skysight-inc/HackerNews huggingface dataset:
OTPs feel nice because "UNBREAKABLE!!". But there are severe problems.

1) The pad needs to be random. It must only be used once. It must be larger than the plain text you want to send.

2) You have to be able to transmit the pad somehow. If you can transmit the pad, why don't you just transmit the message, or transmit keys?

People do sell OTP technology. It's up to you to decide if it's snake oil or not. (http://www.mils.com/en/products/unified-communication/#2) (http://cipher-text.blogspot.co.uk/2005/08/one-time-pads-on-p...)

> First, they were founded in 1946, and have been doing one-time pads ever since. Second, they seem to be pitching their products at governments. Third, amongst other things, their random number generator can output to a...wait for it...5-channel paper tape puncher (pictured above left).

> 5-channel paper tape -- as in, pretty much the same one-time pad implementation Gilbert Vernam patented in 1919. I'm flabbergasted. Who's still using this stuff? I reckon you'd need a little over 4 meters for each kilobyte of information you encrypt.
Play-i: teaching children to program with robots
The Conversation is just perfect. It's worth a watch for sure. While we're thinking about surveillance themed films, The Lives of Others comes to mind as a strong recommendation:

http://www.imdb.com/title/tt0405094/
sudo, ssh certs, egress firewalling. Congrats - you've covered about 4 pages from the NSA's 200 page hardening benchmark. Off to a good start!

http://www.nsa.gov/ia/mitigation_guidance/security_configura...
What about if a subdomain of the real website was pointed at the ad network, e.g. adverts on this site would be served from doubleclick.ycombinator.com

Every website would serve from a different domain, which prevents (? helps prevent?) tracking, but advertisers like myself can still run it through our own network and see valid stats.
Why Someone Bought a $1,500 Bitcoin Miner on eBay for $20,600
Being poor in America is a state of mind. Do you think that the majority of people in the world today would consider themselves "poor" if they suddenly traded places with a "poor" American?

Do you think that the majority of people would think that it was "too hard to bear" if they had to work, live in low rent apartment AND go to school?

America's poor are the worlds wealthiest.

The sad state of mind that people fall into is all about relativism. They are poor relative to X people. They are disadvantages relative to X groups. They have to work harder than X people so this is suddenly an insurmountable feat.

Put nearly ANY (truly) poor immigrant in the US and watch the magic work. Watch this insurmountable feat accomplished again and again. Watch this success propagate for a couple of the immigrant's generations. Then watch the values that they brought, the very reasons that made them succeed them washed away by American influence.

I have seen this first hand on many many occasions. I would like to see a study of immigrants and how hard they work compared to the inner city people of America. I would like to see the difference in choices that they made.

Why don't we see this. Why don't we see the government publish and advertise what poor people must do to escape poverty. Advertise how the immigrants do it without wellfare. You never see it (and probably never will).
The laser light that could cut cyclist deaths
I also always change the SSH port to 9922. I haven't seen any failed login attempts so far.
Couldn't have asked for better timing. I'm currently debugging performance issues on a production machine and the summary of tools on slide 16 is really useful. I like the breakdown into beginner, intermediate and advanced.

For anyone skimming, be sure to check out Methodologies (slide 86), which covers 4 different approaches to performance analysis.
So this is what it's called. I didn't even know it's a "thing". I'd say it feels uncomfortable, not terrifying. I usually just confirm that I can breathe, and once that fear is settled, I "haul" myself out of it.
Unless his cat is named Fat Man, it's probably not intentional.
I dislike going to concerts because it is a crappy way to listen to music.
This is the reason that you enable all of the compiler warnings that you possibly can, and treat them as errors. For instance I believe that gcc's -Wconversion would catch an implicit cast from a long to an int (and I'm sure there's a Visual C++ warning for the same problem).

There is simply no excuse to work with warnings like this disabled. If you come across a codebase that was built without such warnings, turn them on and have fun finding out about tons of bugs that could have been trivially avoided.
Then what does "800 write operations" refer to, if not 800 encryptions? How can a side channel be used to break a single encryption?

