skysight-inc/HackerNews huggingface dataset:
I'm torn on the national security implications of Snowden's disclosures and the creep factor, but what he did certainly have prompted an important conversation and it seems like he's been reasonably responsible with what he discloses. What a contrast with the Wikileaks diplomatic cable disclosures- blanket, sloppy, and in the end not that important (though it did make life harder for a lot of career diplomats.)

Again, I'm really torn on what Snowden did, and maybe I'm just one of the "naive sheep" cowering in fear from Them blahblahblah, but I really, really don't want any explosions slipping through as a result of it.
Why use the .val() method with the jQuery test, but .text() for the minified test?
If you could social engineer an employee to change a voicemail number, you may be able to convince them to port a number to a new account.
was about to post the same. Request policy + noscript ftw
I've been a Perl fan for years and I really enjoyed using the language in my personal projects (and in a couple of professional projects, it was "the secret ingredient"), but I couldn't fight all the prejudices surrounding Perl; so I finally gave up and learnt Python hoping to find a quality job as software developer.

It worked out pretty well and I found a great job. I love doing Python, the community and the culture behind the language, so I've never looked back.

I get contacted from time to time by recruiters looking for Perl developers but the truth is that it is still less frequent than Python; and now I don't have to explain that you can use a powerful language in different ways and that it's up to you if your code is readable, maintainable and easy to deploy.
Agreed. If BOTH are required than even if the second factor is relatively weak, it's still better than password-only.
PHP has a database abrstraction layer built into language that offers support for postgres in addition to a couple of fairly popular abstractions / ORMs / other alternatives.

This has nothing to do with either language and everything to do with the projects themselves. Stop dissing languages based on the distant past, especially not when using Perl.
"delivering 8 μJ pulses of 280 fs at 200 kHz repetition rate."

8.0E-6 J * 2.0E5/s = 1.6 J/s = 1.6W

So, this laser outputs 1.6W of power (in very short pulses, but that is irrelevant here). Let's assume a LED powered laser. http://en.wikipedia.org/wiki/Energy_conversion_efficiency gives, optimistically, 35% efficiency for a LED. That would mean a single-laser version would use 5W, a 100-laser one 500W of input power.

=> Some improvements are needed before this replaces hard disks at home. We'll see whether there is room for that.
Test this, you might be surprised. I strongly doubt it, because there are so many versions in use, and as of 2012 only 25% of jQuery sites even used Google CDN, by far the most popular CDN — most hosted it elsewhere. http://royal.pingdom.com/2012/06/20/jquery-numbers/

I have vague memories of reading a post with a stronger conclusion — that CDN caching was basically a non-issue, it would so rarely work — but to my frustration I can't find that right now.
Cultural explanations when the group of people make up a statistically small portion of the incidents == bad.

Cultural explanations when the group of people make up a statistically significant portion of the incidents == good.

The question as I see it is : Do Koreans make up a statistically significant portion of near misses and accidents?

From what I have read from various aviation professionals, the answer is yes. What have you guys heard?
certain companies get excited for the chance to have a "token woman" on their team

I've certainly been someone who has looked to hire more women in my engineering departments over the years, but I can't imagine why someone would do it for token reasons. For me it was about increasing diversity of opinion and balancing out the culture so we didn't hire misogynist assholes in the future.
PC World, 1983-2013
Here's the story of a banking trojan attack that redirected the victim's phone to authenticate large transfers:

http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...

Scary when it really happens.

(My blog post)
This was an easy choice for us when we setup two-factor auth for our app. We chose TOTP. The only real con (if you can call it that) is requiring the user to install a TOTP app (eg. Google Authenticator) but given our target userbase that was a non-issue.

