skysight-inc/HackerNews huggingface dataset:
how is it possible to have both cheap access to mortgages, and yet have houses be unaffordable - that seems contradictory to me - and yet it does happen. Economics baffles me o_O
I think it does that when London is already a day ahead of the current timezone. That's obviously a bit counter intuitive so if like to get that working properly.
Hipmunk is hiring engineers!
Landing page flaw: If it is going to replace my signup form, please tell me what user credentials it will send to my app. Email? Phone#? What?

As many comment, this is a pretty vague proposal.
If the CPU is compromised then you've already lost.
IE 8 on Windows 7 became completely non-responsive and consumed an entire CPU until terminated.
Security dangers of the NIST curves
There are those who have technical concerns. But there is no technical solution to a compromised chain of trust - including, "Trust me, I'm Linus and I know what I'm doing."

Ken Thompson described it as "Trusting Trust."

http://cm.bell-labs.com/who/ken/trust.html
It is not. Bitcoin gives you an option of transacting irreversibly which you can use as-is, or with a mediator (e.g. PayPal). Traditional banking does not give you such option. All transactions are mediated and always reversible (even wire transfers, see my reply in a parallel thread).

As a side effect of irreversibility, anyone may build their own "PayPal" or "eBay" on Bitcoin in any jurisdiction and compete freely. Customers will have much more options than with traditional highly controlled and restricted banking system.
Oh, and I love getting suggestions. Have your friends tweet me their favorite watches and I'll check them out!
That is not regulation, merely threat of competition. And competition is moot if all the servers are accessible to the "bad guys", in this case, NSA. Unless, you mean to tell me there is a viable alternative to AWS that is located in Switzerland?
How To Download Facebook Photos On Android Phone
think i made my point rather badly.. gunpoint and spelunky were my examples of good gamemaker games which make money.
The Declaration of Independence is rhetoric meant to justify a war. It's ironically contradictory--people talking about "all men being created equal" right before founding a country where blacks were enslaved, Indians were exterminated, women had few rights, and only land-owners could vote. The most sensible way to read that part of the Declaration of Independence is for the narrow statement that "white land owning males in the colonies are every bit as good as white land owning males in Great Britain." That plus Thomas Jefferson having a flair for the dramatic.

"People not in America are equal to people in America" has never been an animating principle of American society. The U.S. has a long and storied history of e.g. intervening in Latin America to keep it a brushfire-free back yard: http://en.wikipedia.org/wiki/Latin_America%E2%80%93United_St...
Beyond Passwords: New Tools to Identify Humans
I know I'm being overly pedantic, but it's not actually CSS that's crashing the browser, it's Micrsoft's extension that is the culprit.
The author would benefit greatly from using the appropriate UI components to accomplish his goal instead of kludging a rate limiting mechanism onto his MainWindow's resize implementation.

Instead he could build a graphics scene using QGraphicsScene (http://qt-project.org/doc/qt-5.1/qtwidgets/qgraphicsscene.ht...) with a nice normalized coordinate system which logically represents the namespace size in the SSD on UI elements designed to be rectangles. Adding a view of that scene onto his window is trivial, and as an added bonus he gets the power of Qt's scene graph which will be a boon for both performance (http://blog.qt.digia.com/blog/2013/09/02/new-scene-graph-ren...) and portability. Qt will efficiently manage resizes and draw the scene optimally without overhead associated with a re-purposed widget.

His approach does achieve the desired goal and is probably appropriate in some circumstances, but in this instance he should take a step back and assess if there is a greater fundamental problem with his design.
So Spelunky was made with GameMaker. It was extremely enjoyable to play which led to the development of the XBox version.

It contradicts your statement "it's unfortunate that the process doesn't result in games that are particularly enjoyable to play.", doesn't it?