Also, how would a one time pad be vulnerable to any side channel attack? That seems like it makes no sense.

What am I missing here?
Currently, views are split into 3 places: html, css + js (for rendering updates - usually done with a template). The big difference here is saying that the view is actually all three things/ that it's made up of all three components, which is closer to the truth than other systems of thinking.

Can HTML be the view without css and without js binding for events and updates? Not in a modern app!

Can CSS be the view without HTML/JS? NO!

Can JS alone be the view? Yes, but you'd have a lot of inline css and html - it'd be and a pain in the ass to maintain.

So if you want a single, true View in your MVC, you'd need a view that has all three parts. Other frameworks like backbone try to do something similar - backbone allows you to let your view have a template, but backbone views rely on external css and often attach to dom elements that aren't even in the view's template. So what you have is a view that's only referring to/aware of a few of it's actual dependencies. That seems sloppy if you ask me.

Also, if I had a TweetView that was a backbone view, and I wanted to move it to another person's system - maybe I created an awesome design and called it AwesomeTweet - other people who wanted to consume AwesomeTweet without OJ today would have to include a css file, some html (or a template) and some JS. Each presents a rich opportunity for namespace collisions, and for my bad documentation to make it difficult to import AwesomeTweet as a module. Instead, OJ could allow a simple line like showAwesomeTweet('2131221121'), which would be guaranteed to work everywhere, simply.

Does this explain the "why" better?
There's an important point not empathized enough in this article: Supportive Parents

The lack of support from your parents is probably the biggest brake you may have at this age. Fortunately for this kid, thanks to the support of his parents, he managed to succeed in a really short time. Kudos to the entire family.
Sure, Thomas, I'll bite.

I think Andrew did a good job of exploring the question of asking people to help an individual, when their dollars would be better spent on issue-focussed NGOs/charities (defined as greatest good for greatest number of people/tackling systemic issues).

He quotes a UC Berkeley economist to frame the criticism , invites rebuttal from Watsi Though Andrew's inclination initially resides with the economists's argument, he concludes that Watsi's model isn't likely to siphon off money that would go to a charity like Mercy Corps. He concludes, based on an interview with Watsi, that it appeals in a different way and thus isn't using a cheap fundraising model that hurts more effective charities.

Whether you agree or not with my assessment, there's no need for the donation via bet -- but if you are inclined to find another avenue for your charitable donations, I do like Mercy Corps.

Sincerely,

A-Sometimes-Fan-Of-Silicon-Valley
I asked a question on Quora that garnered a number of interesting replies to this question:

http://www.quora.com/Poverty/Which-is-harder-being-poor-in-A...

The basic gist is that just looking at quantity of physical possessions is an impoverished way of analyzing the situation.
You are correct, sorry, I didn't read the caption.
http://jonas-daehnert.deviantart.com/art/Microsoft-Surface-P...
Wow. The author posted thousands of words, and missed the key difference between mathematics and science.

Science must be empirical -- it must compare its theories with objective reality, in practical tests. If the tests fail, the theory that led to the tests must be abandoned. On that basis, science is falsifiable by reality-test, and any theory, however well-established, may be falsified by new evidence, in perpetuity. There are any number of examples in the history of science where a well-established theory, after prevailing for hundreds of years, was falsified by new evidence.

Link: http://en.wikipedia.org/wiki/Scientific_theory

Quote: "The strength of a scientific theory is related to the diversity of phenomena it can explain, which is measured by its ability to make falsifiable predictions with respect to those phenomena."

Mathematical conjectures and theorems do not have to be compared to reality, only to other formal axioms and theorems that are part of mathematics -- this means mathematics only requires internal consistency.

On that basis, mathematics is not a science. It is vitally important to science -- without mathematics, much of modern science would collapse. But mathematics is not itself a science.

