skysight-inc/HackerNews huggingface dataset:
You think you have a handle on how hard it is to get crypto right. Then you get a result like this. As an expert (not me; I'm not smart enough to say this) would put it: "if attacker data is mixed with defender data, none of the branches in the cryptosystem code can depend on the content".
Visual Studio 2012 Launch Event (Live Broadcast)
I think 'jgrahamc is right.
Aw, usually programmer's day is my birthday, but it's a leap year.

I'm turning 100000 tomorrow.
I think you're correct here but how would you manipulate the cookies being sent when sending XSS requests from a different domain?
It's a very useful hack but I would hardly call it a great strength. As a module system it completely sucks.

It does leverage one of the language's great strengths, lexically-scoped first-class functions, but that doesn't make it a strength on its own.
Effexor literally made me think and act in ways I never had before. There's the disassociative feeling you get from depression, and then there's what Effexor did; effectively making me a ticking time-bomb with an insanely vivid, active (and morbid) imagination. Really dark times, and coincidentally a few months after I'd quit it, Time magazine had a cover article about the rise of [teen] suicides because of it.
Note that it is effectively the same attack as ECB byte-by-byte decryption, except using record length instead of repeated blocks as the signal.
He has essentially described Qwiqq http://qwiqq.me
Winkey +D

That's how i deal with it.
The author is right that, with scrum you end up focusing more on process and not delivery.

There are nice things about scrum, but I think scrum followers are too doctrinaire. It has some well-defined practices and is associated with that agile "manifesto" that you are compelled to buy into if you adopt scrum. Being doctrinaire about anything is guaranteed to distance you from reality - you give project managers a weapon to coerce you into worrying about how to break down your work into a velocity and stories and tasks. Any time you enforce a process like that, you are disengaging yourself from the reality of having to ship something.
Strength training is a more difficult case because it really depends on goals. If you're trying to bulk and build muscle, yeah, you can eat a whole bunch more.

But other people strength train to look better while trying to lose weight; those people can do a leangains-type program, or just generally eat at a caloric deficit to cut weight. Thus, they have to watch what they eat too, strength training or no.
> It's not possible to "cheat" at natural selection

You are right but the same can be said for winning in contests. The only real rule is "to win" all the rest are social contracts that you can break if you can get away with it. In that sense the smarter, more capable more hypocritical individuals will win, so yes, you are selecting for those same traits. I take objection with the author for his moral preaching.
Play! is meant to be a Rails-like framework for the JVM. I use it at Mapquest (version 1.2), and I like it so far. It contains its own compiler and server, so you don't need to rebuild or redeploy when you're developing like you might in other frameworks.

I've used Play! 2 for a freelance gig, and didn't like it as much. It tries to compile EVERYTHING (HTML templates, your routes file, etc), and for the simple app I was trying to accomplish, that simply wasn't necessary and led to a lot of unnecessary fighting.

I'd recommend giving Play! a try.
Off the top of my head? One network they multihome had a weird packet loss only experienced by DNS and other services, so they tried to cut the routes over to the second network, but packets were still getting sent to the first network (which had DNS disabled but ICMP enabled on the hosts) and further router fuckage prevented them from switching back easily. Hell, they probably just couldn't get their BGP to propagate once they made the first change.

If you go with 'router tables' being the culprit, they probably had a core router that maxed out its RAM when they added another router in place, but they had already moved a part of the network that housed DNS by the time the routers synced and RAM filled from too many BGP lists to sort. You can still ping 'hosts' (which are I am almost certain a hardware load balancer and not an actual DNS host) while the DNS traffic is going nowhere because the backend DNS services were moved. Would take a couple hours to unfuck all of that.
Does Dave know Ichiro plays for the Yankees now?
How to become your own boss
This is a really good description of the process. The initial challenge for most people is to even be conscious of the hot thought (love that term). It's more like a flash that passes through your consciousness and immediately affects your mood. One you learn to catch it on the way through it's a lot easier to diminish it's power to affect your emotional state.

