skysight-inc/HackerNews huggingface dataset:
timing attacks don't necessarily need access to the actual machine to work. his point is valid because a side channel timing attack may arise from the differences in time it takes to receive a response from the server. there are remote timing attacks that take advantages in the differences in execution time between paths in the code. this means anyone observing message traffic may be able to execute a side channel attack, instead of just people with access to the hypothetical backdoors you mention.

you are saying not safe as if the term has a standard meaning across all contexts. anything can be cracked - the question is whether the time it takes to crack a computer is worth it compared to the data stored on the computer. in almost any case you actually need cryptography and it's not just a nice to have (aka credit cards, personal information) it's not worth using anything but native code.
Why hackers should be afraid of how they write
I like to call it my "Personal PIN Number, for identification purposes"

Now go explode!!! ;)
Fair points. Though you pick a product that is also more of a want than a need. Diabetics want insulin because they do not want to die. In other words, their need for insulin is
born from their desire to manage their condition and live a normal life. I'm a heart disease patient. Every day I drink a pill to control my health condition. I want to drink it because otherwise I might cut my life short. Some people with the same condition don't take the medication. Even though they want to keep on living they don't think they need the medication.

The author concludes with saying he built something he thought people needed and it fell flat. Obviously the problem was that he was too unsure they needed it, and it turned out they didn't.

I have built many things that have fell flat. Too much to count. Such is the reason I have come to understand this. It is not something I'm pulling out of mid-air.

He implies that building a 'want' product is better than a 'need' product by using confirmation bias and focusing on Apple products, vs using concrete opposite examples.

You missed the point. People buy products they want. Not products they need. You should find out what people want and
offer it to them. Within all markets you can find niches. Say diabetics who want the insulin. There are also diabetics who do not want insulin, and don't use it even though they need it to stay healthy.
I see BPython has a list of alternative pretty interpreters listed on its page. iPython (that I know of) and DreamPie (that I don 't know of).

http://bpython-interpreter.org/alternatives/

Can anyone say how they all compare to each other?
Besides killing ids, use full URIs, not just the path. That enables you to replace the links to other domains, possibly to a third-party. Just like we often link to Wikipedia on our posts, you could decide tomorrow that your service should link to dbpedia.org or Freebase instead.
Node and SQL Server aren't as far from each other as you might think. In its latest mood swing, Microsoft is actually promoting Node.

Look at WebMatrix, their simplified web development tool, I was surprised to see that it supports Node: http://www.microsoft.com/Web/webmatrix/node.aspx

Same goes for Azure: http://www.windowsazure.com/en-us/develop/nodejs/
Also, Its possible to use script tags to run javascript code in an svg.

If you really wanted to, you could pretty much make your own webpage run on the image hosting server.

Also, you could send a malicious script to someone hidden in a cute cat drawing, and it would look like it was the host's fault.
Well, that statement is based on a ESRs' quote.

"Linux is the open-source community's flagship product."
Implementing union types in Scala
Having working in the bioinformatics industry as an SE for 9 years I can both agree and disagree.

1. I agree that SE standards and good coding practice are completely absent in the bioinformatics world. I remember being asked to improved the speed of some sequence alignment tools and realized that the source code was originally Delphi that had been run through a C++ converter. No comments, single monolithic file. The vast majority of the bioinformatics code I worked with was poorly written/documented Perl.
In addition a lot of bioinformatics guys don't understand SE process and so rather than having a coordinated engineering effort, you end up with a lot of "coyboy coding" with guys writing the same thing over and over.

2. I agree that productivity is very slow. This is a side product of research itself though. In the "real world" (quoted) where people need to sell software, time is the enemy. It's important to work together quickly to get a good product to market. In the research world, you get a 2/5 year grants and no one seems have much of a fire under them to get anything done (Hey we're good for 5 years!). You would think that the people would be motivated to cure caner quickly (etc), but it's not really the case. Research moves at a snail's pace - and consequently the productivity expectations of the bioinformatics group.

3. I disagree that research results from the scientists are garbage. Yes it's true that some experiments get screwed up. However, if you having a lot of people running those experiments over and over, the bad experiments clearly become outliers. Replication in the scientific community is good because it protects against bad data this way. Somehow the author must have had a particularly bad experience.

4. Something the author didn't mention that I think is important to understand: most scientists have no idea how to utilize software engineering resources. The pure biologists, many times are the boss, and don't really understand how to run a software division like bioinformatics. Many times PHD's in CS run a bioinformatics group, who have never worked in industry and don't know anything about good SE practice or how to run a software project. A lot of the problems in the bioinformatics industry is directly related to poor management. Wherever you go you're going to have team members that have trouble programming, trouble with their work ethic, trouble with following direction. However, in a bioinformatics environment where these individuals are given free reign and are not working as a cohesive unit, you can see why there is so much terrible code and duplication.
XML has no default schema.
> I think it is ludicrous to require to open source an application that may be using library as is without any modifications.

