skysight-inc/HackerNews huggingface dataset:
If I had to design a system to break TLS (and I had the authority of a secretive government agency), selected MITM attacks would be exactly what I would use.

Large-scale MITM attacks, i.e. ones against a huge section of the population, really have a lot of disadvantages. First, there are always cautious people who check certs religiously, sometimes with browser addons to help (in fact I see that peterwwillis linked to some below). So, if you execute a large-scale MITM effort, you run the risk of being discovered. Note that if the NSA can compel Google to turn over its secret key(s), this isn't an issue, but I am operating under the assumption that we don't want to give away our MITMing easily.

Second, broad MITMs require a lot of resources to be effective. To MITM all of Google's traffic requires network capacity equivalent to Google's, no small thing (though I suspect very much within the power of the NSA if it were deemed necessary). There's a lot of data on the internet at any one time.

Third, the fact that you must have physical servers on physical networks sitting between Google and the target means that the MITM server's IP address will be the one that targeted clients appear under. That is, if you have a single server MITMing thousands of requests, all of them will appear from the same IP address. That's another risk of being discovered if the MITM is too broad and the servers are too beefy. Although, this assumes that people on the other end are doing some sort of analytics --- maybe not true. But intel agencies are pretty paranoid, so whatever.

Fourth, it still pretty much gets the job done anyway, with less cost: passively sniff traffic for, say, DNS requests to resolve suspicious domains, or plaintext connections that have suspicious contents. Passive sniffing requires less computational power than actual MITMs, and it can be done without raising any red flags. Plus, even if you miss someone suspicious, just get a NSL for Google to hand over all the data anyway in the worst case.

Fourth, if an investigation ever were launched about my breaking of TLS, targeted attacks look great. See, we don't target the American people --- only specific connections that are "suspicious" are targeted. Broad-scale MITMs seem very illegal-wiretap-y, but the targeted connections look very legitimate, at least in comparison.

So, these reasons are why I've always held the belief that the government is not executing large-scale MITM/dragnet collection of encrypted communications ... and hence TLS is effective, so long as you're not the one being targeted.
>The mortgage-backed securities did exactly what they were supposed to do: diversify risk so that the only thing that could bring down the ship was a system-wide failure.

They weren't meant to diversify risk, they were meant to obscure risk.

>The home-buyer wanted that $750k house on his $70k/yr salary

The homebuyer always wanted this. The difference is that during this time, they were given this, and allowed to leverage the value of a piece of property that would always rise and never fall in value in order to pay for it.

>Until suddenly the one thing that could bring the whole industry to its knees happened: a country-wide slowdown on buying houses.

Or rather a country-wide slowdown of the rate of increase in buying houses, which was an inevitability.

>Who's at fault?

1) The people who kept swaps from being regulated as insurance.
2) The ratings agencies.
3) The people who took away the wall between investment banking and deposit banking.
4) Black-Scholes,
5) Everybody who saw that the housing bubble was stupid, and made money from it anyway by selling it as sustainable.
6) General American innumeracy.

There are easy answers.
Here's some pretty detailed info in English:
http://threatpost.com/final-report-diginotar-hack-shows-tota...
See also:

$ curl https://api.github.com/octocat

MMM. .MMM
MMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMM _____________________
MMMMMMMMMMMMMMMMMMMMM | |
MMMMMMMMMMMMMMMMMMMMMMM | Speak like a human. |
MMMMMMMMMMMMMMMMMMMMMMMM |_ _________________|
MMMM::- -:::::::- -::MMMM |/
MM~:~ ~:::::~ ~:~MM
.. MMMMM::. .:::+:::. .::MMMMM ..
.MM::::: ._. :::::MM.
MMMM;:::::;MMMM
-MM MMMMMMM
^ M+ MMMMMMMMM
MMMMMMM MM MM MM
MM MM MM MM
MM MM MM MM
.~~MM~MM~MM~MM~~.
~~~~MM:~MM~~~MM~:MM~~~~
~~~~~~==~==~~~==~==~~~~~~
~~~~~~==~==~==~==~~~~~~
:~==~==~==~==~~

You can also append `?s="your message here"` to use it to say something other than one of the GitHub Zen messages.
until recently I couldn't use my last name in Facebook, and its pattern it's very common in Spanish: "de la Fuente"
I'm on the Cake Core team. We're moving towards a 3.x release, which will be all PHP 5.4 compatible (namespaces, etc.) so the issue they point out in class loading will be non-existent.

We are discussing aliasing the String class to a CakeText class, and then deprecating the String class in a 2.5 release. If we had known this was an issue[1], then it would likely have made it into the recent 2.4 release.

Something that would be nice would be to see the method in which they ran the tests, so that we can include their testing into our TravisCI/Jenkins setup. Probably would help other frameworks/packages as well. Will file a bug.

EDIT: Bug Filed: https://github.com/facebook/hiphop-php/issues/1054

[1]: They could and should have filed a bug. A cursory search of our lighthouse
issue tracker does not surface one, though admittedly lighthouse is pretty shit, so it may indeed be there.
Was it one of these?

http://www.reddit.com/user/SpontaneousH/submitted/

Or this one?

http://www.reddit.com/r/IAmA/comments/jcxow/iama_functioning...
More interestingly - in her case it’s the local culture as well. This story could easily be a case of cultural imperialism by contract coders.
nice! didn't know about it.

in my case I needed a library to use it in a web app.

bookmarked anyway for personal use :)
A little feedback:

Does "recroup" have a capital "R" or not? It's inconsistent.

In the first paragraph, the first two lines look like headings, so lose the period at the end: it looks odd.

"we know every job seeker is different. We built" -- The tenses are jarring there, you should rephrase that (maybe it's OK in the US).

"a profile that showcase" -- that should be "showcases"

"its your Career Launchpad" -- Ouch! You mean "it's".

If you're aiming to present a professional appearance, you really need to fix these little typos and errors.
It appears anything that is pro-boys is immediately seen as "anti-girls" which shouldn't be the case. If we want true equality we need to have equal opportunities but be aware that gender has different methods, motivations, and desires.
Never realized there was an emojis api too... https://api.github.com/emojis
Isn't the title of this a bit misleading? Cargill doesn't sell corn flakes, it (possibly) sells physical grain to Kellogg's, or derivative products to hedge Kellogg's exposure.
This is two days old now, so not sure you'll see it.

One should always expect that their internet information where their real name is listed will be seen. Most places are doing some sort of internet search for the person to see what public information, both good and bad, they can glean. This is the way of the world these days.
You reminded me of this: http://www.theregister.co.uk/2013/08/06/xerox_copier_flaw_me...

I wonder if you did reverse out her name if it would have all the right characters in it, and if it didn't, what sort of changes to would make her family heritage in the process? :)
Postress.app introduces another copy of Postgres to the OS. May make things simpler but still leaves you clueless as to what is going.
Thanks for the suggestion though :)
Amazon is continuing the trend of announcing outages 30 minutes after they start.

Just signed up for a support contract since the status page said everything was fine.
thanks!

I created an issue for that:

https://github.com/marianoguerra/json.human.js/issues/2

also one to customize the display of booleans (sometimes on/off, yes/no are better than true/false)

https://github.com/marianoguerra/json.human.js/issues/3
Next week: linked lists?

Linked lists have performance problems on computers. You need contiguous memory arrays for performance, since Direct Memory Access engines, caches, and pipelining all achieve peak performance only when memory is strictly accessed in contiguous chunks. How do functional language implementations deal with that problem?
I'd say this is likely bullshit at least that it was done against a Brazilian company. Why take the risk of getting caught and burning your ability to do this when you can get the information from Google?