Here's a quick summary of pros/cons:

TOTP pros:

* Assuming the initial secret is delivered securely (eg. HTTPS) no MITM vulnerability
* Free as in beer
* Simple to implement
* Instantaneous
* No additional personal information asked of user[1]

TOTP Cons:

* Requires user's to install an app or have a physical TOTP device
* Clocks must be kept in sync[2]

Phone SMS pros:

* Nothing to install assuming your user has a phone

Phone/SMS cons:

* Not free as in beer
* Could be MITM by telco or anyone with access to telco data (wireless scanner)
* Requires asking for the user's phone number
* SMS is *not* instant, could be minutes or more to receive a message

[1]: I don't like giving out my phone number and I assume most other people are like that as well. Less is more when it comes to sharing personal info.

[2]: Clock sync is really important. If you're going to do a TOTP implemenation make sure you run ntpd/ntpdate to keep your clock in sync.
Number porting attacks have been used to compromise SMS-based auth in the past.

http://www.itnews.com.au/News/282221,phone-porting-used-to-u...
There are a lot of smaller technical trainings and conferences once you get to a certain level. I like to rate conferences by the technical quality of what is being presented. Am I constantly being blown away by new ideas? What can I use in my own projects to make them better?

At too many defcons I have seen nonsense panel discussions and presentations by people with little qualifications. Some presentations I have seen have obviously been created one or two nights beforehand. I've even seen a troll presentation where slides with walls of text were read word for word in a monotone voice.

I have no idea who this person is or how old this list is and I have not attended every one of these conferences but you might take a look at this:

http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm
An AngularJS Directive Warning
Basic 2 factor authentication doesn't even cover the scope of password resets, so the idea that 2FA is flawed when used in conjunction with cellular networks is a terribly unthought out argument. If any service uses a token reset code sent to a phone as SMS or voice message, then that service is using a flawed password reset mechanism using the idea that cellular networks are highly insecure, regardless if it's also using 2FA. _Any_ single authentication mechanism over cellular networks is flawed using the same logic. 2FA, arguably, is more secure over cellular networks because it requires an authentication mechanism (the password) that is not transmitted over SMS/voice cellular in a plain format (assuming the authentication itself is sent over TLS/SSL).
That still assumes you use session cookies at all. As I said, you can keep authentication entirely within the confines of the websocket connection, deliver only non-user-specific static assets over HTTP(S), and persist your authentication token client-side in localStorage/sessionStorage, thus avoiding cookies entirely. Which is actually the best practice for libraries like SockJS, since they rely on (and encourage the use of) cross-domain connections that can't see your cookies.

Of course, using localStorage (which doesn't have the equivalent to cookies' HTTPOnly attribute) makes the Javascript-injection attack even more effective--but that's a bit of an airtight hatchway problem[1]. If you already have control of the user's DOM, you can just make it look like they were logged out and phish their credentials out of them.

[1] http://blogs.msdn.com/b/oldnewthing/archive/2007/09/20/50027...
I think I can easily agree with that.

As a citizen of the US I have signed the petition to pardon Snowden (any activities related to whistleblowing; should there happen to be any actual spying or treason, that is excluded, but it does not seem very likely, imho). As a citizen of Russia (yes, both) I would be happy to sign a petition to offer him an asylum, however such petitions are not really part of the Russian political culture, if such a culture exists at all any longer.

Snowden could easily find job in Moscow, however it would be hard for him to stay private. And to stay away from FSB (or CIA, for that matter). His professional career also is going to be... interesting, be it in Russia or another place.
CodeSchool - NodeJS : Free Pass
I reached Level 4 for the "Realtime web with NodeJS" course, within 12 hrs of using CodeSchool. Here's a two day free pass to review some of their material.
Quotas: Because the best way to fight discrimination is with more discrimination.
How is "typical male-tech resentment for being called creepy" functionally any different for the female job candidate?

"No, he's not sexist, he just doesn't like women... for good reason!" "No, he's not sexist, he just can't talk to women... for good reason!" "No, he's not sexist, he just has seizures when he sees the color pink, and women are more likely to wear pink."

Who cares? The woman still doesn't get the job.

The excuses are equivalent to a student saying they deserve an A for trying hard and having extenuating circumstances though they can't actually do what they're graded on.

