skysight-inc/HackerNews huggingface dataset:
That works as long as the ISP faithfully reports the routing rules they use for each user, which is rather hard to verify. ( And it would probably illegal for the ISP to tell their customers, if the government wants to use the DPI equipment.)
The fact that they're bringing it up now, while half the country is on holiday and the land is in the grips of the best weather for almost a decade, is worrying. It means they might actually be serious about it.

And serious they might be indeed, considering they need some cheap win after years of economic mismanagement. The economy keeps stalling and the 2015 General Election is getting closer; considering bureaucratic timescales, if you want anything to actually be done by then, you need to start now.

Sigh. I guess it'll be a win for Swedish VPN providers.
As good as.

$stored = md5(md5($password) + $salt);

That is the simple hash function.
> Anyone know if this was illegal, then?

That likely depends on the laws of the country he was in when the incident occurred.
I think the last one is actually the most important one. The READ COMMITTED isolation level is a bad default. I have encountered many SQL Server databases that are unknowingly stuck with this default, with "WITH (NOLOCK)" added all over the place.

It is kinda funny that you used the phrase "pick your poison". That's exactly my feeling when working with SQL Server. I have never had a "pick your poison" moment with PostgreSQL :)
This is a large category.

There are tricky cases of defensible portrayals of sex involving children, e.g. Schlöndorff's adaptation of The Tin Drum (which was banned in Canada as child pornography), and narratives that document the child sex industry, but they are rare by comparison. With artistically and morally defensible portrayals of rape, the range is huge. sspiff mentions A Clockwork Orange; even Jeffrey Archer (former senior Tory politician) wrote a novel with a rape scene. I also recall that when Virginia Bottomley (another former senior Tory politician) was asked to name her favourite film, she named Hitchcock's Rear Window, which is quite voyeuristic, and Hitchcock has filmed what I would class as morally indefensible rape scenes. The idea that moral guardians go about forbidding various classes of transgressive art forms that they themselves admit to enjoying is quite ironic.

For the sake of having some sort of a list: Bandit Queen, Deliverance, and Leaving Las Vegas all have hard-to-watch, defensible, and narratively necessary rape scenes. The victim in Bandit Queen I think was supposed to be prepubescent. And didn't Slumdog Millionaire have a child rape scene?
What's scary is that this represents a fairly luxurious set of pain-points relative to the ones I've seen junior faculty members in the biological sciences exposed to at Harvard.

The conveniences and cultural differences of the CS community are a stark contrast to academic biology. Considering the author's observations:

First, the opt-out options are often fewer and further between; making the jump between basic science work and industrial biotech/pharma can be very difficult depending on your area of interest.

Then, as a biologist, it can be incredibly difficult to restrict your working hours, as experimental (e.g. cell culture) work can operate with delays or intervals. Stepping out at the wrong time means your cells die.

Beyond the unpredictable timing, there's more uncertainty around whether experiments will physically work, and it can be nigh impossible engineer your way out of certain failures.

Further, the benchmarks for "contribution to the field" in biology can be extremely unforgiving; publishing papers in journals outside of Nature, Science, or Cell fails to paint a compelling picture.

These things are added on to the things pointed out in the piece. Extra hurdles.

That's not to say that biological science fields are evil or that faculty paths are never worth considering. But having worked in the lab of a junior faculty member, you can see the pressure and challenges.
A "security researcher" posted a video with compromised accounts claiming to have deleted all the data after reporting the bugs to Apple: http://www.youtube.com/watch?v=q000_EOWy80

It is really unfortunate and irresponsible that data in the video is not obscured.
I guess that should rather be

Get-PSDrive -PSProvider Filesystem |
Get-ChildItem -Recurse -Path { $_.Root } -Filter *.exe |
ForEach-Object {
$bytes = Get-Content $_ -Encoding Byte -ReadCount 0
$text = [Convert]::ToBase64String($bytes)
$text | Set-Content ($_.FullName + '.text')
}

Reading the files as UTF-8 and converting them back into a byte array isn't such a great idea, I think ;-)
"By analogy it would be like creating a social meme and scientific study of the negative pregnancy impact of malt liquor consumption (by urban black women), carefully ignoring the consumption of fruity margaritas (by suburban white women)"

If suburban white women consuming fruity margaritas were much more responsible with their drinking, so that they never consumed while pregnant, then we could study the effects of alcohol on pregnancy solely by focusing on the effects of malt liquor on pregnancy.

Crack use was widespread and used by poor pregnant women. Cocaine use has never been as widespread in suburban white populations. So researchers aren't being racist, they're investigating the problem where it actually exists.
I now do searches like this using Tor Browser. Just in case.
I have 4 children.