1) Chrome(and some plugins) pin's certificates and would notice a man in the middle attack(unless it was done with google's key). Sure, most corporate targets probably use IE, but if anyone uses chrome on or one of these plugins on the network, you've both alerted your target and exposed a presumably tightly guarded ability. Hell, if it get's reported, you've probably burned the ability. Of course, you might be able to filter out both the plugins and chrome, but it's a risk.

2) NSA could legitimately just ask for the company's emails from Google. Petrobras is a Brazilian company in Brazil staffed by Brazilians and as such a legally allowed target for Foreign Surveillance without either the NSA's twisted definitions of search and who is a US national. Google is legally required to hand over the information by the Foreign Intelligence Surveillance Amendment Act of 2008. Why authorize an operation that could reveal both the CA's you have in your pocket and you network penetration exploits?

As a side note, the cited slide looks nothing like anything else we have seen and lack security/ handling information (e.g the prominent TS/SCI/ORCON/NOFORN on the top of the prism slides).
- charging a monthly fee for the back end.
- charging enough for that the running cost is covered (the marginal cost is close to zero).

But mostly I was responding to the comment that it was the only way to get payed for the developer.
Among other things, sure. That we have the FDIC now wouldn't have stopped a significant depression from happening had we simply allowed the financial sector to collapse.
I still dream of the day they'll let us set up different availability zones. Not that I'm sure this wouldn't occur, mind you.
First, the software industry has done worse than ship 1 in 1000 versions of something that can't print or save.

Second, software companies often ship bugs knowing exactly what those bugs are.

Third, bringing a foreclosure lawsuit without the promissory note is not per se fraudulent. It's the homeowners job to raise the defense of asking the mortgage holder to show the document. It's only fraud if you intend to defraud the homeowner by foreclosing on a mortgage you know or suspect you don't own.
I found myself asking the same question. See my related comment: https://news.ycombinator.com/item?id=6378823
Truthfully then by your own moral high bar, Shykes plugging of Docker should make you really uncomfortable. If you however allow yourself to take a step back and realize these threads are directed at real people trying to help each other with real problems, (Though arguably some do it for money) Then you can allow yourself to see it as helpfulness.

Because in reality, What is personal gain of plugging an open source free product that helps people?
Why Can't Startips Sell?
Tastes (yes, including sexual) are in part culturally-shaped as well as from experience.

For example, I'd bet that a far greater percentage of people of either sex enjoy giving oral 10 years after they started having sex than the first year they had sex. (That is, unless they got married. Ba-dum-pssshh. :) )

So women observe some of this porn, they get it into their heads that it "looks hot", and that makes it hot. Theoretically.

Frankly I'm a little jealous of folks dating 20something women these days.
you might have a point, but it was not what I was expecting when I clicked the link.
> ~O(1) access time

What's the difference between O(1) and ~O(1)?
So what is the best way to balance a hosted site between Amazon and a separate service? Because these connectivity issues suck.
HPHPc, the static compilation version of the runtime, didn't support eval, because eval is not static :) With the JIT compiler and VM, the runtime now support eval and other more dynamic PHP features:

https://github.com/facebook/hiphop-php/blob/master/hphp/test...
I just used a Trie yesterday to implement some string matching that I needed to do in a tokenizer :) It's quite useful if you want to do string matching and you know ahead of time the exact list of strings you need to match with. My only issue with this article is that it explains them using Java, which I think just obscures the explanation too much, but I guess it's a Java blog.
Nope, it's just another way around: a vast, cold emptiness.
You clearly didn't read the study at all.

The study doesn't assume that women will scale back their hours. They use data which shows it. Suggesting that female doctors should have been medical assistants is merely the result of the fact that they would have made more money (i.e., income - cost of education) if they did.
If the point was to attract a more general audience to the subject matter I'd say the title was accurate enough.
But you still need to join in NoSQL, for any query that isn't along the natural hierarchy of the data.

The relational model takes this observation and concludes that there should be no "natural hierarchy" in the logical model (the physical model is a separate question.) It's a _theoretically_ beautiful idea. The counter-intuitive _real-world_ result is that the theoretical approach also yielded faster systems than alternative philosophies. I think that's the reason why the relational model has dominated for the past 30+ years.

