skysight-inc/HackerNews huggingface dataset:
Thank you for that. I hadn't seen the high end section. Any ideas how much Dingadeal would be worth?
Hushmail uses Java (not Javascript) cryptography.

They pushed modified client software to some users after a Canadian court issued a court order.

(http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/)

(http://arstechnica.com/security/2007/11/secure-hushmail-can-...)

Getting a court order doesn't seem particularly hard; it's certainly not the full might of the NSA applied to cracking the crypto.
This piece has surfaced before. Then and now I see people coming out of the woodwork with seemingly smart ideas about how it still should be possible to safely use crypto in the browser one way or another.

One of the things my company does is security testing of web applications. Regularly we encounter 'creative' use of cryptographic techniques (both in the browser and server-side) and each time it makes the hacker in us smile, because we know it is not a matter of 'if' we'll crack it but 'when' we'll crack it. Good crypto is a roadblock, bad crypto is just a challenge. And although it is very hard to decide if the crypto is 'good (enough)', the 'bad' is usually glaringly obvious.

With the current state of crypto in the browser - just forget it. That's what Thomas is trying to get across: forget it - if you think you've found some smart way around one of the weakness he addresses, you're very most likely wrong. And even if you seem to have got it right, you're probably wrong still without anyone realizing it (yet).

Same is true for building a crypto-system from primitives. Use what's out there, designed by the few people who know what they're doing.

Remember: from the defensive side you need to get everything right. As an attacker I only need 1 hole. That's what makes it "capital-H Hard".
For python beginners i would not mention the print statement. It won't work for python 3.x.

So, beginners: Please use print() instead of print, to save you some hazzle when using python3 :)
MongoDB does run on Azure.
That's the thing - you don't actually have to trust the servers to the same extent. You can look at and verify any JavaScript and CSS and HTML that the server's sending you, manually if necessary, but there's absolutely no way of telling what code the remote server is running.

This actually matters for sites like Mega. There have been previous examples of file storage services falsely promising that all your files would be encrypted and their staff would be unable to access them, for example Dropbox. If all services use server-side crypto there is no way to tell the difference between a service that lies about this and one that's honest. With Mega it's possible - not easy, but possible - to check exactly what kind of encryption is being applied and where it's getting the keys from. You have to go through every bit of content manually with a fine-toothed comb to be sure, of course, and there are various ways to obfuscate things, but it's still better than not being able to see the code at all.
Doug’s talk was hard to follow because he didn’t give an adequate explanation. Not because he’s subject to some curse of the monad, but because he evidently did not understand the topic well enough.
Putting OAuth authentication on an oEmbed endpoints strikes me as counterproductive.
It's like people have a taste for orderly things, (after all, life feeds on the reduction of entropy). An absurd chaotic life is not satisfactory.
It's important to note that the purpose of a heat shield on a warhead is significantly different from that of a manned vehicle or scientific probe. For the latter, the goal is to safely and efficiently transfer as much kinetic energy as possible (subject to acceleration limits) to the atmosphere so that parachutes will survive being deployed. For a warhead, (disregarding burrowing nukes), they don't care how much kinetic energy is expended since they don't want the warhead touching down. In fact, they would prefer to minimize the amount of time that reentry takes, and so want to minimize the amount of kinetic energy lost to heating the atmosphere. For burrowing nukes, they want the nukes traveling as fast as possible, as long as the impact won't break the nuke, which is somewhere in between the airburst and manned vehicle design cases.
XML being XML, it's hard-to-impossible to host SVG without allowing people to store arbitrary XML on your service, which sooner or later is going to be abused.
My point is relevant as he considered the problem of availability of a CSPRNG 'solved' - and it isn't until you also solve most of the other problems Thomas identifies.

And it was not my intention to 'bash' anyone - if it came across as such I apologize.
JavaScript, and all other crypto code not done with native code is not safe, for a reason not mentioned in this article: side channel attacks.

