skysight-inc/HackerNews huggingface dataset:
I've come to the conclusion that it is yet another useless question. Or perhaps "it's alive if it interests us". Is the great red spot on Jupiter alive? I don't know, but who cares if it is interesting enough to study? Imagine we finally manage to land on an alien planet, and all we find is robots "living" there. Would we go "ah, too bad, we didn't find life"?
What if Amazon realizes there is no one book of a book
I happened to think about Amazon or anyone are wanting to develop Kindle's and Motherhood's
on developing devices to read books.

My thought was - the book you're reading in that case is a finished one. What if you happened to read the author's mind that ended up being this book? What if the author was able to showcase his directions he was wrong and right to become this book? I think of like Kickstarter's project
where you show off everything before you reach your goal and thus attracting people
to know more about your project.

Thoughts are very much appreciated!
OK, I dove a little more. The actual signing happens in org.spongycastle.crypto.signers.ECDSASigner . I haven't dug into _that_ yet.

But one thing I'm wondering is: would any setSeed on any SecureRandom instance cause a potential problem? Or just on the same instance being used for signing? In other words, do I only need to check that spongycastle -- which I presume is a fork of bouncycastle -- handles things reasonably? Or could any other messing about with SecureRandom mess it up?
You kind of make it sound as if his brain tumor is more of an annoyance to you and your company than to him.
To Install Ubuntu.. Just for this Twitter App - The Tech Veda
This is literally already happening, and has been in secret for years. The DEA and IRS, from what is known so far, receive intelligence from the NSA and others to tip them off for various domestic crimes, and they then use that tip to build a parallel criminal case against the people, while hiding the true illegally obtained source of intelligence from everyone, including the courts.

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
In nature there is no "morally neutral" or "virtuous". Morality is a social construct.

Advantageous? Yes. Virtuous? Nature stares at you, blinking.
This is a very interesting look into not only a new MVC view engine, but also looks at what the Razor vie engine was supposed to be and where it actually failed to meet it's goals.
Wikipedia co-founder refused compliance with Chinese censorship laws
Absolutely. I'm so tired of these true believer bureaucrats telling me "it is all for my own good, and no, you can't know anything about it."
And:

> Around this same time I became aware of the problem of observation in quantum mechanics. At it’s basic level the issue is that you can affect particles by simply observing them.

That's simply because you can only measure by adding energy to the system, which obviously changes the state of the system.
> HTML/CSS nonsense

Structured and well declared markup is no joke. If you actually refer to the common "hacks" to get demos and eye-candy stuff working, then I do agree. On the contrary, if you refer to ditching all HTML and CSS in favor of WebGL, then we're fucked.
The part about hiring a bunch of interns sounds weird. Were they getting paid?
That is exactly the problem with these people: they refuse to acknowledge basic logic, so such a thought experiment is beyond them.
Oh cool thanks! Been in such a habit i never noticed:

config.assets.logger = false
I apologize for changing the goalposts (slightly). I was using ssh-keygen and 16kbit was the maximum RSA key length I could use. Running the numbers, if we assume L(1/4) then 4kbit keys are slightly stronger than 1kbit keys today. 8kbit keys are very slightly stronger than 2kbit keys today. Please verify this, it's possible I made a mistake. L(1/4), 8kbit would be ~5*10^10 harder to factor than 1024 k-bit keys today. I think I now have the goalpost where it should be for a meaningful discussion? Another interesting question is why did Google choose to move to 2kbit rather than to ECC?
what do you exactly need?
I'm 39 and dealing with my own cancer struggles. It's tough. Reading about someone else around my age deal with it helps, though.
I upvoted this comment, then I realized that those PHP stats functions aren't in the standard library. They're in a PECL extension (equivalent to Python C extensions).
Norway's Prime Minister works as a secret taxi driver
Having our communication intercepted, stored, and analyzed en masse is not bad because of whoever is in office today. It's bad because someone different, someone with less scruples, could be in office tomorrow.

