skysight-inc/HackerNews huggingface dataset:
Databases turn the big Cartesian product into a large number of smaller Cartesian products by inexpensively grouping values such that keys not in the group are guaranteed to not meet the filter operation criterion.

Instead of n^2 operations it is more like m * ((n/m)^2) that can be evaluated in parallel across the m groups.

The simplest example of this is hash joins and equality filters. Keys that match on equality will also be grouped into the same hash bucket, reducing the search space. Keys that hash to different buckets will never be equal. The join is therefore the union of the cartesian product on each hash bucket, which requires fewer operations than filtering the cartesian product of the entire key set.
Her 'bias' is based on the evidence already submitted in pre-trial and only shows that she's leaning one way not that her mind is completely made up. A bit unusual to say it out loud but anybody would form an opinion after reading the DOJ's side of the argument.
Bang With Friends: Behind the scenes with this controversial app
> The pace of obsolecence on the Internet is unacceptable.

Or it's unacceptable that I can't buy hay to feed my horses every mile down 5th Ave in Manhattan. Sorry -- you're entitled to your opinion, of course, but it's a pretty silly thing to say. The world changes. Things progress.
I'm just curious: the obvious response to the first problem (message extension attack) is to include the message length in the message. If this wouldn't work, could an expert please tell me why?

Edit: To be specific, I was thinking of a Pascal-style length-at-start arrangement. It's clear that if you put the length at the end you may be vulnerable to exactly the same attack!
If you're making near minimum wage, the absolutely last thing you want to do is work more than 40 hours a week. A low-income individual needs more time and energy than somebody with above average income. If you don't earn much, you will have to do a lot of things yourself and spend more time doing it; you'll take the bus instead of the car, you'll spend more time shopping around to save money, you may have to spend more time preparing your own food. If, say, you're taking on a second job, you're not increasing your standard of living; you're mostly just increasing your stress; you're increasing your income, but also your cost of living (generally dramatically more so if you have children).

You mention Germany: Germany does not have a statutory minimum wage; however, it guarantees you certain minimum living standards as long as you are working or actively looking for work (or, of course, if you're disabled, too young, too old, etc.). This includes a roof over your head, comprehensive health insurance, and enough money to get by (if you earn too little, the government will top it off). It's a frugal life (even if it's technically above the subsistence level), but one that can be managed and one that you're not improving on by working extra hours.

If you want to improve upon that situation, your best chance to accomplish that is to acquire extra skills, not to commit yourself to becoming a wage slave. If you're fine with that standard of living, your quality of life will be better by only working 40 hours a week and having 4-5 weeks of guaranteed annual vacation time rather than working 60 hours and not having any vacation time.
> K customers buy ads to be shown in the UK to UK viewers, from UK staff at Google's UK offices. They pay in UK pound sterling, from UK bank accounts. So far everything is in the UK. It is only at the very end of the process that someone in Google's Ireland office pushes a button to close the sale, thus taking the sale out of the UK (and our tax system) and into Ireland and their tax system.

Except, arguably, the most important thing: the search algorithm and database that brings those UK customers to view those ads in the first place.

In any case, my point isn't that what Google is doing is the right answer. My point is that its quite debatable even from our armchairs how much tax revenue the UK is entitled to from Google's activities in the country. Google is just taking advantage of that complexity.
It seems like just about everyone's written a static site generator. Mine is Kerouac (https://github.com/jaredhanson/kerouac), another Node.js-based generator.

I specifically wanted to apply the middleware concept to generating pages, which turned out to be a decent fit. It ends up being a very similar API to Express, so its instantly familiar to Node.js developers. Check it out.
Do we know that the user waited a long time? My reading was that he paid before deadline, things went a bit weird, he called support, got a receipt, but then everything blew up. It sounds like the state of his account was mangled in there somehow, not necessarily that he waited too long.
The problem with these attacks on SSL is that they're not protracted; They're trivial. Python's httplib doesn't check SSL certificates at all by default, for example, so you just hijack the TCP connection, negotiate SSL, and then you're done.

