skysight-inc/HackerNews huggingface dataset:
As tptacek has mentioned many, many times, SecureRandom is one of those things which is very secure if you understand exactly what it is doing and do not shoot yourself in the foot.

One easy way to shoot yourself in the foot with SecureRandom is to use seed values from a source with low entropy.

http://developer.android.com/reference/java/security/SecureR...

If one were to copy/paste the sort of code samples which show up when one Googles for [Android SecureRandom], one would more than likely call setSeed, possibly in such a fashion as to duplicate seeds and, predictably, make the output of the random number generator deterministic.

I will leave it to one's individual judgement as to whether "It is unlikely a serious developer would copy/paste in crypto code into a project that has real money on the line" is descriptive of the prevalent standard of care in engineering in the Bitcoin community.
Obviously we can't know O'Donnell's motives for being condescending and dismissive.

But that's just another reason that's a bad idea to be a jerk--people might misattribute the motivations behind your dickishness.
Holy crap, everyone here needs to take a deep breath. And, preferably, look at the law itself (not just this article). Despite the author wringing his hands and clutching his pearls about how this law is soooooo hard to understand, it's really not that complicated. It's a sales tax. It works like sales taxes tend to work, with similar distinctions between industrial product (sold as a good) and bespoke construction (sold as a service), and with similar handling of inter-state purchases (if you have a nexus in MA and sell to someone there, you collect, and if you don't have a nexus in MA, they're responsible for use tax).

Let's not mistake the fact that people don't like taxes for some sort of deep, abiding flaw in the legal situation.

(Now, the complaint that implementation was too sudden, that's totally valid. They should have had a several-month gap between passing the law and the tax kicking in.)
Looks like 55 BTC is about $5448 according to Bitcoin Charts's [1] currency converter.

[1] http://bitcoincharts.com/
I strongly recommend listening to his Quakecon keynote in full. It meanders over a huge variety of topics and I personally find him a very engaging and easy to listen to orator.
Sure, but I see people going at each other like this all the time on TV, regardless of gender - we no longer have the mutual respect of the Edward R. Murrow days. I think this is actually how Bill O Reilly speaks to every single one of his (predominantly male) guests.
ok, a better example. The point remains that the body can do amazing things to survive once it reaches the point of possibly no return.

"Cold comfort: hibernation helped man survive 24 days in wild"

http://www.smh.com.au/articles/2006/12/21/1166290678782.html
Screw everyone. You guys shipped an OS.
>They are far less productive than engineers -- all they do is argue all day and not create anything of value.

Proof? This is worthless of a statement as

"[Lawyers] are far less productive than engineers -- all they do is read reddit all day and not create anything of value."
They were explicitly seeding SecureRandom?
If that's the problem, it does lead to a beautiful solution of fixing bugs by removing code entirely.
It's still showing not encrypted on the screen which allows all sort of possibilities when done on a browser. For example, let's say you're using Chrome, hard to make sure page contents are not being used somehow.
Lest we think everything's lost, Thomas Pornin's RFC to fix (EC)DSA's need for good randomness when signing was published this month [1]. The approach is similar to Dan Bernstein et al's EdDSA.

[1] http://tools.ietf.org/html/rfc6979
Sites like gmail.com?
How do they remove the CO2?
The area that I would be the most critical of the benchmarks is that it's unclear whether frameworks that use process based concurrency are being set up well. With frameworks that use process based concurrency, generally one wants to run as many processes as can fit in RAM with a nice amount of headroom. That way, when one app process is waiting on I/O, another will be handling another request (and the operating system handles the context switching).

Right now, the setup.py for Django specifies that it will create 3 * NCPU worker processes. On the i7, that would probably be 24 processes and possibly using an eighth of the RAM in the box. Similarly, for Rails, the Unicorn configuration specifies 8 worker processes (one process per GB of RAM) regardless of whether it's on EC2 or the i7 (while Django goes from 6 to 24 processes depending on the box it's on since it's 3 * NCPU). For all we know, the CPU usage might be around 25% and the RAM usage even less. As such, it's hard to determine if the speed achieved is because of the limitations in the framework or whether the box is simply being under-utilized due to sub-optimal configuration.

If you're going to do another around, more than any other changes, I think a view of the CPU and RAM usage would really help - if for no other reason than to show that the test is accurate. Right now, I have questions about whether the process concurrency frameworks are well set-up. Why would Django benefit from getting 4x the number of worker processes on the i7, but not Rails? Is 24 processes utilizing the i7 box with Django? CPU and RAM numbers would help provide answers.
I would like to see schooling evolve into a loose association between learners and access to learning resources (virtual and physical). I've learned far more outside formal schooling than within (at all levels up to phd).

That said, this particular article is hyperbole, as creating a institutional brand like Harvard is something you do not say you are going to do. A great example of this in recent history is Y-Combinator.

