skysight-inc/HackerNews huggingface dataset:
I'm a programmer, not a NYT contributor, but even so my back-up plan for when I'll no longer be able to earn money from writing code is to start raising goats. It helps that my (living in the countryside) parents used to have a goat until not that long ago, and I could use their place for, well, starting the new endeavor.

Back to the article, I'm bummed that the photo of said goats wasn't presented to us.
It's interesting that they would bandy around the word "transparency" -- with secret unapproachable courts, not all committee members being read into programs, and so on.

That's gotta win for me the "political doublespeak" award for the week. Better to have made a case that the structures were needed (which he feebly does, incongruously), than simply call one thing something else over and over again.
Your original claim -- the one in that's still the headline of the linked HN post -- is that the NSA admitted it listens to phone calls without a warrant. I don't want to get into a linguistics debate, but I think this has indeed been refuted. It's certainly unsubstantiated. I mean, that's why you changed the headline of your article on CNet, right?

For the rest, I don't see how it's possible to prove the negative: that the NSA isn't doing what you claim in your piece... but if the only evidence they are is second-hand from what Rep. Nadler says he heard in a secret hearing... and now he says he was wrong... Well, seems awfully weak to me.
The simple and much more flexible answer to this is to have a firewall rule on the edge router that simply drops all packets to and from the hosts you do not want visible. Note that this is more flexible in that if you want some hosts visible and some not, you can do that. You cannot do that with NAT: you only have one port 80 and several servers for example.

In general, use the right tool for the job. NAT provides some blunt security features incidentally. It does not, for example, prevent your server from making connections to the outside world. The firewall is what is meant to be used to restrict traffic. That is its only job and it does that well.
Question for people familiar with the Parallella project [1]: I see the board design has an FPGA. If I buy a Parallella, can I take the Verilog source code in this article, run it through some toolchain, and actually execute it on the board?

[1] http://www.parallella.org/board/
This article was on the HN front page some time ago:

http://chronicle.com/article/I-Will-Ruin-Him/136693/

It sounds like your situation is similar, though perhaps less extreme.
Henry Kissinger.
If I'm paying my dev $100k/year, I'd rather spend that $48/hour doing something else.
Bush (2005): We don't torture

Obama (2013): We don't spy on citizens

The President really has no credibility here - it's like asking a CEO if his company is engaged in illicit behavior - even if it is, it's his job to say it isn't (or that he isn't aware of it).
any projects?
New DRM Fingerprinting Will Change the Words in Your E-Book
I agree with both Ptacek and Percival, with one caveat: the Ptacek statement should be "If you're not learning how to use crypto by coding attacks, you might not actually be learning how to use crypto".

Even within the academic community there has been recent upheaval over the value of proofs. Ostensibly, proofs are good in the sense that they restrict the focus of cryptanalysis. Without a security proof of a mode (say CTR or HAIFA), cryptanalysis wouldn't be able to focus on distinguishing the core function from random in some sense, but on everything. Note that coding attacks does not help much here. It also seems that the role of proofs is often misunderstood, and assumed to mean much more than it does.

Then there are the practical aspects of the trade: cryptographic engineering. This involves avoiding information leaks (timing, power, etc), knowing what to do with IVs and keys and nonces, and the list goes on. This is a much more hands-on task, and often much less documented ("the implementation is left as an exercise to the reader"). Experience on building and attacking these is often the best way to learn how to do it, and not by reading a book about it.
> I see the utility of FPGAs everywhere I look

Examples?
So far I haven't found any starbucks that wouldn't have free wifi in London. Well, apart from the small wooden one at the Liverpool street station enterance (but that is to be expected sincie it's a, well, a wooden box:)
Anything able to live in there has never had a chance to infect any vertebrate, so it's unlikely that it would be able to infect a mammal. Mutation alone won't do the trick with no selective pressure for virulence.
You haven't looked at Digg for a couple of years, perhaps?
Each of us is two very different people - the one we know, and the one others know.

