skysight-inc/HackerNews huggingface dataset:
I want to qualify your (1) a bit—there's actually enormous value in "partially proved" systems in a sense. At the very least, that 30% is something you won't have to think about every again so long as the spec it's met works for what you need.

But what I really wanted to talk about is the exciting stuff going on in languages like Idris where programming is paramount and proving is just there for support. In a situation like this, your goal is less to arrive at 100% formally proven systems, but instead steal 90% of the power of a proof assistant to build more maintainable, powerful code. In this case, you're quite likely to only prove 30% of your code, the skeleton perhaps, and leave the rest. The result is often however that when you do this, the remaining 70% of the code is so restricted by your design that there are only a handful of ways to continue and they're likely all the right behavior.

A great example of this is Ur/Web which uses just a little bit of dependent typing to ensure that the names in your forms, domain, and databases all match up. It means you design your entire system around those names (your domain) and prove it to be formally consistent. Then the remaining design space is tiny and it's easy to write a good program.

... Or even to augment that skeleton with a security policy and have static flow control analysis "for free".

(That said, Ur/Web is a prototype system with minimal documentation, so I won't recommend it as an actual "system of the future"... just a glimpse.)
I'm sorry, which were the atheist nations participating in the 30 years' war?
That works fine because Intel has open source drivers. Not so much if NVIDIA and AMD decide to only support Wayland.
I think "unauthorized access" is like porn. You know it when you see it.

As for chilling effects for security researchers, I don't think they're an inadvertent result of vague statutory language. I think Congress clearly intended to make that sort of tinkering around illegal. After all, back in meat space, you can't pick my lock, burst into my living room, and say: "hey, your lock sucks, buy my security service!"

I don't think it's necessarily a good idea to create such a rule, but there is a certain internal logic to it. Laws create social norms. When it comes to private property, the laws create a social norm wherein you're expected to give peoples' private property a very wide berth except according to certain clearly-defined, socially-accepted conventions. I.e. you can come onto someone's property if you're invited, or if the property seems to be a public venue and you have no reason to think you're banned, but generally you stay the fuck away. The end result of that norm is that people don't go and buy the best possible locks. The social norm enforces the owner's right to exclude, not technology. I don't even lock the door to my apartment because I know that nobody is going to come into my apartment and just look around because they found the door unlocked. And I know that if a neighbor sees someone do it, they'll call the cops because it's such an egregious violation of the social norm that it's per se suspicious.

I don't think that trying to create that norm for internet sites is the best model, for various practical reasons, but like I said there's a certain internal logic to it.
I am definitely going through the G.B., with other writings from Middle Eastern background. It started when I was researching Islamic & Western texts on a particular subject and similarities. Somewhere along I happened upon Adler's book on How to Read. I agree on having no one to discuss it with, but it's ok, "I am having a discussion with the authors on the margins." If you are going through the list I'll be more than happy to have a long term dialogue (email in profile).
SHA is just used for verification in TLS, so the security considerations are different from those when it's used to, say, hash passwords. There's not much in the way of attacks that could take advantage of SHA being broken, and most that would would involve things like MITM-replacing packets in real-time with different ones with colliding hashes. It's probably true that for some classes of crypto problems, the NSA has incrementally-better cryptanalytical capabilities than the public does, but being able to find collisions in real-time, even for SHA1, seems like a very tall order.
Action is starting in 10 minutes, and demos themselves should be starting in 20-25
Which Smartwatch apps/functions people want the most
They hold most 30 year mortgages. Subprime mortgagages, ARMs etc were securitized. If the problem was Freddie or Fannie not getting paid it would be a different problem.

Lehman Bros went bankrupt, as would many other financial institutiosn without a bailout because they held a lot of garbage paper (including subprime mortgages) and were very illiquid. Many European and Asian banks had huge US mortgage exposure.

