skysight-inc/HackerNews huggingface dataset:
I think the thing this is supposed to be analogous to is carrying around an encrypted drive with your stuff on it. As in just trying to deal with the problems of not physically holding onto the drive (that is if there is client side encryption).

Basically what this would prevent would be data collection if you were caught in a web of general surveillance. I agree that if you're in a situation where a government is making a case against you you're fucked. But that requires specific targeting of you.
This: this is why I pay $20/month for NYT, even though I think that a random sampling of articles from Google News (representative publications from around the world) provides more signal to noise.
Does it matter? The null check is gone, so it achieves the author's primary goal.

Conceptually, they both say "update this field for every entry having this ID" and at a quick glance the code for each language looks almost the same.
I worked at one of the first companies to ship a program with OpenGL ARB Fragment Shaders, so yeah, we traded developer time for customer performance. Managing the code was an utter nightmare, and we developed a ton of custom tools to try to tame that beast. If we'd had something like LLVM available at the time, it would have been a godsend.

And yes, getting performance out of the video card was left up to us, and that was a beast.

I'd think the single most important factor would be the data you had, and the operations you needed to perform on them. If your business logic was amenable to FPGA, then it might make sense...
In fairness that's not very reassuring for the idea that an NSA analyst may decide to look at a U.S. citizen's traffic and then "whoops, let's minimize that".

I guess what I'm wondering is what are the supervisory controls that are put in place to catch and discipline an analyst who looks into warrant-required intercepts where it isn't a bona-fide innocent error? I.e. if you know the person is a citizen you shouldn't look at all (without getting a warrant), and if you don't know but find out in the middle of reading the data then you should stop and minimize immediately.

I can't so much as release a military member's pay transaction without having it looked at by a supervisor and eventually audited (likely by 2-3 different groups when it's all said and done). Are there similar supervisory controls in place here? Those would be good questions to ask to ensure that any such usage of the FISA is kept in line with the already quite-expansive spirit of the law.
I guess you're lucky/you win if you only ever get automated analysis :)
Earlier this evening I received a text message from a someone I felt I was starting to have feelings for. Probably just infatuation, but possibly something more.

Another text soon followed; one that was very affectionate.

In the 3 minutes between replying and receiving the apologetic '... I'm sorry that wasn't meant for you...' reply, I experienced a full range of emotions from elation to embarrassment — disappointment to denial.

It's a funny old life. I found this article at the top of hacker news 5 minutes later. Definitely struck a chord.
The point I was making is that the wording and capitalization could have been different to minimize the snark. I also think you were kind of hasty to label me a fanboy just because I expressed an opinion that you happen to disagree with. The world is not black and white - if I see snark in an article, that does not make me a fanboy.
> after all, Colin circulates the code to Tarsnap so people can find exactly these kinds of bugs. Unfortunately, the population of people who can spot bugs like this in 2010's-era crypto code is very limited, because, again, people don't learn how to implement attacks.

I disagree, I think there is so much code, including so much crypto code out there in open source projects that you either have to wait for someone explicitely reviewing this code or someone particularly interessed in this project to find it.

Otherwise on your other points, I don't disagree with your argument but I think it's more important in that order to 1- know the mathematical aspects behind what you implement 2- know how to implement crypto (by having studied different open source projects) 3- know all the main attacks at code level. Ideally one should have a good knowledge on these 3 points before feeling confident in his code.
The Commoditization Of SaaS
I wish someone would buy up the old Gemco building at the intersection of Boulder Highway and Sahara and do something useful with it. The last time I someone made a run at it the owners were apparently "waiting for a big hotel" to come around and buy them out for millions. What a waste.
This is highly dumb.
You'd think odesk would flag this as illegal...
What do you do when you get back?

I've done this (twice) but unless you travel with the intent of working remotely, you eventually have to make money, right?

That's the whole point of the super-wealthy they can afford to never work, so they get to live a permanent life of leisure.
SPARKON creates a digital "life in a box."
US used to be the gold standard in democracy and justice.

The US also used to have a gold standard for currency.
I'm pretty sure you didn't actually read most of this article.
The answer to things like the Pidgin configuration issue you mentioned could be https://tails.boum.org/ -- a live USB distribution that runs all traffic through Tor, and comes with Pidgin preinstalled and preconfigured. It has optional encrypted persistence too.
Can't cryptography be both a science (or branch of mathematics) and an engineering discipline?

The science part of it will continue to provide methods of greater robustness and security, laden with increasingly better and broader security proofs and properties.

The engineering side of it will continue to seek and cling onto any slightest toehold afforded by mis-steps in design, implementation, protocol, all the way up to UI. Much of this is not, at least pre-emptively, subject to mathematical analysis.

