skysight-inc/HackerNews huggingface dataset:
Almost straight port here to luajit - http://github.com/malkia/ufo/blob/master/samples/notch.lua
We're figuring it out. At the very least, I will be swinging by from time to time to teach periodically, but I will probably not be there full-time.
you can install some add-on to enable that function
I'm replying to my own message to provide some solutions I found to the problems I reported.

First, regarding inaccessible window header bar, one must use the alt-right click magic action to display the window manager menu and select the move window. This works wherever we click in the window. The other menu commands might also be useful. However, my opinion is that it is bad UX and inefficient.

Second, regarding NoMachine, I tested Xubuntu which doesn't depend on 3D accelerator and with some trick it can be used as an ersatz of Ubuntu. For the trick that works see here: https://answers.launchpad.net/ubuntu/+question/157817
One widget is not working, but it is not critical.
The usual statement is that any IP you create on company time using company resources will belong to the company. Any IP you create on your own time will, likely, be outside the scope.
If you are genuinely interested in testing your 1Password keychain, the Jumbo builds of JTR include support for the agilekeychain, and some branches (Magnum Jumbo for example) offer OpenCL support for even faster attacks.

I tried it against mine, and was significantly disappointed in how quickly even my laptop could attack it. I promptly increased the complexity of my master password.
The question was more of a curious one, I'd like to see what others think Google's rationale is for sticking to page by page.
The implementation is just wrong; this extension will prevent the playback of any video that have playback disabled for third-party websites; because using an iframe makes youtube believes that you are watching the video on another site.
Actually, after 20 mins of use I found it incredibly uncomfortable. I still don't know why they didn't just continue with the fabulous Sparrow client. I'm going back to Sparrow right now.
We use it to mean practising how we handle bad things, such as unexpected server failures, which seems to me a reasonable appropriation of the term.
Yes, I printed that one out and stuck it to my monitor, actually :-)

I still value HN very much, and I read the comments because there is often useful information. It is just the way I interact with it that is the problem - certainly not HN that is to blame.

HN is actually almost the only web site I visit, apart from a local newspaper which I would like to quit (they are actively manipulative, as newspapers go).
This reminds me of the presentation "DEFCON 18: Your ISP and the Government: Best Friends Forever" http://www.youtube.com/watch?v=t0aQojDGSD4. I wonder if the "don't get involve in drugs and you'll be fine" advice still holds.
because it sucks!
I'll probably get shot for this but in the shared source license there are a number of huge holes around the signing key code. NSAKEY doesn't exist any more but its more suspicious when there is just no code there.

I wouldn't trust Microsoft - the world's largest Trojan.
Really cool. Would love it if hitting the ? blocks actually did something cool ;) - great job.
Agreed. What I've seen happen is the company becomes destructively divided into two camps: Those who have a slightly too healthy work-life balance and take liberal amounts of vacation, and those who have a tendency towards work-aholism, take little vacation, and grow to resent the first group as a result.

What works much better is to just decide on what's an acceptable amount of vacation, say 3 weeks, and tell everyone that's what they get; take it or leave it.
I understand that a word processor faces greater challenges in cursor positioning than a simple text editor--that's why I write my documents in LaTeX :)

As for swap, I always figure that if you're hitting swap, you're dead. It's time to buy more RAM. I've had instances where running Firefox and a kernel compile at the same time on my 4 GB laptop turn it into an absolute thrashfest--I have to walk away for 15-30 minutes, because I cannot do anything at that point. Applications, even plain old xterm, are big enough that swapping them in and out makes the machine unusable.
This will hurt Apple in the long run.

Soon app innovation will stifle because only a very few companies are making money. Indie/mid size developers will stop working on innovative apps and start working for bigger risk aversing boring companies.

Biggest reason imho is that these top 25 are one big self fulfilling prophecy: A top 25 position guaranties big download numbers. And to get there you need either a collection of apps already out there for cross promotion or buy lots of ads and installs.

Switching to a metric that indicates quality much like engagement measured by # sessions or # minutes use/month will make quality apps stand out much more.
Cottonballs - flexible mock GCM server for high-scale local testing
Here's a good response from such an owner: https://groups.google.com/forum/?fromgroups=#!topic/nodejs/W...
Are you sure? PHK is a quite seasoned FreeBSD kernel developer and did phkmalloc which was used in FreeBSD for a long time, see http://phk.freebsd.dk/pubs/malloc.pdf.
Well, I don't remember the last time I had to navigate past Google's first page.
I think the "return an error code" approach is just as unreadable as nested or multiple try/catch blocks when the number of failure states grows large. I think the "Maybe Monad" approach of functional languages and Scala, combined with pattern matching in the language tends to look cleaner, e.g.

some_expression match {
case Some(x) => do_something_with(x)
case None => no result (e.g. null in C/Java/etc)
case Error(x) => handle error x
}