Also I'm sure the dev tools don't play such a big part in the gameplay's quality of the result as you think.
Yahoo! Screen
Blog post: http://yahoo.tumblr.com/post/60758567758/re-imagining-video-for-mobile-with-yahoo-screen
I'm not saying that the person should be required to know the language; a translator would be fined. My point is whether it should be the police's responsibility to arrange for that translator.
So, you're not using https://c9.io/ yet? ;) Are there any other tools that could fit the description of cloud IDE?
> ... and granting a free license for all nomilitary use.

I never thought about this. Maybe it would be a good idea to add such clause to applications I release. It wouldn't be compatible with GPL of course, but then again... not sure which one I care about more.
First off I would expect a parent who sees their children suffer to lash out at someone when they have no way of controlling it. That doesnt mean it goes without merit though.

If a child is bullied in PE to where every day he just tries to curl in a corner and try not be noticed not only does he not get anything out of the class it can alter the childs desire of becoming an active participant in sports. I think you can draw a lot of correlations between that and this.

If we want to avoid and undo segregation between the sexes in our field having them attacked for it at a young age and have the idea indoctrinated in them that computer science is not for them is something that needs to be prevented. The only people really with the ability to do so in this scenario is the teacher and parents of the other children. The teacher is the single =individual= with the most ability to affect the lives of the children and although he shouldn't be held accountable he should try to be more attentive to prevent the bullying or at least try to make the class more engaging and fun.

She was pretty patronizing and mean, but I associate that with her frustration and anger with her lack of control. In her shoes I would probably do the same.
isn't this kind of stuff subject to responsible disclosure?
Tutorials are great, but when something comes close enough to my domain to understand it pretty well, I love a timelapse as I have those "OH! I see what you did there!" moments while getting an appreciation for the full scope of the project.

Either way, I'll be checking back regularly. Great work.
> Up until now, it has been NSA pretty much the ones establishing the new security standards, since they have the best minds on it.

They have? I thought they were still regularly fought and ignored by the rest of the crypto community.
Introducing Private Networking
"If you can't see anything because you can't get the source code... well, who knows what they might be hiding?"

Actually, it's worse than that. Even if you can review the source code, you STILL won't know for sure. As Ken Thompson put it three decades ago, "no amount of source-level verification or scrutiny will protect you from using untrusted code."[1] This is because the tools we all use to process or transform source code (e.g., already-compiled-to-binary compilers, assemblers, loaders, etc.) may already contain secret back-doors. Ditto for even lower-level tools like hardware microcode.

While open-source software tools -- and open hardware too -- are much less likely to have secret back-doors embedded in them, there are no 100% guarantees. Ultimately we have little choice but to trust the people who create, package, and distribute all the software and hardware we use but didn't create ourselves from scratch.

--

EDITS: Added last paragraph. Made minor edits to second paragraph so it more accurately conveys my thoughts.

--

[1] http://cm.bell-labs.com/who/ken/trust.html
Ah, but with a little practice (& patience!) you can dial complete numbers using this system. I used to call the 113 number (clock/time information) here in Argentina in this way just for fun.
Apple Store is offline.....
> I'm planning to port BEAM to asm.js

now that is a very interesting idea. Wouldn't mind keeping an eye on it if it's going to be open source!
> you won't defeat an agency that has you on your radar because you use "open source software".

The point is not to create obstacles to criminal investigations but to thwart massive online private data collection.
A simple photo app with Knockout.js - Lesson 1
Sure, but the CPU has to perform correctly on general-purpose computations so it's not too likely that, for example, the multiplication instructions occasionally give wrong results. Detecting cryptographic code executing in the CPU and subverting it is hard in general, but quite easy if you have a special instruction used only for the purpose.
I believe the issue stems from a lack of education about the loans themselves that the student borrows. Very few high schools around the U.S. are teaching personal finance, and I also suspect the public high school I went to wasn't the only one not properly preparing their students for the financial part of higher education.