When attempting to create crypto code using an interpreter or a byte code virtual machine, additional side channels are created by the differences in the execution compared to executing native code. Crypto code should be written in Assembler or C code where the assembly output is reviewed by the author. This is the only way to create code that does introduce side channel information that can be used with timing attacks, cache attacks, branch predictor attacks, etc. This introduces a problem because it takes a cryptographer and a hardware architecture expert in the team to write safe code for cryptographic primitives.

This does not mean you can't safely use crypto from interpreted languages, as long as the cryptographic primitives are good native code.
Seth's Blog: Eleven things organizations can learn from airports
There is no legal restriction for crawling any web site. But you should respect robot.txt document for every single web site. Such as: https://www.facebook.com/robots.txt
http://web.archive.org/robots.txt
I agree that browsers simply don't have consistent enough APIs for the strong guarantees required for encryption, including strong random number generation and memory allocation behavior. That was the takeaway for me when I read this the first time.

The "if SSL, why JS crypto?," DOM, and "chicken-v-egg" trust problems seem more like straw-men and sophistry though. Desktop crypto underwent an iterative evolution with early adopters bearing the bulk of the risk too. (Mega got the digest part wrong, but they fixed it, for example.) SSH doesn't use certificates, but you can read the host fingerprint and follow the chain of trust that way. If people are going to use crypto, they have to take responsibility for these pieces, which is improbable en masse. "[T]he security value of a crypto measure that fails can easily fall below zero" definitely rings true. Repeated malware infections, however, suggest peope don't even learn after they are burned... "Normal users" can't be bothered to update their browser or verify trust (leading to VeriSign having complete power, for example), for the same reason "normal" people don't use the existing native encryption (GPG/PGP) and, if they did, there would be no need for JS crypto.
Also, until recently SSL didn't support any kind of forward secrecy, and even now many SSL servers and clients aren't configured to use it. What this means is that if an attacker ever gets hold of an SSL server's old private key, they can decrypt any SSL sessions they've recorded which used that key.

This makes security measures like JavaScript crypto which only protect against passive eavesdropping quite a bit more useful than you might naively expect.
The article never actually gives a reason for preferring the pursuit of some meaning to the pursuit of happiness[1], does it? At most it provides anecdotal evidence you are more likely to survive a concentration camp.

[1] Ignoring the debate on how much they are, or can be, mutually exclusive.
Genome assembly relies heavily on sequence alignment. So: Is genome assembly hard just because sequence alignment is hard? Or would genome assembly present separate algorithmic problems even if there was a super-efficient solution to sequence alignment?
True - but how is a web server with certainty going to decide which clients can be trusted (because they've a truly capable browser)and which are not to be trusted (because they have a vulnerable and compromised browser that just pretends to be capable and secure)?

Of course it may be possible that one day there is a way around that issue, but currently there is not. Not even academically let alone practically. Hence Thomas's next remarks about the impossibility of 'graceful degradation' for crypto-in-the-browser issues.
On your first point, my post detailed that 23andMe confirmed it was a GATK bug that introduced the bogus variants and the bug was fixed in the next minor release of the software. There are comments on the post from members of 23andMe and the
GATK team that go into more details as well.

On your second point. 23andMe had every incentive to pay attention to their output, but it is fair to say it's their responsibility for letting this slip through. But, it's worth noting in the context of the OP rant, that 23andMe probably paid much more attention to their tools than most academics who often treat alignment and variant calling as a black box that they trust works as advertised.

So what I actually argue in the post (and should have stated more clearly in my summary here) was that GATK is incentivised, as an academic research tool, to quickly advance their set of features with the cost of bugs being introduced (and hopefully squashed) along the way.

This "dev" state of a tool is inappropriate for a clinical pipeline, and GATK's teams' answer to that is a "stable" branch of GATK that will be supported by their commercial software partner. Good stuff.

