skysight-inc/HackerNews huggingface dataset:
This was something that really prevented me from pursuing Firebase as a real asset, despite its easy real time socket magic. If there's a diagram to "roll your own" after, though, it's probably moot (forums/ chat). Their json-rpc server has a really slick api and they've spent a lot of time on problems such as authentication and data security.

You could argue that moot is just a very well designed Firebase app as far as security permissions go, but at least it's proof that it's possible to rely entirely on pub/sub for your app and be fast, scalable, and successful.
If you had graduated in the 60s or 70s (or even 80s) chances are that you wouldn't have worked in Computer Science at all. Today you can choose from a vast field of possibilities. Keep looking and go to the edge of one area
>>> Of course there is. You could, for example, survey developers

So objective measure is which language is preferred by more people? I'm not sure how it is an objective measure but I'm pretty sure PHP would win on that.

>>> If you wanted to be more scientific, you could

Nobody even did that. I still encounter a lot of people speaking as if they personally did.

>>> don't actually have that much experience working with a language like python or ruby

That's meaningless argument because it can not be disproven by any possible means - for each counterexample I provide of people that know a lot of languages and still think PHP is ok you'd say "well, and I know hundred PHP developers who don't know any other language". Maybe you do, maybe you don't - how anybody could consider that an objective measure of anything or a measure of anything except the characteristic of people you are surrounding yourself with?

>>> It's rare to find people with lots of experience in both php and ruby/python who prefer php.

What is rare? I know a number of people who could work very well in any common language, but that means nothing - I could also write "I know hundreds of people that know all languages in the world and prefer PHP". Your personal acquaintances don't like PHP, so what? My personal acquaintances don't speak Mandarin. Does it mean nobody speaks Mandarin or Mandarin is a failed language? It just says something about me, not about Mandarin.
I won't use it - it doesn't end in .ly
Why would you use a password at all? Use keyfiles for everything encrypted and then use keypassx with dropbox sync or 1password/lastpass if you can afford it.
That's a great tip. I occasionally sit through a somewhat exotic variant: I imagine I can take to flight like a bird (slow flight only, not like Superman) and mentally take off from the balcony and imagine what the town would look like from above. The end of the exercise would be taking a full trip and 'returning' home.

It's a bit more engaging to figure out the aerial view of a place you normally navigate only by road. It's very hard to sustain this practice for even a minute or two initially.
I'm pretty sure I said this exact same thing when my boss finally figured out that this issue was causing a script we use to fail on the BOMs I was trying to release. It took an embarrassing amount of time for a few engineers to figure that one out.
This reminds me of a fun thing that happened to my colleagues a few years ago (weeks prior to me joining them). They were working on a router pimped with some home automation features (Z-Wave/ZigBee interfacing & co.); the baseboard that the HW provider was offering had 2 Ethernet ports, but they wanted four. They informed them they don't have a four-port version, so they asked if a custom one can be made, extending the current design.

The answer (in a strong Chinese accent)? "Noooo we can't do extended custom design hitishu".

They were baffled. Sure, they understood the "can't do extended custom design part", but the last word was entirely foreign to them. They tried to dig deeper, but all they got was "if we extend cable network we have hitishu".

The talks continued, in order to explore some alternatives; while the business guys did their talking, one of my colleagues figured what this hitishu gizmo was by accident; a few days later, he accidentally touched one of the chips on the board and burnt his fingers. The problem was that the processor they were using was already fairly loaded and, due to the design of the case, couldn't be properly ventilated. They feared that pushing it even harder could get it to heat up even more, which would have lead to heat issues.
The popular myth you mean. Human brain is crap RNG and producer of entropy no matter what you do - it will still be crap.
>>> is that it's populated by many young, inexperienced developers.

It's not a bug, it's a feature. PHP is by design the language for young, inexperienced developers. It's like saying the only problem a school has is that it's full of kids.
Really? I've lived in Austin on and off for 5 or 6 years now, and i35 is hell now. There's far more people now. Also, we currently have a horrible drought, that's a reason why I'm considering leaving if people keep moving in.
200k is not a lot of money, especially when competing against a multi-billion dollar company that has had a number of years head start.

Furthermore, the advantage the project provided was never really clear from a laymen's perspective. My bias belief is that most people don't love Facebook but don't have a necessary reason to move elsewhere especially when a social network relies on ones social network. IMO, G+ has a prettier UI and some cooler features. But while a lot of my network has joined, few have used it again after launch.

Ultimately if they were to have done it again years back, I think it would've been interesting to do a pure mobile social networking app. Again bias perspective, but I've noticed most of my online interactions with friends nowadays isn't through Facebook, e-mail, or Twitter, but through Whatsapp, Snapchat, Instagram (yes, I know Facebook bought them) and Vine.
For "basestation" read "the network". The partitioning of responsibility within a GSM network is relevant to this attack only in regards to which component maintains the "signals-pending table". There are a number of different locations this could be stored, depending on how the network is setup.