With libcurl, I think you have to set CURLOPT_SSL_VERIFYHOST to 2. If you set it to TRUE (i.e. 1), it skips part of the certificate check, rendering the whole thing trivially insecure.

Most (all?) crypto libraries have terrible APIs, or have APIs that are far too low-level to be safely used by most developers. SSL shouldn't be the easiest thing to attack, but in the current state of affairs, it often is.
Conway's Law: "organizations which design systems ... are constrained to produce designs which are copies of the communication structures of these organizations."

http://en.wikipedia.org/wiki/Conway%27s_law
Hmmm, one of the things I've noticed is that if you've studied pre-web cryptography extensively (as I did, starting even before I started programming), "Everything you know is wrong". Or thereabouts.

The HMAC timing attack illustrates this well, "classical" systems as I will call them, e.g. Enigma and how it was used, are not subject to zillions of known plaintext attacks (although I've read one bit of known plaintext from an out of the way base ("I have nothing to report"...) regularly helped the Enigma decryptors when the key changed).
Doesn't OED4 use it as the platform it's built on?
Unfortunately the site looks a bit of a mess on iOS. I suggest a basic browser detect so you can display a nicer looking splash page to mobile users.

You named your product Steve. If you want to go the Jenkins/Ask.com route of having a product with a human name then come up with a memorable and attractive avatar for Steve ASAP. Personally I would be weirded out using a product with a bland and generic name like "Steve". I understand this is subjective, but you may want to iterate on the name until you find something interesting and memorable. This may sound trite, but in a crowded marketplace where every conversion matters you'll want every edge you can get.
I would break the levels of crypto knowhow down thusly:

1) End user level: You want to buy things online, you should know to check for the padlock icon.

2) Deployment level: You run an online shop using an off the shelf eCommerce system. You should buy an SSL cert and know how to install it on your web server of choice. You should also know the difference between a public and private key (and hence why you should never give the private key out) and roughly what a certificate and digital signature are for.

3) Integration level: You are building a custom application/API which uses crypto for security/privacy. You should know the difference between symetric/asymmetric encryption, what things like HMACs are and what the purpose of a password hash is.

You should know how to choose a good library or ensure that your framework is integrating a good library. You should also be mindful of which information you should never leak over cleartext channels and also things like MITM attacks.

4) Implementation level: You are using existing crypto primatives to develop a new use for encryption, maybe a crypto currency or a new type of auth protocol for example.

You should know a lot of deep computer science related to crypto, like the difference between AES CBC and ECB modes, various issues related to padding, how to generate secure random numbers and countless other issues. Here be dragons, you probably need significant peer review before your work is "production ready".

5) Design level: You are trying to improve an existing crypto algorithm or develop an entirely new one. Here you are going to need a very deep understanding of mathematics and cryptography research, probably to PHD level. So all kinds of stuff about number theory and being able to formally prove everything.

I would guess that most developers should stay at around level 2 as much as possible, delving into level 3 only when required and never further.
I wonder if they're taking precautions against the blimps being shot down.
Yeah, and half the people replying thought he was seriously making those points rather than recapping the crap from round one.
I'm pretty sure that Foxconn and Apple are separate corporations, so I have no idea what you're getting at.

Apple has 73k employees, 50k of which are in the US. Pretty sure most of them have benefited from US society (education, roads, police stations etc.) or benefit from it now that they have moved to the US.
That's well understood, but I would argue that it doesn't always matter (such as in this case, where customers are choosing which service to use), because to many it's not how they see the cost equation.

In short, it doesn't matter how much value Google derives from the transaction, but how much the client feels they spend on it which determines whether they think it's a good deal. If people feel the cost is free, that's what will go in to their internal calculations as to whether to use the Google app or a competitor, and when n comparing "free" to some small cost.