People take "sexist" and "racist" to describe intent. I don't give a s(*& about your intent. It's the effect that's relevant.
Engineers do not build infrastructure projects. They design them and supervise. I am talking about the people who can actually do welding, plumbing, construction, etc.

Its not exactly easy to get foreign workers into the US to do vocational work. Projects around the oil fields in ND are delayed or cancelled because of a lack of workers. Heck, the oil companies are currently recruiting in Canada.
High-fructose corn syrup prompts considerably more weight gain than sugar (2010)
What? Printing [view recursiveDescription] in a tiny little box in Xcode isn't enough for people? :)
A two day pass to CodeSchool. I reached level 4 on the 'Realtime web with Node.js' course in about 10 hours. Pretty good material.
What surprises me is that for example Apple and Google don't simply ignore the gag orders, and just release what and how much they have handed over.

Google/Apple are not going to get shut down over this. They can afford lawsuits and penalties. So why not take a stand? Are they really that timid? Or is what they would reveal actually so grim they just sit by and hope they're somehow going to escape this?

This is the time to put cost/benefit analysis aside and take a stand. Show the world what kind of company you are. So far, its all whimps and pushovers.
About time to update that VMWare install - http://status.lavabit.com/export/graphs/graph_401_4.png
Ruby's Eigenclasses Demystified
Move along and keep on shopping. Nothing to see here.
It's easy to suggest that someone else should go to prison.
I have never interpreted that commercial to mean crazy in the sense you mean. People make crazy bets all the time and they sometimes payoff. We celebrate the crazy successes. Crazy isn't the problem, failure is.
TL; DR: the founder likes Perl
But he used perl to build some thing huge. Just wondering if that huge thing would have run as smooth in python as in perl?
By crossing the fence you put your car on the train tracks and derailed the on-coming train. Happens over and over again.
And I don't meant to suggest papering over bad naming conventions with comments. You're preaching to the choir there.

What I do mean to suggest is that while in any half decent codebase, addCD should be unambiguous, someone thinking title is ambiguous isn't having a stroke -- at worst they're being incredibly jaded. API design is nontrivial, people make mistakes in the trivial cases distressingly often (due to laziness, lack of familiarity, wildly different backgrounds, or any number of other reasons), and relying on context too much has it's own problems anyways.

For example: We're missing it in the very snippet we're discussing. There's no class shown. You're filling in the blanks with reasonable code. I've seen far too much unreasonable code to dismiss it when talking coding styles, and even reasonable code is only a botched refactoring or two away from being unreasonable.
Perl is not going away any time soon. 1,20,000 packages[1] ( compared to Pypi : 32621 [2] and Rubygems : 59,519 [3] )is nothing to scoff at.

[1] http://www.cpan.org/

[2] https://pypi.python.org/pypi

[3] http://rubygems.org/
Its mildly interesting but the conclusions stated on alternative languages seem somewhat odd, and what is presented isn't enough to tell the real reasons for them. It also seems to conflate platforms with languages (e.g., the "Mono is no real substitute" in regard to C#; there are some ways -- which might be important -- where Mono doesn't substitute for .NET, particularly in terms of library support, but C# on Mono and C# on .NET, from a language perspective, aren't that far apart.)

And even to the extent I can pull apart some idea of the preferences underlying the conclusions, I simply can't fathom the idea that C# is in any way an inferior language to Java in a way which the tie to Microsoft would be on top of the some language inferiority as presented here.

So, in the end, I don't get much from this than that Perl was chosen because they like Perl better based on underlying preferences that aren't really clear at all.
Anechoic pointed me to his 1956 MIT thesis on non-linear systems some time ago. It can be downloaded here, http://dspace.mit.edu/handle/1721.1/38918#files-area
There have been bank account hacks where the perpetrator has had an accomplice inside a cellular service provider who intercepted the SMS and prevented it from being sent to the account-holder's phone while retrieving the code.
Just curious, are those packages being re-written to make them better and faster (if they can be, that is)?
The latest bleeding edge design patterns: The Main Pattern
Is it just me or is it ironic that you need a design pattern to implement Hello World in Java?
I thought exactly the same thing: what point is the author trying to prove? Also it would help if the question was linked - users with 10k+ rep can still see it.
Yes, it's either too early in the morning and my strong cup of joe hasn't kicked in, or I'm not understanding your post at all.
Please take a look at the Apache Lucene and Tinkerpop Blueprints codebase that will soundly meet all your parameters.
StyleDocco
It's funny, back in those days the equivalent archive of such things were that people would write a book for use in the class.