This seems to have been a recurring theme for as long as cryptography has been around rather than some specific aspect '90s vs '10s crypto.
AFAIK it's just the name that's left.
A few quick first thoughts, having just flipped the switch. I think the description and website fields should be click to edit (and the labels need to be wired up). And I'm not a fan of the increasing emphasis on % LOC by programming language - this seems like an extremely low value metric to be so prominent, and a terrible way to distinguish between repos!

I'm looking forward to digging more into the redesign in my usage of it today. Glad to see GitHub continuing to improve and happy to re-think the current state of the app.
exactly. this is so stupid, it has to be a joke.
This?

http://www.latticesemi.com/products/developmenthardware/deve...
here's a few good reasons why it's hard to make easy-to-use vendor-neutral FPGA tools:

- all the devices/bitstream formats are proprietary with little or no documentation of the logic blocks or programmable interconnect structures. it is probably technically easier to build a new FPGA from scratch and design tools for that, than to reverse engineer existing chips [1]

- there is very little cross-compatibility between vendor products (a 4-lut here, a 6-lut there, some carry-chain logic here, a DSP block there)

- all the optimizations (synthesis, place-and-route) are NP-hard problems

- sequential imperative (C-like) thinking is not the correct way to make parallel systems

- the FPGA vendors compete on tools and offer their software for free to push hardware. hard for an independent vendor to compete.

[1] some reverse engineering efforts exist. see "From the bitstream to the netlist" http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.117... / http://code.google.com/p/debit/
America is overrated
Michael Ginsberg: "I feel bad for you."

Don Draper: "I don't think about you at all."

(The irony of this line is that Draper, in fact, was obsessed with one-upping Ginsberg the whole episode.)
I don't think this is good advice for the developer population at large.

> Sure, it's complex and you have to get all the details right

What's really dangerous about cryptography (someone on HN pointed this out a few weeks ago) is that you get very little feedback on this. It's very easy to take reliable primitives and build a broken system. When I say "broken" I don't mean "theoretically vulnerable" - I mean "game over".

I get paid to look for these bugs, and they are legion.

> so for developers, I recommend a more modern approach to cryptography — which means studying the theory and designing systems which you can prove are secure.

The average application developer does not have the time or the need to learn the theory at a deep level. And as before, it's very difficult to say with confidence "this design has no bugs".

The best advice I can give developers is to play very conservatively. Our default recommendation is PGP for data at rest and TLS/SSL for data in transit. Or some high-level library like KeyCzar, NaCl, etc.
Scores of vulnerable SAP deployments uncovered
Somewhat true.

I think the OP is targeted at programmers en masse. So, if we were to pick majority of embedded programmers and see if their application would benefit directly from an FPGA, I'm fairly certain my previous post would come in to play.
San Francisco Coffee | It's not rocket science
Interesting. I search within a repo (for code or issues) 95% of the time! It'd be interesting to know what their metrics are for usage of the search bar.
I would indeed be concerned if everyone around me really lived in a bed of lies that deep.

I don't have many friends, but I have no reason at all to suspect that I wouldn't still have those friends should such a thing occur.
They need to improve the local schools. This is by far the largest barrier to recruiting real, stable, sustainable talent to the area.
What's he going to do when he comes across a problem where these is no library that solves it?
A handy CSS3 Button Maker
You should be able to. The SoC used for the Parallella is a Xilinx Zynq-7020 which is available on various FPGA dev boards too.

The Parallella will use some of the FPGA for various glue logic, but the code in question either is or will be open sourced - they're being very good about opening up whatever they can (since their goal after all is to get people to build stuff that'll drive orders for their chips going forwards)
Learning how to implement crypto by studying open source projects is a recipe for getting people's sites plastered across Pastebin.

It is exactly this 1-2-3 approach to learning that I was thinking about when I wrote the fateful tweet. How do you evaluate whether software is making proper choices? Why do you assume popular open source packages are secure? They often aren't; in fact, they're broken in meaningful ways more often than not.

It's the engineering equivalent of a game of telephone; you copy the errors of the systems you crib from, which are multifarious, and at the same time introduce new ones because human nature has you working hard only so long as there's a payoff, and 99.999% of the payoff in this approach happens once your system round-trips properly; you miss all the subtleties that happen after round-tripping works.

So yeah, don't do it like this.
dorky
However, it can also be said that the wording in these phrases was so masterfully written that they allow for the meaning to evolve.
Are they referring to FPGAs in a mass-production/manufacturing sense or for the hobbiest/garage hacker?

I guess I'm unsure why I would use an FPGA over say an Arduino microcontroller.
I think he was referring to the beer drinking/rock throwing/etc...