I'm not a conspiracy theorist and I actually believe that the people in charge of this stuff today are at least trying to be careful about what they're doing with the information they've collected. But once the infrastructure to surveil, analyze, and more importantly store for all eternity everybody's communication is in place, you're leaving an awfully tempting pot of gold for the people in power a decade from now. That's who I don't trust.

In either case, saying mass surveillance and archiving of everybody's personal communications is OK because "trust me guys, I'm for realsies not gonna screw you" is ignorant at best and despicable at worst. I didn't elect this guy and I've never met him, and he doesn't have my interest at heart--his interests are catching terrorists, and soon everybody's going to be a terrorist. We're already calling nonviolent nuns terrorists: http://www.washingtontimes.com/news/2008/oct/10/protesting-n...
What do you think about integrating https://github.com/charliesome/better_errors directly into rails?
Replace turbolinks with pjax.
Strongest possible disagree. For instance, the Debian OpenSSL bug was an entirely unforced error stemming from applications that chose to use Debian OpenSSL's terrible CSPRNG on top of the OS's CSPRNG. The local attacker scenario you're talking about is a theoretical risk when there are attackers running code in the same OS as your CSPRNG; a far more likely concrete flaw is, for instance, a SecureRandom implementation that allows developers to specify insecure seed values.

I'll go to bat on this disagreement. Don't use application-layer CSPRNGs. Use the one the OS provides, to the exclusion of alternatives.
The general population of China do not use Google, gmail, wikipedia, or facebook.

Surprisingly, google maps is doing ok.
The latency of the crypto itself is minimal, what you're really having a problem with is traversing the ocean. Solution: Don't do that. So we need more nodes. If there are a thousand nodes within a hundred miles of where you are then you don't need to use the ones that are ten thousand miles away.

In addition to that, you can mask latency with caching and prefetch. Browsers could prefetch all the small content on linked pages so that by the time you click on a link the data is already on your computer. This could be helped by general purpose HTTP protocol improvements that allow a browser to know speculatively what such content will be on a page through a POST request etc. without having to actually POST anything. SPDY/HTTP 2.0 also allows asynchronous operation which is extremely good at masking round trip latency when requesting many small objects.
I couldn't find a line of code in bitcoinj that explicitly seeded SecureRandom, or used the explicit-seed constructor.
You may start here: https://en.wikipedia.org/wiki/Darknet_%28file_sharing%29
To be specific, since I spent a lot of time on that bug...

Older versions of Android's SecureRandom could return the same value if (a) you were manually seeding SecureRandom and (b) no prior crypto operations were performed on that SecureRandom instance before seeding,

There was some (very) bad advice circulating on blogs which advised using this technique to generate local encryption keys from a seed, in order to obfuscate the key.

This was fixed in Android 4.2 when we switched from BouncyCastle to OpenSSL as the underlying crypto provider. I don't know why you'd still be seeing this on Android 4.2, but you shouldn't be doing this anyway. SecureRandom is seeded by the system. Manually seeding it is a bad idea. (And trying to force deterministic output from is a very bad idea.)

There's a blog post I wrote which goes into a bit more detail: http://android-developers.blogspot.com/2013/02/using-cryptog...

The linked article is a bit light on details, so I don't know if this is what they were doing or not. I doubt it though, since that would have meant they were seeding SR with the same value, and I'd like to believe the Bitcoin devs wouldn't make that mistake.
Just swap out ActionMailer with the `pony` gem!
In many production environments where a few lost writes in the event of OS crash aren't entirely the end of the world, innodb_log_flush_at_trx_commit is set to 2. In some it will even be set to 0 (in that instance, data is lost in the event of MySQL crash). If you care deeply about every write definitely hitting disk in a recoverable manner, you set it to 1, but at that point you may have to do other stuff (is the OS lying to you? Is your RAID controller lying to you? Is your disk lying to you?)

> If the point is that other databases do not have something comparable, that speaks to the point of the linked blog entry.