The problem was extreme mispricing of risk and illiquidity.
I was hit hard in the face by a segmentation fault. It took hundreds of test cases and more than twenty hours of confusion before I found the error: I was passing a reference when I should have been passing a pointer.

That code wouldn't compile, if a pointer is expected you can't just pass a reference, hello static typing. Furthermore, you can't explicitly "pass a reference" to begin with, as in there is no syntax in the caller to signify "this shall be passed as a reference", that would be something that is in the signature of the CALLEE. So his "error" literally makes no sense as it cannot happen. If what he means is that he wrote the callee wrong, that doesn't make any sense either, because the whole point is that you can't reseat (make to point to something else) a reference. So you would know if you needed to use a pointer instead the minute you tried to reseat a ref type.

Also, anyone who takes 24 hours to debug a segfault needs to pick another profession and quickly.
You're thinking something like Ur/Web?
The list of teams demoing is at https://docs.google.com/spreadsheet/ccc?key=0Aha_Rxus9XXSdER...
I'd say it's more painful than a blood draw if the phlebotomist gets it right on the first stick, less painful if the phlebotomist is going to have to try many times or go for atypical access sites.

I'd be more wary of potassium and other electrolytes, but it would be interesting to see a comparison to venipuncture.
the pictures of the people kind of creeps me out. the technology sounds great but the website design kind of gives me a half life feeling... like if I give them my blood next thing we know I'll be walking around like a zombie.

besides that - website looks great. It would be great if my kids did could only have to deal with a finger prick to draw blood... definitely one of my worst memories growing up.
Netflix for books
As a noob in encryption, why is it not possible to guess the 128 bit private key by brute force?
Building a web crawler
JPEG image glitching / corruption
My guess was pretty much the complete opposite. That's rather uncomforting.
Excellent read. Thanks for this.
So, it's a health testing company that will keep all my blood-related health information and make it "actionable", with the backing of James Mattis, William Perry and none other than Henry Kissinger. There are more soldiers in that board there than doctors.

The only way I'd give them my blood would be to infect them with a disease.
http://www.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipse... If you could provide some more information on responses, perhaps emails dismissing it, I think we can figure out what went wrong.
to copy a tree of files:

tar c SOURCE_DIR | pv | tar xv -C DEST_DIR

or

# on source computer
tar c SOURCE_DIR | pv > /dev/tcp/192.168.1.2/4567

# on destination computer computer
nc -l -p 4567 | pv | tar xv -C DEST_DIR
Does it support all the latest css3?
Tutorspree: Thank You
No offense, but you've got it all wrong.

Many libraries already are those things (local archive, online content, free internet terminals, wifi). As a person who made it through college by leveraging the library because I couldn't afford many books, I think libraries and bookstores both serve an important function. The local library in my town is also a meeting ground for many kids after school. As a kid, I read hundreds of books, multiple per week. Dahl, Dickens, Wells, Chrichton, King, Twain, Defoe, Card, Dumas, Prachett, Eddings, and heaps more. How could I have done this without a library? How can any kid these days get that much reading without a library (apart from their parents splurging on a kindle).

Incidentally, adding a DVD section doesn't make them "like blockbusters." Blockbusters failed because it was a corporate entity that needed to generate revenues to succeed. Libraries are trying to maximize social value, not profit. I learned grammar when my foreign parents borrowed a VHS from the library as a kid to show me at home. And multiplication. I would want my kids to watch certain classics on DVD too. Lord of the Rings. The Prestige. 12 Angry Men. The Godfather.

You clearly don't use or have a need for the library. But don't criticize what you don't know.
Yes, positive rights that have real cost associated with them–rights which require that someone else do something for you–seem more like "part of the social contract" rather than a fundamental right.

Also, this company states it will still require doctors' orders so not sure how that squares with the rights talk.
checkout wellnessfx... affordable, nice design, pretty easy (although they use a big needle), and they track results over time.
I assume the image of the micro-vial balanced on a fingertip is meant to illustrate how small the quantity of blood is, but, at least for me, the initial evocation is of drawing blood from beneath the fingernail.
>With 3taps and Swartz, it's pretty clear that the defendants knew they were kicked off the site and tried to access the, anyway.

