skysight-inc/HackerNews huggingface dataset:
> He is right about how specific the circumstances are that give rise to Bard's CBC IV attack. Not only that, but BEAST itself was the product of a former NSA cryptologist, now a Wisconsin university math professor; it is vanishingly unlikely that it was common knowledge inside of NSA, since the guy PUBLISHED it just a year or two after leaving the agency.

I don't think BEAST was a product of Bard. If we read Bard's papers then we probably never came up with BEAST [1]. Bard wanted to apply Rogaway-Dai's attack to SSL, but he didn't understand how browsers worked. His papers didn't target cookies - in fact he didn't even mention that word - but he wanted to decrypt short PIN sent in POST requests, which is impossible as far as I can tell. The reason we cited Bard was because his English is much better than us, so we'd thought that we could re-use his explanation of Rogaway-Dai's attack in the context of SSL. In other words, we both attempted to exploit the same vulnerability, but we used different approaches and targeted different secrets.

Another way to look at this: imagine if one reads Bard's do you think if he or she could use any of Bard's ideas to invent new BEASTies attacks, e.g., CRIME, Lucky 13, the RC4 attack, <your attack here>?
> "one person suggested banning any Haskell based solution" -- that's pretty much literally calling a taboo on Haskell.

Personally, I would love to call this nonsense out: Say, "OK, you get to lead a team that is prohibited from using any Haskell-based solution. My team will compete with yours and must use a Haskell-based solution. May the best team win."
I think conflating the issue with trademarks narrows my definition. "For its own sake" means registering a domain for no incentive beyond the status or vanity of holding that name, i.e. just because it looks cool or it's short, funny or memorable.

I still think it's squatting if I registered yoursurname.com, even though it's not a trademark and wouldn't meet your definition under the ACPA.

I still think it's squatting if I have no intention of ragging you in to buying yoursurname.com from me. Maybe I just derive satisfaction from having something you want?
When you're president of the US, you don't get to pass the buck. Sorry, but Obama deserves all the criticism for this.
> Wait a second, "prospective" trial does not mean that you draw patients from a pool who have no interest in treatment.

Then it's a good thing that I never said or implied that. The subjects must be drawn from a uniform population, not from a population that have already come forward for treatment -- otherwise the result is biased by the experimental population at the outset.

> Prospective simply means you have decided what the endpoints will be before the trial begins.

No, it means the experimental design doesn't recruit from a pre-existing population of subjects with a history or established preferences, instead you choose random subjects from the population at large.

> The inverse of a prospective trial is a retrospective trial where you have a set of data and you go looking for signals.

There's nothing stopping you from actually learning what these terms mean. A prospective study recruits subjects from the population at large, people with no particular interest in, or knowledge of, the topic being studied. A retrospective study relies on self-selected subjects, people who are already engaged with what you want to study.

For example, let's say I want to study the link between daily vitamin use and intelligence -- do people who take a daily vitamin become more intelligent as a result?

I begin to design a study. Shall I enlist people who already take a daily vitamin (retrospective), or do I enlist people with no interest in the issue, divide them into two groups, make one of the two groups take a daily vitamin, and make the other group take a placebo (prospective)?

See the difference? In the retrospective, any conclusion I make may result from a confusion of cause and effect -- for example, if the vitamin-takers turn out to be more intelligent, that might result from a factor like intelligent people taking a vitamin because of their increased awareness of health issues, in other words, it might be an effect, not a cause.

The prospective experimental and control groups, one of which got a vitamin, and the other which got a placebo, is much more likely to produce a meaningful result.
The author is describing an office culture that is completely unconnected to actual Montessori schooling under Montessori methods.

Montessori actively encourages children to develop the capacity to disagree reasonably within teams while preserving civility. The classroom environment and curriculum encourages solitary inquiry into subjects of great personal interest. Providing quiet spaces for individual students to carry out work is a high priority in Montessori classrooms. And, in marked contrast to a hierarchical, command-and-control style education, Montessori allows a student to choose to spend hours of the school day away from the noise and bustle of the classroom and their peers working on his/her project.

Aside from considering what Montessori "actually" is, the whole premise is blown by one fact: traditional, hierarchical education systems put students in the classroom, a completely open, depersonalized space that explicitly encourages surveillance and strips away individual privacy. So, tell me again, what does the model for open-space offices most closely resemble?

I've read some excellent critiques of open-plan, non-hierarchical office culture and management styles; this was not one.
It's funny to hear that perspective from a Canadian. In comparative constitutionality, the prevailing scholarly opinion is that the Canadian Charter of Rights and Freedoms is a modern update to the US Bill of Rights.