Other databases do have something comparable. It looks like MongoDB actually doesn't, but that's highly unusual. Postgres does (I believe it's on by default), Riak does, Voldemort does (one could make an argument that it's safer to leave it off in the latter two cases than elsewhere).
> I realize many Americans don't trust their government. I wish I could change that. I wish I could tell people the amazing things I witnessed during my 30 years in the CIA, that I've never seen people work harder or more selflessly, that for little money and long hours, people took it for granted that their flaws would be scrutinized and their successes ignored.

It takes far more than doing Good to earn trust. You must also not do Bad.
rails package - dockerization of app, but this rather goes beyond of responsibilities of Rails and I should complain at capistrano guys ;-)
If only I was paid 1 satoshi every time someone brings up roads, police and all that stuff when I say taxes are theft, I'd have more than Satoshi has.

Just try to imagine how a society without a government could function and still have all the things we currently have. Try to come up with solutions. Think about the demand side of the equation. Just for once, try to imagine how to organize things in a world where it's, for some reason, impossible to create a government. You'd be surprised of your own ingenuity.
Thanks for asking Steve! I think Rails is already very complete. I would like to see an included state machine, rails-api integration, commands (baby-zeus) integration and GitLab secret storage (https://github.com/gitlabhq/gitlabhq/pull/4040). But I realize these are all very controversial. The most important thing is the core-team stays happy, so no problem if these can't make it.
"Let me break this to you gently. The government is not interested in your conversations with your aunt, unless, of course, she is a key terrorist leader."

Let us contrast this with what Hayden's remarks were (after which going on to compare the following group to Al Qaeda and the attack on 9/11 if you watched the speech [lets not forget the DoD internal report that came out recently about how the DoD is currently funding them [0], but that is neither here nor there…]):

"Nihilists, anarchists, activists, Lulzsec, Anonymous, twenty-somethings who haven’t talked to the opposite sex in five or six years."

I guess this career CIA officer didn't get the memo that "terrorist" will be used when it is convenient.

[0] http://www.bloomberg.com/news/2013-07-30/al-qaeda-backers-fo...
> We don't need more tools, we need tools that non-geeks can use.

Why? Suppose someone comes up with these tools for the non tech-savvy, and the internet is "fixed". Now the evil government would no longer be able to spy on innocent citizens and obtain private information for its nefarious purposes, whatever those may be. Would people stop being so easily manipulated by private corporations' campaigns and will no longer surrender their private information so willingly? After all, much more information is yielded voluntarily due to deceitful corporate propaganda than due to clandestine government surveillance. How are tools going to help with that? Will tools educate the public of the ways Google and Facebook use private information to exploit their users?

We don't need more tools. We need politics. We need laws to regulate both government and corporate aggregation and handling of private information.
To be honest, being a guy in both lands for living, ASP.NET is much more to offer as a base framework that worries about security.

Obviously, now and then security vulnerabilities opens up, in all such occasions RoR prompts before you think about MS patch! It is something to do with MS release cycles, even though you can fix it as most of this frameworks (ASP.NET MVC or Web Api) are opensource ones.

I think your question is open ended that you cannot expect one answer.

For example, if you're worried about SQL Injections it is purely a framework like Entity Framework or NHibernate is to question about or in other cases how you're dealing with SQL queries (Are you using StringBuilder to build your query yet?) otherwise there are answers in both the land for every known security issues.
That's just an optical effect caused by the fact that the veins are (normally at least) underneath the skin. Even oxygen poor blood is not blue.
It is a matter of few years when other federal agencies and private corporations will start wanting access to this information making it nearly impossible for private citizens to live freely.

I heard that bad elements are still active and kicking. Offence is not the best way to promote peace.

