skysight-inc/HackerNews huggingface dataset:
I have no idea what his list would actually make you, but it wouldn't be anything I'd consider to be approaching "security expert". So, here's my list, So You Want To Break Shit:

- Learn C. Learn it well. That will give you the level of understanding you need of the way the computer works.

- Learn Python or Ruby. If you can automate something, do it. Computers are better than you at repeatable tasks.

- Learn x86 assembly (to start). Write some C code, compile it down to assembly, and read it; understand how the two map to each other. Get your friends to write stuff for you and decompile it back to C, and have them check your work.

- Learn the basics (at least) of web development. Understand how web applications work, understand the constraints it puts in place, understand the interactions between the client and server.

- Internalize the OWASP Top 10. Understand and be able to recognize and mitigate XSS, SQL injection, command injection, arbitrary file reads/writes, etc.

- Grab old versions of open source software and rediscover known vulnerabilities. Grab the latest versions of open source software and discover new ones. Start off looking for simple things, and know it well.

- Reverse-engineer network protocols. Pick a game, write a server emulator for it. This is a great way to use all your skills up to this point. It's also a lot of fun (it's how I cut my teeth).

- Write a debugger. Understand the interaction between hardware, the kernel, and userland.

- Understand, understand, understand. Ask questions. Ask a lot of questions. In my opinion, the key to security is always asking "Why?"

These are in no particular order, and none of these is more important than the other. It also jumps all over the place, perhaps because that's what I do myself; I may be breaking a web app one day and reversing some hardware the next. But these are things I feel are important, and will give you some direction.

If anyone has any questions, wants direction, or anything else, my contact info is in my profile. The world needs more breakers.
These kinds of articles were much more important/interesting in the 90s when it wasn't clear that Linux was ever going to be adopted by business or become mainstream. For example in the late 90s when the Burlington Coat Factory started to roll out Linux clients to all of its warehouses, it was a big deal.

Now Linux is everywhere from smartphones to supercomputers, and has pretty much outlasted or killed off all its former proprietary UNIX competitors. It'd be news if AIX, Tru64, SCO, or Solaris had anything to do with the discovery. We can stop doing this now, we've won.
Haven't kept up but 20years ago when I shared a building with these guys the computers were the bottle neck.

The original design for ATLAS had a sampling system where only random blocks of data could be analysed just because the computers (and buses and memory) couldn't keep up - so the data analysis became a sort of monte-carlo process as well. And this was in spite of huge and very impressive arrays of custom FPGAs and Transputers (in the 90s).
Watchup aims to be the only iPad news video app you’ll ever need 
Watchup, a new startup competing at our MobileBeat 2012 Innovation Competition next week, hopes to reduce the noise with its free tablet app, which allows you to queue up news videos and watch them uninterrupted.
This sounds like an awful law and I would strenuously argue against it if it was proposed in my country.

http://www.businessweek.com/magazine/italys-cap-on-cash-paym...

The limits are quite low, too.

I have a somewhat unreasonable hatred of banks, which stems from some unfortunate incidents - they basically lost my meager money back when I was starting out and they literally left me with nothing to eat for a few days; some unreasonable fees, awful hours, anti-customer service, etc.

So so far I've made all my large transactions in cash - I bought my car in cash, for example, U$ 9000. It's actually a tiny pile of money.. I'm pragmatic and I do use all banking services, but I'd love for them to be disrupted (and even had a tiny try at them myself befare I despaired at the humungous amount of red tape)
I also am a fountain of ideas, and I've found that this is caused by burn out. My solution is to go do something completely different, that you wouldn't normally do, for a week or so.

Many times I've found that new ideas on a new heightened level start flowing due to the distraction.
DNSChanger safety net going offline on Monday, July 9th
Not this again! How can you give advice to use bcrypt/etc. and also suggest the following function?

function HashPassword($password)
{
$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM)); //get 256 random bits in hex
$hash = hash("sha256", $salt . $password); //prepend the salt, then hash
//store the salt and hash in the same string, so only 1 DB column is needed
$final = $salt . $hash;
return $final;
}

It's becoming ridiculous.
We implemented a "mega box" drop down at the University of Nebraska (http://www.unl.edu/) in 2009. We didn't do a production a/b test but we did do in-person a/b testing using a custom web app that tested user's ability to find things in the navigation in the mega box compared to a traditional flag model. Mega box won.

Also note that this nav and template isn't unique to the homepage like most higher Ed institutions but is used site wide by all units. That was an epic battle story for another time.
God Particle Presentation Written in Comic Sans
> All this really is showing is that Apple should've made iOS from the beginning ask the user for permission before allowing an app to access the address book. After iOS 6, this app won't do anything.

Agreed.