Google gets away with not always having the best app for a service with the trick of looking free, even though strictly speaking they aren't always.
Wait, wasn't the discussion about Wordpress themes having to be GPL (being purely derivative works) over and done years ago?

You create a derivative work of GPL-ed software and call somebody else a thief for doing the same to you?
http://ipcommission.org/report/IP_Commission_Report_052213.p...

> The Commission on the Theft of American Intellectual Property
> With U.S. companies suffering losses and American workers losing jobs

Jobs. Translation: this is a PR piece.

> The Department of Homeland Security, the Department of
Defense, and law enforcement agencies should have the legal authority to use threat-based deterrence
systems that operate at network speed against unauthorized intrusions into national security and
critical infrastructure networks

Huh? This includes national security now? Are they deliberately blurring the lines between pirating and national security? Why I think so.

> Informed deliberations over whether corporations and individuals should be legally
able to conduct threat-based deterrence operations against network intrusion, without doing undue
harm to an attacker or to innocent third parties, ought to be undertaken.

They want to legalize Sony's rootkit, but they want to do it right. Rootkits in the wild cannot be tamed, don't even go there.

> if counterattacks against hackers were legal, there are many techniques that companies could employ
that would cause severe damage to the capability of those conducting IP theft.

You do something that the system thinks is pirating and your computer blows up. What could go wrong.

> ...The Commission is not ready to endorse this recommendation because of the larger questions of
collateral damage caused by computer attacks

Ahh I see, they're reasonable after all! IOW, they want to make their rootkit legalization idea sound sane.

> Recommend to Congress and the administration that U.S. funding to the World Health Organization (WHO) program budget in whole or in part be withheld

At this point I want to punch someone in the face.

I can't read anymore.
In fact, as that Wikipedia article points out, it was exposed by a Microsoft employee:

The scandal erupted on October 31, 2005, when Microsoft researcher Mark Russinovich posted to his blog a detailed description and technical analysis of F4I's XCP software that he ascertained had been recently installed on his computer by a Sony BMG music CD. Russinovich compared the software to a rootkit due to its surreptitious installation and its efforts to hide its existence. He noted that the EULA does not mention the software, and he asserted emphatically that the software is illegitimate and that digital rights management had "gone too far".
Yeah, freakin' poor people. If they were decent human beings they'd be living green, sustainable, carbon-neutral lives respectful of Mother Gaia. It'd be nice if they weren't poor, but since they're such greedy anti-environmental jerks, they probably deserve it.

If the fish aren't biting and your children are starving, you're going to do what you have to do.
Israeli Scientists develop advanced biological computer
I see a disturbing amount of this attitude: it's fine for corporations to be as unethical as they can get away with, and it's up to government to constantly rein them in.

I don't buy it. No, it's not Google's responsibility to find ways to pay tax, but they also shouldn't be constantly finding ways not to pay tax. A company is not a function relentlessly optimising for money, it's made up of real people making decisions. I expect those people to use some sense of what's morally right, not just what the law allows them to do.

The law is a heavy, slow implement, especially when multiple countries are involved. Multinational corporations can rearrange their accounts much faster than we can pass legislation to control them. It's like playing whack-a-mole with a vote before each hammer swing.

If they're dodging taxes within the letter of the law, they can expect judgement in the court of public opinion. Which is how this debate started.
Does this still work for Flash?
The effect of petting a dog on immune system function. : Seriously, Science?
Silicon Valley and New York or any place in the US are in the same country. Its much easier for entrepreneurs to move to Bay Area and work on their projects than stay in their home town and try to duplicate it. So the reason I think there exist only one Silicon Valley in the US is less friction to move there. While citizens of other countries have very high friction (visa, culture etc) to move to Silicon Valley. So yes I believe if you can make your country's laws entrepreneur friendly you can too create something equivalent to SV. But the laws don't exist independently, they are mere reflection of the values and culture of the country.
Yes! You're almost half right! But more seriously TN is one of the most important thinkers of the 20th century. see my note above.
If you're working an hourly job in the UK, you're still entitled to paid statutory leave (as a fraction of actual time worked) [1].