One of the nice things about the monad approach is they can be combined together. Consider the following chain of function calls which may return null at any point:

int val = foo().bar().baz().blah();

To deal with this with if/else statements, you need 3 nested if-statement for a single line of expression. In a language like Scala, you can just write:

for (a <- foo();
b <- a.bar();
c <- b.baz()) c.blah();

I think there is an inherent tension between explicitly detailing everything and boilerplate in terms of readability and writeability. I haven't seen enough Go code or written much of anything to say anything about it, except that it worries me. I do think the multi-return stuff can limit the amount of accident ignoring of error conditions, but the Go language itself doesn't provide any high level syntactic constructs to make dealing with the errors less painful, whereas with the Monad approach (which essentially is multi-return), the pattern matching tends to look cleaner IMHO.
the only situation I could possibly think of is that the key is a user input and the digest is only sent to the server. Then the server could verify knowing that customers key.
True, but in reality you're probably sending that password over something less secure (like an SSL connection) that doesn't require quite as long (but still a very long time) to crack.

Anything is only as secure as the weakest link in the chain.

If (I'm sure you don't) you allow your browser to save that password so that you don't have to enter it every time then you just need one cleverly designed trojan to be run on your machine (probably easier to do than waiting 4.84E34 years to crack a password) to grab the saved passwords cache from your browser and it's no longer secret.
Seeing as what kind of GPU farms people ran/run for mining Bitcoin, this is somewhat "in the middle" rather than being a "monster"
Not everyone works on products requiring 24/7 support. We also take a mandatory 1.5 week company break around the December holidays -- it's fantastic!
I haven't seen the discussion that I think is really necessary - when are we going to move beyond passwords, which are obviously growing more and more obsolete? What are we going to use instead of passwords in the future?
It lasted until morning, before I deleted it. While I like the UI to look at, it's not conducive to getting things done.

And I made the mistake of enabling push notifications - only to find my phone covered in notifications when I woke up - I know Google don't really have a better way of doing this due to iOS... but it does beg the question why bother, when you can't better what is already available?
Or stop being employees in the industry which is why I no longer work for a defence contractor.
Absolutely; NTLM has been attackable for ages. Running on a Quad core machine it can be cracked in a reasonable amount of time.

The cost/time trade-off for such cracking makes this rig pointless for such cracking, unless you absolutely must have it in 6 minutes.

I don't see any other major use for this; it's simply not powerful enough to attack anything new (Edit: even with 128, rather than 25, GPU's).
VMware, EMC spin out cloud units in big new joint venture
Well, you're right to some extent, but it also means that if Intel were to use their R&D might to engineer an x86 mobile chip that (for instance) is twice as fast as an ARM chip with the same power consumption, it would be in the next top iPhone/Android/WinMo handset without much difficulty. I honestly would not be too surprised if something along those lines happened. The RAZR M-i or actually seems to be competitive with the ARM version of the RAZR M in terms of battery life and performance, and they can only improve from there.
Apps Redirect Text Messages, and Profits, From Cellular Providers
My workmate did something similar few years back, http://cufon.shoqolate.com/generate/

(Converts font files to js structs and renders them into canvas/vml, this was meant as sIRF replacement before native support for CSS custom fonts was common.)
copy news.ycombinator.com. differentiate yourself (if you want) with content (maybe geo-focused? hn might be comparatively weak on NYC, Boulder, Seattle, Austin content?), and/or add actual features.

It's not like the community even cares about "pretty" design, they want functional design, and HN is approximately as good as it will get. The things to fix about HN are the non-reversible actions, annoying link-timeout due to continuations (hint: don't use Arc, probably...), etc.
Didn't realise that, although beyond reading pulp SF, I've not done any kind of investigation into the subject!

How much carbon/coal would you need to support a colony of say, 5 people (+plants)?
Law Students in Austria Challenge Facebook Privacy Policy in Irish Court
How foreign firms tried to sell spy gear to Iran
New contender for oldest dinosaur
I do that, but I always follow it with "sorry I was in the zone", which everyone instinctively gets and understands.
As people have pointed out, even if you have opted-in for html5 videos in settings page and have perfectly html5 capable browser, Youtube refures to play some content in html5 player unless you switch your UA e.g. to iPad (so the html5 version clearly exists).

(Edit: this happens at least with Safari on OS X (not having WebM support), not sure about Chrome, which of course plays WebM as well.)

This is seriously lame act from Youtube. Anybody from Youtube/Google can explain?
Well there are many things we are doing which are not environmentally-friendly, but it's not like they will build road and new trucks just to deliver your water. They use existing commutes and transportation pathways to deliver it, among other things. Most cities in the world now are heavily dependent on everyday delivery of food, water and other critical supplies - it is part of the system and it is not going back.
The problem with all of this is that security specialists (of which I am one, guilty as charged) have historically campaigned for more complex passwords. This worked well for conventional (non-clustered, non-accelerated) password cracking mechanisms.