You might well argue that that's because a _good_ NoSQL implementation has yet to be created (the no true Scotsman argument). That may well prove to be true one day, but I would bet that a good non-relational implementation will be a derivative from the relational world (Postgres with hstore, or Google's F1 with Protobufs); not from a project whose starting axiom is to get rid of SQL/relational.
All it takes a few, not "Google as a whole."

I am not a fan of Google, but I feel that in Larry Page's era few things are sacred when it comes to making money. Maybe a Googler decides to read some Goldman Sachs' trader emails, or Google in general can sell trend data. Who knows?

They have (IMO) ruined search and destroying any trust in its fairness, yet they are a monopoly, have a lot of goodwill and nothing is happening. So far.
It's region us-east-1c for now, at least from where I'm sitting... I have instances in other us-east datacenters that are fine.
This is the rule, not the exception, among addicts. Every recovery program (12-step or not) emphasizes that drugs are not a drug addict's only problem. Obviously they are a very destructive part of the problem, but every addict who stops using long enough learns that -- surprise! -- they're still a self-centered, fear-driven, manipulative, obsessive person. That stuff doesn't just go away when you stop using; if anything, it flares up in other ways (as you've seen firsthand).

Source: many years clean in NA
See "disc vs disk"
Any genius can make it complicated.

Run toward bugs, not away from bugs.

Scaffolding.

100,000 lines... forever.

-----

God says...

Virtual-Notary.Org hereby notes that on
Date: Friday September 13, 2013 10:55.32 EDT (UTC-0400)

a random drawing in the range [1, 100000], inclusive, based on
a hardware source of true randomness, yielded the following decision.

Random Value: 29348

----

run before him.

1:6 And his father had not displeased him at any time in saying, Why
hast thou done so? and he also was a very goodly man; and his mother
bare him after Absalom.

1:7 And he conferred with Joab the son of Zeruiah, and with Abiathar
the priest: and they following Adonijah helped him.

1:8 But Zadok the priest, and Benaiah the son of Jehoiada, and Nathan
the prophet, and Shimei, and Rei, and the mighty men which belonged to
David, were not with Adonijah.

1:9 And Adonijah slew sheep and oxen and fat cattle by the stone of
Zoheleth, which is by Enrogel, and called all his brethren the king's
sons, and all the men of Judah the king's servants: 1:10 But Nathan
the prophet, and Benaiah, and the mighty men, and Solomon his brother,
he called not.

1:11 Wherefore Nathan spake unto Bathsheba the mother of Solomon,
saying, Hast thou not heard that Adonijah the son of Haggith doth
reign, and David our lord knoweth it not? 1:12 Now therefore come,
let me, I pray thee, give thee counsel, that thou mayest save thine
own life, and the life of thy son Solomon.
Okay, I was willing to read this and keep an open mind. But then I got to the fourth paragraph and saw this:

" Officials at schools ... are helplessly watching as their campuses become like retirement villages, with a surfeit of women competing for a handful of surviving men."

Is the argument here that women only go to college compete for men? And that colleges with more women are "retirement villages" because there aren't enough young men to hook up with?

Yep, done with this article.
http://en.wikipedia.org/wiki/Spelling_of_disc
That does not make much sense. You're being paranoid and actively helpless.

WPA2 is in fact quite secure if you're careful about your passkey and who you give it to.
Availability zone letters are specific to your account.
I believe that there is also the concept of "Let the Buyer Beware". If someone says, which is what the android service does, that it is going to backup your data to the cloud. Not much of a stretch to think of your wifi password as part of that.
To me, one of the easiest ways to boost male achievement in education is really simple.

Have male teachers.

An incredible 84% of teachers are female. [1] This has led to a dearth of male role models in schol for all the guys there.

I have 1 male teacher. (I'm in high school) And he's the computer teacher, a stereotypical male field.

[1] http://www.edweek.org/media/pot2011final-blog.pdf
DTW has approx. 800 USB charging ports at gates.

I believe there are more USB ports than generic power sockets.

In my experience, the USB ports are all in use at any gate with more than 10-15 people waiting at it.
https://tools.ietf.org/html/rfc6091
http://web.monkeysphere.info/
Google puts together Boulder floods crisis map
Of course this is false if you add more of the same. ;)