[1] https://www.gov.uk/holiday-entitlement-rights/entitlement
There's actually methods being worked on to compensate for color degradation in AMOLED over time[1]. Many of the AMOLEDs being used by Samsung are also Pentile (since they're cheaper to produce), which is even more likely to suffer from what you mentioned as well. Originally, phones like the Galaxy S and S2 did not have a Pentile screen, but starting with the Galaxy Nexus, I think they all have since (including the S3 and the S4, albeit higher quality ones).

[1] http://www.hindawi.com/journals/ijp/2013/839301/
At $work we regularly have trainees who learn just a tiny bit of programming. We teach them not to touch cryptography if at all possible. And I don't touch it either.

When we do web development, the admins take care that the application runs over https, and authentication is handled by some LDAP thingy in the web server. The only other cryptography we use is ssh, and signing submissions to the RIPE database with PGP, and stuff transparently done by some database client libraries.

It seems to be a sweet spot where we're still flexible enough for what we do, and don't present too much attack surface.
Sony MDR-R10: The world's best headphone
Show HN: Embeddable hackernews comments
Pinch to zoom isn't so intuitive either. What happens when you pinch to zoom in Contacts for example. I'm guessing nothing. Of course you can tell by looking at something whether it is "pinchable" but it's not intuitive to know.
Sure, because your average US company has the plantation mentality - "the more time the employee spends on the job, the more productive he is", which is obviously not true for software development. The US company sees vacation as wasted time, not an investment into the employee's productivity and well-being.
P.S.: TN is one of the most important thinkers of the 20th century. Perhaps not top10, but definitely top50, after Einstein, Freud, Chomsky, etc. He talked about personal computing before personal computers. He invented (i.e. thought of) Hypertext, before people did have access to computers. Building things is important, no doubt. But thinking about them is also important. Note the three thinkers I mentioned also never built anything. They wrote books/articles. For instance Nelson largely influenced IBM in building the PC. http://www.youtube.com/watch?v=Kasu0BhRFGo. He also influenced Steve Jobs, I believe quite heavily. At least Woz mentions the influence of Nelson and I think many ideas of Jobs actually came from Nelson in some sense.
http://catarse.me/pt/leca#reward_9709
My point is that low vacation days is a symptom of capitalism which has its own advantages and disadvantages.
Not to mention Apple especially does this. 68K -> PPC -> Intel, OS9 -> OSX, ditching Rosetta, and ultimately forcing everyone to update OSX regularly. My fiancee's Mom was forced to update to Mountain Lion to play her latest games, when Snow Leopard was more than fine for her.
Simple JS snippet to embed a hackernews comment feed on your page. With optional HN style theme!
The hosted version is on a small box so may struggle under load, also feeds are cached for 5 minutes so may take a while to update, if you want to customise this checkout the source and self host.

Thanks
Memory safety in memory-unsafe languages. We've had Valgrind and ASan for a while, and people still find crippling bugs in C and C++ code all the time.

XSS vulnerabilities. Maybe Content Security Policy will help some here when it becomes ubiquitously available.

Integer overflow. This is a particularly insidious problem because your well-formed test cases often won't catch it.
Thank you for pointing this out! For a second there I couldn't understand how the American population is turning a blind eye to such a pointless war.

Also the new Start trek movie is oddly reminiscent to this. Although the taliban/iraq aren't nearly as powerful as the Klingons.
'Curse of the new HQ' for Apple, Facebook, Amazon, Google?
It's hard to design and create software for subjects you don't know much about. It's not really a surprise that people create software for their own lives.

A lot of open source is focused on programming languages, libraries and things to help you code. It's what most open source people know, and thus what they create.

