skysight-inc/HackerNews huggingface dataset:
The reason those companies are still running the old versions is because even if they're out of support, they're known quantities. Implementing new versions will require development and testing to put in to place along with the possibility of additional upgrades (OS, other apps/libraries, etc.). Unless you have resources to handle that aspect in addition to any of your actual business, you're going to want to stay on a version for as long as possible instead of being on the upgrade treadmill that Microsoft/IBM/Oracle try to place you on.
They'd probably find more value in the general populace not having access to the rest of the world.
Because they photoshopped a stock image??? Seriously? You understand how journalism and blogging works, right?
> so we just iterate through progressively less broken solutions.

And then get all ideological about it and iterate back to more broken solutions (Chicago school)
Parent fail, assuming the kid was given gifts. Never wrote a thank-you note and mailed it?
People were shooting drones in the US[1]; you don't to assume a warzone to consider it a risk.

[1] http://www.suasnews.com/2012/11/19719/activists-drone-shot-o... (Yes, the drone may have been above private grounds; so probably will the blimps)
> Measure the time each request takes to complete. Since string equality takes a tiny bit longer to complete when the first char matches, the message that takes the longest to return will have the correct first character.

Always wondered if this really works in practice ...

I imagined the time it takes to compare 2 strings should be negligible / indistinguishable in a full HTTP request over the wire. Among all the other things happening in the network stack, OS, Rails, HTTP, database access, and everything else you're doing in your request, a string comparison of a few dozen characters should be well within the noise range.

I've Googled around and it seems like it really is a viable attack:

http://www.cs.rice.edu/~dwallach/pub/crosby-timing2009.pdf

> We have shown that, even though the Internet induces significant timing jitter, we can reliably distinguish remote timing differences as low as 20µs. A LAN environment has lower timing jitter, allowing us to reliably distinguish remote timing differences as small as 100ns (possibly even smaller). These precise timing differences can be distinguished with only hundreds or possibly thousands of measurements.

#mindblown
Regardless of what Jobs may have thought or felt, the AppleLaser writer was not the first laser printer.
I'm amazed by the rate of the Django releases lately; the core devs must be very busy.
For the timing-based one, you I would've made the server wait a small random amount of time during the process. The xor is more clever, though.
Oh, I see. I'll add a comment about that.
Thoughtful Tips from the founder of Fotolia
I am thoroughly familiar with Nelson. I've read probably a majority of everything he's ever written. He's a smart man and a visionary. As I stated.

Doesn't change the fact that he hasn't been very successful at turning his ideas into anything actually useful to people, and doesn't change the fact that he shits all over the amazing accomplishments of thousands of other people who have.
Be careful about making this argument - the people whose job you're trying to eliminate might be the people who are making the decision. A better argument, if it applies, is that you offering reduces non-core work, allowing staff and resources to be focused on core work. Any company that has IT staff will likely benefit from continuing to have that staff, just focused more on value-add activities rather than chores.
Sure, I meant in terms of production implementation though that may not have been clear.

It's probably wise to know basic things at least one level further down than your required level so you know when things are starting to smell funny.
Point by point:

* Despite all the press password hashing gets, bad password hashes are rarely the worst mistakes people make in their applications. I'm glad there's a meme now about using bcrypt or scrypt, but I don't think people should be afraid to deploy password hashing.

* The alternative to signed requests is to credential the requests directly and not build delegation features. Many applications that use signed requests to solve authorization problems are in fact overbuilding; they're in effect building the infrastructure for federated authorization to solve simple point-to-point authentication problems. Just use HTTP Auth and a long random credential.

* You said it right here: just use random tokens to key a serverside session store.

So, I'd suggest those are four bad examples.