If it's my library you do as I say or you don't use it. If you don't like the license, you are free to write your own library.

The GPL is about giving freedom to the users.
The MPL is a good balance between "do what you want" and contributing back. I used to use it in all of my projects but I found that because people don't know it well, they are scared of using it so I've switched to MIT.
Dissecting a mobile malware - Hacking News
RespondMe HTTP-server programmable via HTTP
Nice presentation. And it plays into the fact that managers, no matter what they come up with, always seem to think that it should take "about two weeks".
> timing attacks don't necessarily need access to the actual machine to work. his point is valid because a timing attack may arise from the differences in time it takes to receive a response from the server.

That point of yours actually points to a potential vulnerability in server-side (possibly native-code) encryption, not client-side encryption, which we discuss here.

I completely agree with you that anything can be cracked, and JS crypto more so than _some_ native-code cryptosystems. My point is that using JS crypto for some non-critical applications (e.g. as an alternative to corporate IM/email) can be useful and convenient.
....if only to watch Fry regularly hitting Laurie. No, not acting, several times they cock it up and Fry actually hits him!!!!
The horse vs the automobile is a great example of a want. People did not want to deal with horses. They smell, can only carry two or three people, are slow, and require a lot of upkeep. Worst is that they are dangerous. Horses can kill with a bite or kick. No matter how much you tried you could not really improve on a horse. The carriage proved that. How many hundred of years passed during which the carriage did not have any significant technical improvements? This due to the fact that you cannot simply improve a horse.

On the other hand, the automobile has been evolving into something that people go broke to buy every day. They do smell, harm the environment, are sometimes slow (they started out to be very slow), require upkeep, and kill many people every year. Yet they still buy it. People want it. Sure, there are other factors at play such as automobile-biased planning to promote the sales of cars. But at the end of the day, the market conditions are the wants that define the want. The problem defines the want, which goes higher up the list than the need.

Tell me, do you own a car? If so, which brand?
Sir, is it not the case that such an establishment as ours, indeed, does provide an endless source of discourse with regards ones inspirations? Were it not for P.G. Wodehouse, what good would one such as Steve Jobs, or any other manner of autocrat, be?

As the case shall be discovered, much in our circle is derived from sources beyond our own immediate horizons. P.G. Wodehouse, though not new, nor hackerly, certainly demonstrates a prowess with language most indoubtedly motivated by an inner force, a muse as you wish, which allows its effect upon the minds of many.

In short, if one cannot see P.G. Wodehouse in hackerdom, then it may well be simply because one has not read a single of his words. I encourage such circumstances to be resolved, post-haste, lest ye miss the beat of certain drums whose temper has wrought much upon our field ..
The term "viral license" is a really descriptive term ;)

My point is that i think that antirez has too much faith in humanity when it comes to business. A company selling software doesn't necessarily care about forks being inconvenient. A typical closed-source company only thinks in terms of money and thus potentially contributing to open-source also contributes to your competition.
It is worse than that. You can't even integrate a GPLed server program with a closed source client program, only interacting via TCP, if they constitute a single "bundle". See the "SDR Touch" story here: http://lists.osmocom.org/pipermail/osmocom-sdr/2013-January/...
That's great! But you know that begs for sparklines... https://github.com/holman/spark
Dropbox is another product of solving a need. We had to use our USB or email transfer our documents. As a result, we had many versions of the same document - not knowing which version is the most updated version. Mind you, Dropbox is a billion dollar business.

Dropbox is a want. You can go back to using the old methods. But you don't want that. You want to the ease of transferring files that Dropbox provides. Stop seeing it as a logical argument. Like I said, people are not logical.
The link and numbers I used were in regards to MD5. I even quoted "The cluster can try 180 billion combinations per second against the widely used MD5 algorithm."

And no, you don't need to recompute the whole MD5 each time. Here's the Python code which shows that you can capture the hash state at an intermediate point:

>>> import hashlib
>>> h1 = hashlib.md5("This is the start")
>>> h2 = h1.copy(); h2.update(" # Blah!"); h2.hexdigest()
'a309b70b0bc8de4e7aad1d0ac6e14b16'
>>> h3 = h1.copy(); h3.update(" # Fnord!"); h3.hexdigest()
'a0a5979225e0ba46543856242daeab3c'
>>> hashlib.md5("This is the start # Blah!").hexdigest()
'a309b70b0bc8de4e7aad1d0ac6e14b16'
>>> hashlib.md5("This is the start # Fnord!").hexdigest()
'a0a5979225e0ba46543856242daeab3c'

You may think that perhaps the copies are keeping track of the entire string. However, this is not correct. Indeed, it would make the MD5 rather useless, because it would limit processing to available memory. How would one MD5 a multi GB file with only a small amount of RAM?
I believe you missed the point. Shakespeare rarely made a joke to save a life, but rather: to take one.
Creepy Crazy Blind Date || Learning to love the scrambled date
> This offers no additional security at all for anyone but the most paranoid cryptography experts.