They are doubtless using osmocom-bb, which is an open source baseband implementation for a number of older phones using an old baseband board. The implementation of the attack is not relevant to the attack itself. You could implement it with an SDR, or with osmocom-bb compatible boards, or whatever. It is still a race condition that they've figured out how to win.

The solution is simple. The network needs to maintain to "signals-pending table" entry for a mobile until it successfully authenticates, or the entry times out. If they are flushing the entry after an unsuccessful authentication attempt then it enables a DoS, such as this one. I still have a hard time believing this is how it actually works because it seems like the network is behaving incorrectly.
Yeah, what does that even mean? What are independent sources with TSA or DHS? And whatever they are, how did a random blogger contact them all?
May I reply with a Russian proverb?

“If mushrooms grew in the mouth, that would be not mouth but kitchen garden.”
Firebase's solution isn't difficult to configure, it's just more difficult when you contrast it with the simplicity and grace provided by the rest of their product.

My startup is addressing the usability mainly by acting as a proxy to a client's sensitive data storage, and providing a sane set of defaults for very specific applications.

This space is awesome, and so is Firebase - Client-side apps are incredibly attractive for MVP development - it's almost as slick a feeling as moving from PHP to Rails 10 years ago :)
Just curious, what database is that? If the index on id is a B+ tree rather than a hashtable, it's very unlikely id > 100 would be slower. You are issuing one query with it vs. N queries with the 2nd approach.

Were there a lot of qualified rows for id > 100? If there're a million rows qualified for id > 100, which way is faster?
Also, surely the presence of beta waves (12-30Hz) needs to be detected by an electroencephalogram (EEG), not fMRI? I thought fMRI has a much lower temporal resolution (~1Hz).
Workaround for bug in Excel 97 - Move Your Mouse Pointer
I'm pretty sure I know what "airline emerging media consultant" means: http://socialmediadouchebag.net/
Most people only type their pathnames occasionally and often use descriptive sentences to avoid confusion when clicking.
Basically by disallowing read access to /users in the Firebase security rules (which you should do), the latter 50% of the article would be moot. However the html injection is interesting, be extra careful to validate data when using dynamic jquery-selectors?
> I wish I didn't have to use Facebook.

Your wish can still come true have you tried friendica? Of course the project never got hyped at all no one gave enough money to them but It has almost all features including the federation. After proving himself ones the author of software Mike McGravin has moved on to create much more stable scalable Red#

[1] http://github.com/friendica/friendica/
[2] http://github.com/friendica/red

I always feel bad when Diaspora gets hyped and real valuable project like friendica doesn't get any credits :(
Probably the least painful way going forward is to use Heroku.

If you do not use Heroku, you will probably want to use Capistrano/Deprec to automate deployment. They can be a little fiddly, but they beat the heck out of doing it manually.
I actually rather enjoyed the commercial. Other than the "Designed by Apple in California" text that appeared, I found it to be heartwarming.
"Mr. Mukerjee refused additional screening"

No. Mr. Mukherjee refused screening in private. It's unacceptable to be unconsensually screened in private without a third party (I.E. not TSA officer) witness. I've refused to be screened in private, the TSA makes it VERY hard for you to do that, and I definitely got verbally agitated. How would you feel if there you were exposed to a significant risk of being sexually assaulted with no witnesses present?

"This is absolutely correct, at this time he was in limbo, he was not being detained, but he could not leave."

That is completely unacceptable.

Once you are threatened with sexual assault, it is unreasonable to expect to be anything besides "aggressive evasive".
There is also flagging, which allows people to artificially force articles down.

It happens all the time on sexism-in-tech articles.
Why exactly do you need stored procedures in sqlite? You can just write code. Are you using it in a scenario where you can't write code to interact with sqlite?
I don't disagree with you, but I think the media coverage was worth a lot more than the $200k -- and they received a lot of media coverage.
For now, crypto should be done via a native client. In the case of encrypted p2p communication, clients such as http://retroshare.sourceforge.net/ get the job done nicely.
with increasingly decent phone cameras, and everybody seemingly buying a DSLR to start a "Johns Photography" page, facebook will have to respond to this - currently their compression is horrible
Except I am on Excel 2003. The company is slowly moving to 201x although (can't remember the version, the email subject was "digital toolbox" and thus I directly deleted it).
Stripe launches German beta
Excel 2007.
Really?

