skysight-inc/HackerNews huggingface dataset:
> It's an awfully weird trojan horse --- or, as Daniel Franke put it on Twitter, a trojan platypus.

Heh, that is a pretty good term for it.

> no OS I know of uses a design taken directly from NIST.

Except for all of the pressure recently on the Linux kernel developers to use Intel's RdRand directly rather than mixing it into their existing entropy pool (see, for example, https://plus.google.com/117091380454742934025/posts/SDcoemc9... and https://lkml.org/lkml/2013/9/5/212), where apparently the reason is "Customers want a SP800-90 source available through the OS interface" (quote from David Johnston, designer of the RdRand hardware, on the Google Plus link).

So, apparently there is a lot of pressure to get the OS to adopt the NIST standards directly.

There are lots of reasons for this kind of pressure. Obviously, if you sell to the government, it'll be easier if you follow the NIST standards. There are likely lots of other compliance related reasons you would want to, such as encryption requirements for HIPAA. I wouldn't be surprised if some of those standards either required or were easier to comply with if you just used NIST approved algorithms, and it's easiest to use those NIST algorithms systemwide if the OS CSPRNG uses them (and directly, without extra unapproved random number generation on top).

> Second: Dual EC DRBG is a CSPRNG that uses elliptic curve point multiplications; in other words, it requires bignum math. If you're unfamiliar with CSPRNG design: that's not a normal requirement. Dual EC is very slow. Nobody would willingly use it.

Yes, this is the odd part. On the other hand, you do have to recall that the NSA is a big government bureaucracy. It may be that their SIGINT enablement department (the one that's responsible for weakening exportable crypto, planting backdoors, and the like) had promised to get some backdoors into widely used standards, but couldn't find a better way to do so surreptitiously and effectively without weakening security against foreign attackers as well.

It may be that Dual EC DRBG was just inserted so they could check off a box and continue to get funding for the standards body division of SIGINT enablement, and not as an actually realistic attack.
I'm glad someone is talking about this. If you set a passcode, iOS encrypts your data with a key derived, in part, from your passcode and a per-device salt; Apple claims that even with access to the device, a nine digit passcode would take 2.5 years to brute force. [1]

A fingerprint is only useful for authentication, not key derivation, which makes it effectively useless in protecting your secrets from a determined attacker. As it stands today, my data is encrypted with a key that isn't stored on my device. Unless Apple has developed some kind of fingerprint-based key derivation algorithm, that can't be the case for the hapless user who replaces his passcode with a fingerprint scan.

I fear that the innovation announced today is going to make people and their data less safe, not more.

[1]: http://images.apple.com/iphone/business/docs/iOS_Security_Oc...
Apple has been doing colorful consumer devices for over a decade... iMacs come to mind... they do the modus operandi and they are suddenly copy someone? you have some serious tunnel vision.
Java 8 developer preview ready for testing
Phonebloks - a phone with completely interchangeable parts
I am trying to see how input validation addresses cases where the constraint is based on what else is in the database. It is conceptually much simpler and less error prone to let that class of issues be enforced only by the database rather than asking the db first "is this ok" and if so then doing another round trip to insert it (to be safe you'd have to lock the table).

Now, PostgreSQL can do any data validation you want to do in the application, it can do so at least partially declaratively. You can then pass back messages that the application can use in error handling.

I am actually working on frameworks which essentially delegate most of this to PostgreSQL. It's a very powerful approach but it means the db just doesn't trust the application.
WOW.

Forget the Photoshop stuff, this needs to be integrated with 3D printing immediately.

Spit out a design file into Tinkercad[1] for some minor adjustments and BAM, you've made a printable 3D model.

[1] https://tinkercad.com/
Eventually I realized that the only reason the companies pushed so hard, why they insisted so strongly on rankings and scores over information and analysis, was because it made it not their problem anymore. They didn’t have the credentials to pull 50 ‘good’ countries from 100 uncategorised ones, so they used us to push the responsibility away. ‘It’s not me saying Bolivia is an 8.2,’ they could tell their boss. ‘A human rights NGO said it was. Making shoes there is totally approved.