The perception of quality comes from actual quality.
The same guy who did the same for Quicktime and tons of other programs back in the day...
A secure random number generator wouldn't seed based on time in the first place, though.
I think it would be interesting if respective technology vendors could be motivated to tune the configuration, and be bound by some rules. eWeek did a DB shootout like this 10 years ago, and (as the rumor goes) led to the creation of the MySQL query cache to specifically beat the benchmark.

Getting the various vendors involved would require a lot of clout though :(

Here is some commentary on the MySQL configuration:
https://github.com/TechEmpower/FrameworkBenchmarks/blob/mast...

* innodb_log_flush_at_trx_commit is not specified, so it's going to default to 1 (durable). This is a little unfair, since other databases won't do this.

* innodb_buffer_pool_size isn't specified, so it's going to default to 128M. A database that uses mmap files will have an atvantage here - since it can automatically use free memory and won't require this level of tuning.

* I thought it was fair to disable query cache though :)
Apples and Oranges. I'm talking rates, you're talking dollars. People in MA make and spend more money than people in Alabama, so you'd have a higher per-capita tax burden even with lower rates in MA.

Per capita income minus dollars taxed or the ratio of the two might be a better measure than either of ours for what you're trying to get at.

Point being, the rates are low and could easily be added to without dumb-ass industry specific things like this.
Introducing SpkrBar.com - An online community for the conference world.
Well there is this paper: http://www.scribd.com/doc/131955288/Randomly-Failed-The-Stat...

Quote:

> Apache Harmony revealed multiple weaknesses caused by implementation bugs. As a part of Android a plethora of cryptographic functions [17] rely on this PRNG. One of the bugs addresses directly the Android platform, where as the second one only targets Apache Harmony.
Sounds like a candidate to go right next to epipens in "stuff that we're crazy for not putting in every first aid kit".
The 'sticker price' comparison is really misleading here. I don't think the Wall Street Journal do anything to correct this. Here's what the article says:

> A degree [at Minerva] will cost less than half the average top-end private education, which is now over $50,000 a year

At Harvard today, the minority of students pay full price. Over 70% of the undergraduate student body are on scholarship. Notably, if your family earns less than $65,000 per year you will pay nothing to attend.

Minerva wants to charge students $20,000. There is, as far as I can tell, no financial aid policy or bursaries available. And why would there be - Minerva is, after all, for-profit.

If your family is at or below the median household income in the US then Minerva is an extremely expensive proposition. Whereas at Harvard, and many other colleges, it's free.
here's some course materials

http://www.cse.chalmers.se/edu/course/afp/lectures.html

http://www.scs.stanford.edu/11au-cs240h/notes/

http://www.seas.upenn.edu/~cis194/lectures.html
My 32-year-old co-founder has a brain tumor
Why wonder, you answered your own question already. Its just convenience... Hard to measure security against the productivity of dual displays.
What's the big deal about consciousness anyway??

I don't see the 'magic' about being self-aware.
Surely it just a step up the cognitive ladder from existing without awareness.
Can you please not be so abrasive on HN? Your points may be correct, but your tone is exactly what we're trying hard to avoid here.
They don't, is my understanding. Not healthy, but healthier than no oxygen, so might be useful in some emergency situations.
Bitcoin/Android Security Hole Discovered
Beyond the Quantified Self
The best home based business
None of what you are saying about mplayer has been true for years. And it has never been necessary to download codec packs for mplayer2.
The value of great institutions lies not merely in education, but in bringing great people together. Simply attracting already smart people (or determined and otherwise talented people) is a value in and of itself.
I don't think real Philosophical Zombie will be indistinguishable from a normal human being.

If it would, why aren't we all Philosophical Zombies? Why have we evolved to have consciousness? And that seems probable.
Scroll down to "What if my website isn't coming from a server?" which should cover Firefox OS.
while i don't have a handy link doubting this one, there's not actually any proof that he really spent 24 days "hibernating"
On the other hand, the author of the Bitcoin Wallet Android app thinks it's a SecureRandom problem: https://code.google.com/p/bitcoin-wallet/source/detail?name=...
Seems that some invocations of SecureRandom were able to always get the same result.

http://blog.kchandrahasa.com/blog/2013/08/09/android-4-dot-2...

However I've read somewhere that now apparently even Android 4.2 is affected which would mean there's something more? Whoever knows more, please write more technical details.
Especially considering the "terrorists" are actual employees.
There's obviously something wrong with the numbers. It's too dramatic of a change, both in terms of magnitude and in immediacy, for it to be due to a simple content tweak.

Pages/Visit is stable yet Bounce Rate suddenly dropped significantly.
“Life is far too important a thing ever to talk seriously about.”
Oscar Wilde
this guy is all about talking - compare that with Udacity or Khan.
Slingshot looks pretty much like a non-fullscreen version of Launchpad[1].