Sadly, this starts to fall apart with accelerated and/or distributed cracking. On average I crack a few hundred passwords a week, and more often than not organisations have what I call seed words (e.g. the password reset word or common words used throughout the organisation) and the majority of passwords are variants of them.

My own ability to crack passwords for most algorithms (within a reasonable timeframe) tends to cap at dictionary words with number and letter substitution and somewhere around the 8-10 character mark. Using a phrase means that as an attacker you have to account for other people using more complex but shorter passwords. I'd still suggest getting capitalisation, punctuation or at least a number in your phrase but the bulk of the keyspace comes from the length rather than complexity plus the fact that the people carrying out these attacks are normally cracking more than one password at a time.

For a few years now (since around the time of Oeschlin's paper[1]) I've been advising customers to use longer passwords made of phrases and things they can remember for passwords they regularly use[2] and randomly generated passwords of some length stored in a password safe[3] for things they might forget. The goal of this advice is to make it harder for people to crack passwords and to reduce the volume of passwords people have to remember.

[1] - http://lasec.epfl.ch/pub/lasec/doc/oech03.pdf

[2] - http://xkcd.com/936/

[3] - http://keepass.info/ - one of many options available
There you go

30 chars password don't matter. Sure, it's not low hanging fruit, but it's not troublesome if you're the target

Why?

Weakness 1: Because it's written down somewhere.
Weakness 2..n: weaker links in the chain
1) Don't call me bro; I am pretty sure we are not relatives.

2) You don't understood what i said; when you change #watch-player for an iframe it wrongly believes you are watching it from a third-party website when in fact you are watching it from youtube.com itself. So many videos become unwatchable because those are configured to be watched only in youtube.com

Example: http://i.imgur.com/TZpWp.jpg (Translation: EMG doesn't want you to watch this outside youtube.com)
Google's Explainer-in-Chief Can't Explain Apple
Coding Blues
JetBrains Academy members Anton Arhipov and Igal Tabachnik talk tech
Being a lawyer, I can't really give you actual legal advice on how to do this stuff without you being my client, but i can explain a very very generalized process.

Note that if you are not a lawyer, you will end up spending some time reading rulebooks and filling out forms that lawyers know how to fill out. There are usually legal aid folks/etc in most state courts that can help.

So let me give you an example process (Again, this is not legal advice, just an example process):

1. Open a small claims case against the pseudonym of the paypal person (to be filled in later), or what they claim their name to be if you have it, in the state you believe them to be in (assuming that state allows subpoenas in small claims. If not, you may have to open a real case in their district court, which is more expensive and requires more paperwork). This will require service of process, which will be initially hard, but there are fallbacks in case the person is deliberately making themselves unreachable, like publishing service in newspapers, etc.

2a. Start by getting a subpoena from the small claims/etc court, see if that's enough to get what you want.
They may want a subpoena from their local court. In that case

2b. Contact the relevant court for paypal (northern district of california, I believe), and get them to issue an out-of-district subpoena. For the central district, you can see the exact process here: http://www.cacd.uscourts.gov/court-procedures/filing-procedu...

It should be roughly the same process for northern district (the form numbers are the same, though the form content will say northern district instead).

Note that the envelope should be addressed to you.

They will assign a miscellaneous action number, and mail you an endorsed subpoena.

3. Send a copy of the endorsed subpoena (keep the original since you are likely to end up playing mail tag a few times) to the address paypal provides.
Again, i don't have this address handy, but as a registered corporation, you should be able to lookup where they receive service of process. They are required to have a registered agent that accepts service of process.

If they fail to respond, file a motion to enforce the subpoena (this is covered in the URL linked above in the case of northern district, if it's another local court subpoena, they will have a similar way).

They do have a fraud investigation team which you could contact with the subpoena first, and see if they will respond.
They may work only with law enforcement.

Again none of this is legal advice, there may be intermediate or more steps, i'm not responsible if the steps are not right or in the right order, or if following these steps causes you to lose all your legal rights, etc.
Millionaire fugitive John McAfee seeks asylum in Guatemala
Sir Tim Berners-Lee flags UN net conference concerns
As much as I hate to disappoint everyone, chaffing with lots of keywords, made up searches, and arbitrary blocks of suggestive text will not trigger any kind of flag except "people trying (poorly) to chaff NSA".

The algorithms used for text mining are much more contextual and semantic than what would be fooled by the simple gags I commonly see on the Internet. Those gags might send a message of sorts but they don't make anyone's job more difficult. For a start, they know you are not a terrorist or whatever; nothing about your life as modeled across myriad data sources suggests that. Instead, you will be some random person pretending to stick it to The Man, which they don't care about and never lands in front of a person.

