skysight-inc/HackerNews huggingface dataset:
>> I think it's more like saying that "putting in fewer calories than you burn" is not actionable advice

> It's extremely actionable ...

There is no clear-cut action from that optimization request. In comparison, "eat less" or "eat different in this specific way" are examples of things that are actionable.

> and I've seen it work for hundreds and hundreds of people (I attended Weight Watchers to support my roommates. Both of them went on to become WW leaders, and I made so many good friends there I kept going back year after year. I have personally been involved in the lives of well over 500 people losing well over 100lbs each)

This means that it is "effective", not that it is "actionable".

>> as changing what you eat can be easier than insisting that you have to eat less and go without something your body is demanding.

> I never said anything about eating less. You miss read.

Well, now it isn't clear what you mean at all, because you've said you advocate Weight Watchers while also advocating a simple belief that "it's physically impossible for a body to gain weight if it's burning more calories than it's using". The people at Weight Watchers are very clear that "we know that a calorie isn’t just a calorie": they advocate modifications in the kinds of things that you eat and the way you live your life that will lead to a healthier body and, as a side effect, weight loss; in the process, they have a fairly complex equation that assigns "points" to different food items based on a bunch of different quantifiable metrics. This is exactly the kind of "too complicated" advice that you complained at glaugh about.
Systems like that are only a privilege escalation away from being compromised and are much softer targets. Anything with shell access for multiple parties not known intimately to the owner of the box should be monitored with great zeal.
Usually, "transgendered" is not preferred by trans* people themselves. It sounds awkward.

For a transgender person, one's gender is always what it is; it's just the body that might need adjustment. Also, it's hard to say when one's "arrived" anyway; there's not really a point when you just say "tada!" and you're all done. It's a very gradual process.

Some trans* people will still rrefer to themselves as trans* even "after" transition (inasmuch as you can pinpoint an 'after') because they internalise that as part of their identity; others don't.
Better way to reduce the need for copying keys around would be setting up a private CA, and signing the individual keys with it. Of course you need to keep the CA key secure, I'd strongly suggest removable media or preferably a real HSM.
On Contact Management
Maybe you should randomize the order of IPs you scan, so you don't hit the same network at 100K requests/sec.
Minor point but Japan is one of the world's foremost consumers of eggs. One of their popular dishes is raw egg on steamed rice. More here - http://www.westonaprice.org/traditional-diets/inside-japan - it mentions they eat more eggs per person than the US.
If for each two jobs automation removes, it creates one new job. The one new job pays less than two previous jobs. This changes the balance between capital and work. Workers share from production has been in steady decline in all OECD countries over two decades.

To achieve the goal of working less, you need to own capital. Technology changes the capital vs. work equation towards capital at the same time when there is increasing global supply of educated workforce. It's just supply and demand. Workers are simply competing towards bottom.

To get to position where you need to work less you would need to have:

1. Change taxation from work to capital.

2. Basic income.
PrioVR: Get your ideas moving
only []()+ in js code
Not any more.

There are tags you can put on your markup that will tell screenreaders and other accessibility tools that this thing is a button, there is an entire set of aria roles and states for things like checkboxes, buttons and other ui objects so you aren't limited to the defaults provided by the various html standards.
> There's absolutely no spare space in a modern phone.

My Treo 700p was >3x the thickness of an iPhone 5S, roughly the same width, 7mm taller (not counting the antenna, which was, by far, the most annoying physical part of the phone), and weighed an extra 68 grams. My manager around the same time used an HTC Windows Phone of not-dissimilar size and weight.

Phones are smaller because they can be, not because they have to be.
No they don't. Apples buttons are round, ms buttons aren't.
Guide To Conversion Rate Optimization
What if Motorola so that next storage upgrade or screen? And modern desktops are built to be modular from the start. Why not have a motherboard in form factor of a smart phone device.
iOS7 now prompts you to establish a relationship of trust between the phone and the Mac before it'll do anything data-wise.

http://allthingsd.com/20130801/ios-7-will-immunize-iphones-f...
Maybe.
http://williamtpayne.blogspot.co.uk/2012/12/the-political-ec...
I'd argue that the biggest problem is not new technology and how it replaces workers - it's the increasing rate of change of technology, and increase in speed of new waves that replace / commoditize industries. In otherwords, I worry that we'll eventually get to a place where every month there's something dramatically better/more efficient coming out that will replace the jobs done by regular people. People take time to learn, and re-education for the jobs available will not be instant. That means that if the group of available jobs changes too quickly, we may find ourselves with a growing and unfillable skill gap, since nobody can learn the new skills fast enough to actually use those skills in production.