I've found that self-reflection only takes me so far because of how charitable we tend to be to ourselves. I'm trying to get to know the me that others know - the me composed of my actions and their perceived motives and outcomes. It's deeply discomforting how different that me is from the one I know.

Try this - record a few of your phone conversations (with the other persons permission) over a week and listen to them. I found that the person on the phone is pretty far from who I thought I am.
Error in 2nd to last paragraph: bars the NSA from collecting data on people unless... i.e. excluding Americans from collection vs excluding non-Americans.
So much parallax hate, why? The [awesome] library is for triggering events based on how far down a user has scrolled. It could be used for parallax effects or any number of things including detection of how far down a user scrolls before exiting, subtle cues to indicate your at the end of an article, fading out non-essential navigation items.

This demonstration is over the top to show the range of features the library can provide. If someone uses the technique to inhibit usability or make you dizzy, then shame on them. There are plenty of sites that use the parallax effect very well, a couple that have been #1 on HN: http://www.nytimes.com/projects/2012/snow-fall/#/?part=tunne... , http://www.apple.com/mac-pro/ .

The key is to use it as an enhancement, not a dependency.
Go for it. Your UK 'inFlatable', charges a modest user fee, finds a flat(apartment), renter years later leaves the rental,
you return the fee with modest interest(as a model to recast damage fee abuse), and in the meantime, earn on the float,
when ex-tenant/user fills their experience on unit/landlord review form,
you return the fee with modest interest.

Old and new users-renters love your reliable vast database, hilarious scathing reviews, you go viral, and you're on the cover of The Economist and Punch.
I hope you've noticed that a number of people came forward to relate a similar perspective on death.

I really respect your decision to bow out of the emotionally charged conflict in the thread.

...However, I am not inclined to be so wise. If you're reading this, please try to understand my position even if you feel affronted by it; bare in mind also that there is some of my own emotion in this and I recognize I'm venting a bit.

For some people, emotions are a very public thing. They are shared with anyone and everyone nearby.

For some people, they are a quiet, contemplative thing. They are felt and shared only with those close to them.

What happens in public settings is that people that feel quietly are shunted out. They aren't heard, they don't express themselves because, by their nature, they don't have to.

Attachment to death seems immature to me. It seems like we have to trumpet again how awful death is, say the things that everyone knows.

Because that's the other thing about emotionally loud people: they have to make sure everyone's feeling the same things, that we're all on the same page.

virtualwhys experience with a close friend's suicide was criticized: he was told he was __grieving wrong__. The appalling rudeness of this is overlooked because virtualwhys, a quiet person, emotionally, stepped out rather than continue to feel like he was stepping on other people's emotions. Quietly emotional people respect other peoples' feelings.

Meanwhile, a lot of _other_ people are quietly relating their own grief in similar terms as virtualwhys.

Look, death is an experience. You can't change it. Even if we cure everything someday, that won't change the fact that we've lived and died. Wringing your hands about death is only additional suffering.

Because that's the beautiful thing about accepting death: you can make it more about life than loss. It is an experience of the vital things, the core things, the deep bonds and strong connections.

Aaron will die, with his family around him, still looking to the future and full of life. That is very profoundly beautiful. It is a gift. More to the point, it just _is_. It cannot be changed, but it can be appreciated.

Here's where I fall on virtualwhys side: to me, any other understanding of grief seems to be pretending you could possibly have control. Death forces us to see that we have no control--and when that is pointed out, _some_ of us can't handle it.

Yeah, that last part is a bit rude, and I apologize... somewhat.
The idea that he's referring to policy prohibitions - not technical limitations - is even more unsettling when violations of law as egregious as Clapper's lying to Congress go so conspicuously unpunished.

