skysight-inc/HackerNews huggingface dataset:
"Crypto can't be a «bit broken». It can't be «mostly working». Either it's 100% correct, or you shouldn't have bothered doing it at all. The weakest link breaks the whole chain."

I completely agree. Ever seen a password hash mega-post on paste-bin? Bought to you by bad crypto. Saying "I don't
know" is one of the hardest things to do, and also one of the most powerful. I applaud you for knowing your limits in this regard. I like to say crypto is like surgery, best left for the experts. You never want to "I kinda messed up that triple bypass," because there are major consequences for it. The same is true for virtually all aspects of cryptography. Thank you for this post!

Edit: Here a link to a blog post that was discussed recently on HN that is pertinent: http://www.daemonology.net/blog/2013-06-17-crypto-science-no...
All I Ever Really Needed to Know I Learned in Kindergarten (and at MIT)
I almost choked when I read Microsoft's new mission statement: "our strategy will focus on creating a family of devices and services for individuals and businesses that empower people around the globe at home, at work and on the go, for the activities they value most."

In other words, Ballmer wants the company to "focus" on being everything to everyone!

Not a good sign for the business.

--

PS. Compare Ballmer's long, complicated memo to Google's mission statement: "to organize the world’s information and make it universally accessible and useful." (Source: http://www.google.com/about/company/ )
There ought to be a good set of FOSS unit tests for those who dare implement their own crypto. For instance, you let it hook in to your PRNG, and it'll tell you if the output is random-looking enough.

It wouldn't be a panacea for bad crypto, and it does create a risk of people thinking "oh, it passed all of the tests, it must be secure," while still implementing it overall incorrectly. But I still think it would mitigate these "foolish/easy" errors and allows devs to focus on proper overall implementation.

Or does something like this already exist?
It needs some sort of fallback for search results or it's useless to a specialized user. My Google search history looks like random bits of consciousness spread out across months. Half of those search terms bring 0 results on Blippex, and while I understand that they're early, it's hard to beat something like PageRank when it's already got established experience.

It's a catch 22: the results won't get better unless people use the service, but people aren't going to use it if the results are bad in the first place. If I install the extension but use Google, it's a one-way relationship that only they get data out of. Not very good for me.
This is the kind of tech Bump needs to get on -- auth and identity management. They showed a way a while back to upload an image by "bumping" your phone on your keyboard. Since phones are singular and ubiquitous and have their own identifiers, your phone could essentially become a makeshift physical key. You could log into any machine, public or private, with a simple "bump" of the keyboard. So Bump, if you're listening, create a Bump Auth.

Of course if you lost your phone or someone stole it, that would be problematic, but I don't anticipate you'd use this as a way to log into your bank account.
It's not about performance gains; it's about making it harder to mess up. C-style for loops are easier to get wrong. (Try iterating backwards from 10 to 0 with an unsigned int loop index in C; most programmers get it wrong the first time due to underflow.) They are also more vulnerable to race conditions. (See "race on loop counter" at [1]; with first-class iterators you can create a separate binding for each iteration of the loop, eliminating this problem.)

[1]: http://golang.org/doc/articles/race_detector.html
The worm that regrows its head, and memories, when decapitated
> A little known fact is that if you wrap Java/C# code in enough unit tests you get Haskell.

It is enough to make you want to switch to a pure message passing system, isn't it?
You sir, are mistaken.

Communism didn't offer a basic income. People were paid for doing works at jobs. Which everyone had. The constituion of communist Poland even listed having a job as a citizens duty.
Dotcom’s Mega Debuts Spy-Proof Messaging This Summer, Email Follows
I'm not sure that is completely fair. He was just making the point that using only your keyboard is much faster and there are already built in tools for doing that. He may have just been asking why someone would want to use a mouse over a keyboard for this type of thing.
Much easier on a smartphone managed with MDM. Some of the MDM platforms even include a pre-configured CA.
Is half the Security industry just attending conferences? Seriously.
1) The numbers don't work out. Even a very steep CO2 tax will produce too little revenue for any form of meaningful BI.