Finally, I actually have no conflict of interest here as Golden Helix does not sell commercial secondary analysis tools (like CLC Bio does). I wrote this from the perspective of someone who is a 23andMe consumer as well as being informed as I give recommendations of upstream tools with our users (which I might add, I would still recommend and use GATK for research use, with the caution to potentially forgo the latest release for a more stable one).

You know though, the conflict of interest dismissal is something I run into more than I would expect. I'm not sure if some commercial software vendor has acted in bad faith in our industry to deserve the cynicism or if this is defaultly inherited by the "academic" vs "industry" ethos.
Technically you can't be sure that when you open() /dev/random in a native C application that it's actually opening /dev/random either. Yes, really.
My friend said: Bioinformatics means that computer scientists – who don't know mathematics and don't know biology – are trying to do mathematical biology.
You're trying to argue that the reason that there are so many top-tier grads in positions of power is that top-tier schools are disproportionately graduating talented people. But then you say this:

"What the study I linked suggests is that if the brilliant student was capable of getting into MIT, regardless of whether or not they did get accepted, they are likely to have a similar outcome to the ones who ended up going to MIT."

If this is true, then it implies that the top schools are simply very good at monopolizing the world's intellectual talent. So which seems more likely to you: that the top-tier universities monopolize the world's intellectual talent, or that we've set up a system that systematically rewards the kind of people who get to go to top-tier schools?

Given your previous caveats about minorities and middle-class kids, I think you generally agree with my premise, and now you're arguing just to argue.
The Raspberry Pi onboard ethernet is connected via USB.

$ dmesg | grep -i usb | grep -i ether

[ 3.058947] smsc95xx 1-1.1:1.0: eth0: register 'smsc95xx' at usb-bcm2708_usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:[ELIDED]
One thing that seems to missing from most travel sites is the ability to compose a travel consisting of several legs.

For instance, this spring I am going to India with work, after which I want to travel to somewhere in southeast asia, probably with one or two stops, and then home to copenhagen.

It should be possible to have an overview over my entire travel, not just the one leg or a simple return trip as my travels are rarely just that.

(looks good though, I am definitely going to try it)
IOS Concept based on existing APIs and Design
I'd considered making one some time ago, but gave up when I realised that somebody had already purchased http://s.vg/.
The Wikiemacs experiment is over, long live Emacswiki
You are quite correct - that wasn't too different; and I like the current situation of "just use any current browser," thankyouverymuch.

But I don't see any descendants of Netscape claiming that I should be nostalgic for these times; or saying "oh, we are rooted in Netscape's legacy, and that's why you should use our browser". That doesn't make any sense beyond "we don't suck any more, really, take our word for it" - and, honestly, that's not a very encouraging motto, when you stop to think about it.
Perhaps Apple felt they were circumventing the "only payments via Apple" rule?
Sensible question. Here is an attempt at a bit of an answer.

In the UK, the 'public' schools are actually private and the more famous ones charge a lot of money. They are also registered charities which annoys some other people trying to run real charities (the ones that help poor people), but that means there are a few places made available on a scholarship basis at little or no cost.

A good public school has small classes (8 to 12), individual attention, and focuses on the development of what they call 'character' in the pupils. The result is an education that provides considerable self-confidence (sometimes misplaced by the way) and self-reliance.

When you think about it, an ideal education for an individualist social critic. Whose career can then be presented as 'eccentric' and thus the threat immunised.
My 5 Enterprise Cloud Predictions for 2013
The Cloud in HP’s Cloud (Part 2): HP Discover, the Enterprise and AWS Cloud
Not having an Ethernet port would be a bit of a handicap for this kind of work.
Is this real? There's no mention on their blog:

http://blog.coinbase.com/
There are some good examples and arguments there, but to me it reads like it mostly boils down to having SSL, which does quite a good job at solving the chicken/egg situation. You can have a good degree of assurance that you talk to the right server, and that your communication to it is not in the clear (of course, what's good degree is debatable, and depends on what you're trying to protect and against whom).