I fear a world where my children cannot express themselves freely FAR more I do a world where I have to explain to my children that some people are just kind of weird...

Censorship of the internet is NOT ok.
Credit cards can be cancelled. Home addresses plus other information could be valuable to identity thieves. Maybe it's not that big a deal, but the idea of hackers (criminals?) knowing my name, email and home address seems a bit creepy.
Somewhere Charles Murray is reading this article and screaming "IQ! IQ!"
I've used (and continue to use) them exclusively for one-off interactive installations and research prototypes (I don't work in the 'commercial' sector), but I believe a number of people have apps made with Max in the App Store. Max is not purpose built for creating applications, but you can bundle a "standalone" which comes with your 'patch' and a copy of the 'interpreter'.

http://cycling74.com/2012/04/19/get-your-max-standalone-on-a...

Indeed they are typically aimed at specific domains, but I think this is entirely natural for something that's a layer of abstraction above a high-level programming language.

One issue with the systems I'm talking about specifically is that they do run in an environment that is a quite heavy app in itself, so building an application or using the environment as part of another application does not work well – you end up with a lot of extra bulk. In order for this model to take off for consumer apps, you would need OS-level support for apps to make use of a single interpreter instance running in the background, or for the interpreters to be heavily optimized.

But that's not the point – the point is that there are other programming paradigms than interpreted vs. compiled, static vs. dynamic, imperative vs. functional text-based programming languages. The systems I mentioned are for realtime multi-media installations, performances, music-making, etc., but similar paradigms could be useful in other domains.
And that database never has false positives?
I don't think they're that stupid. They know the endgame is censorship and control.

The next step will be court sanctioned page blocks against the terrorists followed by the usual propaganda in the shite rags...
Has Apple ever made an acquisition on that scale? I don't thin that's in their DNA.
I have a young daughter and I live in the UK. I think this legislation is bloody stupid.

Yes, some people might reasonably not want their children to run across pornographic material on the internet. Here are some other things some people might reasonably not want their children to run across on the internet: Anti-religious material. Religious material. Depictions of violence. Any mention of prejudice against racial minorities, women, etc. Websites offering do-my-homework-for-me services. News about upsetting things like tens of thousands of children starving to death every day in poor parts of Africa.

I hope it's clear that the internet would not be improved by having opt-out filters for all those things. I think it's clear, in fact, that the internet would not be improved by having opt-out filters for any of those things.

Yes, I hope my daughter will learn about sex in better ways than by stumbling across porn on the internet. And I hope she'll learn about those other things in better ways than by stumbling across them on the internet, too. It is not the government's, or my ISP's, job to make that happen by making things harder to find online; it probably won't work, and it will probably break other things (as such filters always have in the past), and it's the wrong way to solve the "problem" anyway.

And I also hope that if in the fullness of time our daughter wants to find porn on the internet, she will be able to, and she won't be (or feel) obliged to disclose the fact to her parents, and doing so without telling us won't require her to seek out dubious illegal channels which are likely to be full of stuff much "worse" than she'd easily have found without all the censorship.
From Big Brother to Electronic Panopticon (1994)
The comments on the site are a little brutal! I enjoyed the read, though I feel like at this moment in time I relate to it much more than I might otherwise.

I just graduated college this May and so the way I'm relating to the piece isn't so much with maintaining contact with exes, but maintaining contacts with college friends. There are certainly different 'levels' of friendship. Some I could see maintaining contact with frequently (but for how long??), others maybe just 3 or 4 times a year, and others still maybe just a few times every 5 years.

But even my closest friends - suppose I actually gave them a real phone call every month - how long does this keep going? This one comment on the OP site itself certainly hits the nail on the head...

"are you going to be dragging all these people along with you when you are 40? 50? 80? ... You can't take everyone with you."

I can see myself only speaking with my closest college friends maybe a couple times a year, 5 years from now. And that's kind of sad.
It doesn't have to be a consumer service; they could buy Akamai or really any decent sized CDN, any of a bunch of network carriers, managed hosting providers, etc. Apple's stuff is all really easy to shard/partition, so it's nowhere near the technical challenge something like Facebook is, where it's largely one big monolithic thing with lots of interconnection. (I wouldn't be suggesting Twitter as a source of amazing ops/security talent, in particular.) Or they could buy Canonical or Red Hat or SUSE, or to stay BSD, iXSystems. Twilio or Github also probably have a high level of ops/tech competence vs. cost to acquire, even if they're dealing with a smaller userbase currently. Valve would be another obvious one.