What a bunch of jerks--hasn't this been standard behavior for quite some time?
Not all salmon is of same grade. Only highest grade can be eaten raw. Unless you buy "sushi-ready" salmon I'd not advise raw salmon.
I had some ideas about how to address this:

The return address is contained inside the encrypted portion of the message so only the recipient can see which address sent the message. The message should also be cryptographically signed with the senders private key so that the sender can be verified.

Next, the DHT key would likely be a hash of the recipients address so it would be difficult or impossible to determine who the messages in a specific bucket belongs to. Also since the service would only be accessed through tor or i2p, the actual sender and receiver would be hidden. Obviously the recipient address (or rather DHT key) must be known so that the message can go to the right place.

Also obviously anyone can technically retrieve anyone else's messages but since they are encrypted this shouldn't matter.
Where in Texas are you? If you're in Houston or Austin and don't need super deep technical skills, hit me up, I might be able to connect you with some people (email in profile)
Slightly off topic

Helvetica Neue Light - iOS Development
So what you are saying is that Haskell forces you to understand the problem for which you are implementing a solution, and this is bad because often that is too hard.

Instead one should be able to just hack away until the code kind of does what they want (even though they can't prove anything about that piece of code) because that is the only way to really manage inherently complex problems?

The older I get the less I find writing code an attractive method for understanding a problem. I also find utilizing something like a type system to enforce invariants in code liberating - and actually conducive to solving problems.
Show HN: ElcomSoft productizes live forensic data recovery from iCloud backups
From the recent Ars article on cracking long passphrases;

"The new version of Hashcat came two days after developers for Russia-based ElcomSoft updated the company's Phone Password Breaker software. The fee-based forensic tool now supports the selective recovery of certain types of data stored in Apple's iCloud service. The new version allows users to retrieve contacts, call logs, pictures, or other specific types of backed up data without having possession of the original iPhone, as long as the attacker has the user's Apple ID and password."

See it on ElcomSoft's site here: http://www.elcomsoft.com/PR/iCloud.html

"ElcomSoft Co. Ltd. discovers yet another way to access information stored in Apple iOS devices by retrieving online backups from Apple iCloud storage. The company updates Elcomsoft Phone Password Breaker, a tool to retrieve user content from password-protected backups created by Apple iOS devices and BlackBerry smartphones, with the ability to retrieve iPhones’ user data from iCloud. No lengthy attacks and no physical access to an iPhone device are required: the data is downloaded directly onto investigators’ computers (PC) from Apple remote storage facilities in plain, unencrypted form. Backups to multiple devices registered with the same Apple ID can be effortlessly retrieved. Investigators need to know user’s original Apple ID and password in order to gain access to online backups."
The middle click to paste is one of the great features I use continuously, and often show to windows users who find it useful too.
Requiring Security Rules is a bad idea and would really stall the work flow in projects where you don't need them. I have one of those where I don't care if people manipulate the data via the console.

Anyway, the Firebase team should really address these security issues that keep coming up all the time.
Sometimes I get the feeling that there are only idiots or assholes working on gnome :-/

It all started with this whole: "Yeah - let's dumb it all down."-movement.

"Improvements" like these are just disgusting.
(Edit: This falls into the same category of great ideas like the "spatial nautilus".)
It is letting folks know you may be asserting it after the fact and you aren't waiving your right. What you are doing is establishing that the search isn't voluntary and that your cooperation is not consent.

I don't know how different circuits would look at it. My understanding is that this would not be effective in the 5th and 11th circuits since they hold that you consent to searches when you get in line and you can't revoke that consent. But other circuits haven't gone that far. That means that if they want to hold the search as lawful, they have to establish that it is a valid administrative search, and that consent is not required.

It would be clearer if "you may" was replaced by "I am aware you may" clarifying that this is not permission but a statement of possibilities.
passwords will continue to be the weakest link in the chain for many systems until we start forcing uniqueness:

every webmaster/admin cracks their collection of hashes against common wordlists, and if any given password appears too often (or at all, against a weak wordlist), user is forced to change it.

"But complex passwords are too difficult to remember"

Not necessarily:

JanesDogIsCalledHarry!9482

"Must I have a different one of those for every service?!"

Nope. ebay, twitter,facebook:

JanesDogEbIsCalledHarry!9482

JanesDogTwIsCalledHarry!9482

JanesDogFaIsCalledHarry!9482

also, as has been pointed out - bcrypt.

are there any hash ciphers that allow offline cost stretching yet?
If you are using sqlite for hosting a production scale app, you are doing it wrong.

If you want an database for your mobile app, or a web app use a full fledged database like MySQL or Postgres.

sqlite is for embedded storage applications, especially in the backend. Where the resource utilization foot print is supposed to be minimum, and where you running into situations where are you are reimplementing SQL like DSL's to query and write to files. Or say you just wish to maintain some structured form of inventory.