The United States Constitution has served as the template for countless founding documents, especially those written constitutional documents in most of the Commonwealth of Nations.

The innovations in the Constitution were threefold. First, a federalist system in which states ceded only specific enumerated powers to a central government. Second, a balance of powers between three branches with differing missions, members, and procedures. Third, a specific list of tasks that fell explicitly outside the powers of the central government. These are commonly termed federalism, separation of powers, and the Bill of Rights.

The federalism experiment failed, beginning with the establishment of true Federal supremacy following the Civil War and ending with the SCOTUS decisions that expanded the definition of "interstate commerce" to include virtually everything. The United States Federal government is for all intents and purposes now a government of general jurisdiction. This is what they have in e.g. Britain, so this is neither a good nor a bad thing, but it's simply no longer a differentiator from other modern governments.

Separation of powers is failing us right now. Without controlling both houses of Congress, with a supermajority in the Senate, and the Presidency can accomplish any coherent agenda.

Our third contribution, the Bill of Rights, is still holding relatively strong. Unfortunately, it's a few centuries old, and we've had to update it quite a bit by quite creatively reading rights into text where they might not really exist.

So the search is on in academia for a bill of rights that's a better model for new documents than the United States version. The Canadian Charter of Rights and Freedoms is the most commonly examined alternative. And the Supreme Court of Canada is generally considered more activist than SCOTUS.

So it's strange to hear that tribunal described as a kangaroo court. I'm not saying you're wrong, just wondering how the experience of an informed citizen differs from the prevailing winds in academia here.

One thing that troubles me about the Canadian Charter of Rights and Freedoms is that it has an explicit escape clause to suspend it. In fact, I believe it was invoked two years ago during the student protests in Quebec. An off-button seems like a major anti-pattern for a bill of rights.
What's behind Microsoft's fall from dominance?
Instagram the Brand
As TelmoMenezes said above, explaining mental illness entirely through neurological glitching is like explaining a software bug by claiming a circuit board wasn't soldered correctly.

Yes, there can be "hardware" causes, and yes, the "software" does run on the "hardware" as substrate, but the hardware is not a useful model of the software. Neurology is not necessarily an entirely useful model of an individual mind.
Obviously his theory is being challenged and there might be some valid reason why it is. I'm not an expert in that field.

The guy saying Lustig is "wrong" was just full of it and I called him on that.
How to Encrypt Your Files
> Not doing it would just send a message to other psychopaths running for president the next time, that it's okay to blatantly lie to the electorate, and then do stuff at least as bad as he did.

Frankly that ship has sailed. Pardoning and rehabilitating Nixon, along with never prosecuting Nixon, Kissinger, Bush, or Cheney for war crimes after they left office has made that message loud and clear.

And it's at all levels. Government is simply above the law. How many police are in prison for murdering civilians?
Nobody Knows What Built These Weird Little Web Structures
This is a three-year-old blog post about a three-year-old HN comment about a different three-year-old blog post. Just sayin'.
For the vast majority of cases, I would expect panic/recover to work for iteration over in-memory data structures. For something like a database iterator where the possible errors are more varied and likely, I agree an explicit iterator object is better. I probably should have defined the scope of problems I was thinking about better.
I really hope TLS crypto standards won't be set (or changes rejected) based on who proposed a particular change.

Changes should stand on their own merits. I don't see why we should trust anyone, random or not. It's not about trusting people, it's about trusting algorithms. So it doesn't really matter who in particular proposes changes.
Sunglasses with infrared emitters. Blinds CCDs without visible light.
My email's in my profile. Just shot you an email.
Thanks everyone for the comments! I didn't intend for this to get shared yet, because it was a work in progress - apparently Hacker News thought differently. I appreciate all the compliments and feedback!
Technology is Heroin (2009)
"If black swans were farmable there would be no significance to the black swan" - this statement does not make sense to me. It seems reasonable to think that they are both significant and can also be sought after more effectively than through random chance. If you mean to imply that if it were possible, it would be happening already then I would just say the experiments need to run another decade before we'll have good data.
right to use is not ownership. Ownership is a misplaced metaphor for things like articles.
Hey davedx - I never ran spell check, because the piece wasn't really finished. Someone chanced upon it and shared it before I was even done with the design.

I've got a couple things that need my attention right now, but I'll put in those spell checks ASAP. Thanks!
Well it seems to me that backlash against Montessori management is Montessorian in nature since no where in the article does the author imply an extreme negative pull. You know, the phrase, "Anti-Montessori management on the upsurge". Where is it? You can't be midway off midway.