http://www.amazon.com/Introductory-Network-Theory-Amar-Bose/...
Blog post about why DuckDuckGo cannot provide any real privacy assurances when it comes to the NSA... http://etherrag.blogspot.jp/2013/07/duck-duck-go-illusion-of...
I see:

tml xmlns:fn="http://www.w3.org/2005/xpath-functions" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:page="http://tjansen.de/minifiedPage" xmlns:i="http://tjansen.de/internal" xmlns="http://www.w3.org/1999/xhtml">

at the top of the page. Apparently the minification went too far. :)
This is even more so if your site is served over HTTPS given the latency for the initial SSL handshake[1]. Even better not to load anything and have it properly cached on the client side.

If you do it right you don't even have the client send/receive an HTTP 304. For our app we have a lot of modular dependencies but we serve all of them from a unique prefix per build (eg. 'assets-SHA(build)/js/foo.js'). The second page load and beyond has zero requests for the same static asset. Whenever we have a new build of the app the unique prefix gets auto updated to force clients to use the latest versions.

For HTTPS make sure to mark your assets as public or they won't be cached:

Cache-Control:max-age=31557600, public

[1]: http://www.semicomplete.com/blog/geekery/ssl-latency.html
Personally, the only computer magazine I feel sad about not being in print is Byte. I loved that magazine.
There does seem to be a certain amount of truth to the "oh, you kids, we were doing that in Perl ten years ago" attitude I occasionally run into. (Sort of like Lispers, except they invented whatever cool feature you think is new back in 1958.) But it's hard to justify switching from something else to Perl, and indeed I think your rephrasing -- "it's familiar and there aren't really massive advantages to using the other languages" -- about sums this up. (Largely why I've been using PHP for a current project, despite agreeing with a lot of the criticisms people make of it.)

I'm not sure I can see explicitly choosing to learn "modern" Perl to start a new project in, though. Personally I prefer Python over Ruby, unlike the author here, but I prefer both of them to Perl and its extremely... eclectic syntax. I once failed a job interview because I joked that Perl was a read-only language, but it really frequently is.
You do not understand
This is utter stupidity. Somehow voicemail PIN weaknesses translate to being able to intercept SMS's?

Security is about systems, not individual components. Take a random Internet service protected by passwords and add a second factor to the login step where after login and password you must enter a code that gets SMS'd to your preconfigured phone number. The number of fraudulent logins will drop to near zero as password guessing is no longer sufficient to break in to an account. The number of attackers that will be able to attack your login page and intercept SMS's for a specific user within the phone network is limited to three letter agencies.

The best security is security that people will actually use. Virtually everyone has a mobile phone and thus why the SMS channel is attractive.

Sure, this isn't the be all and end all in security and an app like Google Authenticator is more secure but SMS as a second factor is ideal for most consumer applications.
Their introduction to Perl and documentation for it is really quite handy for someone coming from another language. I wrote a plugin in Perl without any previous knowledge of it and it only took an evening. And as it turns out I quite like Perl now.
You do realize there is nothing DDG and do to shield you from the NSA, right?
What about event delegation? In JQuery there exists an overload to .on() that can pass a selector string to filter the descendants of the selected elements that trigger the event.

Is there something similar in Minified?
It is extremely provocative for TheKorean to equate judging a culture with judging someone by their genetics. His goal all along was to persuade you to feel guilt in doing so even when it is warranted.

TheKorean understands the tricks of rhetoric. He wrote an essay on it on his blog. He did not write this article in an attempt to consider an issue in the spirit of open minded inquiry. He did it to discourage you from making judgements of other cultures in all cases.