Best example I can give you is a web browser. There is a requirement to store a good deal of structured information, in a mechanism which requires little resource utilization, which doesn't require additional software like demons or a server to run or complicated deploy and maintain scenarios. Or even a strict configuration.

If you look at this use case you will see tons of backend application would be better off using a tool like sqlite than play with huge xmls and endless rewrite parts of SQL badly.
This change was backed out: https://git.gnome.org/browse/gnome-settings-daemon/commit/pl...
As someone who isn't doing web programming, this "app culture" is grinding my gears.

I respect a fellow coder's work. I'm sure a lot of hard work went into all those applications listed there (of which, frankly, I haven't heard, because if I want to share something with my friends I upload it on my server and be done with it), but people ought to be more aware of their own smallness. You don't base your enterprise on making (and hosting, and maintaining!) the nth fucking website that essentially offers something that should simply be a feature of a social network. Especially if it's something like a shared album. Who the hell invests money into a business whose end product is basically one week's work away for the company which already provides services to 99.99% percent of the people need that product?

Wishing for a niche to be there doesn't magically make it poof into existence.
I'm guilty as anyone of being a xenophile, but the analogy doesn't hold for scale reasons:

The CEO of a startup is the leader and public face, so should be in command of the company's message. If this person cannot make themselves understood, their odds of success are zilch a priori.

If anything, a big football shop is a highly-adapted enterprise with tons of cash that can afford extravagance. They have already scaled and can afford specialized subject-matter experts with multitudes of baggage.

In an early startup, you need "go doers": those that are infinitely more capable on average to either get shit done or know what shit actually needs doing (and fast). Later on, the time will be right to bring on more specialized people as the early founders may start to get bored.
Judge Approves Facebook’s $20M “Sponsored Stories” Settlement
Someone more knowledgeable than me, please correct my presumptuous understanding, because this seems easily mitigated.

I would imagine that, like with your home network, cell phones have multiple addressing schemes in a network. So there's your phone number, but there's also some kind of network address that I have received from the carrier, and then probably some kind of address that refers to my connection with the tower.

I would assume that something similar to ARP goes on here. A message comes in for 415xxxxxxx, my phone. When AT&T gets it, they determine that phone number is network address 1234, and they have some system that says 1234 is currently in tower X. Tower X gets the message and broadcasts a request for the phone corresponding to device 1234. At this point, pirate device with tower address ABCD responds that it is, falsely, AT&T's 1234. The message is then sent to the the phone whose address in tower space is ABCD. My phone was actually DEFG but I couldn't reply fast enough.

So, if this pirate phone responds to multiple requests, for multiple AT&T subscriber addresses, claiming to have all those addresses, can't the tower just cap it at like 3 addresses? After that can't it be determined to be a pirate device and disconnected from the network? If one device claims messages intended for more than 3 addresses, isn't it safe to say it's faulty or spoofing?

Where am I wrong here? It seems like this level of ability should be built into a protocol that requires recipients to identify themselves? Like if I issue an ARP request on my Ethernet network, and the same MAC address always comes back, that would be a detectable attack (assuming it was not my gateway). Isn't this the same principle?
More details here:

https://bugzilla.gnome.org/show_bug.cgi?id=665193

Sometwhat telling:

(In reply to comment #2)
> Breaking a default that has been in X forever is not
desirable. In this case,
> it is a good default. Leave it alone. Bastien, please
do not do this.

Disabling broken behaviour by default is a good thing. It
would be a GTK+ specific XSetting, which would only be
disabled by default based on your XSettings manager. If
you use gnome-settings-daemon, then it would be disabled
by default.

The people that paste their passwords to IRC will thank us.

Literally everyone in the bug thread is like "Please, don't do this/why would you do this?" and Bastien is like "nope nope better for the users hush".

What a bunch of tools.
when declare and init an obj with constructor, yes it's annoying to type the type twice and I def. use `var`

But what if you're doing something like

var x = myOtherObjectName.y;

readability is destroyed in this case.
My favorite experience with it was trying to deal with a zip file of "C:\Documents and Settings\" from an old computer that happened to contain multiple files whose paths were 255 characters long or so. You couldn't unzip it in a subdirectory of "C:\" because one of the resulting paths would be too long and cause the built-in zip program to crash/fail entirely. Using 7zip was the eventual solution.

On a related topic, do you know how difficult it is to search for files whose path are above a certain length on a fresh/default Windows setup? I eventually resorted to installing Python on it just to write a script to do it.
They call it Party Mode, and they demoed it at the 2012 I/O.
Although this particular feature isn't going to affect me, since I'm primarily a touchpad user, I'm not a fan of the path they're going with imitating iOS-style selection handles. Sure, they can be useful if you only have a touchscreen, but seem to always look ugly and feel awkward to use.
Great. They "defered this change until the next cycle."