I don't quite get why

> You could use SSL/TLS to solve this problem, but that's expensive and complicated

You can get an SSL trusted certificate for a few bucks, and installing SSL is probably one of the most well-documented sysadmin procedures on the web. How can it be more expensive or more complicated than implementing your own javascript crypto?
Alexey Vayner, Tim Ferriss's tragic twin
Nope (Chrome 24.0.1312.56 on OS X 10.6.8).
Given such a detailed article, the solution is obviously another DB. Postgres lacks most of the MySQL flaws described.
IE6. XML viruses.
PHP Comparison Operators
I sort of agree with you, HATEOAS seems to be the least useful thing of the whole bunch for system<->system APIs. However, when there's a human involved (like, when coding against that API), it can be quite nice.
1) Interestingly cropped square images. (although some of them were a lot better than others)

2) I was going to give you credit for the captions, but those are just headlines -- I guess internet media has gotten good at snappy headlines.

3) I'm really biased in favor of this content in specific, so I'm not really a great judge of the format when I see it in this context. Would be easier to judge something I care less about, like "80 vacation destinations"

4) I like the grid vs. the pinterest-style non-aligned grid. (I'm still amazed that gf spends ~1h/day pinning random things. I never got into it.)

5) I generally hate buttons in the UI; it is nice how they disappear.
I've learned Python exactly same purposes as a hobbyist. Although it depends on your learning curve, Its easy to start and continue. You can find tons of examples for every level. Also if you interested with web developing, Django (Python web framework) can be good solution. If you are total beginner, this lesson will be very useful: https://www.udacity.com/course/cs101
Any chance you could explain this further? I would love to hear some tricks finding the best prices.
Comparison of parser generators
True risks are largely unknown at this time. "The cloud" to me is akin to the derivative financial instruments. They said that nothing can ever go wrong with derivatives.

However as a professional I can envision many Black Swan type events that would bring down the cloud. Asking Google et al about the quality and safety of the cloud is akin to asking your drug dealer about the quality of the drugs you are buying.

That is not to say that the cloud and complex derivatives should be avoided. However on should always hedge their bets.
The biggest reason I've seen for not using cloud providers is regulatory. In the UK, principle 7 of the Data Protection Act makes the collector of data responsible for ensuring downstream security. Unfortunately, most of the big cloud providers won't let themselves be audited, and won't accept strong terms in the contract. Until that happens, they can't safely be used for bulk personal data.

(where safely means the data controller is secure from regulatory fine).
The patent agreement part GPLv3 (which is the difference between GPLv2 and GPLv3 in regard to patents), only cover distribution rights. If you do not distribute the whole work, you can create as many code contributions you want and have as many patent license agreement at the same time. They do not interact.

For code contributions, GPLv2, GPLv3 and Apache license has the exact same deal in regard to patent grants. Actually, the text used in GPLv3 that cover patent grants of contributors, is word for word copied out of the Apache license. GPLv3 only added additional patent requirements for distribution of the complete work. My guess, for the exact reason of not discouraging companies to contribute code.

If the company review GPLv3 contributions, but do not review Apache licensed contributions, they have bitten the FUD apple.
I did not realise that rich people were all evil...
But the technical fact is all that matters. What you "believe" is irrelevant.
Or you could use pystruct: https://github.com/amueller/pystruct
But I saved that for another blog post ;)

That is BSD licensed and pure Python, has some more feature than SVMstruct but is not as optimized (yet).
This is awesome. Considering making my own.
Isn't it more likely that he just mispelled "apt".
I'm guessing you could maybe host it with Gists, using the raw link? Although the content type headers might be an issue...
rdl answers in better detail than my awareness extended to - I just found it easy to skim for the relevant links in a sea of information that didn't feel overwhelming.
Mellel, un sérieux concurrent à Pages pour Mac OS X
We recently spent a few weeks trying to make it work in production, and couldn't. We always ran into deadlocks due to gap locking and auto_increment columns.