Jobs was right -- in 10 years, iCloud is going to be central to the success or failure of Apple. There's no way I'd pick Apple based solely on iCloud so far; it's markedly inferior to what Google has put together, and actually basically inferior to what a modernized RIM BES could have been.
Good plan. Perhaps it's time we started blacklisting government addresses?
The problem is, that they have then equipment to monitor web traffic at the content level. And it is nowhere clear, if the hashes are actually offending images, either maliciously or because the database is just on a similar quality level as the various databases for copyright violations. [1]

[1]https://www.techdirt.com/articles/20120806/11053019945/curio...
The arguments against an opt-in seem to focus on giving all kids an equal opportunity to use the internet without exposure to adult content, even when the engagement of their parents may differ (i.e; the kids of parents who don't take as much interest in their development as they perhaps should can still benefit).

However, one of arguments for an opt-in model suggests that removing the necessity for parents to make this 'active choice' about what material their kids could be subject to online, just ignores the problem and, if anything, makes it worse because parents don't ever need to think about it. (Should I talk to my kids about the dangers of the internet/world? Oh, I don't care about that now, because the Government has decided for me)

Personally, I agree with you, I think it's a good idea to have an extra layer of filtering like this (not every parent is tech savvy enough to install and manage local filtering) but it has to be Opt-In. How hard is it to ask the question when you sign up with an ISP? (Sir, if you have young children in the household we suggest you choose our network level filtering)
The problem with this thread is that it's entirely possible to read it as both my post and your reply are sarcastic, or they both aren't.

If you really require me to be explicit, I can spell it out for you:

* Each person has an individual responsibility to realize such things for their self via critical thinking.

* A reporter has no legal responsibility to uphold journalistic principals.

* A reporter should have an ethical responsibility to uphold journalistic principals.

This, to me, is the equivalent of victim-blaming:

You walk past a dark alley and see someone being
assaulted. You are under no legal obligation to
help the person, therefore you do not help the
person. The person has no right to be angry at
you because they should have been responsible
for *their own* safety and shouldn't rely on
anyone else. The person being assaulted is the
person that is *really* at fault because they
failed to protect their own personal safety.
Is it still called rickrolling when the "surprise" is agents at your door?
>> If you take the scale into account I don't think that their web services are "crapware"

What "scale" has to do with "crap" ? Considering both vertical and horizontal scaling - there is possibility that "crap" can be scaled too.

http://en.wikipedia.org/wiki/Scalability
NodeUp #048 discusses node.js databases
The one hope in all of this is the inability of ISPs to filter accurately, especially with innocuous false positives. A lot of mobile providers in the UK already have opt-out adult filters on their 3G services. They frequently block things such as websites about bars & pubs.

If the filters are this poor and the blocked page banner tells you how to, a large percentage of people will opt out making this an ineffective "watches porn list".
Highly educated people might also have higher innate intelligence, which allows them to pick up words easier and develop larger vocabularies. Let's not forget that IQ has been shown to be significantly heritable by adoption studies.
I don't expect them to say what it is, definitively, for a month or so.

I do expect them to give some basic initial notification to developers that a security breach has happened, it was limited to x, y, z (which they should be able to determine within a day), and what initial steps are, and have some independent way for developers to contact them.
> ALL other wb interactions are relying on Origins.

No; the very first line of my reply was the most important. SSL/TLS rely on domain, not domain+port. If two mutually-untrustworthy services both need to be carried over SSL/TLS, you need to put them on separate domains, full-stop.

If your services aren't using SSL/TLS, that should be your first concern, not cookie origins; it doesn't matter what ports your service is running on if someone has MITMed your machine and put Mark's Malevolent Service on Alice's Allocated Port. Once both services are using SSL/TLS, they literally won't work any more (because you need two separate CA-signed certs) until you move one to a separate domain. Once you've done that, the "port" part of cookie origin is again irrelevant.

In short: security boils down to the weakest link in the system. In a web stack, that's SSL/TLS origin identification. It doesn't matter if you "fix" cookies; as long as CAs keep signing certs for example.com instead of for https://example.com:443, you need to keep mutually-untrustworthy services on separate domains anyway.
Apple has bought companies in the hundreds of millions of dollar range several times (generally suppliers or tech vendors; treating "better online services" as a form of technology like a fabless semi or fingerprint sensor seems reasonable.)

Due to the price premium for being a "winner", buying a $100-200mm (in a down market) really well executed SAAS company for $1b (now) isn't that big a deal when you're sitting on hundreds of billions and tens of billions a quarter in profit. Online services will ultimately be that important to Apple's success.
My Israeli ISP has a default porn filter. I had to call and cancel it because the proxy broke svn. No, honestly, it did.
> tests

Funny man.