What else would you expect the corporation to do? Eventually, someone in that organization has to make a decision, and that requires the complex information about countries' human rights situations to be summarized in a simpler way -- for which a ranking is one approach.

It sounds like they wanted the NGO to do this summarization. If the NGO didn't do it, then they'd get someone else or from within their organization to do it.

Something like rankings are inevitable. They fulfill a huge information need. The fact there are lots of poorly done rankings out there won't change that. This just means, it's even more important to make useful rankings that reflect good information.

(And besides rankings, there are perhaps coarser-grained options, like making several tiers of groupings, only asserting each is an equivalence class ... or finer-grained options, like giving each country scores in three different categories. Etc. But in all cases, the incredibly rich and complex source information has to be summarized somehow.)
discussed earlier today as well: https://news.ycombinator.com/item?id=6362221

As I said there, what's worrying here is that the decision hinges on "readily accessible to the general public". While this was just a refusal to dismiss and there may be more to come, the problem is that this is just a small step away from being able to criminalize any access of an open wifi hotspot. No slope required, slippery or otherwise. All you need is a DA that feels justified in prosecuting someone but without an obvious tool to do so, and here one is.

Better to criminalize what you do with that access, but that wouldn't fall under the Wiretap Act as written, so wouldn't come up from this motion to dismiss.
"we do not believe that there is a security sensitive change that needs to be done here." - Google's Kevin.

I think this means Kevin said they are not going to change the code on their end.

Also, author stated: "Even if this vulnerability doesn’t qualify for a reward, I strongly believe that it should be fixed promptly to protect end users."

Do I read the intent behind this correctly. Please do correct me. Because, to be frank, me and labmate are peeved right now about this. Google Scholar is a functional way to spread awareness about own research, but Google's response got on my nerves pretty badly.
Google's Schmidt: Technology can drive job growth
Star Trek-inspired bridge used to sell surveillance tools to Congress
You raise some important issues, but if anything I actually think that this aquifer is going to reduce the conflict in this area. The civil wars, rape, and poisoning are all symptoms of a deeper illness: poverty. Africans aren't more corrupt or warlike than anyone else, they're just poorer and therefore more desperate.

Conflict minerals (diamonds, coltan, etc) fuel conflict because they are easy to control. It only takes a relatively few men to control a mine, and any diamonds mined can easily be exported. In contrast, an aquifer is hard to control: each liter of water isn't worth that much, and Kenya doesn't have the infrastructure to export water anyway.

The water won't really be a target for militia, but it will be able to be used to develop the region. More water gives more crops, which gives higher living standards, which gives less war.

(As a side note, another potential benefit is that this aquifer will promote regional integration, since it's on the border between South Sudan and Kenya. South Sudan is in the process of applying for membership in the East African Community, which has the stated goal of eventually transforming into a political federation. I expect that the EAC will be a very strong driver for regional security.)
Africa has a very long history of not only various factions fighting, but tribal conflicts that go back centuries. Things were only made worse as colonial powers played different tribes against each other. Add to this organized crime, religious hatred, and generally low regard for life, and we have what we have.

Also, "poisoning the well" is a well documented military tactic in European heritage as well. Similarly devastating to the local populations are scorched earth tactics, for example used in WWII.
It's just basic scorched earth tactics, which have been practiced for centuries: https://en.wikipedia.org/wiki/Scorched_earth

It's actually not short-term -- what better way to prevent your enemies from populating an area than to permanently render it unsuitable for habitation?
I'm interested since my application publishes URLs just like that. What's wrong with it as far as HATEOAS is considered? How would it be better?
Apple's Big Reveal: 5 Things We Won't See
Good catches.

This is another classic case of being first (or at least one of the first) out the gate is more important than the rest of the race. They just want to get the traffic up to speed for ad-views before making sure the story is correct.
I actually considered the hetronormativity thing when I wrote my response (my response was "the hga is female" one).

