skysight-inc/HackerNews huggingface dataset:
The most important word in your comment is 'intend'. Unauthorized use is never intended (other than in honeypots, but even there it is somewhat intended...).

Egress filtering is important, if you think the chances are large that a user account is compromised a filter table can help. But an even more effective egress filter is one that you run on the router/hardware firewall just upstream from your machines. After all an egress filter on the machine can be disabled by someone that has compromised that machine.
Why Phonebloks Will Never Happen
Of course Cisco is at the top of the NSA insert backdoors list one assumes.
Password authentication is prone to bruteforce. With public key auth, even if someone has your passphrase, he also needs the private key to break into your server.

Indeed, there's always the risk to lose your private key. That's why it's useful to have several : I have one on my desktop, one on my laptop and one on my mobile. If any get compromised, I only have to delete one public key in authorized keys and generate a new one. That's still open to some attacks, but way less dangerous than simply allowing anyone from anywhere to log in.

That's also better than allowing only a few IPs on port 22, because you'll never now where you will be and what IP your laptop will have when an emergency occurs.
McAfee Firewall Enterprise Control Center only has dual EC_DRBG certified (despite the fact the RSA library they use supports others; strongly suggesting its what they actually use).
His parents also had the "lots of money" that allowed him to "replace the wheels every few weeks".

I know that when I was a child, if I had a scooter and the wheels broke, I would never get to own a scooter again. So that's the kind of opportunity I'd have missed out on.
For WEP this is true, for WPA/WPA2 without WPS it is much harder. WPA2 uses PBKDF2 with 4096 iterations of HMAC-SHA1, this is a rather slow algorithm.

On (http://hashcat.net/oclhashcat-plus/) you can find some values on how slow it is. The same computer can crack 7 billion md5 hash per seconds, but it can barely do 181 thousand WPA2 password per second.

At this speed you would need more than 200 days just to crack a 7 letter password only using a-zA-Z0-9. And more than 38 years to crack an 8 letter password. If your password is a word or derivation of a word, you can obviously get it much faster with a dictionary attack.
why not report him to the wider wiki community. it seems prudent to crack down on this kind of behaviour for all our benefit.
This particular attack exploits a known issue of Tor, which has existed by design since day one.

Just so everyone's clear, this was not a "known issue of Tor". It was a javascript based Firefox exploit.
If you actually spend time reading, you'll see that they constructed an alternate mortgage registry that has lower transaction costs that the existing system, but violates (and fundamentally subverts) the law of the land, the tax code, and thus also defrauded investors because when (assuming it does) the IRS and the counties ask everyone to make things right, the investors are going to be the ones holding the bag.

And that's just one relatively minor aspect of the mortgage business. Everywhere you look, there's significant violations of laws (robosigning, co-mingling of assets) with essentially NO law enforcement interest in finding the responsible parties.

> might be technically illegal. Lets get em!

"Technically" illegal? At the very least, they defrauded counties on registration fees (adding up to a few hundred of millions, perhaps billions).
Well you could get hold of the routing tables and filter out unallocated space. But thats not going to help much as there are still 64 low end bits to guess, some people use xxx::1 and ::2 but others use mac address based IPs (and random ones). So we are probably at the best point to portscan before the possibility goes away again...
Why do people keep trying to abstract away the parts of web applications that have been carefully designed to solve that particular part of the problem as best they can with a ‘one size fits all’ solution?

To me the answer is obvious: we have people who don't understand CSS, who don't understand HTML, who do understand JavaScript (or Java, or Ruby, or Go, or whatever) who want to make web applications but have no interest in learning or understanding the reasons why we do things a certain way.

Frankly it depresses the hell out of me for the next generation of web applications, because it feels like we're taking a technological leap backwards.
My two cents about the "french hosting provider" :
The 22 of july, the french hosting provider OVH suffered an APT attack from intruders looking for the database of european clients.
The 29 of july, OVH announce new rules about using Tor on their network...
In august Marques is arrested.

http://d4n3ws.polux-hosting.com/2013/09/14/freedom-hosting-l...
Which banks actually do this? I've never encountered one.
The Twitter I.P.O: Investor Beware
I was wondering about correlating these to distros to get real world usage. Distinguishing redhat vs centos is not going to be easy though I guess.
I'm not sure there's anything we can do about point #11 - do do you have a suggestion without fixing unicode? Like a few of the last points it's not possible to satisfy every possible problem, but using unicode without restrictions at least gets you most of the way there, it's better than other encodings if you need worldwide support though it has recognised issues with more complex character sets.
Rouge Angles of Satin
You shouldn't try to share them, imo, and generate a key for each device. Yes, that may be painful to have to copy 5 public keys on each new server, but the day where, say, your laptop get stolen, you don't have to change the private key on each device : simply remove the laptop one.