This is not much different from how everything else works. Hopefully the expert criptographers release tools to help the uninformed masses use stuff or at least break the news is some bad shit starts going on.
Recently, I've been trying out a few of the options out there.

My requirements are:

* generates C

* generates a fast parser

Ease of use is also obviously a good thing. A few of the options I explored:

ANTLR[1]:

ANTLR is really great is you're using it for Java. Since Java is the first officially supported target, everything works really well there. The C bindings are pretty good too, though the documentation is pretty sparse and somewhat out of date (the examples are good, though).

ANTLR4 looks really exciting. It uses a new algorithm called adaptive LL(). To quote the author,

The benefit is that the adaptive algorithm is much stronger than the static LL(*)
grammar analysis algorithm in v3. Honey Badger takes any grammar that you give it; it
just doesn't give a damn. (v4 accepts even left recursive grammars, except for indirectly
left recursive grammars where x calls y which calls x).

When I was looking at it, ANTLR4 was not released and the C bindings hadn't been updated. It looks like at least half of that changed in the last couple of months.

Finally, ANTLRworks is awesome. You can graphically step through the parser and it even draws great diagrams. It's far and away the best debugging experience I've had.

Ometa[2]:

I looked briefly at Ometa - the work done on PEGs is really neat. Unfortunately there's not a viable C backend and overall the project is fairly undocumented.

Flex/Bison:

The old reliable. It's a bit harder to write your grammar for a LALR generator, but it outputs good C code and is supported pretty much everywhere. The resulting code is harder to debug than the code generated by ANTLR, though.

Flex/Lemon[3]:

This is where I ended up. Lemon is the parser written for sqlite. It's very similar to Bison but has some great new features and is a bit easier to use and debug. It's also an extremely simple project (1 .c file and 1 template file covers everything), and is extremely well tested (it's been used by sqlite for a long time).

I'm not perfectly happy with my current solution - in an ideal world there would be an LL() or PEG style parser generator that had first class support for C as a target language.

[1]http://www.antlr.org/
[2]http://tinlizzie.org/ometa/
[3]http://www.hwaci.com/sw/lemon/lemon.html
Mega is not the first one. AES.io (my company) and several others have been available for some time. Mega is the first one to bring client-side JS crypto into public discussion.
I'm as far from being mysql fanboy reasonably possible, so no, that's not it. What I'm trying to say is: mixing subjective and objective criticism makes the argument weaker. Don't complain that you lost your data due to a typo (statement worked as designed, you had backups, this was a test database and you'd never do that in production anyway - right?) A complaint about the lack of consistency and not adhering to standards is much stronger and still true.
I think there is also Public Domain. Which has Zero Clauses.

But I also think there were issues with Public Domain isn't exactly a licenses and acceptable in every country.
You are right, it does give that impression. But none of the digital music players before the iPod did not manage to have the impact it had. The iPod evolved from a music player to a personal computing device used by millions of people. It also spawned the iPhone, which turned the mobile phone market upside down. People make lines to buy the iPhone because they want it. No one needs an iPhone. But they sure want it.
Yes. I have always wanted to ask. So what is the difference between BSD and MIT?
I thought this too at first, but my sister used to work in hotels, this is by and large wrong. Almost any price is better than none. Especially if you're out in the sticks and they'll buy dinner.

Think about it a little more. Electricity & heat will mostly be on anyway. Complementaries are bought in massive bulk and are almost worthless. They'd have the same number of staff on if the hotel was 80% or 100% anyway. Depending on the size of the hotel maybe you might have to hire one more minimum wage worker.

Hiring the room for a fairly nominal amount would cover all those costs. Upsell them one product, such as a meal, and you've got profit.

You have to remember the majority of the costs are fixed when calculating the cost per guest in a hotel.
I think more people are realising that "Open source was seen as more of a tool to manipulate the market and create favourable circumstances, rather than a goal in itself." http://www.computerweekly.com/opinion/Open-source-is-just-a-... - Hence Android in order to fight Apple etc. It can help destroy your competitions market rather than helping them.
We don't know why lithium batteries work
oh boy...religious wars are a coming
This looks like a great way to learn, too! The REPL is a fantastic place to play around.