Before my readers object that this is all too clearly defined, and (as I often hear) philosophers are in disagreement about what science really is, I have to remind people that religious groups would like to teach Creationism in public school science classrooms, but in order to do that, they have to redefine science to suit themselves. The key property of science that keeps religious beliefs out of the classroom are the requirements for empirical tests and falsifiability. Take away these requirements, and we lose any practical, meaningful definition of science.

Science is very clearly defined, and it is not a suitable debating platform for philosophers, or for religious True Believers.
I'm ignoring it because I'm assuming that you'll download the file ONCE from cdn.awesomesauce.com/oj.js when you're on my website, then the next time you return to my website, or you go to tom, dick or harry's website, once they have the same url for the file and it's cached in your browser, the load time will be near 0.
I have the impression that this is the strategy for a lot of people involved in personal development in general: change one habit at a time. Most people have enough time to not rush positive changes.
Wholesale nagel opleiding - Probeer een nieuwe zoekopdracht
ij hebben nagel opleiding-spelers van hoge kwaliteit voor u. U kunt de nagel opleiding-spelers tegen groothandelprijzen bij ons kopen.Denk je er over om nagelstyliste te worden? Steeds meer vrouwen hechten waarde aan mooi verzorgde nagels, bijvoorbeeld met gelnagels .
If you allow some self-promotion: you can take a look at the ansible playbook repo I've been putting up (including some documentation and background in the doc directory): https://github.com/pjan/the-ansibles

In all honesty; the steps in the TO's article are only providing basic security. Pointing the ansible playbooks to your server will further enhance it.

You should also consider changing the SSH port, but that's up to you (in which case you also need to change the firewall settings!)
For a _master's_ degree? Or have you gotten a PhD and neglected to update your profile? :P
That's a shame, FreeBSD is actually a pretty impressive OS. You should give it a try, mono-cultures aren't a good thing.
I agree, but would say this its not that will power alone won't work, but that some people don't believe in the power of there own will, and need to submit (at least to start with) to another force. Once people break the cycle they can come to realise that they do have the power within them.
The effect is to dissuade CP traders. It's a warning shot, and it probably scared a lot of people off of Tor. I wonder what the effect on Silk Road has been.
This article is letting IPv6 without a firewall.

A few feedback:

1) Start by the "lower layer"

If it's a physical server, start by reviewing all BIOS options, if it's virtual one you control, start by reviewing the host environment for the guest.

2) Follow from the bottom to the top

Follow by review and secure the boot process. (Grub password, kernel modules loaded, kernel module options, kernel sysctl options.

Follow by review the services started "even before starting nothing".

Review what is accessible in the system to "anybody".

Review what is accessible in the system to each "user". Many times a "user" is going to be listening to the hostile network in a port.

Review what the system is going to do across the time, what is scheduled, which resources are assigned to which users (and their processes), what is going to be registered.

4) Does not limit or scrub any traffic

It's not that we forget about IPv6

It's that such iptables, on any 1 core VPS, is vulnerable to DoS from a single IP (you don't need any distributed attack to put down that). A syn attack to the port 22 could be enough.

In resume:

When giving general security advisories, lets try that people build a secure system if they follow our tips. Not let open things like ping broadcast from our host, or IPv6
I run a VPS that only is only accessible over IPv6. I wonder if they'll ever scan it. Is there a way to narrow down the whole IPv6 search space to the most populated subranges?
But what he basically did was legal, right?
It's not clear that they is advocating 'half measures'. They is advocating changing one thing at a time. That could mean to only eating chocolate on the weekends, or to stop eating chocolate entirely - both of these measures are just changing one thing. I've had success just cutting out one thing at a time - instead of cutting out snacks entirely, I've cut out sweet snacks. Not salty snacks, just sweet snacks. This, in a way, "removed the stimulus entirely", because I find craving for sweets and salty/fatty stuff to be more or less distinct cravings. Now after I stopped having sweet cravings, I cut out salty/fatty snacks, and then I would hardly ever get cravings for chips and such.
Things like fonts can be defined at a high level by higher-level css tags or classes. I usually use less instead of direct css, so for me I'd just throw in an import in each view's less file to get the default styling applied, or I'd just have basic font styling done at a higher level in css so at the level closer to the actual class, I'd only need to apply tweaks as needed.
Well, to be fair, this was in an OS that reads whatever is in a media you plug.