[1]http://upload.wikimedia.org/wikipedia/en/3/3c/Lion_Launchpad...
Why should it?

For one, it provides the welcome ability to bring topics up in Hacker News again, where they might get accepted better the second or third time (e.g because more people are online at the time of the second submission).

If the "deduplication algorithm" had "handled this case", then we would only be left with the first submission (a dead discussion), whereas as it is, HN users have now caught on to this PEP news and we have a discussion going on.
It's certainly worth thinking about longer than the author has. I don't want to be mean, but the part about QM, in particular, was just infuriating.

I wish we could send out a memo to the world that says "Please do not draw metaphysical conclusions from mathematics or science unless you are an expert on the field you are drawing conclusions from."
Sticker Works Like an Anti-Mosquito Force Field
Even if "Minerva" was $1/year, the question is one of value. A degree from Harvard at $50k/year is more valuable than a free one from a UC Berkeley Dean's scholarship student (which is probably about the same difficulty to attain), simply due to the perception it engenders from people that matter.
You're quite right. It's almost unusable on Windows in its default configuration.

I particularly like how difficult it is to toggle full-screen playback with the keyboard. F11 makes it full screen, but doesn't hide the controls. Ctrl-H hides the controls, but also disables keyboard shortcuts!

So now, when you want to get out of full-screen mode, you have to know that you need to press Esc followed by F11. Not even double-click gets you back to windowed mode.

This kind of asymmetric mode toggling drives me up the walls. That, and the fact it doesn't pause when you click the video.
Or just someone without medical training going by what they see, I mean I look at my veins in my arms and they look blue but I have no idea why that is.
To the degree feasible given the breadth of submissions we've received, we have worked to ensure that frameworks that use process-level concurrency are configured to in fact use multiple processes. See question #5 from our questions section [1].

That said, across the board, inclusive of both process-concurrent and thread-concurrent frameworks, we never rule out the possibility of a configuration glitch. We've asked that any subject-matter experts for any framework perceived as underperforming review the code and configuration. To date, we've received a great deal of pull requests to deal with many such matters. On the other hand, very few such tweaks have had a significant impact on performance data.

We do intend to capture CPU, network, and IO utilization in the future. For the time being, we invite fans/SMEs to review the code, run the tests on their own multi-core machine and/or EC2 instances and determine if there is room for improvement.

[1] http://www.techempower.com/benchmarks/#section=motivation
As someone living and working in London, I pass more than a couple of these 'bins' every single day.

These bins are quite strategically placed (1) in the heart of the square mile - the prime financial district and tourist hub of London city (2) especially around bus stops and city squares in this area - which have some form or other of free city wide wifi networks - where one would be waiting for enough time (consuming lunch, waiting for bus, meeting a friend, shopping...) to be an ideal consumer for targeted advertisement.

They also have an extremely amusing design which makes them look slick - but extremely unlike waste bins - infact you have to look at them closely to find where you need to dispose off your waste. This was one thing that amused me extremely when I first saw them - the strange inconspicuous design - but things make much more sense in the light of this article.

As someone who's targeted more than once a day by these things, I see this as a breach of privacy and expect to be informed that data about me is being collected and stored and maybe used for commercial purposes in the future (irrespective of the ICO technicalities and loop holes).

As a human, its a fundamental breach of trust and I would personally not see these things with the same inconspicuousness they have been designed with to deceptively integrate and blend into our daily environment.
you should use your OS's CSPRNG (here, /dev/random) to the exclusion of any other RNG

Bad advice. Use your OS's CSPRNG to get a seed, but work with your own PRNG (say, HMAC_DRBG) internally. Going to the OS every time you want a few bits is both very slow and makes it far easier for local attackers to see when you're using entropy.
Well, one of the things I need is for it to be built in the standard library, so not, numby/scipy doesn't have everything I need.
This is why I personally refuse to engage in any discussions about race or gender issues except online. Low reward, with a high risk of a career-ending brand as a sexist or racist asshole.
> we should be focusing on where real and big problems
> lie: education for the masses, at affordable prices.

You might be interested to read about the Cristo Rey school network — a group of highschools aimed at exactly that. A buddy of mine is working at the Philly one this summer which is why I've heard of it. Here's the history page: http://www.cristoreynetwork.org/page.cfm?p=367
Looks updated now! (make sure to do "brew update" first to get updated package list).
I have done a bit of source diving in response to your question, and the answer is that all I can provide is the bitcoiners' announcement:

https://bitcointalk.org/index.php?topic=271831.0

They claim the problem lies with 'a component of Android'. One of them told me that the solution was to switch from using SecureRandom to reading /dev/urandom directly. The actual source changes appear not to be public, and he wouldn't tell me details about the issue.