But backing your point out a little: so what if you feel like you need to use crypto in your application? Cryptography doesn't get easier just because you want/need it to. I find myself tearing my hair out at the circumvention/liberation tech people, all of whom respond to the same argument with, "so what if the engineering is hard, people need this stuff*. Well, they need it to work, too, don't they?
> [2] http://www.letscodejavascript.com/ - Looks good, but for javascript. It does look like it's better geared toward beginners.

Author of letscodejavascript.com here. The series is intended for professional developers, so I don't spend any time on "this is the command line, this is a variable," but we do build an application from scratch. It's very much the immersion approach, and we cover a lot of things OP is wondering about (command line, Node, npm, Git, TDD). It could well be a good fit.
I wish they made this available as a backend for applications for state syncing. (Both mobile & desktop)

I always have desktop running somewhere that can be doing the more intensive backend processing.
The article's author cleverly avoids the shame of Betteridge's Law by simply leaving off the question mark, but alas the result is the same. And in that you find your answer.
> add chromebook to google apps

Good luck with that...
You can prefix the left parenthesis with a string. You then repeat that string after the right parenthesis. By doing this you can include sequences in the raw string literal that would have otherwise terminated it.

R"foo(xyz)")foo";
by coincidence, saw this just now http://stackoverflow.com/questions/16777091/aes-counter-mode...
> The only way workers' salary/benefits go up when their real productivity goes up, which only goes up as capital accumulation goes up.

LOL. No, if productivity goes up the most likely outcome is that some executives will put all new money in their own bonuses and salaries. This is the country where CEOs earn >350x the common worker.
It's probably worth noting that a relation is a subset of the cartesian product too. For me at least, it makes the concepts make a lot more sense to think about it in these terms.
Why I organise tech conferences
I wouldn't necessarily call Chicago school broken in it's entirety.

I guess the whole idea that there are differing "schools" is probably an indicator in itself though.
Roughly a hundred people have implemented a milliseconds-granular timing attack in our crypto challenges. Our challenge isn't totally realistic (in reality, you'd be timestamping as close to the wire as possible, and if you used Python, you'd be using it to postprocess samples you took in C) but I think if you get through it you'll understand why the attack is viable.

Keep in mind that most target applications will allow you to colocate yourself for ~$100; you just get your sampling server onto a VM in the same hosting center.

There are programming environments that don't readily admit to over-the-wire timing attacks. Nate Lawson did a Black Hat talk about this a few years ago. It is difficult- bordering- on- implausible to remotely time memcmp. It's hard to say whether it's going to get harder to carry out this attack as machines get faster, or easier as attackers discover more filtering techniques and better ways of pessimizing execution on target machines.
You're overcomplicating the issue. It's not the accountant's job to make up for lazy lawmaking. It's the lawmakers. Go bug the lawmakers, not the people trying to make money within the law.

Would you seriously have done differently in Google's shoes if it meant the difference between millions of dollars? Billions of dollars? Your answer to that question is probably why you're not making those kinds of decisions.
What are the parameters for "active development"?

The "Mario World" clone hasn't been touched in a year, but is listed as having active development.

Edit: Sorry.. was 1 year. The only more recent commit was a translation update 6 months ago
A single space at the end of a line? That's extremely common. I don't catch those until I check my diffs before commit. And on that particular line, the width attribute was "removed".

And the class name is "plusIcon", which has to be extremely common.

While it certainly looks like they might have copied the design, the evidence they provided is extremely flimsy and doesn't point to them copying the HTML or CSS.
This thread is about afghanistan.
I'd say it could be troubling for dropbox. It's probably game over for https://aerofs.com though unless AeroFS drastically changes/pivots.

For dropbox, they do have some advantages. Bittorrent brings up thoughts of piracy. Dropbox doesn't have that reputation and would be much more acceptable in corporate environments. Additionally, Dropbox has integration with a lot of apps and I don't see that happening with BT Sync anytime soon. Web access to your files, versioning, etc.