A few calls to the cops to report unruly behavior, and a letter or two to the homeowner may have been enough to get the homeowner to be more vigilant in controlling the tenants, or would encourage a return to longer term tenants.
Czech PM Petr Necas resigns over aide scandal
So beautiful. Reminds me of when I was 13 years old.
What It's Like to Work Inside Jack Dorsey's Brain
Good idea, I just wrote a Chrome extension: https://github.com/olalonde/gh-globalsearch
But the NSA can certainly listen to his wife's calls... many of which may include him as the other endpoint. This is an obvious edge case even if this legal smoke-screen offered any actual protection, which seems unlikely.
I don't even want to think about the beers I'd have to buy if a human were to be tasked with reading what my 20 yr old self thought was important enough to bray about in 1992. I shudder to think.
http://xkcd.com/1053/ !
Another Streisand Effect iteration, try: `the broken symmetry of information entropy conservation', further on, there may be some grand law/theorem you could adapt from information theory where this asymmetric abuse of total surveillance of private information will have systemic catastrophic conservation-requred unpreditable and unintended consequences.
How about measuring the ability to even book a place in a city like NYC? I recently tried to find an apt for a 4 day stay in manhattan with my wife. I contacted 15 places on airbnb. I've got all the reputation stuff filled out. I've used airbnb before. I tried only contacting places with a history of good response times. I even upped my max to higher than a hotel room. $300-350 a night.

Number of responses? Zero.

I love the concept, but the reality is much different than everyone makes it seem.
It being "hard" shouldn't give them a pass on quality control. From the early Project Navigator to ISE to Vivado, Xilinx tools are buggy, poorly documented, and completely unintuitive. Yet, they're still better than Altera's.
True, some language features can indeed make defensive code bit less verbose, but I believe their value is overestimated. My approach in C code is usually to assume no pointer argument is permitted to be null unless explicitly stated, and to not add null assertions (since if is null program will most likely crash which serves the purpose of the assertion). I don't remember seeing a null dereference bug in my code within the last year.
I prefer bit bucket but my job makes use GitHub.
I suppose we have to read it like this: Bush says "It is illegal for us to torture, therefore whatever we are doing cannot be torture"... Obama says "It would be illegal if we spied on US citizens, so, whatever we are doing isn't spying on US citizens".
I understand you were not being definitive and I doubt very much that people would disagree that Cheney is a better person than that rapist given the same ability to effect the world.

Having said that Cheney had a lot of power and a lot of impact. In relative terms the alternative to Cheney in power does not need to be much better to result in an absolute impact greater than the 4 lives affected by that rapist.

My statement was meant to point out that the absolute rather than the relative "evilness" of him is a viable reason for some to hate him.
You evolve the meaning of a phrase when you decide that a digital Word document on a USB key is a "paper" within the meaning of the 4th amendment. Changing something fundamental like the scope of rights in the document, changing it from a social compact, a contract among a community of people, into some universal statement of principles applicable to anyone isn't evolving the meaning, it's rewriting the document and an exercise in historical revisionism.
It's because one has a decision to drink, smoke, or buy a pool. One doesn't get to choose if they will be shot.
The Bond, James Bond effect
Inspired in a Google I/O talk, I uploaded this effect for everyone to see. Cool.
Help
Dear Jay Freeman (saurik),

The file "/Library/MobileSubstrate/DynamicLibraries/WinterBoard.dylib" of the your product "WinterBoard" has possibly caused a crash. Please find the relevant info (e.g. crash log and syslog) in the following URLs:

http://pastie.org/pastes

Thanks for your attention.

/* Message generated by CrashReporter - cydia://package/crash-reporter */
All very fair points. I'm not sure if it's even possible to get the kind of necessary supervision. I'm just pointing out that the law isn't facially ridiculous, even if it might create structures that are practically unworkable.
This book is one route in. It's intended for those who've programmed before but not necessarily with functional languages. I suspect intros to any of the functional languages would be fine (e.g Haskell, Scala, F#). There's even a Coursera course on Scala.
Agreed; though I could imagine some unfortunate situation where the cells of the creatures themselves are unusually sharp, for some selective-pressure reason, and able to withstand more acidic pH (it was in salt for a long, long time), and combined, those cause problems in a person, like asbestos but for the intestines.

More biologically minded people would probably roll their eyes at my idea, but it's what went through my mind and wanted some input.
He has a blog.

https://michaelochurch.wordpress.com/
> 8 vs 12 for the cost of that just isn't going to be worth it.