If you want some kind of centralization, you could only add your keys on a single server, then add this server key on others. You log on first server, then use it to log on others. But that would be dangerous : if the master server crashes, you can't access other servers anymore. Redundancy is good, in that case.
full blog post with video (was on HN already once or twice) http://www.joyent.com/blog/linux-performance-analysis-and-to...
That's because when they do, it often sounds just like a lie.
> A secret key protected by password doesn't provide you more security.

It does. You can encrypt the key and then you have two-factor authentication. You need to have the key and know the password to use it.
Well...this is NYT..Would you rather they call it 'diligent mongolian boy succeeds at MIT online classes'?

I don't think every person his age has the ability to get a perfect score in a course like that given how hard the material is. I think we should be allowed to reward people like that with titles such as 'boy genius'.
It is kinda irrelevant that the Same Origin Policy doesn't prevent requests since, you don't even need to use a javascript request, a simple image tag does the same
Does it say his parents were supportive? It mentions they leant him money, is that what you meant.
The effectiveness of advertising isn't to make you buy a specific product at a specific time. It's to increase the mind share of a specific product so that when you're in the market for it that's what you'll buy. (Or at the very least you'll see it as a viable option.)

This is of course, unmeasurable.
SEEKING WORK - Cardiff, UK - remote/contract/local

Python, PHP Developer. (2+ Years Experience)

Software developer with experience working in large company and small startup. I like to cover the full stack when I can. I am experienced with many web development frameworks like Django and Codeigniter, and I am not shy of using new SPA frameworks like angularjs.

github: https://github.com/viperfx E-mail: tharshan09@gmail.com
"Please note that there is a very long waiting period for Entropy Keys at the moment."

That notice has been there for a very long time, not sure what this period is...

(maybe they have run out of randomness!)
It's not just "you have to compile your own kernel". It's "you have to compile your kernel EVERY TIME there's a kernel update". If you forget one update and you leave an exploit on your system, you're screwed.

Having said that, I'm surprised Debian and Ubuntu don't have better support for grsecurity. If they'd provide up-to-date packages I'd switch over.
I frequently use netstat -tulpen

.. which is a mnemonic trick, "tulpen" is "tulips" in German...
Both my banks do (European banks, specifically Rabo and ABN/AMRO).

These are still not immune to phishing attacks but it's a lot better than TAN codes or some other 'dumb' authentication scheme.

Typically these systems work in conjunction with pin-and-chip card, a small piece of hardware that generates the codes and a challenge / response system built into the website you use for the authorization.

Separate challenges exist for logging in (read access) and transferring money.
Wow, really good idea. Is a VM that is used for absolutely nothing else good enough?
This falls a bit short.

You shouldn't just update, you should update regularly or better yet set up unattended upgrades[1]. Especially for your hobby projects or personal server because odds are that you won't always have the time to act on every security advisory. (Subscribe here[2] to at least hear about them.) Also, if something breaks once in a blue moon, it's not that big a deal.

Fail2ban is fairly heavy and only very recently supports IPv6 (which means the version from your repo may not). You can achieve similar results with something like

-A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 180 --hitcount 4 --rttl --name SSH --rsource -j LOG --log-prefix "ssh brute force: "
-A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 180 --hitcount 4 --rttl --name SSH --rsource -j DROP
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource -j ACCEPT

but if you disable password logins, no one's going to brute force their way in.

[1] https://help.ubuntu.com/community/AutomaticSecurityUpdates

[2] http://www.ubuntu.com/usn/
PRISM-Proof Security Considerations
Animo.js – Manage CSS Animations
It says his mother helped him make a website to sell the wheels. That's pretty substantial, and surely his parents signed some contracts along the way to get deals done (which means money and time, not to mention the more ethereal "support" that you give someone when you sign a contract for their benefit and your possible detriment).
Given that:-
sin(x) = cos( pi/2 - x )
cos(x) = sin( pi/2 - x )
you only need one of them.
APF, which is basically just a simplified way of setting up IPTables rules, does this.

http://www.rfxn.com/projects/advanced-policy-firewall/

or

apt-get install apf-firewall
#BUCCINASCO, MAURIZIO CARBONERA : "Un semplice grazie"
Probably because it's linked to in the first line of the original article.
How To Use YouTube To Flood Your Business With Leads
Learning From Data
A useless article since we don't get to read the actual paper.
Lumia + Android + WP8 launcher

I use the WP8 launcher on my Galaxy S3 and nothing beats it.
I used to think that the Redhat security guides were good [1], but would also go through the NSA guide to securing Redhat [2]. Seems a little ironic nowadays.