What are your thoughts? I'd like to pick apart this issue.
http://en.wikipedia.org/wiki/Ericsson#Products_and_services
Witch_house: MUD in Haskell, played in a Lisp
Then again this only enumerated existing languages. The most disruptive ones might still be in development.
This article has a very fearmongering tone, and completely misses the fact that economically, people will still do these jobs for a long time, because replacing them with computers is not an easy or cheap task. Technology has been replacing jobs ever since it existed, and the workers somehow kept up, I see no reason why they wouldn't in future.
Security is a tradeoff. In this case, unattended upgrades lead to increased downtime.

(Why? Because you didn't read the caution note that upstream sent along to you, that's why. You just woke up to the alert saying that your system is down.)

If you have a reasonable environment, you should have alpha or qa servers that look just like production, except that they aren't visible to the outside. Always test changes there before upgrading on your production machines.
In the article they mention that log functions make some multiplication problems much faster for humans to solve. Can they also make it faster for computers to solve?

In other words, if I'm writing a program (perhaps for data analysis) that has to do a large amount of multiplication, can I get the answers faster by converting them to log and then adding them, and then reverse look up the result?

Or, are addition and multiplication equally fast on most computers so that the time to look up log values would always be slower?
Yes, but it makes no sense that a one time pad would leak key information via cache timing, because the entire operation is just 'message xor key'."

With a one time pad, the key's length has to be the length of the plaintext. There's no way for the key to be leaked through cache timing, because no memory location is ever read twice.

The entire operation is simply: read a byte of plaintext; read a byte of key; XOR the two, writing the resulting byte"

It makes no sense to use cache timing attacks against one time pads, because the speed of memory access is independent of the key and plaintext!

If you have a side channel attack then a single use of the key would be sufficient to break it-even a OTP would be vulnerable.

Let me try to put it another way: as far as I know, there are no reasonable side channel attacks against one time pad encryption, and certainly no cache timing attacks. So I don't understand why you're saying OTP is vulnerable to side channel attacks. Also, how is it possible for a single use of the key to be vulnerable to a timing-based side channel attack?

If I'm wrong, please point out precisely what I've said that's wrong, so that I can learn from my mistake.

I'll reword my original questions for clarity: does "800 write operations" mean "the attacker initiated 800 separate encryption operations, each using the same encryption key X, then analyzed the cache timing in order to infer X"? If so, doesn't that mean this attack can be defended against by changing the AES key for each encryption operation? And if that's correct, then by definition isn't it less safe (if not unsafe) to reuse your AES key?
I agree that key-for-each-device is probably best practice.

It just doesn't work for me though. I frequently need to log onto servers from new client computers, and the workflow of connect from trusted device, generate new key for new device then use new device just isn't practical.

I've spent a lot of time thinking about this.

I think the biggest threat to security on my servers is brute forcing of ssh passwords. The best solution for that is key based authentication. (I deploy fail2ban as well though)

There is a non-zero threat of my devices being lost/stolen/accessed with my keys on them.

So key based authentication is the way to go, but I just can't get around the practical aspects.

In the end I often rely on long, random passwords kept in a KeePass database I sync (along with Fail2Ban). I've considered keeping my private keys in that too, and to be honest I think that isn't a terrible solution. It is certainly less than ideal, but probably mildly more secure than my current method (ie: really a private key shared across devices is acting as a very long password)
I guess this "software is eating the world" explains github's $1 billion valuation (which doesn't make sense to me otherwise, developer tools aren't as large a market as say, the TV-replacing youtube, bought for around $2 billion).
That I can understand. I think the biggest thing that was rather off-putting about this project is that it seems that you're selling it as throwing Javascript blobs to the client to render, instead of as a primarily server-side templating system, which makes a lot more sense. However, it does lead to a request to put in support for ARIA tagging ( http://www.w3.org/WAI/intro/aria ), because if anything, baking accessibility support like this into a templating language makes it easier for people to reach disabled people who want to view sites.

I've got to apologize for the harsh tone of the original posting. I have a few friends who are either legally or totally blind, and have had to help them try to find software that is reader-compatible so they can interact with the world around them. So seeing the "everything is dynamic" ability sold as the big reason to use this templating language, and knowing that readers can get confused if there's a lot of weird actions going on with the DOM, made me frustrated that there was yet another tool made that will further alienate these people, and make it harder to use one of the most awesome tools made for communications. Too many people take a path that is essentially "fuck the blind", which is just saddenning.
Yeah, sure, it's only women who choose a phone on looks.
And yet, no Apple logo on what, 75% of smartphones these days?
Reddit - Github dictionary According to Fox
Can you explain how this would work?

How do I use a private CA to generate(?) keys for ssh authentication?
> the stated motivation for this design is to reduce electrical waste. The best way to do that in the short term is to ensure devices are more repairable

Right, a replaceable screen and battery and an SD card slot would get you 99% of the features you'd actually want from phonebloks, and it's actually something that would be achievable (if there were demand, which I think is the biggest problem here: there's just no demand for this from the majority of consumers)
You can live cheaply, by opting out of the rat race. Though you do need to be pretty resourceful. e.g. http://www.atariarchives.org/deli/cottage_computer_programmi... It's just that most people don't want to, we are social animals and mostly define ourselves relative to the herd.