Re: the rest, well, it depends on who controls the remote server. The action itself might not be so worrisome, but what the action enables could be, IMO.
>This is practical, answerable, an actual problem someone has faced (presumably for a programming interview

sorry but, "faced at an interview" is far from "actual problems that you face".

Interviews contain all kind of junk, abstact and bs questions...
You're right, it's just my opinion based on the tone of the article and what I perceive of Wired. I'd change the wording to reflect that if I could edit the post. Also, this was not really meant as an accusation in the sense that I make no value judgement on Jeff based on what he did or did not pay for the article (but I hear I'm strangely wired (yeah, hum) when it comes to translating my opinions into judgements; YMMV so, you've got another point there because I should be more cautious).
I imagine they can use the same process from the wiki article where they studied the mechanical efficiency of Pistorius's running form and compared to other runners. They'd need to broaden the study to include turns and starts, and possibly more. That should show whether prosthetic runners have a net advantage.
Not to mention Google just spent billions buying patents, investors might think it wasteful if then Google goes to push for abolishing software patents, even if it would still be a good business decision (those billions were never really an investment but a form of "insurance", if patents are abolished that insurance is not needed anymore).
"In step 4, never tell the user if it was the username or password they got wrong. Always display a generic message like "Invalid username or password." This prevents attackers from enumerating valid usernames without knowing their passwords."

What prevents the same enumerating attack against the sign up form. Are you going to give them a generic message that the username is invalid when it in fact has been taken?

Also the article implies that you need to use salt but than recommends using bcrypt which already includes salt.

Good read on how passwords are attacked.
For example, Python using the GMP library --

http://shootout.alioth.debian.org/u64/program.php?test=pidig...

http://shootout.alioth.debian.org/u64/program.php?test=pidig...
Hieroglifs Translations - translation sponsor of Robin Sharma seminar
Have a look in our photo album https://www.facebook.com/media/set/?set=a.350512541685371.79369.100001798830496&type=1
to see how the seminar took place.
It doesn't particularly matter. History will remember the asterisk whether the Olympic committee puts one down or not.

Perhaps the biggest question of fairness is that a person (or two) that dedicates much of their life to training for athletic contests will not receive the medal that they would have received had he been prevented from competing.
Could Oracle ruling lead to used e-book, music sales? Maybe.
Curious to see how this will be done on iOS - last I checked there was no way of running apps in the background.
Seeing through human eyes - system to mimic human eye movement.
Given that the poster said "not in the US," this seems plausible to me. The detectors probably detect dollars and Euro, and maybe a few other high-profile currencies like yen, UK pounds, etc. But do you really think Epson would bother including fingerprints for Lithuanian litas or whatever?
The future of embedded systems?
So what is the future of embedded systems? Computers get faster so where are we in 10 years? Just use Linux code in some high level language and you are done, no need for using resources sparsely because we will have a lot of them?
But then, realtime will still be a problem in garbage-collected languages?

On the other hand, new frontiers will open up, there will always be applications where you want to go even smaller and then you still want to use resoruces sparsely.

Is it a good choice for an engineering student to get into embedded systems today ?
That is basically it. I basically limit most of my heavy ready during the daylight and the iPad is great for finishing up a couple of chapters before bedtime...
I think this is a good list on how to get good at learning to jump between layers of abstraction with gusto, but I think ultimately this all needs to be motivated by a desire to actually exploit or reverse engineer something (as your latter bullets point out).

Learning C super well is important, so is assembly, so is other topics but I think fundamentally, step one needs to be: "I have product X. What is it trusting? What is it trying to protect? How do I get around it?" Then, find similar vulnerabilities and continue on stumbling to the ultimate goal.
If it doesn't already, the ACLU app should use GPS data to disable the soundtrack by jurisdiction.
What implications will it have, exactly? Let's just say what you seem to be implying: that FRAND agreements are worthless once you sue someone. Is that so bad? The patent covenants in the open source world almost always include this kind of term already.

So explain to me why the world will fall apart if everyone gets to ignore FRAND terms when used against parties that are already suing them over patent licenses? That sounds like a good thing to me.
This can be possible through the new static library creation support that also landed in today's update: https://groups.google.com/d/topic/rubymotion/2P0WGJTpF10/dis...

Minor tweaks will probably be required.
>The problem is that by splitting the community into these micro sites they are making the whole stack-exchange universe less valuable and interesting

That's how they want it. Stack overflow is not about being "interesting", it's about being relevant to common problems.
agitprop
Not that your approach needs validation,

but I'm going through the exercise of building out an app sec practice, and for what it's worth, I've adopted the same approach (we're not using automated scanners).
> Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts').

I was thinking more of "this will not steal my credit card" (unless you keep that info in your address book) type of malware. But, yes. I get your point.
Bitcoin payments for person-to-person can be done on mobile. Merchants can run their own point-of-sale or use a hosted solution (or, us a mobile / tablet, just like an individual).