Initially my response was much longer and included a discussion about female-female partnerships. In the end I cut it right back, because as far as I know "wife" is always a term used for a spouse who identifies as female.
Give a man a hammer, everything looks like a nail. REST has become a bit of a hammer. The reason a lot of RESTful designed software I've seen has such poor performance is because REST is used like a hammer... everywhere! And whole bunch of places it's not needed and it's not ideal.
What was the invoice amount for? You list all those reasons why "it's not worth a lot" is not a good argument...so what are you arguing it is worth? I have to say, your "I was going to use it" argument sounds a lot like "I had that idea first" argument for start ups. In the end, buzz feed can just execute with that photo better, your idea (no offense) was never going to touch 4.2MM views.

Definitely not saying you necessarily deserve nothing, but what amount did you put in your invoice? Want to know what you think the value is
Not stretching any point. I presented actual cases and proved Apple's 'controlled' environment hasn't protected user privacy.

> Blame Path &c., not Apple

Oh sure, I won't blame Apple for leaving the door wide open and turning a blind eye for years! Wow.
Are PHP SuperGlobals putting Web applications at risk?
I wonder if Kenya's relative underdevelopment (compared to both western countries and farming countries like India/China etc.) is the reason this aquifer has remained undiscovered for so long.

Nonetheless, I hope the people of Kenya will learn from the mistakes of those other countries when it comes to sustainable utilization of aquifer water instead of the indiscriminate use we've seen elsewhere.

Links:

NASA analysis of India's fast-depleting groundwater, including aquifers: http://www.nasa.gov/topics/earth/features/india_water.html

Economist piece on acquifers drying up around the world: http://www.economist.com/node/17199914
One option is to log everything but display something simple to the user.
My point is that analyzing languages on that basis is silly. I thought the rest of my post was silly enough to demonstrate that.
I will agree with you here, I thought it was only conceptual as well and that he had not verified the Google team wasn't stripping HTML entities in profile names, etc.

Considering that they missed one though and with the amazing things I've seen done with limited characters and Javascript, I would be surprised if it was not exploitable in some fashion.
As long as it isn't hidden in the dead pool, I don't care much where one of my comments' karma is. BTW, it's at 30 now, so no damage done.
Aren't startups all about finding a need and filling it? Isn't that what has happened here?
You don't need to "show" that you can learn new things, you just need to learn new things. And keep doing it. At first you have to do it on your own, but eventually you'll get paid to do it.

The biggest trick to getting there is inspiration. You need to be excited about the possibilities. You'll get ten times farther in an interview if you can enthusiastically tell your interviewer how much fun you're having with Angular.js. Or that project that kept you up til 3am because you just couldn't put it down.

You need to stop looking at your career as some set of criteria you have to fill and start looking at it as the most fun you're going to have, like ever. Seriously, building shit is fun.
(if (< hate-to-be-that-guy urge-to-be-that-guy)
(be-that-guy)
(not be-that-guy))
i think you could find a niche, specialized market.. like the geek and hacker people.. and start from there.. than you can make bigger moves..

i think of course only by being open source, maybe its not enough.. dont know how your project is of course.. but its good to have something that distinguish from the other stuff around.. but it can attrack attention from the geek market..
thats what firefox-os are doing after getting late in this crowded party that is the smartphone industry..
Great point. You could could progressively backfill the search to protect the initial load and user experience. You could cut down on overall bandwidth by only backfilling search data if the user has shown a preference for using search. The first search experience is a little slower, but overall system work and client side implementation using the posted method could provide a good balance.
"A fingerprint is only useful for authentication, not key derivation"

exactly
If you have a vps box, you can easily install memcache and set the size on it (64 megs, 128 megs, 512 megs etc).