KDE/Gnome do the same thing, and there are possible attacks there.
Amazed that "Install grsecurity" isn't one of the key things listed here. Sure, you have to compile your own kernel, but the enhanced memory protections and many other hardening features make it an excellent addition to your security arsenal.

http://grsecurity.net
No, the vast majority of USB sticks in the world are not pwned. If you randomly go out to purchase one in a large market, it's pretty likely to be safe.

Things like the Bagram PX were concentrations of high value targets with only one source of supply. The general USB stick marketplace is a lot safer. In China they're often fake and thus unreliable (smaller than advertised), but in the US, I'd be pretty comfortable driving to a Best Buy 50 miles away and picking up a random USB token.

A USB key someone hands you is much more likely to be a targeted attack. A USB key randomly lying on the ground outside a target is also much more likely to be an attack.
How Dow Chemical Hacked a German Monopoly
There was a previous discussion of this, I'll see if I can find it. Main issues were that laser was of an illegal wattage, and the drivers look in their rear view mirrors for lights at mirror level, not on the floor/road.

Looks good but in the real world has limited use. If the road has bright streetlights then the laser is nearly invisible on the ground, and if the driver can see the laser beam directly, well that is a serious danger.
There's still a lot of ISPs that don't follow BCP-38 so source address IP spoofing is easy enough
The article absolutely forgets about parametrize the kernel space.
I've experienced that as well a couple of times. My mind is awake but my body is still sleeping, completely paralyzed. It's a bit scary and definitely a very strange feeling but not terrifying.
Previous discussion of the light https://news.ycombinator.com/item?id=4842109
Not all automated scripts, or all the available scripts used in automated ways, can flush your rules before send things outside.

You're not going to be 24/7 at the keyboard of the system, there are going to be 0days, or unreleased vulnerabilities, etc.
It happened to me a lot but fortunately I've discovered the 'trigger' that causes it for me. When I'm in bed I have to keep both arms above the duvet, if I don't there is a very high chance I will have sleep paralysis. I believe it's related to heat. If I get too warm it is triggered and keeping my arms above the duvet prevents this.

I've tested the theory quite a lot simply by trying to trigger sleep paralysis (I wanted to when I was experimenting with lucid dreaming) and simply covering my whole body (except my head) worked most of the time.
And then realize you left all ipv6 traffic open (?)
install pax would be more accurate.
anyhow the article tells nothing special.
fail2ban doesnt do anything to secure you, also
At any time the police could in theory fly to your house, launch tear gas into your windows, and shoot you in the head as you run out. And I don't know about you, but I'm not exactly worried about that happening to the point where I want to take guns, tear gas, and helicopters away from the police.

You might want to rethink your position: http://www.democracynow.org/2010/5/13/25_years_ago_philadelp...
Supporting the random button isn't what I'd call anywhere near the top 10 most important functions an encyclopedia of any kind ought to provide. Serendipity is useful in a library or a bookstore, but when you open a book, the bibliomancy becomes avant garde art at best.
If only it had been google's self-driving car so the driver wouldn't have panicked :)

Seriously, though, why is a car accident in Indonesia news?
Not impressive at all. It's just interesting that the designer tried to use technology from 1996 to make something with taste in 2013. However, it might be the simplistic way to create animation that can be autoplay in iPhone Safari. Using video needs users to click play to start.
Well, as long as you own that IP. So once whitelisted and you switch to a new IP that IP stays whitelisted.
What's wrong with passwords ? The info is in your head and in a physical booklet secured at home for backup. Its only weakness is is keylogger.
A secret key protected by password doesn't provide you more security. You can only connect from the computers having a copy of the key. If that computer is inaccessible or dead, or the private key is erased you can't log in. It also is exposed to keylogger.
So I stay with password for now. It should be a secure password of course. Maybe use private keys and a password for backup recovery only.
Easy to block. Needs to serve all other non-html static files too, to be uneasy to block at mass.
This would have been interesting if it was a self driving car, but it's not. It's just a car with a camera.
Sorry, I disagree. Nginx is a much better web server than Apache.
Took me 1 minute to find:

https://en.wikipedia.org/wiki/Lawn_sweeper

Essentially, pick a topic which isn't totally mainstream (and hence getting lots of editor attention), but covers something that people buy for themselves / their house and where they might visit "review" sites to help them purchase the item.
GQ Boot's Russell Brand from After-Party
And supportive parents.
The vast majority of USB sticks are lost, not attacks, the vast majority of USB keys handed to you are handed to you in good faith, not as attacks.

That doesn't mean there are no attacks.

So prudence is adviced in either case, on the off chance that the one that you have is a bad one. Ditto for anything else that you stick into a USB port.

That webcam plugged into your computer, are you sure the mike isn't on all the time and that the driver doesn't pass your speech during the day out in compressed and encrypted form to some server farm at night ;)
Japan launches affordable rocket
http://www.codinghorror.com/blog/2008/05/revisiting-the-blac...

Original article: http://news.slashdot.org/story/01/01/25/1343218/directvs-sec...

Fascinating background story here: http://www.wired.com/politics/security/news/2008/05/tarnovsk...
No. I suggest that genders should be represented equally in all fields of study.
> At what other point in history has police distributed a completly illegal tool onto unsuspected and non-targeted civilians?

It might be a stretch but..

"LSD was one of the materials tested in the MKUltra program. The final phase of LSD testing involved surreptitious administration to unwitting non-volunteer subjects in normal life settings by undercover officers of the Bureau of Narcotics acting for the CIA." - http://en.wikipedia.org/wiki/Project_MKUltra
1 thing we should keep in mind:

Being rich is only possible when others are poor.

"Being rich" is a relative situation: If you have privileges because you're rich, you're not likely to say "I'm going to downgrade my life so all the others can meet me at the same level (of privileges)".

Why? Because, a little simplified: you wouldn't find anybody to take care of your garden anymore.

No rich person really has a natural incentive to call for real equality. So, the idea that we're all born with the same rights is currently still just an idea and nothing more. It's not respected and implemented:

"The Richest 10% of American Families Got Half of All Income Last Year." [0]

And it's likely to get even worse (for the 90%, that is), as money has this natural polarizing/monopolizing effect.

[0] http://www.theatlanticwire.com/politics/2013/09/richest-one-...
I don't understand the rationale to introduce such weakness. The NSA doesn't have the monopole of spying and cracking code. This weakens defense of USA's interest as well. This raises again the question if we can trust the people holding such power in their had.
It's quite strong. Thanks for creating this.
Because Google.
This is in the article FWIW.
Maybe we could crowd-fund this?
I'm surprised Ruby is the #2 language. Because, frankly, Ruby sucks [1] [2].

[1] https://news.ycombinator.com/item?id=5157886

[2] https://news.ycombinator.com/item?id=5872899
Did you really waste your time with this project - this is terrible
he got 2.000$ from his parents? No idea I had at that age was worth even 20$ ..
I thought the same, since the OP has already installed and configured outgoing emails, I think using apticron[0] would make a lot of sense.

[0] https://www.debian-administration.org/articles/491
And bing powered by google ? :)
I fall on the side of an SSH key identifies a person, not a device. That's what host keys are for.

What's always been missing though is a decent way to keep track of all the places which might be set to authorize a particular key so you can revoke it if you think it's been compromised (which should mean "is under brute force attack to decrypt it's AES encryption").

I suppose with a DynDNS server and a smartphone app, you could setup a web-page which would allow you to request a URL to download your SSH key securely to new devices but this is kind of the problem: there's just nothing out there which lets you keep a proper eye on how your web-of-trust works for this type of thing.