I've found as I gotten older that I'm much better at processing negative emotions and not letting them nag at me for hours.
The attack as described by Thomas Pornin is indeed specific to HTTPS. Generalize it past HTTPS and its elements are:

1. Attacker controls some parts of plaintext

2. Attacker's content is mixed with content attacker wants to discover

3. Attacker can make repeated trials against the same plaintext (not against same ciphertext stream or key)

4. Defender compresses content on the fly

There are probably other cryptosystems that have this flaw, but it's less inherent to TLS than it is to the HTTPS security model.
The difference is that iOS allows Mobile Safari to turn memory areas into code pages, which is what you need to do to JIT JavaScript. It doesn't trust other apps not to be able to exploit that somehow, so UIWebView is not allowed to do this.
Twitter Told to Produce Protestor’s Posts or Face Fine
Was pg ever pitched on Instagram? Because a "picture service that gets sold for $1B" sounds frighteningly ambitious.
Browsing HN and Reddit and writing some code and teaching a friend how to code. Plus waiting for iPhone announcement.
Scholrly - Beta Invites Away
Quick & Easy RGB color picker for iOS
The fact that is has been collected is the value added.

If I go to ted.com and search for entrepreneur, I'll have to sift through 81 results, and only one of the top 10 matches the list collected here.

The reaction here reminds me of the assumptive skewering folks often receive elsewhere for innocently reposting pictures without attributing them to some unknownable [1] source.

How is someone with good intentions behind submitting a collection supposed to go about sharing it? Is there an actual problem here beyond the specific phrasing of the title or just your assumption that the submission is link-baiting?

1: Tineye and Google image search are relatively new and not exactly common knowledge.
That's why sites need to enable the Secure flag on their cookies, and to set the Strict-Transport-Security headers.
Again it's only a win if they figure out a way to monetize on it and they haven't yet. I doubt they will, but lets see.
>I wish DoS had more "continuous" force protection levels

I imagine they will, now.

I think State's head of diplomatic security hasn't been doing his job very well...
This is what I was alluding to when I mentioned that it's not obvious when tests should be written. It simply isn't practical to write them as part of a quick prototype (or any other rapid iteration). But writing them at the end of a project may also be difficult due to the need to move on to something else. The same argument holds for things like documentation...
That still looks lame. OTOH, recently saw this segway tech in downtown Chicago and dude looked like he was from the future. http://solowheel.com/
Juliano and Thai actually coined the name "Hollywood attack" for exactly this concept back when they presented the chosen-boundary attack on TLS 1.0.
DFFT FTW!
I use iPad / Boxee and I haven't seen the button.

I'll install Silverlight and try out the web site to see if it's there.

It might be yet another feature that Netflix Canada is missing (like instant queue).
Dear G+, please make public circles
Thanks... we have no plans on raising insects for human consumption! Right now, our prototype is producing fish, berries and vegetables; we'll be experimenting with fruit trees, beans, and eventually poultry (for eggs at first), mushrooms, and honey.
I'm starting to think Amazon is cynically exploiting the edge cases of its pricing to make a large portion of its money.

This looked great at the start, but the details really make this shitty. You need to sign up as a seller and all the hassle it entails (I'd be happy with AWS credits, I'm just going to spend them on another instance), they charge 12% and then they also round down to the nearest month.

In fact, a large portion of Amazon's business model seems to be selling the same thing multiple times. We still waste a lot of money because EC2 insists on charging for a full hour no matter what (eg even if the instance didn't even start!), and it seems a pretty scummy way of making a lot of extra margins. And now they're doing the same thing here.
Yeah, you can have a target market of $100 billion and not even crack 0.25.
I think it's time for me to write a blog post entitled "on the provable security of spiped".