Advantages of BTSync? Free. No limits. Files not stored on 3rd party servers. It's fast. Transferring large files with Dropbox is painful. BTSync is just getting started.
Takes me back to an interview questions two decades ago!
To some degree the OP is right.

A static campaign, sending traffic to the same landing page, not increasing the bids to account for changes in CPC, will be less successful than before.

Over the last several years, the barrier to entry has dropped but the barrier to success has risen extremely high. It is much more difficult to profit when most of your competitors are using every tool at their disposal to crush yo.

The two things that could easily make/crush his conclusion is average position and quality score. I want to see the average position on search and quality score over time as that will indicate:

1. If he has not kept bids in line with the market
2. If his site has continued to be updated with sufficient fresh content to appease the googlebot
3. If he has continued to improve his ads (CTR is one of the components of quality score!)

Those things will indicate where his efforts have fallen down.
Making of the "Wave of the Future" Poster
I am keen to try out freelancing. I am still a student, so I can only do part-time but I already have a year of industry experience (django), and projects I have done that are live now (that people actually use!). I just need someone to give me that first chance to really prove myself and start building up my portfolio of real clients, rather than just projects I did for fun. I have been keen to try it out, but I was never sure when was the right time to dip my foot in the water. I did freelancing with someone for a short time (PHP MVC, Wordpress) but I always kinda felt I was getting the short end of the stick in regards to the pay and work. I guess I always thought it was always a bit risky and afraid of being takin advantage of so I never really went for it.

Anyone have any advice? I would appreciate it.
I need to setup some automated checking rules. Mario World was added some time ago and it looked like actively developed. I'll change status now.
Don't forget to buy her a good and "ergonomic chair" too.

A) Install one of the "many" ChromeOS alternatives, see: http://downloadsquad.switched.com/2009/12/30/10-free-fast-bo...

B) Get a Tablet. iPad or Android, it really really doesn't matter!

UI changes are negligible when the UX is much more intuitive, accessible and better. Most Tablets are filled with crapware and have ugly default settings like tiny font-size, too many app-icons. It is entirely clear that touchscreens are more intuitive, when the UI and UX is optimized to do as much as possible for you with only minimal and intuitive input.

If your grandma is "smarter" and needs the "Computer" to work with Office, then you better get her a Notebook. Again Brand doesn't matter. Make sure the screen is large enough and that buttons have background illumination. If your Grandma is weak, buy her a PC not a Notebook, so she doesn't has to grab that heavy thing up and down.
Yes, that's what I'm driving at: You have no choice but to learn the crypto libraries and use them. I've argued before that authors of crypto libraries have a sort of professional duty to document their libraries well, including info on all the mistakes developers are likely to make. I think if you're going to claim to offer crypto for average developers, you owe it to them to document it properly. It's always seemed a little unreasonable to me to blame non-cryptographers for being unaware of obscure vulnerabilities. We can't all be experts in everything.

Yeah, agreed about the cookie. I guess I should have said "a plaintext cookie only containing 'userid=42.'" Because clearly you can't just let people edit their cookies and take on any user ID, session ID, or other such identifier.
This is more FUD for the pro-piracy crowd to get their panties in a twist over. The root kit is obviously an unrealistic idea though the network idea is a bit more realistic but I seriously doubt either will go anywhere.

This is our fault though. We have these companies that sell us digital recordings of media we want at a price they've chosen. We found a way to circumvent the buying process and get it free. This is simply not okay. We can debate how fair artists get treated, the price of media, and whether or not distributing copyrighted materials online is technically stealing all day long but in the end any rational person sees this is wrong.

So while we infringe on the copyright holders rights for years any time they try to take steps to curb this behavior (which is on a scale way larger than other types of black markets and impossible to ignore) we act shocked and appalled as if we've dont nothing to instigate it. Each time they fail to curb piracy they come back with an even more deplorable plan to stop it. In the end we're all losing, both the media companies and the consumers.