I think government has legitimate need of the information they collect but I also want them to establish regulation to delete all information after certain period of time, so, nobody is able to use this information to preemptively attack or blackmail private citizens.
Considering dhh created Turbolinks specifically to improve upon PJAX, I think we both know how likely that idea is. Thanks for the suggestion though!
at least a politician who wants to know what his folk has to say. If it was a marketing gag, well done!
Have you seen that d3 visualization of the US federal budget? It's pretty interesting. Social security, Defense, and Medicare make up the lion's share of spending. you probably don't use these (except defense, arguably indirectly, but I suspect your politics would disagree with the budget size)
Please finish https://github.com/rails-api/active_model_serializers according to http://jsonapi.org/ and distribute it officially with Rails 4.1
That line actually makes me doubt the authenticity of the article.
The email wasn't from one of us.
I actually believe a lot of what he is saying about the culture of US intelligence agencies. I'd bet that there's little to none of people, for example, extorting people by threatening to expose their fetish-porn habits. I'll even believe that the people who work there care about protecting privacy (insofar as one can when you work at an agency that keeps everybody's communications on hard drives). But there needs to be some oversight. There should be people from outside the Executive Branch with some actual power watching them. If you believe in the US's mass surveillance programs, then you should be willing to concede that, at the bare minimum, this much should happen.

Of course, I don't think the mass collection should be going on at all. That data is too easily abused. If someone takes control of it who has less integrity, is less interested (or able) to prevent violation and corruption, then we have a massive problem. I believe this is what Snowden was referring to when he mentioned "turnkey tyranny".
It's a super neat gem. Improving error pages is always a good idea, I'm actually really happy with the relatively minor changes we added in 4.0, so I could totally see this or something like it, thanks.
> I'm not a conspiracy theorist and I actually believe that the people in charge of this stuff today are at least trying to be careful about what they're doing with the information they've collected.

They're passing intelligence to the DEA and IRS for domestic crimes, with orders from the top of the DOJ to hide that intelligence from everyone, even the courts, and only use it to construct a parallel case to prosecute with. I don't believe that's "trying to be careful" with the information. That's a blatant abuse of our legal system.

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
The co-founder with the tumor has his own blog, read this as well:

http://ronniecastro.me/40-percent-chance-tumor-grows/ (incl. photos).

Good luck
Seriously? And which one of you bothered to ask the cancer guy what he thought?

Stop judging from a distance, or at least get some binoculars.
Not seeing any relevant code that sets seeds in SpongyCastle, either.
Why would you want unicorns AND ponies? unicorns are superior to ponies; adding them both would just bloat the framework.
* Improved migration format:
make it possible to create new initial migrations as a project evolves by rebasing. Meaning there's no need to keep or execute the whole migration history every time. On my current project running migrations from starch takes 30mins :(

* Improvement in performance in regarding to JSON generation or other thing is always welcome. following benchmarks can be taken as reference where rails stands currently. Any improvement in the above stats would be awesome http://www.techempower.com/benchmarks/#section=data-r6
What has the USG done that would engender this level of (misguided) trust??

“Distrust naturally creates distrust, and by nothing is good will and kind conduct more speedily changed.”
― John Jay, The Federalist Papers
I would love for Rails to address keeping secrets/tokens out of source control by default - so every project can do it easily in the same way
And even if the government is sincere in everything its doing, (no privacy violations, no mission creep, etc.) do we have confidence that it can keep the stored data secure from criminals, crackers, foreign governments or other malicious entities?
Most ordinary people will never be on their radar. That's usually the case, even under tyrannical regimes. But that ignores the journalists, the lawyers, the rival politicians, the activists, the dissidents…
So why are we hearing about the company now? Is this how you sell a successful but previously-unknown company?
AMS is currently undergoing a major internal refactoring, possible even a near re-write, but getting it in line with what's up at JSON-API is real important. Also, ember-data is undergoing a major push this month, so while this is in flux, it should improve soon.

As for getting it into core Rails, well, considering it was originally pulled out, I wouldn't hold your breath, as much as I'd prefer that personally.
Hey Steve, great of you to ask! Here are some suggestions:

* Streamline the command line. Why rake to migrate, but rails to generate a migration? I know, I know. But new folks to Rails do not know. And it would be better if there was just one tool that does it all.