To chaff the state-of-the-art data mining would require some sophisticated computer science and sophisticated operations. You would (1) have to understand the state-of-the-art algorithms used and (2) devise a way to break those algorithms transparently. It is not a trivial task by any means even for someone that understands what is involved.

Superficial attempts to chaff surveillance systems might feel good but they won't accomplish much against a sophisticated adversary. The tech these days is much too good. Even leaving a minimal footprint for analysis is becoming nigh impossible.
Hiring a new employee to work remotely requires employers to give a lot of blind trust to someone that is a stranger. I think trust should be earned not given so I would not let someone start off by working remotely.

The company I work for has been burned several times by remote software consulting firms (some well regarded) that created garbage applications. They now require all work be done in the office, and (speaking on their behalf) the difference is very significant. Communication is the key to success, and remote work really complicates things unless you work hard to have a great communication infrastructure in place.
pull requests welcome
Can you clarify the government's SSL decryption capabilities?

I'm aware the US government has CA certs installed in pretty much all browsers. Obviously being a CA allows you to MITM any SSL connection (though probably not without someone noticing, if done on the scale people are talking about, which is probably computationally prohibitive anyway).

But isn't it impossible to decrypt passively sniffed SSL traffic in all cases?
I don't think this is misinformation. You would be surprised at the number of IT people who have no clue how fast NTLM hashes can be brute-forced. Spreading this knowledge is good.

Ranting about NTLM, I am also shocked at how many people are unaware of the pass-the-hash vulnerability enabled by the mere possession of hashes, without having to brute-force them: http://www.youtube.com/watch?v=DkbBCR_vfRQ (disclaimer: I made this video and was a developer for Metasploit/Nexpose).
If you are just starting, I would suggest creating a few apps and seeing which ones catch on and then focusing your efforts on those. Create apps quickly to test an idea, and then iterate quickly when improving an app. As for the type of apps, I believe ones that have decent growth and retention are best. I don't like apps that just focus on growth, because it is not too sustainable long term.
The first few lines mentioned "acoustic delay lines" which piqued my interest. Wikipedia has a page on this old technology: http://en.wikipedia.org/wiki/Delay_line_memory#Acoustic_dela...

It was a pretty amazing hack, before magnetic memory cores. Because sound moved at a slow rate through a medium like mercury, an acoustic wave (that is, a sound) could be applied to one side of a volume of mercury and be expected to arrive at the other end after a predictable, useful delay. So what would be done is that a column of mercury with transducers on both ends would function as speakers and microphones, which in an acoustic medium are the equivalent of read and write heads!

The system memory would be a collection of these columns, each I guess storing one bit. The memory would of course have to be refreshed: when the signal arrived at the other end, it would be fed back into the column, assuming I suppose that there wasn't a new signal waiting to be written to that bit instead. The article mentions that this was not randomly accessible memory, but rather serially accessible. From that and other bits of information, I gather that the device would visit each bit in sequence, according to some clock, and produce a signal on the read line corresponding to the value in that bit. You had to wait for the memory device to read out the particular bit you were waiting for.

Does anyone know if this a correct understanding of how this kind of storage worked? What a cool way to store bits!
GSM - is it even alive?
Pretty much and there are a number of reasons why.
I suggest you try meetup again, as they have similar list style feeds for global and groups you're subscribed to, exactly like twitter or your site. The only real difference I see is you map them.
There are actually houses in London created from these containers...

http://www.containercity.com/
> It would be better if they included an option for a key as well like other password safes do.

I would love to see research about the use of keys and passphrases. Especially, do people who have a key then chose a weaker master password?
Is Search That Hard?
Hey I just made an account to post this.<p>I was wondering what Google does to make their searches seem so natural.<p>So, for example, I searched "mary j blige and friends" on Grooveshark.<p>And the first result was "Friends. Mary J Blige - Love and Life."<p>So they throw away the most common words ("and") and search artist, album, track for the highest frequency word counts (probably with a bit of stemming involved).<p>But I always wondered how Google makes this seem so natural?<p>Do they have 100,000+ if-else statements glued together?<p>Thanks
Can this have anything to do with the Fiscal Cliff?
Even if your browser has CA certs installed someone with a CA cert can only MITM your SSL connections, not passively sniff them, right?
There are 3 types:

What you know.

What you have.

What you are.

And of the 3 What you know (i.e. password) is the most secure when used properly. It's impossible to steal without your knowledge, and it's impossible to misplace.

What you have (eg. physical key) can be stolen from you - or even borrowed, used, and returned without you ever knowing. It can also be copied, and it can be lost - sometimes without being aware of it for a long time.

What you are (eg. fingerprint, iris) is the worst, and the least secure. It's trivial to copy - even from a distance, and it's impossible to change. The entropy available is also low.

So in the future we are still going to use passwords.