After a few weeks of failure, we finally gave up and did it the slow way, unweigh a slave, do the alter offline, catch up in replication, and fail over. Repeat as needed.

Percona's OSC is great for the cases where it works, but there are still many cases where it doesn't.
Ice Cream Sandwich Now on PCs Tabs
"Rails Is Omakase" Followup Video
why do you care about his GPA ? what if he is really smart and have a low GPA
Your logic is sound, but your premise is false.
Meaning is happiness for grown-ups.
>> OK, self promotion over

Good. Not cool to hog someone elses HN thread.
In his bestselling 1946 book, Man's Search for Meaning, which he wrote in nine days about his experiences in the camps, Frankl concluded that the difference between those who had lived and those who had died came down to one thing: Meaning, an insight he came to early in life.

It's interesting to contrast this with the stories from Nothing to Envy: Ordinary Lives in North Korea.

Yet another gratuitous cruelty: the killer targets the most innocent, the people who would never steal food, lie, cheat, break the law, or betray a friend. It was a phenomenon that the Italian writer Primo Levi identified after emerging from Auschwitz, when he wrote that he and his fellow survivors never wanted to see one another again after the war because they had all done something of which they were ashamed. As Mrs. Song would observe a decade later, when she thought back on all the people she knew who died during those years in Chongjin, it was the “simple and kindhearted people who did what they were told—they were the first to die.”

That book has many tales of people surviving by cheating, stealing, and ignoring the plights of others. That's the real truth: In a starvation situation, nice people die first. A sense of meaning contains zero calories.
Once you have some work experience, people stop looking at your degrees. I was actually once told by an employer, "We don't hire people from [the department I graduated from]," ...a full year after I'd been working for them.

Bottom line: do whatever it takes to get solid time at companies with coworkers who'll vouch for your quality. That is the bedrock of your resume: bachelor degrees are just placeholders until you have that.
It's not hard, probably the image hosts concerned merely didn't think to include it.

You can upload svg files with the right content type to Amazon S3 without trouble, is that not good enough?
but "new Number(x)" is not equal to "Number(x)". So, it's tricky, I guess?
http://www.youtube.com/watch?v=DIGdWsxHJlM
> "We all construct our world. It does not matter if those constructs are called sane or insane by others. Our construct is the key to the real world outside of our minds. So the only thing that matters for those who are called insane, it to find an other niche in the world where their key fits."

this is so misleading... it is not about the way you see the world, it is about how your perception of the world is out of your control. my experience of psychosis was that i was both aware of me being delusional, and still having to believe these thoughts. it is immensely stressful, and very easy to put yourself in danger. do you want to find a niche for yourself if you believe you are god, or believe you are persecuted by aliens? the first thing i want (and i am saying this at a moment of sanity) is to be committed by force if i turn delusional again.
Tell you what, I'll let you know first thing when we have diffs ready to be presented to the public
If Java is your idea of a good time, it's unlikely that you'll be an effective researcher (though it's not unheard of), because it's not good at maximizing single-programmer output, and not good at maximizing I/O or CPU or string processing.

FWIW, I have in the past gotten good results out of Java and C# (it's a lot easier in C#) by writing programs that generate bytecode at runtime, so they can use the JIT to further optimize performance. Getting the same results out of C would require a lot more work. This includes string processing - I wrote a regex compiler for Java at one point, easily outperforming java.util.regex.

And such things are not difficult - or at least, not difficult to me now, knowing all I know - perhaps 10 hours work for simple regex compiler. And that is how I would use tools like Java to optimize my own performance: adapt them to interpret or compile a language that is close to the problem domain. A slightly higher constant cost, with the aim of a much lower per-idea cost.
_Arbitrary_ SVG is a security/privacy problem -- it may inject JS or exploit quirks in rendering to manipulate site contents, import external images and fonts, or simply be a render bomb. And it is hard to filter out those problems.