For merchants, just like if VISA/Mastercard/Debit card, etc., goes out due to power problems (and there there is no battery backup or local generation), a merchant can't accept payments until power is restored.

As far as power outages for those mining -- there is no disturbance to Bitcoin even for lots of power distruptions. If the entire world goes dark, your inability to spend bitcoins will be the least of your problems.
I like this approach, esp how it is implemented on Lebron's site. Like wolffnc3 said above, I would be curious to see if users like the idea of triggering all of the drop-downs with one hover or if they prefer the classic way.
Curious to see how applicable this is in states like California where one can't record another without their consent. Wouldn't that apply to the policeman being recorded as well?
Applied Stochastic Processes (University of Waterloo)
Actually the USA is more insular than that. Almost nobody here knows even basic historical facts about its neighbors such as, "The only reason that Canada exists is to not be part of the USA."
Few rhetorical questions:

* I'm pretty sure everyone agrees that customer-driven development is key, so who were you building this for and why were they interested?

* What are they doing to solve their problem at the moment and how is your solution better?

* What evidence did you have that this was a good idea?

* What evidence do you have now that this is a bad idea?

* Why does it have to be friends - can you facilitate spontaneous meetups with strangers (ideally with similar interests and values)?

* Why does it have to be spontaneous - could it connect people who will agree to meet [sometime today/this week/by the end of month]?

* Why do you "spam" people - why not have people collectively opt-in with a "I'm free" marker (with various [free to anyone|free to friends])? Bonus points if you can align calendars to suggest a free time (why Google doesn't do this I'm not sure).

* Is "spontaneous meetups" the right way to sell the idea? What about [coffee-with-interesting-people/speed-dating-in-your-lunch-hour/try-something-new-every-week/never-eat-alone-again/get-fit-with-strangers]?
I think the problem is not whether software patents should be abolished or not, but what kind of software/codes can be patented.

And I recommend everyone who is considering this problem to watch this documentary: "Patent Absurdity: how software patents broke the system" http://patentabsurdity.com/ .
FoxyComplete : Advanced autocomplete search with images
Show HN: MRE - a web framework for Rust
For everyone claiming Oscar has a technology advantage, an expert committee led by Hugh Herr (world leader in bio-mechatronics)[1,2] across scientists from 6 universities, proved in 2008 that Oscar did NOT have any advantage. This has been mostly a political battle.

[1] http://www.media.mit.edu/news/releases/2008/05/study-revives...

[2] http://www.technologyreview.com/news/410167/amputee-gets-a-s...
You're opening it up for discussion with the implication that somehow Linux provides superior tools. However, despite the strong implication, you're unsure of what those could actually be.

This is a leading line of discourse -- you're strongly implying that Linux permitted more rapid development, but you don't appear to have any supportable justification for why that would be the case.
They better hope Apple wins; otherwise, Samsung's S-Voice and various other vendor's attempts are going to become tempting targets. Apple's is likely just getting sued first because they're the richest.
Why Users Fill Out Forms Faster with Top Aligned Labels
Luckily, Clojure has a type system. Actually, several of them, which work together:

http://clojure.org/protocols
http://clojure.org/datatypes
http://clojure.org/multimethods
http://clojure.org/java_interop#Java%20Interop-Type%20Hints
your font could be a bit bigger and you could provide a larger click area - but I like the design.
I was writing scientific X-ray detector software in the early 90s, and it all ran on ... OS-9.

(And for the newbies around, that's got nothing to do with Macs)
How soon for any of the exports? The FAQ says 'summer 2012', but I know people that could use this yesterday.
I'd tend to agree with you in that we could see it as 'every little helps'. Positive publicity never hurt, especially in view of the desktop market which remains stubbornly proprietary. I wonder when Linux will go mainstream there.
>>More like preemptively declaring I don't want to deal with HN crowd replying with "but benchmarks are worthless"<<

It's a dirty job but it still has to be done ;-)

Let them reply and then answer them.
I tried varying my commit messages from those recommended, (e.g., in the second commit, I typed 'git commit -m "Commit all the things!"'), and the commit messages weren't reflected in the "git log" output. It's not clear to me now how much of this is canned response and how much actually runs git.
I was trying not to be too personal, but I do basically agree with you. I dearly adore transhumanist fiction, but their real-world philosophy seems to boil down to pretending that the fiction is real. One hesitates to compare them in that respect to Trekkies, but there the comparison stands.
Show HN: QuicklyChat - A video walkie-talkie for the workplace
I think that says much more about you than it does the Chinese or North Koreans.
What would you think about prompting the user to sign up after they make their own tutorial (so they can save it or what have you), rather than before they start?
Just one thing, you have a checkbox to accept the terms of service, but I dind't find a link to the document.
Quite a bit of the money that mining operators receive is now going mostly going towards investment in R&D (and soon, manufacture) of ultra-efficient ASIC based mining hardware.

