know if I planned to meet some interesting person and the event was cancelled at the last moment, I'd like to know what happened.
The high-level answer is that construction is vulnerable to practical attacks based on hash function weaknesses, but that it's significantly harder to attack than secret-prefix MAC functions. But once you understand how secret-prefix MACs are broken, you quickly see the logic behind HMAC.
Some of the best book recommendations I have ever gotten have come from random comments in HN. I will be adding this one to the queue.

Thanks.
But punching himself in the head? I knew Stallman was weird as we all did and that yeah, he's probably got some disorder but when he's punching himself in the head publicly you can't help but wonder if maybe we should reevaluate our faith in his ideas. Having a mental disorder does not automatically invalidate anything he's ever promoted or done but for me personally, I'd ask myself whether the next idea he promotes is coming from a place of logic or if it's his condition talking. People don't seem to really question him as it is and if there really is something more going on with him maybe that should happen more? Because people are so sensitive when talking about Stallman I have to make a disclaimer: I didn't say he's stupid or wrong or crazy. I'm just wondering how stable the guy is and his public reaction to what happened gives me just cause. I'd wonder the same thing no matter who it was.
101domain.com offers it (along with practically every TLD): http://www.101domain.com/ng.htm
Parrying only works with heavy, slow weapons. The unfortunate reality is that with a light, fast weapon, you do not have the time or reaction speed to actually parry. "Parrying" doesn't really happen. Getting the f* away with your feet is the only option.

So yes I suppose it does matter what you mean by "real swordfighting." If you mean standing there decked out in 50lbs++ of metal armor with a giant sword & shield, footwork is less important. If you mean the kind of swordfighting that took off from 17th century on - dueling with rapiers, not mass combat, then it's footwork all the way down.

And yes, for the record, I think that realistic dueling would make for a very boring video game. I would be 100% behind more realistic sword & shield combat though, that could be incredibly awesome.
> You choose to leave your phone on the hook.

This would be equivalent if the act of having a browser meant that the advertisers could interrupt you at any time your browser is open. That is not the case. Far from it.

> I'll revert to my view that Mozilla is not singularly focused on "what's best for the web".

You've ignored many other possibilities, such as the one I suggested in my last post. What evidence do you have to support your view?
yes, why not ? contact me through my HN profile (twitter).
I agree. Maybe the best way to approach a sword-fighting game would be to make a cheap sort of sword-fighting robot/dummy thing. Maybe like a mannequin on wheels that could quickly extend and retract one of several plastic rods and spin around and whack you with them or something...

I googled "sword fighting robot" and found this: http://www.bit-tech.net/news/bits/2011/07/20/kinect-used-in-...
You guess the length of the last block (or iterate over possible lengths with trials of the attack). When you know it, you can easily predict the MD padding at the end of the hash to fill in the block. That fake padding (our code calls it "glue padding") actually ends up in the forged message; for instance, if you're signing URLs, you'll see it as gibberish in the middle of the URL. In practice, most code does not care about the gibberish "glue" bytes.
RFC 2104 specifies how you should do it, see e.g. http://de.wikipedia.org/wiki/Keyed-Hash_Message_Authenticati...

The Handbook of Applied Cryptography, Chapter 9 (free online: http://cacr.uwaterloo.ca/hac/) nicely explains the reasons.
I think you are wrong. Convincing people to freely give is nothing dangerous and actually it is a proven fact that it is beneficial both economically and societally - many people now have their bills paid by jobs enabled by free software and while it may be that RMS might like it, commercial software is not dead either and won't be anytime soon. If anything, free software made more people able to sell their services as programmers.

My option is that RMS is going to far in his opposition to commercial software and in his zeal for freedom he sometimes promotes choices which I (and many others) disagree with. But his contributions are still great, despite all the disagreement.
More importantly, if you read the article, the text is in Nederlands and the more you excerpt, the more you will have to translate.
> I disagree, I think his evangelism is dangerous and offensive.

Which is completely irrelevant to what you quoted.

> He goes around telling programmers that they should give their code for free

So I take it you have never looked at his writing or heart him speak, and only repeat fifth-hand earsay? Because if there's one thing RMS does not do it's tell people they should "give their code for free". RMS has (and talks about) issues with freedom-less software, not with paid software.

> and he belittles anyone who doesn't follow his advice.

Meanwhile you call him and his ideals "dangerous" and "offensive" for what you imagine are disagreements with your position?
If you actually do this you'll either have to get it elsewhere or not tell him it came from Amazon. Stallman recently wrote about how we should stop supporting Amazon. I seriously wonder if he'd accept if he knew where it came from.
+1 on this, M&B with the difficulty settings cranked is the best you can get atm.
Any competent security architect will assume that if the bad guy gets a copy of the entire password database he also gets a copy of the entire codebase, all design documents, installation instructions, and operations manuals, and designs the system to be secure against that.
rms received the MacArthur Genius grant at some point, which comes with a decent sum of money.

