skysight-inc/HackerNews huggingface dataset:
Wouldn't this be easily solved by behavioural analysis? I'm not even sure what AVs do these days but I'm sure at least one sandboxes all executables for a while to see if they do anything suspicious before letting them run normally.

The re-encrypted malware would presumably make the same system and library calls in the same order - you don't need to know what the code looks like, just how it behaves.

As far as I can tell this method presents the same problem to signature detection as randomly inserting noise into code caves in the binary. The real target of this obfuscation is making reverse engineers lives difficult.
It's funny to see some of the comments on this thread (or the comments on any thread about CoffeeScript), demonstrating exactly what Aseem is writing in his post. Delicious irony, that.

To make a different point, and one which can easily get missed -- the other unsatisfactory argument I hear somewhat often is: "I love the idea of CoffeeScript, except for X feature, which is terrible, so I won't try it." Where X can stand for scoping, classes, optional parentheses, and the like...

One of the big goals with the CoffeeScript compiler -- despite all of it's flaws and imperfections -- was to annotate and make accessible the source code, and to keep it tiny (I think still somewhere ~< 2,000 LOC), so that if there's one particular thing you don't like, you're free to change it. So if you're intrigued, but dislike X, feel free to fix X before using it, and send your patch along as a pull request. Open source, right?

http://coffeescript.org/documentation/docs/grammar.html#sect...
I've written quite a bit in LESS and Sass. My personal preference has been Sass ever since the Sassy Sass syntax.

In Sass, I like

* clear separation of mixins and classes syntax.

* of course, @extend.

* partials naming convention separation from normal compiled sass files.

* compass[1]

* been with Sass for a while and I'm way too comfortable with it.

Edit: Pre-mature submission earlier. Added few reasons why I like Sass.

1. http://compass-style.org/
Yes.

One 'trade secret' I worked on was about 30 lines of code, in C#. I later turned it in to about 100 bytes of x86...

Some of the trade secrets in quant models can just be the weights.
Do not use Tor as your default traffic carrier.
Actually, that doesn't matter all that much. You ought to scan it into a TIFF file and then process it the way you want it. If you want a good JBIG2 compressor according to your liking, you have to write it yourself anyway, I don't think that the printer hardware and SW is up to that task.

The idea is actually very smart: given the infinite (and multidimensional) space of encoder solutions, fixing the bit encoding and the decompression process was very smart. It's like with PDF: it's well defined how to draw it into a bitmap but you're not constrained as to how you generate the layout, what line break algorithm you use etc.
I don't know about new, but I get the sense from Tesla's buyback-and-upgrade program that they're looking to saturate the used car market with lower-cost Teslas to provide options more attractive to your typical car buyer.

If I could get a 2 year old Tesla for the cost of a functionally equivalent new car, I'd be very interested.
It would be more than a 10-15% dive - the stock fell 18% in a single day a month ago after a (bullish!) analyst report from Goldman Sachs which had a lower price target than the current stock price. Tesla stock is insanely volatile.
It's really a matter of personal preference - all of three popular preprocessors (including Stylus) do their job well.

Here you'll find more comprehensive comparison between the three of them: http://net.tutsplus.com/tutorials/html-css-techniques/sass-v...
Emailing files are generally a bad idea as it clogs up the email servers. Better to email a link to a file.
The original Vanity Fair article tries very hard to paint a picture of a stereotypical overly naive techy.

Little carefully inserted details such as pain-the-back side of having to mow the lawn, all these details should be creating a picture of life-unsavvy coding reclude in reader's mind. The reader supposed to chuckle "how naive, anyone who is on $270K can just hire gardener to take care of the lawn!"

I have personal knowledge of programmers taking the code with them when leaving employment for no particular reason except for "in case I might need it as a reference" and then never ever looking at it again. In my mind it's very much akin to hoarding.

I have very little doubt that the code would be unusable outside of GC infrastructure.

What does seem unusually harsh is the punishment for the crime when no damage was ever done to the victim; to me this is an attribute of a show-case trial.
I doubt the patch size is even configurable, as identified patterns can be scaled accordingly. However the author is not to blame, because JBIG2 is poorly documented and the implementation of the compressor is not specified in the standard.
SEEKING WORK - Remote

Javascript developer with strong experience in building real-time web applications. I'm looking for a full-time job.