Seriously, we know how to build secure cryptographic protocols. Unfortunately, step #1 is "don't try to be backwards compatible with the horribly broken things people were doing in the 1990s".
I've been a Project Manager/Developer on projects that involved outsourced labour for the last 5 years. My background is .NET. If you want to chat let me know.
It was a comment to the goodfil.ms guy, because they link to imdb not rotten tomatoes, and it's trivial to also support rotten tomatoes.
What, compressing before encrypting?
Honest question: Does SI actually do anything other than hold conferences and take donations so smart people don't have to get real jobs?
I understand this. But writing tests as you go means you can't introduce new functional code at the same pace. Although I think it's an unsolved problem, I lean heavily towards writing tests (and documentation) towards the end of a project.
Where does Planetary Resources rank on this scale?
Pick An Idea The World Will Want In Ten Years
This product is unlikely to ever replace bicycles. It will always require significantly more skill and practice to ride a skateboard - powered or not.

However, that's an unnecessary measure of success. The board just has to find a big enough customer base to be profitable. There's room in the world for many different kinds of transportation.

As for legality - certainly there are concerns, but unlike the segway, this board is subtle enough to fly under the radar for a while.
Nerf guns matter to me! (I type this while sipping on a free can of Diet Coke)
yup, there's Not Interested right on the website. I'll have to see if it also works that was on the iPad when I get home.

Stupid Boxee.
Compressed Redundancy in Message Exploit?
man sshd_config.

Compression: Specifies whether compression is allowed, or delayed until the user has authenticated successfully. The argument must be "yes", "delayed", or "no". The default is "delayed".

I don't know why they chose "delayed" as default, but this seems to prevent this attack.
Just wake up your inner pg: airbnb, dropbox, that new skateboard thinggy.
success :-)
How Hackers Choose Tools
But IE10, unlike competing browsers, isn't just a "browser" on Windows 8, it's one of the fundamental development platforms built into the OS, along with .NET, WinRT, and Win32. Of course it has special privileges
"There's no reason to assume he's being forced out."

When another officer of the company says "We decided it was best for him to leave the company.", I'm not as sure there's no reason...
He says so about a third of the way down, but maybe he added it after the fact?
Get, Set, Remove & Manage Document Properties of PDF Files by REST API
Saaspose development team is proud to announce the new release of Saaspose.Pdf. This new release now allows developers to manage document properties of PDF files using Saaspose.Pdf REST API. Using Saaspose.Pdf, you can set a single document property. This REST API allows you to get all properties of document or you may choose to get a specific property from documents. You can also remove all document properties or any single property of your presentation using Saaspose.Pdf REST API. You can utilize our SDK and REST examples to manage document properties of PDF files in the cloud.It requires a simple step, download the required SDK from Github.com and incorporate the useful features into your application. For more details, please refer to Saaspose.Pdf documentation. Using Saaspose.Pdf API, you can manage document properties of presentations such as get or remove all properties of a document and set a single document property.
Can you give an example of a JavaScript library that is a singleton?
Have you tried IE10? They have come a long way from the old days of IE6. It has much better web standards support.
The thing I always hated about hearing that phrase is that it completely invalidates what the person is feeling and makes the person saying the phrase. In some cases, it truly may be a temporary problem, in some cases it may not be. How can you say something like that to somebody with Fibromyalgia? Surely they would be apt to feel depressed and unlikely to continue wanting to live. While that may not be a common situation, it is something that could happen and, again speaking from my experience, from what I've encountered the people spouting off that line are the ones who don't know 100% what the person they are talking to are going through.

That phrase also has implications as to what happens after one dies by stating it is a permanent solution. Sure, they won't be here any more but that doesn't mean they won't exist anymore (though that is a discussion for another time).
Honestly if Canada wants to do something truly innovative, they should look at the track record of applicants rather than simply saying "get a VC to sponsor you". Things like: have they received funding previously, do they have relevant experience, have they got any revenue or "traction" on their current idea, how have they validated their current idea and whats the chance of it getting funding...are all great places to start.