Which makes it exactly about cost. It's not worth it for that difference. If it was 10% more would you pay it? I would. But being 5x, 10x, 20x suddenly makes it too expensive. I'd rather pay less than get there that fast.
Actually controlling what's being aggregated. There are times when sourcing intel from the crowd is nice, but at the end of the day I still want to be certain that i've received all of the (periodic) updates from specific sources.
To illustrate that this is not iteration, assuming the existence of a DataSource class with a private find_person(id) finder that returns either a person object or nil, the method being called here could be implemented thusly:

class DataSource

def person(id)
p = find_person(id)
p && yield p
end

end
Additionally, imagine them reading a stream in real-time -- they could still certainly analyze passing traffic - and keep a ticker of flagged items, by type, rather than "collecting"
Because you choose the news sources and you see everything they publish on that particular feed. A good example here might be the blog of an open source project that you rely on. They may make a post every month or two when new releases are made. You care enough that you want to be aware of the post, and you know it's unlikely that you'll see it on HN, but it's not urgent enough that you need an email.

Another good use case is webcomics. You like to read every new xkcd when you have time, and you don't have to worry about loading the page and not seeing any updates. Friend has a blog or tumblr that you feel obligated to follow, but you don't want to ever have to load it up and see stale content? RSS is perfect for that. Like reading David Brooks when he has a new column, but wading through Paul Krugman and Maureen Dowd is a chore? Just subscribe to the RSS feed on his author page.

It's also useful for other things, for instance jungle disk provides an RSS feed for backup jobs. So do many bug trackers.
The NYT reported in 2009 that an analyst was disciplined for snooping through former President Clinton's email (or attempting to).
I would suggest that advertisers and their cronies stop acting like scumbags unless they want to be treated like scumbags.
You don't need to guess. It is explained in the FAQ.

"We just want the ability to create issues in one specific public repository, but the minimum privileges we can request from Github are the ones you see when you login."

http://www.realworldocaml.org/#faq
Well, at least people are belatedly realizing this, even if the government had to be the boogeyman that hackers/Facebook/Google/malicious ISPs/Mallory were not.
I had never used Altera. It's sad to hear that it is even worse!
I'd actually suggest Montaigne, if you haven't touched him already; this is a good intro:

http://www.amazon.com/How-Live-Montaigne-Question-Attempts/d...
Show HN: TweetClock.io. Schedule tweets for announcements. Built w/Ember.js
-as we know it.
But that does not address the fact that according to the GDPR in its current state, a company such as Google should not have the authority to process EU citizen's data unless it's fully compliant with GDPR.

How they're going to enforce that, I have no idea. Now if I've understood this correctly, this means that if a foreign company is fully complaint with this new law, we would have much greater access to data that is being collected, and we also have the power to request the removal of said data. The US government might still collect all those incoming data before it has the chance to be removed, but having a law such as GDPR being enforced would be a huge step forward.
Read Life Kung Fu Bear. Sorry Not a Panda
Yeah that's always your mantra, I'm glad for you that you inherited your skills from god and think nobody else is able to dicern good code from bad code, well implemented crypto, from badly implemented crypto. But I dare to say that for instance it doesn't require to be a genius to know the quality of DJB's code and only by studying how it is implemented I think you'll agree with me that it's possible to learn a lot. In this day and age there are several open source projects with a good code quality I think. And I don't assume anything on open source projects I only say that knowing who wrote them I know I can expect an overall good quality, but even in this case you still can keep a critical eye. For instance I don't know much on pairings, so the first thing I would do after reading the theory, I would try to find a decent library implementing it, just to learn a bit more, it does not engage to anything.
Thank you for helping me decode the double-speak. I had previously read that "collect" had a specific meaning for the NSA, but I'd assumed that meaning also made sense within the context of the English language.
In other news, "UK internet providers reject default porn filters" - http://www.bbc.co.uk/news/technology-22934600

It's almost like you can't believe everything you read online. I'm shocked.
Dc is primarily made up of takers, Sf is filled with doers. Don't mistake the fed govt parasite contractors for true hackers, it just ain't so.
DRM of the future: individualized e-books?
Hmm. I may or may not be an A player, but you've just communicated to me the distinct likelihood that you are not hiring me for the/an A team.

I'm a bit torn in making this comment, as I've seen my share of employees who depend upon inertia to be real 9 - 5 (or, 4:45) types who don't give a damn about the state of things when they walk out the door.

But if "crisis mode" is a significant enough factor to become a primary interview question and topic? You're not doing it right.
I moved one of our smaller projects over to Altera because they were first to 28nm plus the local Altera team was willing to help out with porting any device-specific code.

I was very disappointed with the tools. It's worth a write-up all on it's own, but my staff struggled through the tooling which consumed most of their time.