Recently, we had Bryan Kennedy's "first 5 minutes" [3], linked from Drew Crawford's guide to "NSA proofing" email [4] (pretty good guide to securing a mail server).

[1] https://access.redhat.com/site/documentation/Red_Hat_Enterpr...
[2] http://www.nsa.gov/ia/mitigation_guidance/security_configura...
[3] http://plusbryan.com/my-first-5-minutes-on-a-server-or-essen...
[4] http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-ho...
Google's Coder project turns the Raspbery Pi into a mini app server
Is Unicode safe?
I click on Facebook ads all the time. So obviously we do live in alternative universes. And I don't mind them because sometimes it turns out to be a good way to find stuff.
What's spammy about it?
Quepy - natural language questions to queries in a database query language.
I teach a programming class with ~50 kids, aged 9-15 and we got started using Scratch [1]. It's not quite coding but teaches a lot of important programming concepts, and is really easy and intuitive for kids to use.

After we played around a bit with the editor we checked out games that others had made, and the kids were super excited when they realized they could actualy build the games they had played themselves.

I'd let him/her play around in Scratch a bit, show some existing projects, and then build a game/project together from their interests (which is roughly what we do in our class).

[1]http://scratch.mit.edu
5 Most Asked Questions About Social Media Marketing
assuming rock-star define as some one who tout all along he is rock star programmer, then not much make a rock-star. But if what you looking at are someone who project creative jutsu on programming problem, deliver solution within expected time frame if not earlier and well liked by management and fellow programmer, then what it takes is very clear: 1) sufficient programming knowledge and skill 2) domain knowledge 3) time management 4) good personalities.

just, i'm sure that kind of programmer don't like to be called rock-star programmer.
This is similar to the Jibbitz story of Sheri Schmelzer, the homemaker who one day got this idea. And fast forward a couple of years she earns $10MM by selling her business.

Oh and just by the way, her husband is a seasoned high powered sales guy. What a coincidence.
Jeff Bezos Will Get Even Richer Off Twitter IPO
I think state centric system have been the main metaphor since data is processed through machines. Maybe Hickey and others are living in one side of the universe, but he did use other systems before creating clojure, and does not reject all state, just accidental/unnecessary state.

Sorts are not a good example here I think. QS correctness is uncoupled from its in-place property[1]. And they're encapsulated processes, nobody is supposed to see intermediate internal state. This black-box state is not the problem addressed[2]. All your examples are "single threaded". Two blind people moving chairs around will be a problem when one will try to sit down where there was one. Mutation and sharing is the problem otherwise nobody cares. That's why temporary variables are nasty in imperative friendly languages, any variable became an opportunity to mess up data needed by someone else.

It's also a logical waste, as in the first Java example, you don't need to compute the uppercase variant of a string unless it's needed down the road, if it is required then you pass it as argument to doSomething, that's what function are for. I tried to, but I'm not sure I understand the point of the second code example, because java references means x and original are the same, if you want an in-place uppercase method then both x and original are now uppercase letters, but you want to keep both values ... (Not really communication friendly)

The "focus" object would be a way to denote a place where all methods would accumulate state change ? I never saw this in the light of stack based language, it's interesting.

[1] the FP expression for quicksort is obscure the first time, but when you click you can't "unsee" it
[2] many lisp books explicitely say that this is acceptable because it doesn't leak out of the functional interface, referentially transparent as far as calling functions are concerned
This 'code' reminds me of the gobbledy-gook exchanged between the supercomputers in Colossus - The Forbin Project.
I find it disturbing that we are stuck with a type of economy where this is a problem. The purely rational response: yay, now we don't have to work so much! But this never happens. Why? Why isn't there a market pressure to reduce the number of hours that people work (for the same pay) once more things get automated? Why is it that technology could bring us closer to heaven, but we choose over and over again to live in hell? How could the right incentives be created?
The NSA thinks that if they have a backdoor into everything and a way to access everything, then they can make US "secure", through offensive means.

Yeah, that's what you get when you have an agency run by an army general.
at all - good search tools is not too many. Suggest makes this as build binary bundle and install this as easy kick ass. Also please make web-version this in future.

Problem: no good search tools for code after closing google code search. Need search by languages, versions and so on...
LIFS (Linux Iptables Firewall Script) is aimed at what UFW does but it also provides NAT, port forwarding and allows you to work with groups of hosts and services.

http://code.google.com/p/lifs/
Maybe the 'brands' section that was just removed: https://en.wikipedia.org/w/index.php?title=Lawn_sweeper&diff...