But... isn't that exactly what a VC would do? While I absolutely do understand the frustration with VCs being the gatekeepers for this, it's much more preferable to the government holding the keys. They would be useless at assessing "idea traction" for example, and I'm glad they know enough to not try.

As someone in the US on an H1B visa who left Canada because of visa restrictions, this does look very interesting- even if it's just a starting point. I just got back from a weekend in Vancouver- I'd forgotten how much I love that city.
You mean except the Brazilian dancers?
Man, these lap dances can be pretty disruptive...
Interestingly, once html5 becomes fully ubiquitous, Facebook will probably already be sliding no matter how well it's native apps run. Will be a non-issue in the end.
China is not totalitarian. It's a prime example of an authoritarian regime.

Of course, in the end it's all just a spectrum. Totalitarian regimes are just very extreme authoritarian regimes. Modern China, however, is far from being comparable to historic or current totalitarian regimes.
Yes. There's absolutely zero excuse for including compression as part of a cryptographic protocol.
Software, not just bullets, put military at odds
Somewhat depends on what they find, and if they're able to usefully exploit it. But for ambition, I'd say at least a 3.

Of course, you could argue that anyone who can return non-negligible amounts of mass to earth makes it to 4...
In other words: satisfying each others' sexual needs isn't a valid and important part of a relationship?
This.

And besides, isn't Apple something like 0.001% of Chinese manufacturing output? Apple isn't the problem; if anything Apple may well be the strongest force for positive change at Foxconn.
Can you point to an instance where you said anything like that, here or anywhere else, before last week?

It's easy for me to believe that you've internalized "minimize data-dependent branches in crypto code" and thus wouldn't have designed a compressed encrypted transport.

It is very hard for me to believe that you would have spotted this flaw immediately had anyone pointed out to you that TLS supported compression.

There is well-regarded (though not by me) crypto advice recommending that people compress before encrypting, to destroy structure in the plaintext.
FTA: Scrum forces iterations, forces feedback, forces smaller iterations. These are all good things, which I loved about Scrum.

And yet the author spends most of the article denying that these aspects of scrum are useful at all. Planning sessions are "highly inefficient," a "quick meeting between the architect and the developer" is better. What if someone else has an important piece of information that the dev and the architect don't? Maybe another dev on the team has done something similar in the past, and could have warned that the estimate was low? He won't be in that meeting, to avoid being "bored to tears" with a story he isn't working on.

So how do you know if Scrum isn’t right for you? If it’s hard. If it’s easy, then it will work for you.

Obviously, if something is hard, there can't be any possible benefit to it. It's so much easier to get rid of all that process stuff and just churn out code as fast as you can. What could possibly go wrong?
you don't need to manipulate the cookies being sent, only the body of the message. The browser will send the correct cookie in the header, you control the body, and use the length of the message to determine how close the cookie value in the body is getting to the one in the header.
Confessions of a Processed Food Marketer: Taking Out the Good Stuff
Really? I'd see him as quite important to modern JS. Heck, he discovered JSON, that's certainly important, and he helps shape the ECMAScript standards. To ignore him would be foolish.
Not always. The GP post is more insightful than it might appear. A lot of reasoning used for arguing in favor of adding more unit tests is circular. "Good code is unit testable, so unit testable code is good."

Very often, optimizing certain kinds of code for unit testing makes it significantly more complicated, with none of that complexity helping you in the actual program. This is especially true for "end user" code, such as controllers.
When I took over development of a extremely dysfunctional engeering team at an established startup with 100 people, the first thing I did (after watching for a bit to learn) was put in scrum. It worked. And it worked really, really well.

2 years later, it didn't work anymore. The team had matured, the organization itself had adapted to the leaner processes and mindset and, in time, the actual scrum process was too much. It was time to change again...