---

Email: grdnlndn (at) gmail (dot) com

Skype: grdnlndn

Skills: Backbone, SocketIO, NodeJS, Less, Symfony2

Website: http://jules.boussekeyt.org
It’s about twice as high as in the rest of western Europe (that Americans spend more on healthcare than, say, Senegalese, is not really a surprise), which I, in my orders-of-magnitude mindset, would classify as ‘slightly’. Especially if you look at the % of GDP spent on healthcare, the picture becomes much more varied – curiously with some other pacific countries (nearly) besting the US.
That depends whether they are using a CDN. CDN's charge a lot more for HTTPS
Don't patronise me. I've been developing commercially for 20 years now, I'm not exactly wet behind the ears, nor easily persuaded by anything but facts.

I've evaluated what they are doing on their technical merit. If you want me to give you a detailed explanation of why I prefer their system, it'd probably take about an hour, so it's a bit much as a HN comment.

I genuinely think their direction with the API I'm using is the way forward, I've been waiting for someone to have the balls to do it for some time.

Any anyway, I must have missed the outpouring of love Google received for closing Reader, for not having a native Google Linux kernel OS Drive client, and so on.
How To Check The Number Of Record In A MySQL Table
I'm not sure if it works with the Google API's but usually e.g. with the GitHub API you can send the ETag in your GET request header and if nothing changed (304) it does not count to the quota. It wouldn't solve all the problems but could at least help to stay inside the quota.
Minor bug report, hints 3 and 5 (where the values are displayed as hundreths) overlap with the previous hints (where they are shown as combinations of tenths and hundredsths) for me on Firefox/Ubuntu, but look fine on Chromium/Ubuntu.
It's interesting to note the slight flattening out in the required power since ~2000 (around 220W). Perhaps the sport really is cleaning itself up.
In-house continuous deployment system increased releases by 100%
This is exactly what NOT to do.

The mysql_real_escape_string part is what PHP did with its "magic_quotes" feature. This feature has been removed for good reasons :

- All your variables are cluttered with \' everywhere, so you have to unescape them before doing anything other than using the variable in a SQL query. And re-escape them after that. You will forget to do it.

- It doesn't protect you if you expect the variable to be numeric, and use it in a query without enclosing it in quotes:

// do not do this
mysql_query("SELECT do_not_do_this WHERE x = $var");
// $var could be `0 OR 1 = 1`, even after escaping

- Also, you never know if a variable is actually escaped or not. e.g. in the following code, is "$var" escaped ?

$var = get_data_from_db_or_other_source();
// do not do this
mysql_query("SELECT do_not_do_this WHERE x = '$var'");

- You've "protected" yourself from sql injection and html injection (very wrongly, btw). What about shell injection, css injection, javascript injection, protocol injection ? Are you going to also apply escapeshellarg() on all $_GET variables ?

---

Also, you shouldn't be using strip_tags at all:

- It doesn't strips quote characters, so you would be vulnerable to html parameter injection, if you used a variable "sanitized" like this in a html parameter.

- It alters the data is some non-reversible way. What if you genuinely want to display (not render or "execute") some html code in a blog post on your web site ?

You should be using htmlspecialchars() instead.

---

What to do:

- escape, do not "filter" or "sanitize"

- escape data just in time, not ahead of time (e.g. escape your variable just before using it in a mysql query, or just before outputing it in a html document)

- prefer prepared statements

- use the right escape function depending for the context in which the variable is used: mysql_real_escape_string for mysql query, htmlspecialchars for html, escapeshellarg for command line arguments, etc.
This has been done before with a full human brain scale model in 2005. It took 50 days on 27 processor for that simulation. It's always good to have more research being produced, but this linked article is a bit short on information.

http://izhikevich.org/human_brain_simulation/Blue_Brain.htm
From what I can tell, the issue is that there has so far been no evidence that this move will do anything to actually prevent the distribution of child pornography. That is, it might be collateral damage without fulfilling its primary objective.
The only reason why I am not using tor right now is because of it's barrier of entry. I can probably figure it out, but currently the effort outweighs the return.
Thats what I thought as well, but I have not come across any SAAS apps that do this.