Ah, just ignore me if I don't make sense .Kumbayah!(that's right just one Y)
WordPress Optins - The Hottest WordPress Plugin
pv reads content from a file by default, so that can actually be reduced further to:

pv "$1" > "$2"
I feel exactly this way about reddit and programming, respectively. Guess which I've been doing more often...
What an awful move. Note that they are deliberately hurting open source software by restricting contributions for a purely political reason.

Obviously it will result in an Ubuntu fork of the intel drivers, which will eventually lead to a situation where the only consequence is a more painful workflow for Ubuntu core contributers and early adopters looking for up to date drivers.
> but unlike those DRM-circumvention tools, this setup does not violate the law.

A pretty bold claim.
"The MP3 player that they called iPod was, and is, considerably inferior to other MP3 players in terms of sound quality."

This has not been my experience. Any opinions?
Dynamically allocated memory is difficult to verify automatically. There are some tools based on separation logic (e.g. Smallfoot, HIP/SLEEK, jStar) that are able to verify C programs (or C-like programs). Current developments in this area are focusing on automatically inferring specifications (also known as abductive reasoning). Moreover, automatically verifying concurrent programs is also difficult and a hot research topic at the moment.

If I am not mistaken, Smallfoot is the basis for a professional product being developed by Monoidics (http://www.monoidics.com). Interestingly, the company was recently acquired by Facebook :)

Update: Here's a link with a list of related tools: http://www0.cs.ucl.ac.uk/staff/p.ohearn/Invader/Invader/Frie...
More proof that everything comes in threes. Just like the Ramans...
I think you'll have a hard time persuading existing corporations and developers that this is worth doing; formal verification seems to be currently constrained to academia and safety-critical uses (say, Software Engineers that have been accredited by a local regulator and are working on shutdown routines for a nuclear power plant).

But perhaps if you built a formally proven shim around key pieces of software, you might be able to get someone else to adopt them and/or disrupt (usurp) an industry incumbent.
Hah, I usually don't like when people repost old articles, but I didn't see this comment originally, and it is super awesome.
I think your point is muddied by "celebratory" and "special occasions", which is too bad because it's a good point; but it's going to be lost on people who have a beer or glass of wine with dinner, even though we probably all agree that drinking a "big gulp" beer at work is inappropriate and maybe we should feel that way about colas too.
Quite right. That license doesn't give Medium ownership of the content. It just grants them a broad license. The author remains the owner and since it's a non-exclusive license he's free to republish it under any terms he likes elsewhere.
The seL4 operating system microkernel also aims to be formally correct.
http://www.ertos.nicta.com.au/research/l4.verified/
thanks for the path you suggested
Has Microsoft's court victory exposed Google as a patent troll?
I'm just learning Go, I'm certainly no evangelist. One huge difference for me, however, doesn't have to do with the language. It's deployment. It's really nice for deployment to be scp rather than a bunch of package installs, making sure your classpaths are right, etc.

That said, one of the language features that drew me in is structural typing. I'd yet to see a well supported statically typed language that used structural typing, and it seemed like it would make software maintenance a lot easier. Of course, tools are often a better solution than language features, so maybe that's a bad reason to use a language.
Well, it's probably true when "other" is used to designate very specific high-sound-quality models (e.g. Cowon a few years ago, not sure where they stand now), you can always find better and ipods are of average sound quality at best, they've never been an audiophile's PMP (or a PMP for driving high-impedance cans).

It's a completely pointless statement though.
This is the _Internet_, not an interactive cable tv service. Don't setup servers in every last country, choose maybe one in every geographical cluster. Then you have way fewer "local authorities" to be concerned about.

Also, don't keep logs or ask for any signup information besides authentication credentials in the first place.

But alas, we really shouldn't expect web services to work against the status quo, as corporations are mere extensions of government and wish to identify, track, and datamine people similarly. After all, there's a reason we view a webmail address as an indicator of an uncaring noob.
> If SSRIs are no more effective than placebo, then:

> * Why do some SSRIs work for some people while others don't?

The placebo effect. Surely you don't think everyone has the same placebo effect? Also, you're not describing the same study with the same participants and different drugs, you're describing different studies, different subjects, and different drugs -- all of which can change the outcome.

> * Why does increasing the dose of a specific SSRI have an increased effect?

The placebo effect. If people believe that a placebo is working, then more placebo produces more illusion.