This is the same person who said it was perfectly ok in Korea for a woman to walk up to a girl on the subway and _slap_ her because the woman believed the girl was disrespectful.

Why was it ok? According to TheKorean, because by the cultural standards in Korea say it is ok. He is wrong.

He is not a rational open minded thinker. He is using rhetorical tricks (appealing to your skepticism to convince you that judging cultures is wrong) in an attempt to protect his own people.

This board has smart, rational people. Let's look at motives and not just arguments.
Ask HN: Startup ideas? Join your team?
I have recently finished out of a startup, and am looking to join new startup teams.

I think the day of "take data, put it in a database, display it back"-days are over. That is, for new start ups it no longer suffices to have a client front (i.e.: web, app, api) and simply get and display data back ... that is unless if you are extremely luck.

So I am curious, what are you guys working on, and what are some exciting things happening in the startup space?
Easy to phish. If you know some basic information about the person, you can get the PIN changed.

That's not what phish means. Phishing in this case would mean the victim gives you her PIN, assuming you are trustworthy.
The Failure Of Financial Web Startups in India
The Pixar Theory: Every Character Lives in the Same Universe
they never did. everyone said they would, but when push came to shove, no one.
Bill made it famous with his crashy software that made knowing it needed...

These days of windows 8 I still have to use it regularly because of freezing programs and OS issues.
That time it worked. Not sure why it broke the first time.
No, that's the %^&%#! XSLT processor that keeps inserting unused namespaces.

Edit: oh, no, this time it was me unintentionally editing the compiled index.html.
And yet, few of these consumers were aware of Bradley’s shortcut quietly lingering in their machines. It wasn’t until the early 1990s, when Microsoft’s Windows took off, that the shortcut came to prominence.

In an indirect sense it came to prominence in the 1980s, but via Apple. Apple borrowed the CTRL + ALT + DEL soft-reset idea by adding a CTRL + OPEN APPLE + RESET soft-reset functionality to the IIe (the 1983 upgrade of the Apple II series). That became fairly well-known, even (or perhaps especially) among schoolkids.
well, for simplicity: grasshopper.com -- I needed a telephone line to get a EV SSL and go one in less than 15 minutes.
As per all magazines, it declined to 10% content and 90% advertising that you had to pay a large chunk of cash for. Good riddance to them all.
It sounds like you don't actually understand technical tradeoffs of programming languages.

>I couldn't fight all the prejudices surrounding Perl

Programming languages aren't people, you can't be racist against a PL. Stop using rhetoric and instead talk technical. The reason most people don't use Perl is because it's both impractical and theoretically stupid (not composable, etc). It's kind of hard not to be prejudice against a language that has (albeit optional) dynamic name resolution. The only time I've seen Perl work is for writing tiny scripts (e.g milworm.com), but there are tons of other languages that can be done in. It's actually funny because the fact that you don't have to escape regular expressions in the source of a Perl program is probably one of the only reasons it's popular for writing crappy scripts.

>it's up to you if your code is readable, maintainable and easy to deploy.

By that logic assembly language would be considered usable for large projects
Is there a problem with a system whereby a business already has clients phone numbers and uses them to send the client a temporary PIN when the client enters their phone number as a username on the business's website?
great points, clearly i was misunderstanding, the reset mechanics i was describing are clearly a very bad idea and not 2 factor. thanks!
30KB distributed by a free CDN with a high chance that it's already cached in the browser VS 4KB that probably have to be served by myself.

I am sorry, I probably would still go with the 30KB solution.
2 SUNS MORE REVEALED,
>PCW and its peer publications—PCMag, but also BYTE, Computer Shopper, and in 1991, a fresh-faced CompuServe service dubbed ZDNet—helped bring a niche interest into the mainstream.

I have fond memories of BYTE and Computer Shopper. I repeatedly pored over the same random issue for Computer Shopper for years before I owned a PC.

More recently, I was sad to see SysAdmin go.