For static assets, are you referring to actual files being served? If that's the case, you don't have to put that in memcache. I would recommend putting it on a third party cdn (e.g. amazon s3).
How does it still stand? Maybe the curated system doesn't protect users, but the only example you provided of it failing to do so has apparently been fixed.
The weird bit is the NYT did it on their own website instead of Ars. It's also super classy of Ars to cite a second report by the NYT then link to their own summary of that article too!

http://bits.blogs.nytimes.com/2013/09/10/government-announce...
Oh definitely, it is a challenge to figure out how to gauge readers interests and more importantly to generate constant readership. But getting content by vetting internet forums, and regurgitating stuff is also not a taxing task. Let's see:

What is author's contribution in this article?
http://www.buzzfeed.com/samir/drug-addict-robs-a-store-and-a...

Or this one:

http://www.buzzfeed.com/regajha/diesels-new-ad-campaign-feat...

Ha a post contributed by a community member:

http://www.buzzfeed.com/emilys123/15-signs-you-did-a-musical...

Or the cliched magazine cover story:

http://www.buzzfeed.com/jessicamisener/23-cringeworthy-magaz...

Or let's see what is hot on imgur:
http://www.buzzfeed.com/bennyjohnson/obama-asks-the-hill-to-...

But looks like brain does some research:

http://www.buzzfeed.com/briangalindo/15-celebrities-you-neve...
I expect to get a lot of use out of the ability to convert JSON into row types.
Ok, more simply, what about a network partition where the redis machine gets cut off from the RabbitMQ servers?

My only point is really just that redis-as-a-queue has some bad failure modes if you aren't careful.
Companies Creating Our Science Fiction Future (That Aren't Google)
I asked Jonah about this very thing a year ago. His response was lacking IMO:

http://cdixon.org/2012/07/24/buzzfeeds-strategy/comment-page...
Rather than telling me not to use iOS (which I think is probably the best overall package right now), FSF should build something better. I'd probably tolerate Android 2.x-level quality if it were actually secure (i.e. I pick my own root of trust for all services, which might be a server I own), and ideally could run modern Android apps in nice little partitions. Neither Apple nor Google is really committed to building something like that, and I doubt Microsoft or Blackberry will, either.
Kenya itself has been relatively stable and relatively peaceful for several decades.

(there was some instability after an election in 2007, and there are simmering issues around the periphery - LRA in Uganda, fiefs in Somalia, continual intervention by Ethiopia in Somalia, North/South Sudan skirmishes).
Don't Worry Be Happy
Everywhere people talk is a battleground, called "civil, reasoned debate." One of the rules of that battleground is that when someone pokes a hole in the evidence you've used to draw your audience toward a conclusion, you can't put new evidence in its place to support the same argument; you have to make an entirely new argument, because the new evidence might lead you somewhere entirely else when looked at on its own.
Are there any reasonably-powerful tech-related national PACs?
> "The thing I was missing is that math is just a bunch of symbols that you manipulate to get new symbols out."

This is the Formalist philosophy of mathematics, which isn't the only one (as you might imagine given that it has a name):

http://plato.stanford.edu/entries/formalism-mathematics/

Formalism is at odds with Platonism, to pick an obvious antithesis, as Platonism holds that mathematical entities do indeed have a reality beyond us finite, mortal creatures and our symbols:

http://plato.stanford.edu/entries/platonism-mathematics/

There are, as you might imagine, a lot more philosophies of mathematics:

http://en.wikipedia.org/wiki/Philosophy_of_mathematics

That said, at the K-12 level, formalism is what students need most; make mathematics a game and show them how well the game applies to reality. That unreasonable effectiveness is quite astounding the first million times, and it never really quits being astounding:

http://www.dartmouth.edu/~matc/MathDrama/reading/Wigner.html

http://en.wikipedia.org/wiki/The_Unreasonable_Effectiveness_...
Said this before, but Denno Coil is a recent post-cyberpunk sci-fi animated series from japan that explored AR tech in interesting new ways. It is not the "hardest" of sci-fi, and it is about kids, but it is touching, does not pull punches, and I like the art direction. I would suggest checking it out for anyone who wants some fresh sci-fi.