The process of getting accepted to a school and receiving financial aid may be long, but considering the student is borrowing tens (and sometimes hundreds) of thousands of dollars it's also incredibly simple.
Are you serious? You want a HS teacher to teach Java?
The third comment (on the article) is interesting. In theory, a 'XOR' among sources of data is 'secure' if any one of them is truly random.

Let's look at this further. Imagine you have a stream of entropy, and then you xor it with a second stream. The first stream is secure (truly random) but the second stream is defective: it's all 1's.

Question: Do you now have a random stream, or is it biased towards 0's or 1's or in any other way?

Answer: If they're independent it's secure. Let's see why. In fact, you can consider the correct (random) stream as being a OTP on the plaintext which is all the rest. In this case the 'rest' is all 1's, but it could be something partially random. So, any random-enough source acts like an OTP on the final output - Except you throw away the key.

Naturally, as OTP's are secure, the resulting 'ciphertext' (looking at it as though it were an OTP operation) does not exhibit any evidence of the 'all 1's plaintext that you "applied" it to. It doesn't matter what order you do the XOR's, or how many are secure (random enough) and how many are insecure.[1] So, if you have 27 sources of entropy you XOR by, then if any one of them are 'random enough' then the output is 'random enough'.

There's just one problem: your output could be LESS random if the 'random enough' "key" could somehow be recovered. For example, if instead of all 1's, for our second stream we XOR'd by a mirror of the first (otherwise secure) stream, then our results will be all 0: a horribly biased RNG.

So, if any of the 27 (or however many) sources 'know' about the most random source, they can 'undo' the entropy that is being added, and add hteir own. so you might be XORing with a copy of the 'random enough' source, netting all 0's, and also xoring by the output of an encrypted output of an iterated counter, encrypted with, e.g. the NSA's private key:

then to anyone that didn't have the NSA's private key it would look like the stream was still random enough. But in fact, the entropy added by one source is removed in another.

The correct way around this is for hte sources to not have enough information about each other to be able to 'leak' keys this way (undo entropy).

So the third comment on the article is very interesting in this light.

[1] XOR is commutative so you can rearrange the expression this way for any number of sources of entropy; it doesn't matter which one is secure: e.g. if D is secure in A XOR B XOR C XOR D XOR E XOR F, the output is still the same as (A XOR B XOR C XOR E XOR F) XOR D (by the commutative property) and therefore secure.
My electronics skills are pretty much limited to upgrading my PC, so I was fully expecting to brick my iPhone in the process. Once you actually open it up though, everything slots in very nicely and obviously. The only tricky bit was keeping track of the different sized mini-screws and making sure I put them back in the right place.

I followed an ifixit.com guide (like this: http://www.ifixit.com/Guide/Replacing+iPhone+3GS+Battery/154...) which, combined with the video, was very easy to follow.

Alternatively, you could probably find somewhere to do it for you for maybe $50 or so (still cheaper than Apple), but I doubt they'd use anything more than the cheap stuff you find on Amazon.

Still, it's worth following the other suggestions first and seeing if you can downgrade the iOS version.
Does it even matter? I don't get why you would bring gender into this discussion to begin with. Yes she had her genitals on the inside, but by focusing on that issue rather than the actual subject matter, you're perpetuating the notion that there's a difference between male and female operators. And by saying "I bet she never complained" you're demeaning women as much as the small minded men who feel the need to insult their peers because of their gender.

So can we please stop beating the old gender topic and just get on with our jobs as equals.
Official Yahoo! blog: http://yahoo.tumblr.com/post/60758567758/re-imagining-video-...

Yahoo! Screen blog: http://yahooscreen.tumblr.com/
REMOTE (from Europe) possible for the "right" candidate? I'm more interested in senior C++/engineering positions
Low-cost water purification, sepsis testing kits
If the CPU is compromised then we should try to find out about it.

We might not all be cryptography experts like Linus is implying he is, but he saying there's no way the CPU could be compromised and use the backdoor against Linux? If not, then he should invite more scrutiny, not less.