A very different application of automation to the relative-wealth issue: http://partiallyclips.com/2003/09/25/dome-house/
I'm so excited with all these recent advancements in consumer VR!
What is the purpose of creating a new user and not using root, assuming ssh password auth is disabled, and only I have the key. Making a new user that has sudo an attacker geting that user as opposed to root all they have to do is sudo anyway?
> See, in Europe, the ticket can be given to the owner of the car.

Europe is a big place. In Sweden, the traffic camera has to catch the driver's face. If you cover your face so you can't be identified, they won't serve you with the ticket. They do exactly as you say - employ a room of people to compare photos to the driver's license database. http://www.svt.se/nyheter/sverige/dolj-ansiktet-slipp-boter
Pacman in ClojureScript
Change the default ssh port and use .ssh/config to predefine connection parameters. This way you can write ssh mybox
The biggest problem is that all major hardware manufacturers must create common standard and redesign their hardware components. The combined effort would cost billions of dollars and the result will be uncertain. No one would take the risk.
Instant IntroJs [Instant] is ready to preorder
I think most people already solved this problem by joining Facebook.

Yes, it's obviously not quite the same thing. But it's a central place which (almost) everyone has joined. Many have listed their phone/email details, and if they haven't I can usually message them to ask.
How about "Mac user"? Avoids confusion...
Why was this posted again after one day? https://news.ycombinator.com/item?id=6376422
Security is a tradeoff. In this case, unattended upgrades lead to increased downtime.

Agreed. Indeed, the parent explicitly shows one possible trade-off:

Especially for your hobby projects or personal server because odds are that you won't always have the time to act on every security advisory.
I'm on a phone with shitty wifi atm so looking at the code would be hard to say the least. However, I am curious, how do you deal with packet loss?

The reason I'm asking is because, most people who claim to "scan the Internet" assume that the network is reliable. And they don't follow up on potential false negatives. If you scan the IPv4 address-space sequentially while only limiting bandwidth or time, rest assured that packets will be dropped.
"Being poor in America is a state of mind."

Having spent most of my childhood living with my mom and my three siblings on her meager $8,000 / year income, I'd say I have to agree. Poor is a state of mind.

But, I'll argue that it's not a state of mind that the poor take on themselves. "Poor" is a distinction that others will give to you, not the other way around. Being poor is about being relegated by the other members of society. It's about being isolated, segregated, and honestly, constantly dealing with all sorts of mean-spirited people who believe they could have made better decisions...obviously.

Please try to imagine living a world where you're the lowest status person around, where the kids and adults look upon you in disgust. Imagine no support network, few friends, and a life void of most conveniences. Is it better than the poor of other countries? Maybe. I don't know. But, at least, I would hope that they have some sort of community. Being poor in America is about being alone and laughed at, while suffering.
Great and free. Thanks for this, I'm giving it a try. I was _this_ close to building something similar myself, glad I found a really good version already built. :)
Fail2ban prevents brute force connection attempts. One can also chose a password resistent to brute force by using a long string. A psalm verse, or a sentence from some peoetry which is easy to remember. Or pick a password made of the first letter of each word of this long sentence.
> about removing quotes from strings, I tought about it, and I think as long as some other display property is different (to differentiate the number 4 from the string "4")

The problem is that for most people the technical and subtle difference between 4 and "4" does not have any meaning except that "the system" apparently differentiates for some reason. Subsequently they will (implicitly) attach some meaning to the difference, but, as they don't have a background in information, their understanding probably does not correspond with the reasons why you implemented this difference. For example, they could think that "4" means "about four", or "four is important", or "four", or whatever.

Unless the difference between "4" and 4 is or becomes relevant to the user, the user should be prevented to have to differentiate between the two. And "because the system asks for it" doesn't really make it relevant to most users.

I do understand the problem, of course. Without some function attaching meaning to the JSON fields, a program cannot know if a 4 has to be 4 or "4". That means you have to make a rule one way or the other. The question you should ask yourself is: which one is best in your situation given the audience you target. Possible rules:

- a numerical number on its own, however written, is interpreted as 4 instead of "4". So, "4", " 4", 4, " 4 " will all be interpreted as 4.
- all primitive fields are all strings. The program has to attach meaning to them. So, 4, "4", " 4", are all "4"
- there is a difference between "4" and 4. If you want the number, use 4, if you want the text four written in numericals, use "4".
No, it is not a human right. If we can just point to websites as undisputed facts, then the earth is flat.
PC's are modular. You can mix and match (at least, until a new motherboard standard); you can replace parts (at least, while they're still made).