I don't know. It seems like you could still make the argument, e.g. if your account gets disabled but nobody tells you why, you might have to assume something you did wasn't allowed, but why would you assume that to mean you can never create another account even if you behave differently in the future? And if you can do that then how are you supposed to know what specific subset of the things you did are the ones you aren't supposed to do again? So there was the argument in the Swartz case that, for example, getting kicked off for downloading too quickly just means they want you to slow down rather than stop because they don't want you to degrade performance for others. And the fact that we have to argue about it is the problem.

Also, I think the OP was really referring to Auernheimer more than these others anyway, which gets more to the heart of the issue. He obviously intended to change the number at the end of the URL. The problem is that we don't know whether doing that is classified by the law as unauthorized access, but unless the courts are willing to throw out the statute or adopt a narrow interpretation, he still gets convicted for doing the thing he intended to do, not because he intended to violate the law, but because the judge decided after the fact that the thing he intended to do was a violation of the law. That seems extremely problematic because the judge is doing the clarification on what the law means ex post facto but then still subjecting the defendant's prior conduct to that new ruling, but that's the situation the statute leaves courts in unless they're willing to throw it out as a result of that.
They need to do more than that. Local libraries of physical media are dead. They need to close up and take their significant tax burden off of their citizenry.

Pre-internet, I used to use the library quite often. I probably haven't been inside one in 10 years now. Their time is past, they need to die.
The Inside Story On The Fear Of Holes
People who make these statements don't fully understand what they are typing. I feel like in the modern English language, you almost have to over emphasize just to get your basic point across.
scp just falls back to cp when copying locally, so doesn't show any progress bar.
I don't think it's entirely a corporate move here. Free software contributions aren't infinite; if you have $N developers working on integrating support for display servers, then it's simple math that having to support two display servers means that you'll have $N/2 developers working on each, and will therefore get half the work done (and, since they'll probably still have to support X11 for a while, make that $N/3). Ubuntu selfishly forked Mir instead of choosing to try to use Wayland (especially when they had originally committed to using Wayland[1]), so the burden is on them here. It also doesn't help that Canonical employees were using the inclusion of XMir support as political fodder[2].

[1] http://www.markshuttleworth.com/archives/551
[2] https://twitter.com/olliries/status/375704285083738112
Finally, a site that sums up my mobile web experience and distaste. My question always is... do many people really install the apps for all of these sites, and if so, why? Secondly, what benefit do these sites get out of users using their app instead?
For reference, this is an output of the Stanford startup engineering course (which I also signed up for after it hit the HN front page)

In the homework, this is what they mention the goal of the 'bitstarter' page to be:
"Choose a project which you can get to a crowdfunder

People in the class have widely varying backgrounds, ranging from relative neophytes to fairly advanced students. Your goal is to figure out a final project that you can get to the level of a reasonable crowdfunding site. This can mean anything from verbal description and mockups to fully working code, or anything in between: whatever is necessary to make the sale and prove that you have a market. Note that you have control over who's seeing the crowdfunder (e.g. the people in your email list or social circle), so you are also determining the difficulty of the sale itself by choosing the market and the initial crowdfunding audience. Note also that you can just ask for someone to share your content on social media rather than pay you real money for a preorder. Open source projects are ok as well, not just for-profit businesses. The main guideline is to set your success bar at the point that it'll be an achievable challenge for you. That might be a target of $100 or it might be $100,000."

You can see the other projects here:
http://startupmooc.org/
Is that true for the LFSR proposal?I thought LFSRs were basically never thought to be cryptographically secure.
I think Adam Langley doesn't like GCM because its normal software implementation requires secret-dependent table lookups for speed. It's thus thought to be easy to produce a naive GCM implementation that will suffer from side channel attacks. That concern is rapidly being mitigated by newer CPUs which can do the multiplications for GCM in hardware.