And that is something I think most agile advocates don't realize. Agile should be viewed as an organizational tool that has prescripted and prescribed rules that work in general, but maybe don't work in the specific. It is great if you need something forceful with books or documentation in the beginning, but in time, the organization should mature to the point where agile/scrum/whatever is actually too much.

One last thought. I highly recommend people look at agile for the times when you need a drop in process....but there is absolutely no subsitute for hiring quality people capable of making good decisions. Agile will get more out of bad developers, IMO, but having nothing and good developers you trust is always going to be more productive.
Location Aware Fatigue - Curtis McHale
Good people behaving badly on the Internet
Hmm, did I come across to strong? I definitely didn't mean for it to seem like flamebait. :/
It's not good in principle. There are many legitimate uses of writeable code pages, and as long as they're not the default they are unlikely to cause security problems. Don't forget that these apps all run in a sandbox already, so an app exploit won't get you system access anyway. All the excuses Apple/Microsoft give are just that: excuses. The real reason interpreters and self-modifying code are prohibited is to prevent competition with the first-party browsers and app frameworks.
Reading the title, I thought that Chrome was turning of gzip based compression for HTTP bodies when using SSL. According to http://security.stackexchange.com/a/19914 (linked above by jgrahamc), it is in fact header compression that is TLS specific. So a giant sigh of relief from me.
Googles not making any revenue off you directly, yet they're paying engineers to work on it. They're making money somewhere - it's off of the ads you you see while you likely use google's services.

Please note that I don't think this is a bad thing, and I love and use Google's products myself very happily. But there is a difference between Google who is collecting revenue from advertisers, and Amazon/Apple who are making their money primarily from consumers.
Wow. Great, great article.
You don't even need (3) if you can do enough trials and have an accurate clock. Compression by its very nature drips timing side channels.
My notes:

* While 3) and 4) both create sweeping political changes, 4) is decidedly scarier owing to the sheer destructive power. 3) encompasses positive change as well.

* 6) may enable 7), 8) and perhaps 9), but is less ambitious in that it doesn't seek to bring those frighteningly ambitious ideas into reality (it only possibly enables them).

* Zero.
Bingo. Outside of Tech Companies/Silicon Valley/Major US Metro Areas/the US as a whole, iPhones don't have that huge a market share. More people have Android phones, but often running old hardware, old software, and even more have feature phones. If you're reading Hacker News, forget that you're not a typical user at your peril.
Ask HN - Your favorite programming font?
I'm undecided between Deja Vu Sans, Ubuntu Mono and Consolas.

What do you use?
Go after "Railroad Baron Money." That is to say, to invest in a fundamentally new kind of very useful infrastructure, like a subset network of computers where DRM actually works. If not absolutely, then well enough in practice. That would mean it would take something like 2 to 3 years for people to jailbreak new hardware, and almost a year to break revisions to old devices that fix an earlier jailbreak. (We're getting close to this level of security for some organizations.)

The trick is to be one of the Barons when networks are becoming widespread, and not an early innovator who gets in the history books but dies penniless. (Again fits with the railroad analogy.)

(And yes, trusted computation [DRM] as it is practiced now is bad, in the way that many things only possessed by only the powerful are also bad.)
Ask HN: this social network reaches 2 billion users
I work on a system which uses your imap-mailbox as your social-network-server. But it's more than an new mailclient. It displays your mails as a news-stream, organizes images as a photoalbum, sends comments and likes as mails.

Sounds interesting?
I actually forgot about it. But, surprisingly, my mom called me and celebrated :) Yay!
Fail whale...
Agreed. As someone who was pushed out of Canada because of visa restrictions back in 2008 (and has been living in NYC since), I'm glad to finally see some steps being made here. By coincidence I just got back from a weekend back in Vancouver and had forgotten how much I miss the place- but as someone more tech-oriented, I'm still working out how this could play to my advantage.