The USA currently consumes about 450 billion gallons of petroleum products per year, which is about 1.5 trillion pounds. We also mine about a billion short tons of coal per year, which is 2 trillion pounds. We have about 300 million people.

Taxing $0.75/pound on carbon fuels would generate a bit over $6k/year per man, woman and child. That's $4.5/gallon. This is enough to put a family of 4 at about $25K/year in basic income, which is just above the poverty line this year.

There is enough revenue. You just have to accept a higher tax.

2) The money collected on the CO2 tax could also be used for a general tax cut. So you still have the political problem of explaining to working middle class why their money is being handed out to lazy bums.

The middle class receives the money as well. This kind of program - where everyone pays and everyone receives - has proven very popular in the past. See social security for a demonstration.
I'm the author of this post which I have written in 2008. Since then my views have changed a bit: for one, the added security is debatable as the client cert is easily accessible to malware and thus could easily be stolen.

The other thing is that renegotiation is somewhat broken since that related security flaw in 2010ish, so you can't have parts of a site accessible without client certs and other parts requiring a cert.

This has been fixed since, but I don't know how well it's supported by clients.

Finally, compared to 2008, we're using many more devices for accessing various web applications now. Having the client cert bound to one browser on one machine is annoying and synchronizing it truly securely is probably impossible.

I do stand by the horrendous UI though. Even if the other issues weren't there, the UI certainly kills client certificates for normal users.

Then again, crypto UI is hard and I'm afraid the incentive for redesigning this is pretty much zero because nobody is using it to begin with and because it's flawed anyways.
I have a theory as to why. Discourse on serious discussion on such topics, which are scientifically unsolvable (design, business, entrepreneurship) are often deferred to those who have 'been there, done that', which of course is a logical bias.

So to the humour. The issue is HN can't tell the difference between satire of itself and real advice. Each of which is probably equally valuable. Nobody wants to hear this. They all want to feel good. And get rich! And have authority!

Humour has no place here...
3) overleveraged banks with colossal principal-agent problems and insufficient transparency or supervision
It's pretty striking that a media organization which has almost no restriction on the words it publishes would characterize a torture program that included 183 waterboardings and 180 hours of sleep deprivation as "harsh interrogation"
At least a small timing ckt to flash the IR blaster in regular pulses. Your method would be more useful, but it would require adding a speaker to each remote.

Both require radios of some stripe, though. At that point, you might as well get away from the IR transmission method completely.
> "The new method requires so little energy that it can run on a store-bought battery."

We currently have techniques that require no additional power (just using the sun), but almost every desal operation uses a powered method.

Power consumption isn't the only factor here. A low power technique that has throughput per area equivalent to solar stills is just worse than all available alternatives.

If you made a device that turns the briny sludge byproduct into fuel or some other consumable, that would be amazing.
Inaccurate article! `for {}` in Go acts like a `while (1) {}` loop in C, but the article claims that another form of for loop is the "final form of for loop" for Go.

Otherwise well written and enjoyable.
The biggest benefit I find from using Linq is readability. It allows the code to express what it is doing rather than how it is doing it.
Compare:

foreach (var item in list)
if (SomeCondition(item)) return item;
return null;

vs.

list.FirstOrDefault(item);
That's what happened to me too.
I had a similar idea in college which was to take the actual traffic for pages into account for search ranking (this was before Google bought whatever Analytics had been called before, I can't remember.) I had thought of it as a server side app which would benefit the hosts while feeding the search engine traffic data.

After talking with friends we explored the idea of a user side traffic tracking app as a way to feed the search engine, but I couldn't get enough traction and no one wanted to challenge not only Google but also IE/Firefox/Safari etc. because we felt it would be its own browser.

Alas.