I still can't understand why anyone would think piracy is okay. I've done it myself but I know its wrong. Using reasons like region availability, pricing, and the usual copyright complaints to justify it dont make sense. They're usually all excuses for the person with "I should be able to get this on my terms because, uhh, freedom" syndrome.

Sometimes the complaints are legitimate but still don't excuse piracy. We've created this problem ourselves and the only way to stop it is to vote with our wallets. Piracy does not count as voting with your wallet. To vote with your wallet you have to be willing to live without the thing you desire or go to a competitor until the seller starts giving the consumer what they want. A black market is not a competitor and it undermines the goal of getting media companies to start making it convenient to buy their product at a reasonable price. Piracy just shows them we want what they've got but don't want to pay. The only way to compete with piracy is to shut it down which is impossible and leads us to crazy proposals like the one discussed here. But lets say HBO and Shotime both aired Game of Thrones. If HBO sucks at distribution and pricing consumers go to Shotime instead. HBO sees this and can't shut down Shotime so the solution is to get better at pleasing consumers.

My point is that you can't compete with a black market and this constant arms race to implement and circumvent anti-piracy measures will lead to a stalemate where we all lose. If we quit both pirating media and buying it, that would start leading to changes in a positive direction (for those of us who aren't just pirating to be cheap at least).

*Side note: unfortunately, getting media online has the potential to become VERY convenient but can never be as convenient as piracy as it'll always require a payment step but is that really so awful?
> (Reminder: When I say “regular expression” here I obviously mean it in the programmer sense, not the formal language theory sense.)

Once I read an article where the autor recomended using "regular expression" meaning the formal theory and "regex" to point out the (more powerfull) implementation. I think it's a good way to provide a common vocabulary.
The world needs more broken crypto like a dissident strapped to a chair in a concrete cell in South America needs another car battery alligator clipped to their fingers.

How about, if the world really needs more cryptography, the people who bring it to us take the time to become just a little bit literate in how crypto is actually attacked, instead of pretending like they understand it just because they were able to produce intelligible outputs from OpenSSL's AES?

You're using raw RSA. How much practicing have you done of attacks on RSA? How literate are you in RSA? If the answer is "not at all", why are you allowing yourself to use RSA? How is that not negligent?

(I don't know you, or didn't read your name closely enough to detect that I do, so maybe you have done this legwork; in which case, share with us why you think everyone else shouldn't do the same work?)
Hilarious article. "there is no need to route through the cloud which can slow things down" wtf, no editorial oversight of tech material at Forbes? The rest is shit too.
Yeah. I'd probably list that as sporadic at best.
I'd imagine that the power imbalance of corporation vs employee creates a "lowest common denominator" situation more often than corporation vs union.
The Macintosh has been around for 30 years. Three major transitions during that time doesn't seem like an abnormally high rate of change to me. DOS-based Windows -> Win95 -> NT during the same period is pretty close.

I also find it hard to blame Apple for the death of 68k and PPC. If you know what the dominant processor architectures will be in 2035, please tell me which stocks to buy :)
>This particular vulnerability is not due to MD5 collisions or MD5 being cryptographically insecure. It's because of the internal mechanism (a "Merkel Damgard Construction") intrinsic to hash functions like MD5, SHA1, SHA256 and friends.

That's what I like about SHA3. It only dumps part of its internal state so there is no possible way to resume from a hash. This also makes it viable as a PRNG or cipher stream.
It does matter what hash function you use, though. MD5 and SHA-512 are both vulnerable to length extension, but there are other hash functions that are not, like SHA-512/256, SHA-3 or BLAKE.

The documentation for both Keccak and BLAKE2 recommend prefixing a fixed-length key to the message to do MAC, pretty much like in the vulnerable example, but with a better hash function.
Photoshopping an image and not captioning it as an "artist's concept" or something similar is absolutely a violation of traditional journalistic integrity.