I tried to find the usages of SecureRandom in a couple of the apps that are supposed to be affected, but a cursory search didn't turn up much. I suspect it's inside some library that I don't know to look inside. The question, I guess, is whether all the affected apps share the same library or not -- I don't _think_ so, but if they do it would dramatically reduce my confidence that the issue lies with the Android platform, as claimed.
Check out site44.com - it's an off-the-shelf solution to do this.
Here's an example of how water brands vary:

http://www.ehow.com/facts_6961715_bottled-water-brands-compa...

It is idiotic to believe all water is equivalent. Indeed, a lot of the marketing around brands is ridiculous but it's not quite the same thing.
What is "cognitive ladder"? Where does it come from? How many steps does it have? Are we the last one?
The bug described here isn't sufficient to generate repeated DSA k-values, even if it is still in the code†, which is unlikely. It seems more likely that the application code used SecureRandom insecurely, as described upthread.

† It's virtually certain not to be in the code, since Android's CSPRNG is based on OpenSSL now, not Harmony's built-in CSPRNG.
Splitting a Clojure namespace over multiple files
Absolutely! I uploaded it as single segment at https://www.youtube.com/watch?v=o2bH7da_9Os , will archive it to archive.org shortly.
Don't know. This just seemed like the high-percentage guess.
I disagree, because in Texas, the sales tax is significantly more clear who is affected. "You have an office in Texas, you pay tax" is pretty simple.
Whoops! I meant Alvin Maker. Well, I'm not a huge fan of Donaldson either, for whatever that's worth.
Prototype
We desperately need help building out our prototype (www.insp-i.com). Can you guys help?
>Over 70% of the undergraduate student body are on scholarship.

I am not sure if aid and scholarship are the same thing. But according to this
http://www.thecrimson.com/article/2012/1/26/diversity-lack-f...
Over 45% of students dont even qualify for aid because their parental income is over $200,000

" we come to the stunning conclusion that approximately 45.6 percent of Harvard undergraduates come from families with incomes above $200,000, placing them in the top 3.8 percent of American households. Even more shockingly, only about 4 percent of Harvard undergraduates come from the bottom quintile of U.S. incomes and a mere 17.8 percent come from the bottom three quintiles of U.S. incomes."

Which also means that over half the students wouldn't care much about the cost of tuition.
Please don't put words in my mouth. There is a difference between "not caring if it benefits people" and making increasing our audience our #1 priority.

We care about spreading our efforts. We care about having a nice public face and benefiting as many people as possible.

I was reacting to the more crude notion of "user acquisition". That is absolutely NOT our goal; our goal is to build something great. I was viewing the term "user acquisition" as "focus on getting as many people to use our product as possible".

I think you mistook what I intended to say, and if I was not clear, I apologize. But please don't think that I'm saying we couldn't care less about spreading what we've created and making it beneficial to as many people as possible. I'm saying that we care deeply about building something great, and that is our primary focus, not convincing people to use it.
Thanks for that messagevault link - looks like a nice stripped down version of the self-editing, cross-platform file idea, which I hadn't heard expressed quite a succinctly as you just put it.
A lot of people check the comments before reading an article. My comment is intended as some sort of public service announcement: don't bother reading the article. I think there's value in that.

Of course, if I posted a blog post with the same contents and titled it "Consciousness is worth thinking about: a rebuttal" it would certainly deserve to get flagged.
The sun will come out tomorrow... even if Ubuntu Edge doesn't make $32 million
I faced recently scaling/refactoring problems due to way too large models and some kind of callback-hell baked in. instead of just "drag-n-drop" model code to concerns/mixins/..., have a look at https://github.com/cypriss/mutations to extract business logic in a clear way. This was just a life-saver for my team, this should be preferred over "stuff any logic in your models", at least from my point of view.
The other reason that finance people typically won't go for blue sky stuff is that they need to cash out within 10 years; a few years to select and kick start investments, 5 years of hard work by investees, then a few years for cash out, IPO or sale (preferably cash). There isn't the timeframe in there for R&D.
Wow, this is great. Looking forward to the completed book!
I appreciate the reponse - OneNote/EverNote are orders of magnitude more powerful; I think they make more sense in a 'cloud world'.
Actually, someone elsewhere in the thread has found, and linked, the bugfix commit, in another Android bitcoin wallet:

https://code.google.com/p/bitcoin-wallet/source/detail?name=...

So literally they're just ripping out SecureRandom and replacing it with their own stub that reads /dev/urandom.
Building Mobile Friendly Websites with MVC 4 (The easy way)
He's actually wrong. If you read the executive orders that set up the legal basis for the classification system, it says to err on the side of lowering classification. I.e. not everything should be classified.
_utm.gif is apparently requested 3 times with the same google analytics account id.