Now a days I am more concerned about possible privacy issues, I feel for them launching a search engine that actively asks you to be tracked (even if anonymously), it's a hard sell during this current resistance to that entire idea.
Indian access to BIS is nothing new. They've been doing that since at least 2011. This is BlackBerry Internet Service, where the mail infrastructure is partially controlled by RIM. As far as I understand the BlackBerry Infrastructure, RIM can't give access to BES (Enterprise) Servers.

Even if you're not part of an enterprise, you can run a BlackBerry Enterprise Server Express at home or in a datacenter. With your own encryption keys protecting communication between the phone and your server. In order to grant access to the government, RIM would have to steal your key. Possible, but unlikely. Security is one of the few reasons why RIM still ships phones.
This isn't an agile startup here, it's one of the world's largest software companies. I think aiming to do a lot isn't a big stretch.
Working with Typed Arrays in Knockout.js
>> This has been an abomination since .... the functionality was added. It's hard even for geeks to deal with it - it makes 0 sense for non-techies to even contemplate dealing with it.

Are you criticizing the concept or the implementation?

Conceptually, for a user to maintain 1 or 2 "identities" on a machine seems easier than maintaining 50 "logins", which already require a password manager if you're using reasonably hard passwords.
What is the advantage of doing this in terms of "income" and "currency" rather than in terms of "rations" and "allotments"? Is it a purely rhetorical difference?
It's not just a matter of perfection in the field of programming. It's an entirely different field that happens to involve some of the same things and ideas. Just because you're a driver, it doesn't mean you're a qualified mechanic, and if you're a mechanic, it doesn't mean you're a forensic crash investigator. They are related in terms of subject matter, but they are not equivalent skill sets.

As programmers, we are dealing with interfaces and movement/copying of data. Security deals with epiphenomenal leakage of access and data. It is not programming, though it involves programming.
This particular hospital is catering to the high-deductible crowd, so that's why I put that one in there.
Another way of interpreting this would be "Microsoft wants to get out of your way, it wants to be a (ubiquitous) platform so you can focus on what you're actually trying to do rather than on your OS or your device." Doesn't sound that awful to me.
A Universal Database of Dreams
Then you might like its big brother: iterate.

http://common-lisp.net/project/iterate/doc/index.html

ITERATE is more powerful than LOOP and extensible.
I'm sorry for the offtopic, but on a page that's supposed to get people involved, shouldn't you at least mind the difference between its and it's? In the very first paragraph it goes wrong already. I'm not a native English speaker, but these mistakes always jump out for some reason.
> A certain percentage of the population would stop working entirely since they no longer need to.

Everyone I've ever seen argue this has had strong opinions about how other (more greedy and venal) people would act. They, of course, would still work, but the great unwashed masses would sit on their backsides and take the money.

I suggest, instead, we try specifics. Given a basic income, I wouldn't be lazy. Nor would anyone I know, which includes some very poor people who would love to work if they could only do better than on benefits.

I suspect (though I don't know), that you wouldn't be lazy, either.

Also, the evidence of limited trials is that this increases work, not idle people:

eg http://www.bignam.org/BIG_pilot.html

> The BIG is a form of social protection, which reduces poverty and supports pro-poor economic growth.
If the BI is high, quite a number.

The question is whether there's (1) something they can do that's more valuable than watching TV and (2) some reasonable way we can motivate them to do so.

If (1) and if a lower BI is an effective way of motivating that behavior, then that's a good argument for a lower BI. It doesn't follow that the optimal level is zero. I don't expect the number that would stay home and collect their $1 of basic income would be substantially greater than the number that currently stay home and collect their $0.
Don't really see the point in getting another Motorola phone. I paid a premium for my Photon, and it really annoys me every single day with how long it takes to wake up and actually do something, and how often it crashes. That might be due to the fact that I have no choice but to still run Gingerbread, because Motorola decided to lock the Photon to that version.
The technology part is interesting...

But I think this paedophile hunting behavior around the world is going very absurdly far, and causing more damage than fixing things.