This is not a picture of a "Google Blimp." It's not even a picture of a blimp in Africa.
This article is incredibly terse and uninformative. Why are older engineers having such a hard time? Are they keeping up with new technologies to remain competitive? What kind of engineering are we even talking about?
I second this! or something similar, at least. Having not really gone to college, myself, I was lucky enough to have had so many varied life experiences and interests before I took up tech; so when talking to my colleagues who are cs-equipped, I find their methodology is often very CS oriented, and focused more on the tech than on the problem. I think that's why "design" has become such a big fad these days - it's almost as if we just figured out that people buy products, not tech.

That being said, after speaking with quite a few tech-inclined people, I feel they would be a lot more comfortable with less technically inclined subjects if they were stripped of the general cultural pretensions that they come with. There is a very strong resistance to "acculturation" among techies, as it is usually seen - rightly, for the most part - as a mechanism of enforcing a "cool kids' club", so to speak, rather than an actual venue for intellectual exploration.

I think, that as techies, we are in a unique situation, as far as intellectual development is concerned. The vast majority of the population can't appreciate technical phenomena because it is culturally viewed as "too hard" or "robotic" or "blah blah, boring". We, OTOH, actively refuse to engage with humanistic pursuits, but not out of any perceived difficulty so much as discomfort with the pretensions that come with "cultured society". If effort can be made to induct some history and philosophy, and heck, maybe even theology into the the techie culture, we could have the best of both worlds and possibly even have some truly fresh ideas put out.

In short, it's easier to teach a physicist to write essays than it is to teach a poet Diff Eq
The biggest candidate:

* Pure mathematics: Consider e.g. the difficulty in verifying the recent proofs of Fermat's Last Theorem (Wiles-Taylor-Frey theorem?), the Poincaré conjecture (Perelman-Hamilton-Thurston theorem?), and now the ABC conjecture (Mochizuki-Szpiro theorem?): there is essentially no indication of the correctness of a mathematical proof besides simply having a whole lot of smart people look at it and think very hard. This may be of particular interest because pure math has lately experienced a turn towards the use of proof-verifying systems, and so it may be of some interest if one of these can be designed for cryptography.

In particular, consider the following method of verification: a cryptographically secure function h(M, k), known or at least believed to be hard, a message M, a secret key k, and a channel C(h) over which data is transmitted. We wish to prove the following combination of statements: a: given C and h, a method to obtain the message M also obtains the key k, and b: given M, C, and h, it is "impossible" to obtain the key k -- i.e. it would require breaking the hash function; this means that if the cryptography is broken, so must be the hash function. The latter portion of the proof is necessary because we must always consider the possibility of a rubber hose or a stupid user.

EDIT: I should add here that side channel attacks depend on an incorrect understanding of the content of C. So perhaps we should include c: we send only what we wish to in C.

In the interest of pedantry, I dreamed up an example "cryptosystem" which may fit the bill, though I have no honest idea of the difficulty of the h function [and I know almost nothing about cryptography!]: consider a large prime number p, the finite field F_p, and its algebraic closure Fbar_p. A message M is a [presumaly long] polynomial M(x) over Fbar_p, and a key consists of the pair k = [p, z], where z is some arbitrary element of Fbar_p. h(M, k) is obtained by expanding (x - z) * M(x) in Fbar_p, and we send over C the coefficients of the resulting polynomial. Verification is obtained by computing C(z) in Fbar_p and the message is extracted by polynomial division. Then (a) rests on the difficulty of factoring a polynomial and (b) rests on the secrecy of p: so we cannot, for example, simply compute C/M.

Note that Fbar_p is countable, so the whole procedure uses only integer math.
"All the airlines are also seniority based..."

That's probably something that's dictated by the union contract, just as it is with school teachers and other unionized workers. If it was up to the airline, they'd probably promote based on how well people did their jobs rather than seniority. So in this way, the unions are decreasing the ability of employees to look for jobs elsewhere.