Could you tell me which online games do this - a one time fee for lifelong gaming? Thanks
Top Gear are only scathing of Tesla due to being sued by them over a joke. Prior to that, they were actually being quite fair and reasonable from what I could see.
So in exchange for a failed lawsuit, Tesla lost the backing of the largest motoring TV show in the world. Probably the biggest mis-step they've made so far.
That's what I always thought about tor as well, but today I downloaded and have been using this - and it was/is as simple as installing and using any other browser:

https://www.torproject.org/projects/torbrowser.html.en

I'm probably still missing a few layers of security if I want to order a pound of purple kush or a hitman or something though (right?)
I assume that the research article is slightly tongue in cheek. It's about applying Physics in a creative setting.

If we followed the information bottleneck, we wouldn't be able to move at all. Since we can move faster than teleportation suggests, then I think it's fair to say that there can theoretically be other means of doing it.
Modulo the promise links and other fanciness, this could be done really cheaply with S3's expiring content/links feature and a short script... I'm envisioning a CLI like this.

$ linkme -e 1h picture.jpg
https://s3.amazonaws.com/.../.../?ugly_url
$ linkme --expires 1h --shorten picture.jpg
http://bit.ly/something

The promise links would take a little more logic server-side, I think.
An alternative:
For non-premium users sync every 5 minutes.

For premium users sync every minute.

Use Indian payment gateways if possible, though Paypal works fine too.
I was thinking the same thing... While I agree that hosting cp is definitely a problem. Going after the service provider does not get to the root of the actual problem.
Having said that, the story is quite young so I guess we will have to wait and see what transpires.
The TOR browsing experience is terrible and unreliable. If you're really so concerned, just pony up for a VPN.
There are plenty of reasons to prefer secure browsing by default. Perhaps I subscribe to feeds that would be flagged as "suspect" by programs like PRISM[1] and XKeyscore[2], and would like to make the NSA work at least a little bit to find that out.

[1] http://en.wikipedia.org/wiki/PRISM
[2] http://en.wikipedia.org/wiki/XKeyscore
Trick #0: be a genius.

Also, missing from this is "Talk to the Teddy Bear": http://blog.jgc.org/2010/05/talking-to-porgy.html
US threatens curbs if Pakistan pursues Iran deal, says PM
This is less 'US defence establishment releases software library' than 'US defence establishment requests decentralisation/functional political deniability of widespread facial recognition, offloading of hardware costs to consumer'.
Agree - to assume based on analogy seems risky. Taking the Musk "first principle" road and then navigating based on feedback the "lean" way is what makes the most sense to me.
It just occurred to me...

The title, "Contents", was set in very heavy type which happened to be an unexpected edge case in the classifier and it matched the "o" with the "e" and "n" and output "Contoots".

Wouldn't it be a good idea to perform OCR - using a language model, the works - before you start classifying the JBIG2 symbols? That way, you'd have additional contextual information to say "Aha, 'contoots' is probably not what it reads here" at least in some of the cases.

Although, I realize that on "Google scale", such a complex solution could be a problem.
I can buy that the story sounds fishy, but why does this link suggest it? Just that the fund was really created 2 years ago?
My only question would be whether Tor could cope with that many users all at once.

Having it built in, and defaulting to On when you open a private browsing window would be nice though.
If I remember correctly one of them requires you to specify the port with -p separately, and the other gets it from -l. So it's nc -l 1234 on one, and nc -l -p 1234 on the other.
The article is a bit light around the details of how it works; is it true that it only targets Windows machines?
An amazing traffic light
Car classes like 'luxury', 'midrange' and 'economy' are very loosely defined, and deliberately so. There's no point arguing over what a luxury car is, as many groups will have different answers.

Car companies love this, after all how many times do you see something like "The best [insert feature here] in its class" in their marketing? Because there are so many different definitions of car classes, no-one can prove their statement wrong!
Very interesting article!