If you want to get real problematic people, go get those Haliburton guys kidnapping girls below 10 to sell in Africa (yes, that not only happened, it is still happening, the US government decided that their service is more worthy than the problems they create).

Chasing a few amount of people that chat to minors, or like lolicon, or like even movies of real people, is better to catch the wrong people than to do anything of good.
Headlines of tomorrow: "Paedophile entrapment bot first in history to pass Turing test"

Future AIs will have a predilection for Bieber and meeting with strangers.
Mastering The Elevator Pitch
Doesn't work at all without cookies. Meaning, it doesn't work, and doesn't tell you why. If you're targeting people who are looking for an alternative to the major search engines, there's a better-than-average chance that they'll have cookies disabled.
> there anything else missing?

You named more than I detected.
How about adding a viable business model that brings you some constant money in? I mean you are a really good startup, why don't you ask for VC funding or Enterprise Sponsors?

Maybe a solid and good marketed Kickstarter Campaign that will realize something that people would love to have (I don't know what that is though).

Or adding an integrated Marketplace like http://www.concrete5.org/marketplace/ that seamlessly integrates into everyones Tree.io so that devs can sell their addons to end-users directly within their own install + you get 11% for every sold license. End-users can point, click and pay.
What happens if multiple bots are active in the same room?

Reminds me of the classic Monkey Dust sketch: https://www.youtube.com/watch?v=APG0rNedEwk
Show HN: FlashcardBox - Flashcards on the go, using the Leitner System
Hi guys, here is a small Node app I built that uses the leitner system (http://en.wikipedia.org/wiki/Leitner_system).

The submitted example holds the 100 questions you need to study for the U.S. Immigration Exam (for New York State).

Any feedback/ suggestions welcome :)
This is the most ridiculous thing I've read on HN. Also, the personal attack was real classy.
Thank you for the find, we will fix it!
I was taking the term to the most extreme literal meaning, yes. Because to me, if a netbook is not designed almost exclusively for web-apps, it's not a netbook. It's an ultra-portable laptop, a category that has been around a lot longer than the EeePC.
Those who don't understand history are doomed to misinterpret its lessons.

Do you remember the OSI binary protocols as designed back in the day?

ASN.1 as far as the eye could see. OIDs. MIBs. Loosely defined extensibility. Terrible, complex protocol designs.

This had nothing to do with the protocols being binary or text; the protocols themselves were painfully complex, making it difficult and frustrating to write a working implementation, much less a complete and interoperating implementations.

> ... at this layer the efficiency does not pay off (i.e. the size of the HTTP header leading that 5MB image does not really matter).

"I don't care about RTT time, the lack of bidirectional communication, and the inability to inline binary data in the protocol stream" ... said no mobile/wireless/desktop developer, ever.

> One of the comments here pulled a comparison I did not remember any more: SS7 vs SIP.

I've implemented SIP. It was a massive hassle because it was text-based and annoying and difficult to parse. The available SIP libraries tend to be buggy and incomplete, and people actually pay for workable SIP stacks. I'd rather not look at SIP ever again.

That isn't to say SS7 is better, it doesn't appear to be. As far as I can tell, that's because it was badly designed, not because of a flaw inherent in using binary encodings.
When I click on the https padlock on this site, chromium shows me 1 ycombinator cookie and 0 third-pary cookies. In 2 clicks I can block the cookie, if I so choose.
It's not just algorithms. Implementing the algorithms securely is also hard. Even using libraries implementing algorithms is hard.

Actually, most problems are at the security protocol level. Implementing those is the hardest.
> defending mass surveillance by them is not incompatible with not trusting you with one's email account.

How on earth can you make that argument? Ostensibly, by giving him the credentials you trust something to keep your privacy private. With the feds, you have no choice.
You could do that on a Lisp Machine, too. Symbolics sold a complete interactive animation and game development system. Nintendo used it in the early years. The software later got ported.
Yes, market forces can only be controlled by getting rid of the market. At that point social forces will only be materialized through physical force.