Now before some might get the wrong idea (that it would be easy to be an rms if financial worries were taken care of), rms had a job teaching before he got the award and was already doing these speeches.

As an aside, in my opinion it makes his dedication even more admirable. It would be easy for him to decide that he's done enough for Free Software, gets himself a nice seaside property to retire on and tend to his RSI, instead of speaking around the world, getting mocked and willfully misrepresented in the press, and apparently get his stuff stolen.
But he doesn't, because his work is important. He's quite the character, warts and all, but he does have character.
The Art of Misdirection -- Opportunity cost of some modern dev techniques
Get him a box of Lenode laptop that he wants, inside, it should have a mac book pro. Film his reaction!
The chart you show is inaccurate. It's using Hotspot server for Java, but interpreted Python. For a fair comparison, you should use Psyco or PyPy for the tests. I suspect you'll find it right in line with Hotspot under Java.
If you have a family member suffering from the disease or have a high chance of getting the disease, the said family member can be enrolled in the trial instead of waiting 10 years for the final product.

In medicine, safety is paramount. This is not a Node.js start-up where you can push 100 updates in a day.
Never say never.

http://www.npr.org/2011/12/14/143639670/the-technology-helpi...
Game Engine Architecture and Real-Time Collision Detection were both prescribed material in my games technology course (done as a double major with CS). Cool to hear that they're recommended by industry folk :) Gregory's book is especially good and taught me a lot. +1!
Not to mention the complete lack of Sandboxing and Mandatory Code Signing?
Binjs - a scripting framework using the best of bash and JavaScript
I still have Unreal III in a box new that I bought in 2007 because they said they would have a Linux Client for it.
I fail to see the creepyness/offensive factor of the "Lea Verou will make your dreams come true" line (even if thats what she personally felt)

I took it to mean "programming" dreams. Whatever anyone else did with that in their own mind is their problem. Is there some missing context I'm missing? Just because the other parts of the song sorta mentioned penises, vaginas and drugs, that means they MUST be talking about sex in reference to Lea? I didnt make that connection.

I'd say those parts were much more offensive than the Lea Verou line. I had no idea who Lea Verou was before this, but now I have another great female tech role model to follow.

Overall this was extremely distasteful, and I think microsoft with all their money could provide much better entertainment

But who's to say whats popular in Norway? I certainly don't know what their social norms are. But I also dont know how this conference was marketed. Was it truly a regional event?
According to http://richard.stallman.usesthis.com RMS would like to have a real laptop with an open BIOS.

Shouldn't a laptop like the Thinkpad X60 or T60 with Coreboot installed fulfill that requirement? They are supported according to the coreboot site.

Are there any other potential problems I'm not thinking of? Possibly a firmware issue with the Intel chipset?
I'm not so sure.

They were also described as men. Does that make it sexist?

They were also described as privileged. Does that make it class warfare?

The point is obviously that they come from the same, very particular place at the very top of the same hierarchy that's created the world we now live in. Simply because the media has chosen to glamorize those people more than others doesn't mean we should do the same.

Why not throw some equally intelligent and qualified people as Elinor Ostrom or Amartya Sen in there? Aside from the fact that they're probably a bit more left-leaning/sympathetic to the little guy than the three mentioned.
I absolutely adore the video, but the video should CLEARLY explain what the money is going to be used for. There is no mention (only allusion) to hardware development in the video at all.

Also, it's not clear from the video if the game will be playable _without_ the special hardware...
Also, HMAC is just one MAC (message authentication code). OMAC and is another good one; it has the interesting property of being built on top of a block cipher instead of a hash function, which can reduce the number of "moving parts" in a system if you're using a block cipher of some sort anyway.
For example, if you already happen to know a collision hash(m1)=hash(m2), where m1 and m2 have full block size, then you also get a collision hash(m1|key)=hash(m2|key), just as explained in the article. So, one could forge messages, which should clearly be counted as a weakness, even if it assumes knowledge of a collision.
If I remember correctly this was the same issue that Flickr had with their API calls at one point in time!
The compression function requires blocks be of the correct size. Your blocks will align.

Your hash construction will pad out your data to be multiples of the right size. That padding can be verified in some way - often it is all nulls, or encodes the length of the message. http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_con...
The same here, in the UK.
There's nothing wrong with Applied Cryptography so long as you _understand_ it. If you blindly apply outdated algorithms, yes, you lose. Everyone should read both Applied Cryptography _and_ the other books you mentioned, and keep up on the literature besides.