* Get rid of the global magic functions. users_path is nice and sweet, but where is it defined? Object? Kernel? Why can't I just call a method on my app. Sort of like how engines work: main_app.users_path is IMO better than users_path.

* I guess instance variables in views are a given forever, but I still don't like them. Why can't these be simple methods on objects as well? Simplify, simplify, simplify. Also, deprecate helpers. (Hey, I can dream!)

* I would help if my app was defined as a (singleton) class that I can see and use somewhere. It would be better if this were always a Gem, without me doing anything special. Then I could make all kinds of gem dependencies explicit.

* Fix mailers to allow them to work with async delivery out of the box. (Bringing back queues? Yes please!)

* Make mailers work with Markdown and friends to produce multipart emails out of the box. Write a pretty(ish) plaintext mail, and get HTML formatted for free. (There are gems for this, it would be nice if it were standard)

* Get rid of all hardcoded tokens in source code. Especially the session secret. Require dotenv gem and move all config into ENV. Including the database configuration!

* Fix the log file format. One line per event would be nice. Proper timestamps would be nice. Use standard Ruby loggers with a good format that the rest of the industry understands.
>Let me break this to you gently. The government is not interested in your conversations with your aunt, unless, of course, she is a key terrorist leader.

I'm quickly becoming the go-to person for "what about the foreigners" comments, but I couldn't let this one pass:

By thst logic, since the NSA is tasked with spying on any foreigner without any kind of warrant or safeguard, all foreigners are key terrorist leaders, at least in the eyes of NSA employees/the USG.

Addendum: "Let me break this to you gently" was not a very reassuring thing to read from an ex-spook. Apparently, we're stupid and the intelligence community has to nudge us out of our stupidity with an additional helping of condescendence.
Working from home: how not to get distracted
Surely no private company can ever come up with such technological marvel as taps and tubes and water in them.
Where does it actually run well? It doesn't peg a core on Safari, but scrolling still feels laggy and unpleasant. I initially assumed you'd implemented your own inertial scrolling, as with old Google mobile sites.
What is baby-zeus?

I'm personally very interested in the secret_token issue, and so is the rest of the team, but it's tricky to get the balance right. Working on it!
It's a good rule but in extreme cases I'm sure it can go either way such as free-divers who can hold their breath for five to ten minutes when diving but the world record is 22 minutes (when not diving).
it looks quite nice but unfortunately I guess it's by far too power hungry. My GTX 560's fan went up.
I wish there was some way to call the asset pipeline with parameters. E.g. "render that stylesheet with the dark theme".
I'm really missing deployment-specific settings, like `figaro` gem, especially for database.yml
Maybe moving out secret key to .gitignored file, so that you can't (by default) commit it?
What is so mind boggling to me, beyond the double-speak, is how nobody on the government side acknowledges basic systematic risk. They assume their system is perfect and their people are impeccable... have they ever been the fucking post office or DMV?! Those are government employees!
This is really cool! Would you consider adding a "Sign up for mailing list" form and sending out occasional updates (for new chapters, etc.)?

I often find and bookmark interesting learning resources like this, but I don't remember to come back later and check for new additions.
And over that, they made perfectly clear that they don't care at all about privacy of foreing people (or the people connected with them in any way), in fact the main focus of the surveillace are european countries.
I showed ElementaryOS to my art-student sister and she loved it! She wants me to install it alongside her Windows OS so she can dual-boot.

She loves the simplicity and says that what she does on the net and her PC is completely covered by Elementary. Document writing, web browsing, text chat, email, video viewing, audio listening - all can be done easily and user-friendly.

Elementary is not enough for my advanced needs (I don't like docks, I prefer taskbars), but looks like Elementary might have some traction in the regular-user market.

Keep up the good work guys!
All the more reason why the US needs a robust data protection act, despite the howls of outrage this will cause in Silicon Valley.