I wonder if it would have been better for CS to have been only offered as a minor or double-major to another field of study, at least at the Bachelor level. We would have fewer pure CS people, but a lot more people with training in another domain.
"I don't wanna trade money for vacation."

My point is that the tradeoff between money and vacation does not exist in the aggregate. You get the vacation for free simply from moving to the lose-lose quadrant of the prisoner's dilemma to the win-win quadrant.
The thing with cryptography is that you have to get it right every time. The person trying to crack in only has to get it right once.
Most flash games have an App alternative though.
Laws are written by politicians, and interpreted by judges.

Tax cases are expensive and complex to investigate. Google probably has more money that the entire UK tax authorities. HMRC has to concentrate their efforts somewhere, and they concentrate on the people who are clearly breaking the law, or where they have whistle-blower evidence that laws are being broken.

That puts companies like Google at an advantage. They can operate at the edge of the law, exploiting loopholes, and then pay more if the laws are changed. And then, if we find out that they are not obeying the law but breaking it they make a deal with HMRC. See the deal Vodafone made where a huge tax bill was waived, if Vodafone paid a small part of the tax they had evaded. (http://www.guardian.co.uk/money/2011/dec/06/hmrc-tax-deal-vo...)

Dodging tax is only beneficial to these companies.

As to why they should pay: Apart from the fact that UK customers of Google buy UK ads for their UK potential customers using UK bank accounts and UK pounds and buy them from UK staff at Google's UK office (with a final 'close the sale' bit of paperwork done in Ireland for the sole purpose of avoiding tax in UK) - apart from that, Google makes use of UK schools and roads and police and fire departments and etc.

No one minds that Google pays less tax than they should. People only mind when Google goes to extraordinary lengths to avoid tax.
Cat Arse Me?
I think this is a by product of 20 somethings being the most sought after group by advertisers combined with them being the most likely to try new things without a lifetime of bias towards the status quo.
I don't know what altitude they'd fly at, but this quote from the Wikipedia article on Airships says:

"In November 2006, the U.S. Army bought an A380+ airship from American Blimp Corporation through a Systems level contract with Northrop Grumman and Booz Allen Hamilton. The airship started flight tests in late 2007, with a primary goal of carrying 2,500 lb (1,100 kg) of payload to an altitude of 15,000 ft (4,600 m) under remote control and autonomous waypoint navigation."

So it's perfectly possible for these things to typically fly a few kilometres above the ground. That is outside the range of small arms: the furthest confirmed sniper kill to date was at a range of 1,250 m.

So while it would certainly be possible for someone to shoot one of these airships down using aircraft or guided missiles, they would not be able to with small arms fire. Except during takeoff and landing, of course.
If it doesn't work, it doesn't work. Some things aren't meant to be zoomable. Trying doesn't break anything.
Ask HN:  How to learn through freelancing?
I want to become a full-time Ruby on Rails developer. I've read things like this (http://www.quora.com/Ruby-on-Rails/What-are-the-minimum-level-of-skills-for-an-entry-level-RoR-job#) that range from as little as throwing a few sample apps on GitHub to joining a programmer school. However, it may be hard to be motivated to build a few sample apps that have no users, and I don't want to move far away to attend one of these schools. Another option I've thought about is freelancing on sites like oDesk or elance to learn through experience. I'll have real problems to solve, and I can do it from my current location. I could do freelancing for 6-9 months to prepare a portfolio to get the full-time gig. The freelancing only is needed to provide significant experience; I'm not expecting much money out of this. I've got the savings to cover the living expenses. If you've attempted to learn via freelancing, did it work? What were the pitfalls? I can see one issue being that a lot of these online freelancing websites have a lot of people applying for the jobs so it may be hard to get them as a beginner even with some sample apps
Economics is also an excellent example. Nobody knows how to do it properly, even establishing direct cause and effect is basically impossible so we just iterate through progressively less broken solutions.