His point about MVPs is particularly interesting, IMO - but I'm not entirely sure it's correct.

The point of an MVP is to identify an excellent product/market fit. One of the ways you can tell if you've got one of those is if your crappy, half-finished product still attracts users.

If you're refusing to test at MVP stage, you're in serious danger of applying lipstick to a pig.

Of course, it's worth noting that Rand's company has the money to commit to testing multiple "EVPs" - but for bootstrappers, out of all the advice in this article, I'm not convinced by that point.

(The "build an audience first" advice, by contrast, is proven to work pretty well. Brian Clark at Copyblogger has referred to it as "MVA" - Minimum Viable Audience - strategy.)
That might sound useful, but it would cause a lot of damage:

- many users would get malware-injected web pages from shady exit nodes (they would become a much more interesting target for phishing/other malware than they are now)

- it would no longer be practical for web sites to block Tor as a defence against excessive scraping, spam posts, fake reviews (currently most Tor traffic to "normal" web sites is of that kind)
The 1940s Kitchen of Tomorrow
I ran into the problem of a big memory footprint and the tor browser running really slow (on my quite fast laptop with i7, ssd and 16 gb mem)
Thanks. This thread is a meta discussion about HN, not a technical discussion on concrete data collection methods.

I agree NSA's slides are not innuendo. Neither were BigCom denials. To me it seems reconciling those is neither a rebuttal nor a retreat, it's advancing the conversation from two disputing sides (NSA lying vs corporate collusion) to a third "this is likely what's meant, as seen in multiple concrete cases from 2006 to today, and makes sense of currently available info."

The 19 July story by Pete Ashdown, CEO of XMission, disclosing one in flight data capture practice well known to the data center community, was not abstract. The latest xkeyscore reveal fits this model as well.

"Are they or aren't they" isn't the most productive debate to have anyway. If they aren't, they could, and if the end result is the same, what should we do about it?

As you suggest, the discussions in this area I do appreciate at HN are on what honest rational policy should be, and on how technologists can assist in ensuring trust in confidentiality and non-repudiation in the cloud of services HNers are building.
> Top Gear are only scathing of Tesla due to being sued by them over a joke

The "joke" being that the car doesn't have the range that Tesla claims and that you're likely to be stranded as a result. Top Gear is a joke.
Same for me, but I can see a possible issue with very young users. Re-teaching people who are out of school but never really grasped some math concepts is "easy" compared to providing the whole math curriculum to kids.

For me personally it has been a really great resource. I think the fact that there's no pressure when you're watching them compared to the classroom where you're supposed to understand things very linearly - makes it the best possible resource for learning math for me. I love being able to pause and go Google/Wikipedia around or re-watch the video from the beginning when I get lost. Overall I think it's a great resource, you basically get a private teacher any time you want. If someone doesn't see value in that, I guess they never had trouble in school.
Look, I think masklinn very clearly got your point. It just happens that your point was expressed in an unconstructive fashion, and then you keep (again, unconstructively) repeating "you don't get the point" without following up with a clearer explanation of what your point is (notwithstanding that I think we all understand your point).
Yep, I prefer this app too. The reliance on Ruby or Javascript initially put me off Less.
It's a lot more complicated. If you send cookies with session information over Tor, you've basically trashed your anonymity. https://www.torproject.org/download/download-easy.html.en#wa...
> That's what he paid out of the US as well, I guess that's what it costs. Please explain why you said $78k in your original post.

No no, you're mixing up different numbers. By the way, the $78k ($13 + $65k) didn't even include the surgeon's fee:

"[...] he reached out to a sailing buddy with friends at a medical device manufacturer, which arranged to provide his local hospital with an implant at what was described as the “list price” of $13,000, with no markup. But when the hospital’s finance office estimated that the hospital charges would run another $65,000, not including the surgeon’s fee, he knew he had to think outside the box, and outside the country."