This things solve the computational work at a couple orders of magnitude greater than GPUs (the currently prevalent mining hardware) does.

So instead of 70% of the cost of mining going to pay for the electricity, it will be 10%, and the cost of the technology consuming the remaining 90%. I.e., in terms of total kWhs consumed for Bitcoin mining, we probably are already past the peak.

One single bank building in Manhattan consumes way more power than Bitcoin ever has.
Well, because the current language & tech stack simply does not cut it.
The directionality of those is pretty cool. Of course with latin style quotation marks you can always do the 'smart quote' style quotation marks, but those really depend on handwriting a lot more.

I suppose adopting those style quotation marks in English is probably a lost cause though.
What is wrong with the above function? It's not obvious to me.
Although I'm entirely opposed to patents, a way to limit the exposure of companies to patent trolls if if these trolls need to quantify their "damages" in terms of lost sales or lost opportunities. If they're not actively developing products, that is certainly going to be hard to prove.
I just wanted to say thank you for this summary! :) Very good overview in retrospective after having watched the video. Good start to the discussion.
That's right, sorry! Fixing that broken link shortly...
It's a stupid claim, and we're taking the most agressive action we can against it, which in this case means suing them first.
Either way, the penalties for illegally recording someone are a lot less than the penalties you'd get for the cops planting a kilo of heroin on you.
User selected columns is easy, just select all required columns each time and display as needed, the performance impact of this is minimal. The fact that the query need not be reparsed is probably a bigger benefit performance wise.

Paging is equally easy, using ROWNUM < X in Oracle or equivalent in other RDBMS.

The order by is a good point. The obvious solution here would be to always have the same sorting as default, and do the user sorting client side (by client here, I mean calling application).
This is a 1994 patent. Looks like it should be expiring in Nov. Better hurry up with that suit, patent troll!
Redacción SEO es la "última milla" para los rankings..
Who said it was a news story? It's not about an especially current event, and Wired is not a news magazine (for that, see Newsweek, Time, or any number of others); they're a tech/nerd culture periodical. They've has always had a major focus on long-form journalism.
At least in Ohio most police cruisers are setup to record video+audio of stops and the police are supposed to use them at every stop. Whether or not that happens I don't know.
"I'm iffy on how large the market is for the 7" form factor "

I haven't done much validation, but over here (Uruguay), cost is a huge factor in purchasing decisions, so people get the 7' chinese knockoffs with non-authorized Androids, and I've seen a few Kindle Fires (although the user experience is awful outside the United States, it is very US-centric).

Only relatively rich geeks have an iPad, they're outsold 100 to 1 by the chinese 7 inch tablets. Although they ARE a status symbol and highly desired (like iphones and ipods, which lose out vastly to Android here as well).

Edit: added country
At several companies I've worked at (and my current company) there have been severe limitations on future growth with the existing technology choices. It's more important to be able to remain agile and have a high ceiling for growth than to use the most familiar thing always.
Wrong. You can stay private with >500 shareholders, you just have reporting requirements matching those of a public company.
Trolls likely will settle out of court. I hope Hipmunk doesn't fall for this trap either.
Motores de búsqueda cuchara a cuchara como un bebe?
why doesn't youtube just wipo that domain?
Hidro - Dimensionamento de Coletores Pluviais
That's not your fault. No web app should be able to crash its browser. It is like a browser causes blue screen of death. If you figure out the reason write a blog post about it and send to Apple please. It happens while fetching friends stage, so I believe it could be about storing large data on client via js if you are doing so. Just saying. Wanna try that out when it is fixed! Cheers.
Stand-up comedian Katt Williams' take on Pistorius being disqualified from the 2008 Olympics - https://www.youtube.com/watch?v=_qlNEmpxQxI

"The last place you wanna be in a muthaf-ckin foot﻿ race is behind the guy with no goddamn foots."
I have a different medical condition which leaves me visually impaired, among other things, and I no longer drive. I answered a similar question back in June elsewhere:

http://ask.metafilter.com/217676/Moved-back-home-depressed-W...

I did freelance work online earlier this year of the sort you describe. It was inadequate to my needs and felt like a trap. I am currently getting public assistance and working on developing my websites as my only hope of a long term, real solution.

Feel free to email me.
"Working this way, everything becomes quantifiable, predictable, comparable and traceable."

And laughable.

What architects need to do, is write lots of production code, so they recognize that none of those things is easily achievable, if even possible.
Community building tips... before opening a space
UndoManager and DOM Transaction
What's that supposed to do?