From a theoretical perspective, the polynomial MACs (like GHASH) are very well understood.

But, much more importantly, the TLS GCM construction is the only modern stream encryption standardized and widely available to TLS. The block constructions in TLS suffer from being created before Encrypt-then-MAC was proven secure; they do the operations the other way around, and thus require extremely fiddly code to quash side channels that have (unlike GCM) already been shown to admit plausible attacks.

The author of this proposal probably isn't so much making a statement about GCM so much as he is suggesting that we need to deprecate the 90's-crypto parts of TLS, which is something that is hard to argue with.
Interesting to look at the other numbers. The UK requested 2k~, roughly the same as India (the country with both the largest population and the most serious/active threat of terrorism.) Germany is in the 5k range. Canada is at 47, New Zealand at 9.
Summary of http://allthingsd.com/20130906/how-a-man-in-austria-used-leg...
Sorry, you're just fueling counterproductive witch-hunt hysteria. Probably due to seeking safety and wanting for trustable crypto gurus to show you the way. They don't exist. The only way to move forward is to continue to judge ideas and not people, and use what we've learned to design systems more resistant to hidden subterfuge of unknown design.

> The answers came swiftly: Brian Smith works for Mozilla. Yes, we can trust that this proposal has no hidden agenda. We hadn't heard about it because it was originally posted to the Mozilla Crypto list two days ago.

Would the NSA not have planted multiple long-term people at Mozilla? Would these people not cover for each other, and promulgate their insecurities by planting them in the minds of others who then make the on-record proposal?

The reputation of the popular cryptographers we know and love would only have suffered if their subversions were discovered, which is clearly the opposite of the NSA's goal. And if that is where their morals lie, why would they be personally worried about being uncovered? Moving to Virginia/Utah probably isn't that bad.

And BTW why hasn't Bruce Schneier released the raw documents that could shed clues on which systems are flawed? This is bona fide security-critical information with extreme relevance to the technical community, regardless of the NSA's whining. But I just have to assume he has his reasons even if I'd think they're misguided.

I apologize for any personal implications against Brian, Bruce, et al - they're meant to be completely illustrative. But any decent security person would actually tell you that you should not trust them either.
The kind that are stapled to bearer bonds?
> When the state of the art is the Sony Walkman...

The author either wasn't around in the 90s, or thinks Apple invented the MP3 player.

The first MP3 player appeared 4 years before the iPod. In the U.S., the Diamond Rio was fairly well known, at least in tech circles (i.e., people who knew what an mp3 was).

https://en.wikipedia.org/wiki/Portable_media_player

I've always assumed Apple gained an immense advantage in MP3 players by not being first to market.
Yup, and there's been success with legislation. Take the clean air and clean water acts. My parents say these have had a profound effect in a relatively short time.
Amazon S3, requester pays.
Lua string comparison IS constant time (its always just a pointer comparison).

The timing attack (i.e. memcmp) would happen at the string interning step; which cannot be avoided: but as a lua_State persists longer than a single request, I'm unsure if a timing attack here is plausible.
Fascinating - 1900 bucks for a book that has a free PDF download must be a bot pricing war. Amazed to hear those are still up and running,
Probably. The SHA-1 and SHA-2 hashes are straightforward extensions of hash designs from academia, and the constants in the hashes are derived from the first N prime numbers; they aren't mysterious in any way.
Just recently I had a visit at an allergist and found the entire procedure so primitive, that I nicely informed the doctor that they could upgrade the way they do tests. I or anyone else technically minded could very easily come up with less prehistoric tools, but he was as expected not interested in any improvements. I hate school-medicine.