The entire concept of illegality as an impediment becomes meaningless when a class that's demonstrably above the law emerges in public.
Let me guess... they're using OAuth as an authentication protocol, and it's working weirdly 'cause it's an authorization protocol?
You can use a language with a strong static type system, and let the compiler do the defensive programming for you.
Yes, certainly. Doublespeak, indeed.
You have to read the FISA system in context. Surveillance under the Act is only authorized in cases where the 4th amendment doesn't apply and where no warrant would otherwise be required. Under those circumstances, it's not particularly outrageous to allow the AG or DNI to proceed without a FISA warrant under certain circumstances.
I don't relate much to this article but "I'd like to suggest that you find a nice, quiet sofa in the Beat upon which to curl up on and go fuck yourself" is a pretty funny insult when you think aboutt it...
It works as you describe, pretty much, the gnarly bit being that there's no standard interface for an SRAM (that is, SRAM is not in the standard library, unlike say simple gates.) One reason is the many different ways to implement BIST and connect the BIST signals from all memories in the chip into a coherent whole.
sure, but it's just the right thing, the Unix thing to do.
This is what amazes me, it seems that the problem is only when the ones spied are US citizens.

If you're a foreign living, studying or for holidays in the USA there is no problem that the NSA spies you.
I think it implies that that is what countries must do to exist. Do you disagree with the assertion that intelligence gathering on other nation is key to self-preservation in geopolitics? Are you really implying that US, or any country, should just take what the other country is telling them, at face value?

Yeah, I agree that NSA should not be spying on US citizens. But Snowden did, very unfortunately, lose some credibility with anyone who isn't a naive pacifist, by saying NSA/CIA should not be spying on other countries.
Nicely done, if you add a bit about clock distribution it would be perfect. Clock distribution is important because sometimes you want all the parts of your FPGA design to wait until a particular time to allow for various gate delays etc before they do the next thing. You can synchronize to a "global" clock but if you only have one global clock then you may be limited on how much of the circuit can be in your FPGA if other parts need a different clock.

That said, as FPGA vendors get closer and closer to an efficient mix of hard and programmable gates, their utility gets higher and higher. That increases volume and helps get prices lower. I've mentioned the Zynq-7000 (which I'm playing with using a Zedboard[1]) which is dual ARM9 cores and an FPGA which can drive several HDMI 1080p/60 displays. Other systems with fully "soft" CPUs use definable instructions to optimize code execution but that hasn't been as useful as I expected. Back when Xerox PARC was building the 'D' machines it was great fun when a new release of Mesa microcode came out because everything would get faster or more compact (rarely together though ;-)

[1] http://www.zedboard.org -- of course I'm currently fighting a tool/license issue with the Xilinx tools but once that gets sorted I'll actually be building new designs on it.
In Seattle, you can rent goats to help take care of pesky invasive vegetation like blackberry bushes. Blackberries sound like a good idea until they take over, and they're very difficult to remove. Goats will eat them, though, so you can rent a small herd of goats and in a few days, the brambles will be eaten back to a level where they can be dug up by the roots.

I have no idea whether this was the case in this particular situation.
Let me put this here : https://github.com/milkymist/migen/tree/master/migen
Plan B is important with AirBnB. I'm staying in an apartment right now I found on there (Prague as well), and it worked out well. However, like you said renting an apartment from an individual could easily leave you stranded. I mean, you could show up to get the keys, and they're simply not there. Maybe they're late? Maybe they had an emergency? Maybe they forgot? You need that backup plan and a location of a nearby hotel, hostel, number for a taxi, etc, just in case. This doesn't happen with a hotel. Nonetheless, I'm going to stick with AirBnB. I enjoy renting apartments, they have a lot more character than hotel rooms, are cozy, and you feel like you're a part of the city, which is why I travel in the first place.
as a non-american - fuck you obama.. but I guess you know that already
Nice try secret functional programming guy.
This didn't work with my web browser -- what is this and what does it do?
Maybe, but I think this is fundamentally different. Threesome Girl did not have a real motive against me. In fact, we were still drinking buddies when I learned what she had been doing this whole time. There was no love interest, no need for revenge, nothing to gain from doing this. Yet, she did. And even more puzzling: a lot of people helped her, she always had a lot of social support. She was quite brilliant at that. Maybe - maybe getting that support and recognition was the motive, but she already kinda had that before.
Implicit nulls are the underlying problem. If you default to non-nullable types and only allow nulls when explicitly annotated then it becomes much simpler to spot and handle all the cases where nulls might creep into your code. There are multiple ways of accomplishing that of course. Rust forces you to explicitly declare a variable as nullable and won't allow you to assign a nullable value to a non-nullable variable without performing a null check first. Haskell simply doesn't have a built in null value instead handling the problem via the Maybe type which represents a nullable value. I'm sure there are other examples in other languages, but those are the two I'm familiar with.