I think saying main stream movies are supposed to be imaginative is a bit of a straw man argument.
Postgres-XC is a niche market mostly useful for things like BI setups and highly scalable transactional clusters. It's a very complex solution to very complex problems. If you need it, you know about it.
Unless you have a data plan with less than 2GB of data, that is. And are OK with waiting a bit for things to buffer. With Google Music I end up offlining a lot of songs because data plans in Canada are terrible and because 3G isn't everywhere you want to listen to music. Add podcasts and you hit the storage limit in no time.
I think you have to show that you can learn new things. How else can someone justify hiring someone if they haven't demonstrated that they're capable of picking up a new piece of technology? I was trying to say that I wanted to show my value by producing actual things rather than being able to write code on paper.

It's also funny that you mentioned Angular since I wrote launched a little app using it today.
> "He will know exactly what I charge the client and what I give to him out of that."

In my experience this is exactly how traditional engineering firms work. It seems to work for them, I'm not sure why a software consultancy would work differently. Do they?

Regardless, if you give people the power to manage their work, to bill their clients appropriately, to take ownership for the work, then the right people will thrive and the rest will find it far too transparent to hide behind.
Your point was

> NOTHING about Apple's 'curated, controlled' approach [that of having a closed source operating system] protects users

Definitely shifted goal posts.

Unrelated: you've said nothing to support this point anywhere throughout this thread.
We expect to have information over the next two months... in the mean time, if you care to, please like the Facebook page so we can establish an effective communication channel.
It has nothing to do with security or stealing, you are really making comparisons up now just to prove your point. You are actually stealing from a store because in a normal situation it is obligatory to pay. You are taking something away the store owner normally should get paid for.

Now, imagine this store would offer the Sprite free-to-fetch BUT there is a man singing next to the fridge which sells CDs of his recordings. It is not obligatory to buy a CD before you fetch a Sprite. However, the man ocassionally jumps in front of the fridge and tries to make eye-contact to give you his best shot at convincing you to buy a CD of his. Annoying, isn't it?

This man adds no value to the Sprite you can get for free yet he tries to sell you a CD you didn't ask for! Well, apparently the store owner made a deal with the man: for every CD he sells, he gets a nice commission. Would you steal the Sprite if you put on sunglasses (to avoid eye-contact) and wore earbuds (so his singing doesn't bother you) every time you get a free Sprite from the fridge?

If you know the answer, you know whether ad blocking is stealing. Now, if the set-up would be "Buy a CD and get a Sprite" (a pay wall) you would indeed be stealing if you got the sprite without paying.
There is an invention without which no other invention can spread beyond its inventor. An invention which makes possible inventions beyond the ability of one person to create. An invention which permits a person to do something with their life other than kill for food, skin for clothes, and hide in natural shelters. An invention so important and fundamental, our physical brains and the thoughts of our consciousness are continually shaped by it. An invention so powerful, it defines the scope of what we can accomplish as a species. An invention impossible to leave behind or survive on most of the planet without, as defenseless physically as we are. An invention so complex and manifold, we continually reinvent it, and almost cannot teach more than the barest rudiments to any other species. Have you got it yet?
Intel forum accounts removed over wifi bug
Lesson learned. Never use hyphenated names. They're bloody unreadable.
How not to get new users
language?
Examples please? I am aware of hard corners in places, and rough spots, but some clear discussion might be helpful.
To be fair, error 1 and 2 came from Apple during the press conference.

Edit: I am wrong, ignore this.
I just want to highlight what's important about this design:

IT'S FRAMELESS

This drastically brings down the costs.

There are still disadvantages, of course -- the inflexible shape and lack of large, flat, vertical surfaces is a problem for most applications -- but the dome is now so much cheaper that, in some niches, they're worth a second look. I can well imagine, for instance, mass-produced geodesic haybarns based on this design.
"He who controls the past controls the future.
He who controls the present controls the past."
-George Orwell