Thanks for the background info, it's always worth to know who is behind something. Even the best thing that can happen to humanity would be abused, if supported and financed by sick minds.
“The founding of libraries was like constructing more public granaries, amassing reserves against a spiritual winter which by certain signs, in spite of myself, I see ahead…”

- Marguerite Yourcenar, Memoirs of Hadrian

http://www.goodreads.com/quotes/680896-the-founding-of-libra...
The article cited two primary causes of the population explosion: the destruction of sardine populations from over fishing (sardines compete with jellyfish for the same food sources), and expansion of eutrophic zones due to agricultural run off (fertilizers).
For someone who lives more and more on the command line Pass looks really nice. The only issue I have is that the lastpass importer is not working for me, tried it with 2 different version of Ruby but always get a NoMethodError. Adding 400+ passwords is going to be a huge pita.
The "why" generally comes into play when you project it as a solution to an unsolved problem(or at least a problem which can't be easily solved). If you leave it as "because it's fun", I am fine with it. If you present it as "now you can have progress bars with cp", I will ask "why? I can already do that with rsync". That's not because I want to put down your work; that's just thinking out loud.
How about people that do not know how to effectually search the internet to get the social, economic, and political information to make informed decisions in their lives?
I don't understand how you can compare two strings in constant time by doing a pointer comparison. Can you elaborate?
> All I truly care about is daemons and command line interfaces.

Welcome to the world of computing in 70's. Some of us prefer the future. :)

I enjoy GUIs since my Amiga 500 days.
Why You Can’t Travel Back in Time and Kill Hitler
You don't read books I take it? Or perhaps you read on a very slow cadence? You should visit one sometime in the evening. You might be surprised how crowded it gets.
True enough. No support for NVIDIA cards at all in current Ubuntu betas. I think even nouveau was falling back to X compatibility but I might have that wrong. It was sloooow
For the record: (a) I can't find anything Schneier has ever published on ECC; it is a notable omission in his most recent crypto book (Cryptography Engineering, (b) the ECC issue is confused by Dual-EC-DRBG, the ECC-derived CSPRNG that nobody uses but is now thought to be a deliberately weak NSA design, (c) his reasoning for avoiding ECC (the constants are suspect) is a little bit of a stretch given that the most popular curves have a relatively straightforward derivation, and (d) it's downright weird to point a finger at all of elliptic curve cryptography based on a single set of constants; surely he's not implicating the Edwards curves Bernstein and Lange have been promoting, for instance.

The recommendation is confused enough that I'm inclined to dismiss it.
Good point. Most (95%) of my experience has been as a freelancer. As a result, the grass might seem greener on the other side.
Sorry to be boringly practical but if you go remember :

winner 1993 world baseball series - Toronto Blue Jays.
Now take the winnings and buy Netscape stock:-)
Lots of things eat jellyfish, or more commonly, their young. We're just killing the predators off.
How can be any other parameters than the standard ones used in the current browsers and servers? I think they can't, am I right?

And how can browsers start to use any other parameters before they standardise them? I think they can't?
bought a sweater within 1 min of using it. the big discounts at kohl's helped.
When your business is booming you can make your products appear prestige by high prices. But then your business grows so big that you have to keep a big load of customers satisfied or else you start making losses.
There are lots of things at play here, saying a company must not change is kinda funny coming from an apple fan....
My (non-tech) workplace has individual offices for the engineers. Every engineer, even fresh grads, gets an office with a door (though windows are reserved for the senior guys). It sounds like a privilege at first, but with our lack of email it's pretty isolating. We can always get up and walk to each other to talk one-on-one, but sometimes I miss the collegial feel of 3-4 people hashing things out while at their desks.
At which point does History become irrelevant or ill suited for discussion? Please aware us all as you seem to hold the key.
Congratulations, PG!
Ok, what the hell are they selling? It says in "our tests":

- Oncology
- Pediatrics
- Geriatrics

Yeah. Would you go to a doctor that is specialized on "cancer and stuff"? I wouldn't. This is as unspecific as one can get.