The difference between a socialist and an individualist is in how they think the physical force equation (applied to the society in which they live) will work out for them.
Circumventing Invasive Internet Surveillance with Carrier Pigeons
How to patent your idea? Interesting presentation
I've lived that situation.

In dysfunctional organizations people are sometimes not allowed to talk across org silos. It's horrific.
It's not a mission statement though, or a goal.

"We're a company that does stuff for customers."

Yeah, not helpful in the least.
Well that was a quick response, at least that's a positive thing :). I installed the add-on. Testing the search engine, searches seem to take forever. It keeps displaying the spinning icon in the orange square next to my query.

Edit: Ah the niceness of asynchronous javascript. It returns an error (I can see it in the JS console) but the page never displays that to me. Good ol' page reloads wouldn't have done that </rant>. In any case, the issue is my header modifying add-on. It injects "'\ into the x-forwarded-for header, causing your application to error. You probably have an sql injection in your code somewhere.

If you want to track the issue down, my IP is 83.161.210.237 or 2001:980:1f44::/48 if you support IPv6. Timestamp around 17:51 UTC+2.
8 Interesting And Really Helpful Vim Editor Features
A Plea for 'Close Learning'
The problem with this is that it's basically asking to be manipulated.
"confirming or denying the very existence of a vacuum cleaner design, a Swiffer design, or even a design for a better hand towel would apparently expose the U.S. government and its citizens to exceptionally grave danger"

Is he being serious?
Blippex don't use any cookies, neither the API nor the website. We don't store any data from the people accessing Blippex.
Yes, I meant to say Odin, sorry. Thanks for the correction.
> Concurrency is a control flow concept.

Couldn't agree more. Also a list of all flow control constructs that doesn't include destructuring pattern match ain't a complete list in my book. if and switch are just special degenerate cases of pattern-matching.
Using Node.js to Build Great Streaming Services
I was tempted to grab a ticket (they are reasonably priced), but then I remembered how much work there is to do.

One day, when I've got the money engines running, I look forward to socializing. ;D
Link appears to be broken:
http://www.crikey.com.au/2013/01/16/dole-around-the-world-ho...

The interesting part in the article is that in order to receive this payment, you have to be actively looking for work. Not sure how this is measured, but the qualification makes it philosophically different from the unconditional wage being advocated.
Well, in 0.7 the external iterator `each` pattern is mostly gone, leaving external iterators the standard style, but because the semantics of `for` haven't changed yet, there is an `advance` method provided for iterators, such that the code is actually at present thus:

for [1, 2, 3].iter().advance |i| { /* a closure */ }
Why on Earth did the Cryptochat guy write his own cryptography functions in the first place? Couldn't he have used the Stanford crypto JS library?
Why Consulting Is A Job Everyone Needs To Experience
Excellent point; I wish I'd thought to mention that. I spent a few years as a CISO, and honestly, I know that I really want anything to do with the security industry again, outside of making sure that systems and apps are as secure as I can make them.

Why? Because security is a lot harder than most people recognize. Blowfish is an excellent symmetric encryption algorithm, but, as you say, it would be easy enough to implement it badly and end up with insecure, trusted code.
I think its a general enough statement you can say whatever you want about it and it would make some sense.

That said, it's seriously lacking intent. Being everything to all people, all wrapped up in a single 'strategy' isn't necessarily going to solve the problems related to designing and building great software.
That'd be a whole lot more expensive, not meet people's individual needs as well, and have more opportunity for corruption and abuse.
Being as its Levar...

His famous role was in Roots as the slave that kept getting lashed for not taking a proper English name from his owner over and over if he would just say his English name...

So its more than a little ironic that THIS actor makes a video about how to be properly submissive to his mas'ers!

It just sad that he would have to make a video like that because most of his TV time has been spent reading books to children. He's about as threatening as Mr. Rogers and still gets the jackboot.
> posing as a 14-year-old girl to spot paedophiles

Something tells me they don't really know what "paedophile" means.