From what I understand it would be very hard to even know if the CPU is compromised, so why is he so absolutist about it then, if it's impossible for him to prove with absolute 100 percent certainty that it's false?

As the post at the top says: trust no one.
Does Dale Emmons reply make any sense? I can't imagine how you could "bias" the output of a RNG just by XORing some data in, unless the RNG is already broken. I guess you could argue that the NSA could find vulnerabilities in the stock linux RNG and then use this XOR to hide data in a side channel or something.

Sounds a bit far fetched, although I guess I can't prove him wrong. But if the stock RNG is faulty we're already quite screwed, rdrand or not.

I mean if you're willing to believe this could be compromised, why not imagine that intel inserts backdoors in the silicon of all their chips? Why trust the rest of the logic but not the random number generator specifically?

EDIT: also, the picture illustrating the petition is pretty terrible: https://www.change.org/en-GB/petitions/linus-torvalds-remove...

I can't really blame Linus for responding aggressively on that one...
Show HN: Solve your legal problems
As a lawyer, my friends regularly ask me for help with their businesses' legal problems. Most have common issues, like deciding where to incorporate or whether to change a contract. It would take valuable hours away from their business to find a good, affordable lawyer; it would take even longer to solve the problems themselves.

I built PlainLegal to make it easy for startups and small businesses to solve their legal issues. PlainLegal's streamlined process connects you with our group of prescreened lawyers so you don't have to waste time looking for the right lawyer through Google searches or personal referrals. Our goal is to quickly connect you with the right lawyer so you can get back to business.

Once you contact us, PlainLegal's team works directly with you to understand your legal issues. We will then show you a personalized list of lawyers so you can pick the one that's best for you. We've selected lawyers to be part of PlainLegal based on their qualifications and ability to communicate clear, actionable steps in plain English. Each lawyer has at least 4 years of experience and understands start-ups and small businesses. Some are even entrepreneurs themselves.

If you have any questions during the process, our team is always available to provide support and make sure your problems are solved. We are launching our alpha today for startups and small businesses based in New York. Get started now at www.plainlegal.com.
> Normally I'd just move on and assume others were offended as well, but this is somehow the highest voted reply...

And this reply is the highest voted reply to the offending reply, including mine.

Just throwing this on the table...
Suppose for the moment that the output of RdRand is known at all times to the NSA. In the relevant Linux code it is mixed in as follows:

/*
* If we have a architectural hardware random number
* generator, mix that in, too.
*/

for (i = 0; i < LONGS(EXTRACT_SIZE); i++) {
unsigned long v;
if (!arch_get_random_long(&v))
break;
hash.l[i] ^= v;
}

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

i.e. the output is XORed with the bits being returned. (Note that the output of RdRand is not added to the entropy pool itself; it's used to modify the value being returned via an XOR).

This seems reasonable given that the intent is to XOR together two random streams.

And if RdRand is known to NSA then NSA can do the XOR and get back to what would have been returned if RdRand wasn't there. Thus if NSA knows all about RdRand then the effect would be to downgrade the random number generator to the situation before RdRand was used at all. This doesn't seem to provide much vector for an attack on Linux's random number generation, it would just make RdRand useless.

Of course, if RdRand is the only thing you trust...

PS Linus' reply is disappointing, however, because it doesn't explain the situation.
According to this article (http://women2.com/girls-go-geek-again-fog-creek-software-blo...), apparently in 1987, 42% of software developers were women, and computer programming was considered a female position in the 1960's. Actually, my own grandmother was hired to use an early sort-of-computer (a comptometer, http://en.wikipedia.org/wiki/Comptometer) during WW2.

Regardless, I'm confused what your point is here. It seems like you're implying that modern women complain too much about sexism and the majority of men in the workplace. To this... I encourage you to look, well, pretty much anywhere on the web to see its veracity:

http://valleywag.gawker.com/techcrunch-disrupt-kicks-off-wit...
http://www.fastcolabs.com/3016238/why-your-startups-culture-...