The concept of null is fine, but it shouldn't be the default state of everything. Force the programmer to declare his intention ahead of time and have the compiler help him by trying to find and validate all the edge cases, or at least as many as reasonably possible.
I will add, if you have access to a car, a great overnight trip (stay near by the night before) from London is to do the early morning, pre-opening Stonehenge visit (book it a bit in advance and you can get right up to the stones with hardly anyone around) and then head over to Bath for lunch and the afternoon.
A closed letter to myself about thievery, heckling, and rape jokes
> Thirdly, public internet posts aren't subject to privacy, and to the degree one may think they are of the sort that phone calls and private emails ought to be, what is the standard being described as hypocritical here?

Isn't this a bit ironic then if you are one who is up in arms about this NSA story? IE: Wholesale scooping up of unencrypted emails / forum posts etc should be expected. It hasn't been proven that actual listening in on phone conversations involving US citizens is actually going on, just phonecall metadata.
See for Yourself
You should point to this comment on your facebook feed. That'd be a fun comment thread.
I submitted this because of the impressive level of introspection Patton Oswalt displays in this letter.

It's a fantastic piece on different perspectives and allowing yourself to change your view, especially on something you care deeply about.
If you want to get your hands dirty, there is a pretty good eval kit available at Lattice, $100 gives you a PCI express board with GbE port, 1GBit DDR3 1330 and software...
So I am supposed to know brown means assembly and javascript is orange , oh and coffeescript is dark blue..and so on and so on.
I’ve often thought that the single most devastating
cyberattack [would be] simply to simultaneously make
every e-mail and text ever sent universally public.
. . . . the fabric of society would instantly evaporate,
every marriage, friendship and business partnership
dissolved.

I don't think it would be quite that bad. There are some people who lie to everyone, but there are also some people who are decent and honest. Some relationships would weather that kind of storm just fine.

In fact, maybe this is the optimist in me, or maybe I'm projecting, but I think most relationships would be just fine.
Well, he is empathizing... just not with his wife. :-)
Oops, something I'd fixed was accidentally reverted. You should see working links again in ~5 minutes.
"EXTERMINATE" -- Dialek.
Misleading headline alert: the hinted particle is two quarks and two anti-quarks, which is not quite the same thing as "four quarks" (which would be _very_ surprising because four is not a multiple of three).
Previous discussion: https://news.ycombinator.com/item?id=4162519

(submitted back when GitHub Pages were served from *.github.com)
Find password for any GMail Account
Section 702 was written, and has been interpreted, to have very few restrictions.

1) It bars the NSA from collecting data on people unless "reasonably believed to be located outside the United States."[1] Data can be intentionally collected on any communication that has at least one foreign recipient or sender.[2] The wording of the warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.