One problem with mobile phones is that they haven't been fast enough - by tightly integrating every part, you can maximize efficiency to get the best out of the hardware. Apple does this fantastically, whereas Android is more modular, and so isn't quite as efficient.

But now that the iPhone 5S is 40x-56x faster than the first iPhone, speed doesn't seem to be an issue, in practice or theory. So an even more modular phone is plausible.
In effect, we have exactly this if your acquaintance's contact information is on Facebook and you link your phone's address book with them. You don't need to keep track of constantly changing information since it's all centralized in one location. The "spheres" you reference are akin to Google+ circles or Facebook's lists. You can set the visibility of your contact info to achieve something pretty close to what was described.

The upside of such an approach is that there is one central point of truth for everyone's info. Conversely, the downside is there's also one central point of failure.
Uhmm, all the images are oriented right in Safari on my iPad.
Floating-point multiplication generally isn't much slower than addition on modern machines. Logs are useful for avoiding floating point overflow/underflow, though.
This is the norm in the UK too for shared housing. You have multiple named tenants on the lease and each is responsible for the full rent if the others can't pay.
Lets be honest, the press for the most part vacated the fourth estate in 2008 and still far too many of them like their new home.

We need to not only protect those who report the news, whether they are traditional news people or new style, bloggers, from the government but at the same time we may need to find ways to prevent political parties from co-opting the media. Far too many are way to cozy with political groups and fail to realize when they voluntarily give up their freedoms.
I never understood why the EXIF rotation tag was invented. It's caused so much pain and wrongly rotated images. Why can't whatever software writing those tags just rotate the JPEG blocks instead? "jpegtran" can losslessly rotate and flip JPEG images fine.
PC's were once integrated, too, and then became modular. Smartphones are integrated, but I could see a future where they become modular. It would also follow Clayton Christen's theory of "integration/disintegration" from his Innovator's Solution book.
Great, until you walk into a wall!
I don't want to be picky but this isn't two factor authentication in its usual sense. Two factor authentication uses two independent means/media to authenticate. Protecting the private key with a password is required to protect it of beeing exposed when stolen. But if it's stolen then brute force password guessing is for free. Brute force attack against a login password can be detected and impaired, not with stolen private key.
Review of Tresorit "Secure" Cloud Sync / Hostcult
If I recall correctly the standard MacBook Pro also sports a DVD-slot drive, which may attribute to quite a bit of the added weight and size. However I do agree, that modularity will come at the prize of less miniaturization. And with mobile phones this is even more of an issue.
And the most oft-repeated phrase in Ecclesiastes is, "Eat, drink, and be merry"
I wish there are a similar effort on Ruby VM.
You make a interesting point in describing TACK as intrusion detection system. It makes sense against larger adversaries, while the MITM protection make more sense against smaller.

The question I have then is, what happen if look at TACK as an IDS. What is its false positive rate? Can it be lowered? Maybe it should inform the website owner as a way to inform both side of the communication that something eerie is happening.
Hawaiian is written in the Latin alphabet, like English, so supporting the language is not the problem.

The length is the issue, and that's more a cultural issue than a language one. (English names could also be very long.)

If Hawaiian names are typically very long, then this could be interpreted as a cultural bias against traditional Hawaiian names. However, in looking around for Hawaiian names, it does not seem that they are typically so long.

There is not enough information for me to get a sense if this is discrimination on the basis of cultural, or a one-off case.
> > the stated motivation for this design is to reduce electrical waste. The best way to do that in the short term is to ensure devices are more repairable

> (if there were demand, which I think is the biggest problem here: there's just no demand for this from the majority of consumers)

I'm old enough to remember people treating their phone less carefully towards the end of the contract, so that they "had the excuse" to upgrade to a better phone when they got a ew contract, and not just keep the same phone on a cheaper contract.

So, repairability is good, but WEEE is also important. (https://en.wikipedia.org/wiki/Waste_Electrical_and_Electroni...)

Luckily phones contain comparatively large amounts of gold so they're desirable for recyclers. It'd be great if all the other rare earth minerals etc could be recycled too.

It's great that there's a lot of aluminium cases being used, if that's creating a market for recycled aluminum. Not so great if new ore is being mined for it.
But you can arrest individuals who, using their office, engage in felonies. If this is organizational, i believe we could use RICO.
Cheap iPhone, or cheap iOS device?
Here's a list of them that use Verisign's VIP: https://idprotect.vip.symantec.com/wheretouse.v

Others may use in-house solutions. Here's Bank of America's two factor solution: https://www.bankofamerica.com/privacy/faq/safepass-faq.go

We're almost to a point where the question isn't whether or not they support it, it's finding out that they have a program, clicking through tiny text links at the bottom of pages, and figuring out how yet-another-implementation works.