I don't know about you, but as a man in CS, I'd rather attract women to come to tech rather than ostracize them or marginalize them. I don't want my workplace to become a frat.
From the headline I thought this was going to be about scaling your application.
Any way pretty amazing slides and nice tips .
I am assuming they are looking at the referrer to get the last visited page (the referrer) . And also wouldn't the tracking only work for their own page (the one created on their own website ).
Why technical explanation alone is not enough
My initial thought is this is working via the microphone/speakers on the computer and phone. My second thought is if you don't need to unlock the phone and activate anything I bet this absolutely kills your battery life.

I'd bet the proprietary technology is that the phone constantly emits some tone outside the normal range of human hearing (probably with some time varying value encoded in the frequency of the tone) which the mic on the computer listens for. Once the computer picks up the tone, it decodes the time varying value from the tone and from there proceeds like any other TFA login system.

There's also a question of what happens in a busy setting like say an office environment when multiple people are using this system and say two people attempt to login to a site secured with this at the same time.
Similar thoughts : http://unqualified-reservations.blogspot.com/2007/07/my-navr...

CTRL+F for "computer science" and start reading from there. Till then it's filler.
(1) You can in some configurations. If you use qemu there's a block-device driver in qemu and another on the GlusterFS back end (as of 3.4), which both allow snapshots via methods external to us. I meant what I said about it being a hard problem. We're determined to deliver a general snapshot function. That's much harder than delivering snapshots that rely on an uncommon and/or unstable base technology, so it's taking a while.

(2) Yes, if you want to survive N concurrent failures you need N+1 mount servers, and currently released code only supports N=1. However, http://review.gluster.org/#/c/5400/ has already been merged and will be available in the next release.

(3) IMO you should also have mentioned that the problem only manifests in a specific deprecated use of the CLI (from machines other than the servers). Nonetheless, this is a known deficiency which I've been personally pushing to fix.

(5) The current state includes many of these "cool features" (thanks!) without need for any specific OpenStack integration. That's kind of the point. Unlike some, we don't need to re-implement features for every access method or use case. 90% of that functionality would be available e.g. to CloudStack or OpenNebula today. IMO making a big deal of snapshots as a differentiator in one direction without mentioning myriad differentiators in the other doesn't leave people with the information they need to make progress toward their own decisions.
>shaming people isn't going to change anything

Wouldn't it dissuade people from taking $50,000 loan for a communications degree?
This is most likely a hang and not a crash. The difference is a hang is highly unlikely to lead to anything exploitable and if its obscure enough, Microsoft will almost certainly not fix it in older versions of their browser.

I've found a similar one a few months back. Please note that this will also crash your browser...

https://gist.github.com/lojack/6510214
Wonder what the response from the teacher was...
I would prefer a cryptographer, not Linus, to weigh in on how Linux's PRNG works and what impact RdRand would have on it. It's not that I distrust Linus, it's just that it's hard to separate the vitriol from the facts. That, and a second opinion on the matter would settle it. That'd put the FUD to rest.

However, I found this message a good explanation of what RdRand is/does and how they're integrating it with /dev/random. http://www.spinics.net/lists/linux-crypto/msg05883.html
Well I am talking about true live migration where not a single icmp echo request is lost.
She said something about Mark I being the first such computer in the United States, but I think the gist is true anyway, that people employed at least in the practical aspects of computing at that time were learning a lot as they went along.
It's not quite as bad as it sounds: I don't think even the NSA has people smart enough to insert code into a compiler which will add backdoors to software which didn't yet exist when the compiler was written.

If you're paranoid, use software written in the past 5 years and compile it on a system running FreeBSD 4.1 off a CD which you've had in your closet for the past decade.
New in OS X Mavericks: OpenGL 4.1 Brings Features, Performance
100% Reproducible Builds in Go
At what point does it become ok to harass and threaten this "privileged" group of people?