2) The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. [3]

3) The NSA does not define "collection" as actually obtaining the data or metadata, but as a human analyst viewing the data.[4]

4) According to Snowden: "NSA likes to use "domestic" as a weasel word here for a number of reasons. The reality is that due to the FISA Amendments Act and its section 702 authorities, Americans’ communications are collected and viewed on a daily basis on the certification of an analyst rather than a warrant. They excuse this as "incidental" collection, but at the end of the day, someone at NSA still has the content of your communications." [5]

If they realize that it is actually an American, they have no obligation to delete the communications and will continue to store it indefinitely.

The NSA has been written a blank check to do whatever they want, existing checks and balances are simply insufficient. Whether that is due to their interpretation only breaking the spirit of the law (but not letter), or whether this is unconstitutional, is up for debate.

[1] FAA 702.g.1.B http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...

[2] FAA 702.b.4

[3] http://www.washingtonpost.com/investigations/us-intelligence...

[4] https://www.eff.org/nsa-spying/wordgames#collect

[5] http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...
Excuse the prolix reply; I have a flight to catch.

As I wrote in my blog post, I have a lot of respect for Thomas. He's who I usually point people at when they want their code audited. I really hate reading other people's code and I trust Thomas (well, Matasano) will do a good job.

two different kinds of practical cryptography: cryptographic design and software design

Agreed.

Colin happens to work on both levels. But most people work on one or the other.

I'm generally writing for an audience of people who already know how to write software, but want to know something about crypto. So I take one as given and focus on the other.

modern cryptographic software developers work from a grab-bag of '80s-'90s-era primitives

Right, and that's exactly what I'm trying to change through blog posts and conference talks. We know how to do crypto properly now!

This is an AES CTR nonce reuse bug in Colin's software from 2011. Colin knew about this class of bug long before he wrote Tarsnap, but, like all bugs, it took time for him to become aware of it.

To be fair, that was not a crypto bug in the sense of "got the crypto wrong" -- you can see that in earlier versions of the code I had it right. It was a dumb software bug introduced by refactoring, with catastrophic consequences -- but not inherently different from accidentally zeroing a password buffer before being finished with it, or failing to check for errors when reading entropy from /dev/random. Any software developer could have compared the two relevant versions of the Tarsnap code and said "hey, this refactoring changed behaviour", and any software developer could have looked at the vulnerable version and said "hey, this variable doesn't vary", without needing to know anything about cryptography -- and certainly without knowing how to implement attacks.

Unfortunately, the population of people who can spot bugs like this in 2010's-era crypto code is very limited, because, again, people don't learn how to implement attacks.

Taking my personal bug out of the picture and talking about nonce-reuse bugs generally: You still don't need to learn how to implement attacks to catch them. What you need is to know the theory -- CTR mode provides privacy assuming a strong block cipher is used and nonces are unique -- and then verify that the preconditions are satisfied.
Oh dear gods no, I'm trying to put this debacle behind me. It seems every time I try to clear something up about this, two more stories come to life. The only winning move, as they say, is not to play. I'm counting on the semi-anonymity of my HN account here ;)
Yeah, no kidding. "Sorry, faceless NSA algorithm. I'll buy you a beer next time I'm in the same zipcode as the server that you're running on."
facepalm

I suspect this guy doesn't understand how this works.
A little collection of things redesigned by Sir Jony Ive
Seems like for some people you can never have enough, its like drinking salt water to quench ones thirst…
Aumentando a Durabilidade do Betão para 2000 Anos
I take a weeklong trip to San Francisco every few months -- a city with loads of Airbnb uptake. I used Airbnb for the first few trips and was happy with the apartments I rented, but I've stopped even looking at Airbnb because the booking process is such a pain.

Every time I've used it there's been 24-72 hours of back and forth with a host before I even know whether I can reserve their place. Often I lose a day waiting to hear from a host only to find out their calendar wasn't up to date and it's not actually available.

Hotels are more expensive, but booking one is trivially easy. That convenience is worth a lot to me.
Gabe Newell on Game Development and Perceptual Computing
Texas becomes first state to require warrant for e-mail snooping