Awesome.
Shouldn't it be possible to always preload the following video in order to have seamless play of all videos? Now there's always a little gap.
Apple chart: Why iPhones, iPads are key to future results
i would argue that GPL is more about "contributing to humanity" then BSD just because it forces someone to contribute back and thus enforce more "contributions" to humanity

In theory yes, but it's like telling people that they should attend Sunday prayer service. That's like, your opinion man.

In any case, once software is out there, it's out there. Maybe one fork or another makes some closed progress but it's only a matter of time before an open source equivalent comes along.

Has there ever been any closed-source software that's important to humanity but doesn't have an open source equivalent?
I suspect there is some incoherent thinking about the BSD license. If you are a BSD advocate, consider this:

Someone takes a BSD project and bases a proprietary program on it. Is that person doing something wrong? Well, no, you say, because that's the whole point of the BSD license. It's also fine to keep rolling in new versions of the BSD project.

Now suppose someone takes a BSD project and relicenses it under the GPL, announces it on the internet, gets it into all the Linux distributions, and starts soliciting contributions of new GPL-only features while also rolling in new versions of the BSD project as they become available. Is that person doing something wrong?

I suspect that a calm, "No, that's also great. That's why we made it available under BSD." would not necessarily be the response.
Stopped reading at the "GPL folk are anti-commercial" straw man attack. This is not "a few thoughts", this is just another attempt at starting a flame war.

If you want a constructive discussion, you should consider listening to other people's arguments.
My idea: an online AI that exceeds human intelligence. Two weeks and €3000? What a steal!
ITerm is a terminal emulator for Mac that does amazing things
On the had, the just shall me emphasised in Heaven!
What are Stephen Fry plus books? (I know who stephen fry is, but what are plus books?)
Payday Loan Sites' Dirty Tricks To Boost Traffic
>That point of yours actually points to a potential vulnerability in server-side (possibly native-code) encryption, not client-side encryption, which we discuss here.

...it also relates to the time it takes to generate a response from the client, server was just a specific example. side channel attacks are extremely flexible. the only reasonably secure crypto code is code that executes in the same amount of time no matter the execution path.

lastly, if you're using protocols to prevent mitm attacks, you've already reached a level of sophistication where you may as well just throw javascript crypto out and use a real crypto package. if you're not using those protocols the information is basically free and you shouldn't add any crypto because that might mistakenly convince people that they're secure.
> First of all, open source for me is not a way to contribute to the free software movement, but to contribute to humanity. This means a lot of things, for instance I don't care about what people do with my code, nor if they'll release back their modifications. I simply want people to use my code in one way or the other.

As other people (buster) have mentioned, they feel that releasing GPL code is contributing to humanity too. Here's the difference as I see it:

You want to maximize the number of people who use your code, because that makes you feel good about yourself and your contribution.

Someone who releases GPL wants to try to maximize the good outcomes that result from their releasing that piece of code.

For example: the FreeBSD hackers get to know that their code was incorporated into OS X and used by many millions of people. That's pretty cool for them. But the contribution to humanity of their code is limited by that -- the OS X kernel's closed source, so no-one can benefit from learning how that works, and in the meantime the FreeBSD project itself is dwindling. Meanwhile, e.g. Android is based on Linux, and is available to everyone to study. Linux is growing hugely, and is an amazing example of humanity working together to achieve a public good. I can't really say the same about FreeBSD.

So, I think the question is -- is your aim somewhat selfish, in wanting to maximize the consequences that can be directly traced to you, or is it driven by wanting to maximize the consequences to the rest of your society of your actions?

If the latter, I think there's an entirely reasonable argument that says that the GPL is a better way to do it. There's no question that, as you argue, the GPL has less immediate freedom for each individual user than the BSD licenses. But why should we measure freedom for each individual, if what we care about is the final level of freedom for everyone in society?

To put it another way, I think the BSD license can result in "tragedy of the commons" scenarios where maximizing individual freedom has worse total consequences than would have resulted by applying regulation to maximize societal freedom instead.
Ask HN: Review my LockScreen news and social reader startup
Frontpage launched last week and is very much a minimum viable product at the moment - it only has minimal functionality and there is still lots to do. Its bootstrapped by myself building the frontend and my cofounder developing the backend.

Frontpage allows you to browse your favourite news and social feeds right from your lock screen without having to enter any passwords or fumble through multiple apps.

Once installed, simple activate Frontpage from Frontpage's settings tab, turn the screen off, and when you turn it back on you can begin browsing content.

Frontpage currently only supports the New York Times (remember, its a MVP). Frontpage is also only available on Android due to the fact that iOS does not allow lock screen augmentation.

We'd love to hear your thoughts!

http://www.frontpageapp.com
Seems so (Must have missed it) thought HN picked up double submissions?
Really cool. Does something similar exist for Ruby?