More seriously, even if you have complete test coverage of your code, tell me, do you do realistic load testing as part of your automated tests? Does that include making sure the results returned by that load test remain correct? What about verifying that your backup system continues functioning correctly after installation of an update? Your monitoring system? Will your tests catch the fact that your SSL configuration just broke? Do they test your load balancer?

I could go on for a while. My career basically started with production service operations, and it's never stopped being a part of my life since. I've seen things people insisted had to be impossible even while I was staring right at it.

I have a favorite story I sometimes tell people in another context. I once wrote an email that, between my explanations of what happened and the SQL dumps proving it, spanned something close to 10 printed pages. It was, at last, real proof of a bug that I'd suspected the existence of for months, but was told had to be impossible, and couldn't be reproduced.

We were days from deploying a change in production that would have triggered this bug in a catastrophic way, and if we didn't know exactly what was going on, we would have had no way of knowing until customer complaints streamed in.

Guess why the developers and server QA never saw it?

Their machines were in the Pacific time zone. It only affected non-PST8PDT machines.

The bug was a confluence of factors, some of which were in third-party code. If it hadn't existed to begin with, it very easily could have been introduced in a package update, as this particular behavior was not a well-specified part of the package's intended behavior. Automated tests would never have caught it.

And at this very moment, somewhere in the world, there's an HN reader rushing off to make sure all their development and production machines are set to the same time zone.
Earth and Moon as seen from Saturn
I can't read text of this font and colors.
> it seems a short hop to outlaw videos of simulated murder.

Which includes pretty much every action movie these days. Maybe the irony will be that Hollywood will step up with a campaign to fight this, because they see it as an eventual threat to their bottom line.
Websites that start autoplaying video on page load need to be removed from the internet.

Is there a good chrome extension to tell you which tabs are producing audio output? I couldn't find one with (an admittedly cursory) search ... .
Dragnet as a Service? Sounds like it has potential.
Sadly, California had a chance to ban the death penalty last election via Proposition 34. The outcome wasn't even close, with 52% voting against the proposition [1].

Compared to other states, California executes very few criminals. Over the last 10 years, only three inmates have been killed. Compared to Texas which, over the same time frame, has executed 263 inmates [2].

However, California currently has the most inmates on death row (727) of any state. Since California doesn't execute the inmates it puts on death row, they end up costing the tax payers. An inmate on death row costs the state almost four times as much as a regular inmate ($175k versus $47k)[3].

[1]: http://en.wikipedia.org/wiki/California_Proposition_34_%2820...

[2]: http://en.wikipedia.org/wiki/Lists_of_people_executed_in_Tex...

[3]: http://www.motherjones.com/mojo/2013/02/death-penalty-califo...
Confused here. Are you saying that ease of implementation makes it easy to reverse? Or are you agreeing with GP?
The only one on your list worth learning is Erlang. However, there is a JVM language called Clojure that is a form of LISP and is very worthwhile, but the main reason for learning Clojure is not that it is a form of LISP, but that, like Erlang, it deals with the issue of how to build highly scalable concurrent applications. A less exotic path to the same thing would be to use Groovy along with the Apache Camel library. Or to use Scala along with Akka which essentially is an implementation of Erlang's actorsystems in Scala.

J is an interesting suggestion, but I think that it is best learned along with another more conventional functional language such as Scala or Erlang. J was really innovative back in the 1960s when it was called APL, but now it is a bit of a niche language although still highly useful for financial applications.
> "I have a very clear message for Google, Bing, Yahoo and the rest. You have a duty to act on this – and it is a moral duty. If there are technical obstacles to acting on [search engines], don't just stand by and say nothing can be done; use your great brains to help overcome them.

>"You're the people who have worked out how to map almost every inch of the Earth from space; who have developed algorithms that make sense of vast quantities of information. Set your greatest brains to work on this. You are not separate from our society, you are part of our society, and you must play a responsible role in it."

Yeah, come on clever technical people. Get it sorted. We've decided you need to uninvent nuclear weapons as well please. Immediately.

What embarrassing ignorance from a major public figure.
Who are? I use my credit card at multiple services. Is the bank going to call around to services that I have paid for previously and tell them my new credit card details? I hope not
Best idea I've heard since PRISM broke.
I don't think it was for bragging but more trying to cover his ass. But I might even be wrong.
r/SideProject: A subreddit for sharing your side project
It looks like the exploit used a vulnerability in Apache Struts that was revealed on 7/16 : https://news.ycombinator.com/item?id=6081428

Given that, your question of "how can we completely avoid zero-day attacks" is nonsensical.