Although it mentioned several brands so it seems a bit of a weak case for being a spam article.
Old obscenity
sex
It's also a bin packing problem :)
Yes the idea is good, but can not practical implemented.
Category: Fun projects for geeks.
Check out the links in the References and (the second link) in the External Links section. Do those really add to the article or are they content-free "comparison" sites? The fact that you don't think the page looks spammy shows how subtle this game has got.

Edit: stable link to the page I was discussing since hopefully someone will remove the spam links soon:
https://en.wikipedia.org/w/index.php?title=Lawn_sweeper&oldi...

Edit#2: Since I used to work in "whitehat SEO" (thankfully no more) let me explain what's going on here:

A long-lasting link from a Wikipedia page is like gold to search engines. It's far more valuable than if you linkspam a comment on someone's blog. It indicates that this page is very relevant to the topic. So when people search for "lawn sweepers", those links appear nearer to the top. The spammers monetize this by filling these essentially content-free pages with affiliate links to Amazon and other sellers.

There's no motive here apart from money. This doesn't make Wikipedia, Google, the web or even lawn sweeper sellers any better. It just benefits the spammers.
How to price your hardware product
The article notes his parents lent him $2000 (at 13) and his mother helped him build the site for his company.

Sounds like support to me.

They were also likely undersigners on his manufacture deal.
<meta> I didn't expect such a bright topcolor!
I never heard Robert Young say "fucking sue me" in Father Knows Best. But then fathers don't wear fucking fedoras these days either.
I can't see anything in the Play Store called 'WP8 launcher".

There's a whole bunch of things with similar names.

Do you have a link or the exact name of the app?
10 Programming Languages That Will Change The IT World
For HTTPS, you can always fall back on blocking entire domains by host-header in privoxy. Not very fine-grained, but still useful for some things
Healthy Italian diet suffers as economic crisis bites
Growing up near nuclear power plants "not a cancer risk," study finds
World Tourism Day Travel Giveaway
I can't, sorry. I'm in Europe and drink mostly local ones. But you might check this out for hints http://www.reddit.com/r/absinthe
I think about this a lot. I think it has most to do with that people don't only care about absolute wealth, but also relative wealth - keeping up with the joneses, if you will. As long as social status is connected to wealth, this will be a problem.

Personally I advocate a gradual decrease in allowed work hours - 10 minutes shorter work day every year, or so. Although France has tried this and it doesn't really seem to work.
There is no security advantage to #4 (security through obscurity is no security) other than it prevents anyone getting a ping by sweeping Port 22, they actively have to look for an SSH port which will trip fail2ban.
Is there any indication that this evidence is used? This was under discussion around the Bundestrojaner in Germany whether such a computer can be used as evidence. I doubt that this won't come under severe scrutiny at least in Germany.
Call me a cynic (I don't mind) but they do the sweep of the whitelisted address and then two weeks later I get an attempted break-in from a completely different address....

I'm not white-listing anyone I don't know.
I've also seen people run a fake SSH server on 22 and log attempts (if you know that you don't use 22 then any connection attempt on 22 is interesting).
This is particularly prevalent in geographical articles. I recently spent a few hours clearing spammy links out of articles on Greek islands (and towns, and beaches, ...).

One strategy spammers are using to try to make their links in Wikipedia "stickier" is to insert them as citations instead External Links. Wikipedians will (rightly) think more carefully before removing references than external links, since refs are supposed to be providing justification for part of the article, not just a nice-to-have extra. But in most cases they are not really legitimate citations, in the sense of any kind of reliable source for information (either the information isn't even there, or it's copied from a better source like an official website, in which case the original source should be cited instead).
We should definitely embrace the future as fast as possible, instead of trying to hold it back so we "don't lose (the old) job".

The problem is a lot of people need to be retrained, since things are changing so fast, and their jobs aren't lasting their whole lifetime, like they used to. And I think neither the government, nor the private education sector is properly equipped to handle that yet, nor are they making much progress in that. But they need to, and soon, because this is only going to get "worse" (for the people who aren't trained for the new types of jobs).

This is just machines and automation "disrupting" human jobs, which means us humans need to keep moving "up market" (doing stuff machines can't easily do yet, which tends to involve right-brain type of jobs). But it's only a matter of time before the machines/automation catches up to us there, too.

Hopefully, by that point, we'll be having a society where food is easily and very cheaply created by "replicators" for everyone, and it will be a society where money has less importance, and we don't need to "work for a living" anymore, and we can just be free to follow our passions.

I think all of this will happen in five decades to a century, but it will be a very tough ride, as we try to quickly adapt and keep pace with technology, as we try to make a living.
20 Jobs of the Future
Or they simply try to avoid an unwanted USB child that could ruin their professional career.