" [...] he ultimately chose to have his hip replaced in 2007 at a private hospital outside Brussels for $13,660. That price included not only a hip joint, made by Warsaw-based Zimmer Holdings, but also all doctors’ fees, operating room charges, crutches, medicine, a hospital room for five days, a week in rehab and a round-trip ticket from America. "

"The Belgian hospital paid about $4,000 for Mr. Shopenn’s high-end Zimmer implant at a time when American hospitals were paying an average of over $8,000 for the same model."
Maybe it just denotes that Jobs was a bigger celebrity.

Maybe it was a sign of respect given Jobs' failing health.

Are you seriously suggesting that the corpse of Steve Jobs has more influence than Eric Schmidt?

Or are you seriously suggesting that a company that imports a few electronic gizmos has more influence than a company that has the single greatest practical influence over the internet?
Since Google Reader went down, I've found I waste less time. I used to use Reeder as my front-end, but they've been slow to update their desktop app. I realize I'm "missing" things I used to keep up to date on, but the net gain is a lot more time I used to spend consuming what I suppose was superfluous content. For me - it's been kind of a nice change.
From http://tsyrklevich.net/tbb_payload.txt - yes. It uses Winsock routines and WinAPI stdcall calling conventions.
Ping doesn't make TCP connections!
Continuous 2.0 Mobile App Testing Tool is Launching
(Berlin, 01.08.13.) CONTINUOUS 2.0, TestObject’s leading mobile app testing tool in the cloud, is out as of August 1st. The launching will be followed by a month long preview period offering free access to all users.<p>TestObject’s premium mobile app GUI testing solution, CONTINUOUS, offers developers, QA teams and anyone involved in the process of Android app development an easy and on-demand testing interface usable at all stages of the app’s development and lifecycle.<p>With CONTINUOUS, developers can regularly execute previously recorded tests as part of the Continuous Integration workflow to assure their app’s functional integrity and get informed of any possible bugs immediately. Companies can use TestObject’s APIs to integrate their build process with CONTINUOUS cloud service and further reduce the manual work needed for testing.<p>“Some of our beta users have showed a significant decrease in testing time and budget some of up to %90.“ says Hannes Lenke, TestObject’s CFO. “TestObject’s CONTINUOUS fully automated on-demand testing ecosystem offers an innovative testing approach for Android apps without the need of physical test users, real devices or any in-house expensive hardware.”<p>CONTINUOUS can be used with no prior coding experience. Simply upload your app, record your actions the same way you would use it on your phone and you are ready to go. CONTINUOUS’s system allows users to update app versions automatically, organize tests with labels and badges, Copy/Paste different test scenarios, use 3rd party apps, code with Java Script for further testing force and so much more.<p>“The fast-paced mobile App world needs an efficient and reliable testing solution, which we found at TestObject” (Jonas Spengler, CTO and Founder - Komoot)<p>For more information: http://www.testobject.com/
Hannes Lenke (CFO, CCO)
hanneslenke@testobject.com
+49 (0) 33 02559375
How to Create Better Content Using the Conversion Funnel Approach
If anyone in Google is reading this please don't mistake me, I know Google is a innovative company and through this post I don't want to give any negative impression about Google.

I want Gmail Tasks to be world recognized and people to use it more frequently.
I see that there are very less standalone apps developed for Tasks, this is a small effort by me to make Google Tasks better and more usable.

If you find value in what I am doing and see it innovative enough, please help.

Thanks for giving me an opportunity to build an app on google.
It's a 12 column (col) grid, so a 'col-lg-6' takes up half of the page. 'col-offset-3' adds a 3 column margin on the left, effectively centering the element.

http://getbootstrap.com/css/#grid
5 Reflections On Full Stack Marketing
Bold statements require bold proof. Care to share?
If you read the article further, you learn this demand was actually just a joke.

"SnowFury Studios, Inc: @WindowsPhoneUsers – Our apologies, the comment re Windows Phones was a poor attempt at humor and was removed when it came to our attention on launch day. This in no way reflects the company’s view of the platform. We have no issues supporting Windows platforms yet at the same time, we also need to focus our efforts."
SASS.
And here's the security advisory for the vulnerability, which was fixed in Firefox 22 and Firefox ESR 17.0.7:

http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...
I use Outlook email for one of the domains I own. So far, no stupid emails (read spam) and things work just fine!