Also, your use of the term "increased effect" is misleading. The largest doses show an effect, smaller doses show no effect. One theory about that is that the large-dose drug's side effects alert the subjects that they're not in the control group. A proposal has been made to create "active" placebos, placebos that mimic the side effects of the drug under test but not the property under test. This idea hasn't been tried yet.

> Is it not possible that the real reason that SSRIs might be no more effective than placebo in clinical trials is that we don't quite understand the reasons that they work yet?

You're overlooking the fact that placebos produce the same effects as the drugs under test. Our understanding or not understanding isn't an issue, because they've been demonstrated to be indistinguishable from a sugar pill.

And our not having a mechanism is definitely a criticism of this kind of treatment -- it would be like administering a mystery drug that proves essential to health, then deciding to increase the dosage, without understanding that the mystery drug is fatal in large doses (like vitamin A).
space chem is way harder (and easier to understand at the beginning), imo
"Moreover, the process of blending fruit destroys its latticework of insoluble fiber, whose job it is to slow food’s digestion and absorption from the intestine into the blood, explains Robert Lustig, a pediatric endocrinologist at the University of California-San Francisco"

http://www.slate.com/articles/double_x/the_kids/2013/03/pure...
posted by a three-year old!
I did actually use an interesting domain for a little while, but got completely fed up of it being rejected everywhere.
>A man walks into a store. He spots a binder on the back counter,..

Your analogy, for the record is wrong. Completely wrong in fact. But enough with the analogies. We have 20 years of mainstream HTTP usage. We know how it works. Authorization over HTTP is a solved problem and can be done in multitudes of ways, trivially. If he's breaking the law than so is Google millions times over because there are a shit ton of indexed pages that technically Google wasn't authorized to crawl. If your web server is configured to fulfill all anonymous requests, then you are implicitly granting the authorization to access this data. This is the way HTTP was designed. That's the only way this all makes sense, otherwise youtube can change their TOS to make every person who views a video a criminal.
Left with Nothing
Taleb's "black swan" is by definition not a repeatable -- or even predictable -- event. The metaphor loses all novel meaning if stripped of that quality.
If you don't have a public facing job, then does it matter if you wear a t-shirt and jeans to work

I think it can. I've had a couple of jobs where I needed to wear a suit to work (or at minimum, dress shirt, tie, and slacks) even though my job was not customer-facing. It had its annoyances but in some ways I think I took everything a little bit more seriously when I was at the office. Probably for the same reasons that uniforms are found to decrease behavior problems in schools that require them. There's sort of a mental switch that is thrown when you put on your suit, you switch into "work mode" and then when you take it off at the end of the day you switch to "not at work mode" and it actually can help with work/life balancing.
Lemme repeat this: BROGRAMMER!
The Internet Timeline
Want a domain with existing page rank for your startup?
That is why the strict, and obviously insane, reading of the law is not the correct reading of the law. The intent element applies to every other element of the crime--you must intentionally (a) access a computer, (b) without authorization or inxcess or authorized access, and (c) obtain information from a protected computer.

Intent is the most important element of criminal statutes. For example, for homicide intent is the difference between a capital murder and involuntary manslaughter (and all the gradation between).
You're missing the point. Regardless of whether "jam" is used, so is "jelly" (not "jello"). I am American and I use both "jam" and "jelly". There's probably variation in usage throughout the country.

Don't reply to this comment.
I think it's more accurate to say the iPod (which one?) was not superior in all aspects of an MP3 player (especially in price). But IMO it had a very healthy balance of well done properties and good design. It was a device easy to love because unlike most other devices, it had way fewer glaring flaws and frustrating UI decisions.

TL;DR: It's better to be great overall than excelling at just some features while also having crappy downfalls.
If you are looking for a domain name for your startup, why not pick one that already has existing page rank? If you can, why not piggy back on SEO done by someone else. This is a list of existing domains with high page rank that can be bought off from various auctions.

What do you guys think?
Current thinking on this matter is to avoid the tired old web 2.0 hipster stuff. The current batch of YC is all about solving real problem for real people. Spoonrocket got the most applause ($6 meals delivered within 10 minutes).
I hate all these "saved people" bits. Every person ever still dies. Nobody gets "saved" from death, we get prolonged life or happier / healthier life. We could talk about reduced suffering. That stuff matters but just be accurate. There's no billion people saved, there's (arguably) billion people suffering less. Which isn't belittling anything.
Traceroute is a hack
Checked a few domains. Why not change the default registrar from GoDaddy to Namecheap? Most people in this community hate GoDaddy. (myself included)