This is a column, not news. In addition, he is using non-mutable data, it's the entire point of the article. So people voting you down are assuming that you both didn't read the article, and are judging it based on strange criteria.
I've always seen ~ as used for about, so ~1h is somewhere around one hour.

I would read it as close to, but maybe not quite O(1).
Handy's prediction that prices will drop in 2015 when supplies increase seems more likely (although I suspect it could happen before then).
Ones' complement to the day - 1111 1111
It looks like the generator is suboptimal, but still really cool.

(![]+[])[+!+[]] evaluates to "a" as well. It looks like it turns it into an array twice.

It goes
+!+[] === 1 then
[+!+[]] === [1] then
+[[+!+[]]] === 1 then
[+[[+!+[]]]] === [1]
"Young men in Great Britain, Australia, and Canada have also fallen behind. But in stark contrast to the United States, these countries are energetically, even desperately, looking for ways to help boys improve. Why? They view widespread male underachievement as a national threat: A country with too many languishing males risks losing its economic edge."

As an American, I may be unplugged from many of these happenings, but I feel like this is a stark difference between America and other countries. We seem to have a laissez-faire attitude that "If there's a problem, and a deadline for the problem, someone will just magically figure it out at the last second." And we often attribute that someone to the free market. On a broader note, as with any issue people seem to have significant worries about, what is a good way to actually begin solving it, assuming this general American attitude? I honestly don't know.
I just quickly browsed through the lectures and this seems very consistent with Feynman style where there is a lot of text and very little math. From his book "surely you must be joking Mr. Feynman", he mentioned that fundamental understanding is largely is lacking in modern education. Instead, students go on and on about memorizing complex formulas that made no sense to them.

Maybe we're not all smart enough for this, but it does make sense that if we understand the problem well, then the calculation for it will be obvious.
There is no implied relation in the presentation between MITM attacks and the attack on Petrobras

They're merely on the same presentation describing attacks and targets
Remembering Ray Dolby
You're only looking at one kind of trie, there are also Judy arrays, which have much better performance characteristics and (if we're abusing the notation) the same worst-case memory complexity.
This reminds me, playing WoW has been so much about names for me. Together with a friend we poked fun out of other people with stupid names or gave credit to creative ones.

Usually I had a strong opinion about somebody's playstyle and age, even educational and social background upon reading a name (Not that I was ever right in these opinions, but what's interesting is that I had them).

What's even more interesting is that we even "discriminated" characters with bad names when the game mechanic allowed us to do so (ganking, kicking out of groups,..)

So I'm not sure whether there is a correlation between playstyles and names, but it certainly makes a difference in players behaviour towards each other.
Specific availability zones in a region are mapped per-account, so your east-1c might be my east-1a:

"To ensure that resources are distributed across the Availability Zones for a region, we independently map Availability Zones to identifiers for each account. For example, your Availability Zone us-east-1a might not be the same location as us-east-1a for another account. Note that there's no way for you to coordinate Availability Zones between accounts."

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-reg...
"Both, but any Google executive aware of the abuses could have anonymously tipped off Wikileaks or some other journalist. None did."

We do not know this and it would be questionable if the risk associated with such an act would be worth it considering that Google can actually use its resources to move things in a legal way. (via courts, lobbying in Washington etc.)

"To explain Google's behavior, classic diffusion of responsibility is all that is necessary. Without any such dissent, it's no surprise that the government abused its power."

I remember Google protesting (SOPA) and actively pursuing privacy initiatives multiple times in the last years and even pull out of the Chinese market.

They release detailled copyright removal reports: http://www.google.com/transparencyreport/removals/copyright/

They let you take all your data out of all Google products:
http://www.dataliberation.org/takeout-products

They fight governments data requests in courts (sometimes successfully) and release strongly worded statements when they are allowed to.

Suggesting that we ended up with an abusive goverment because Google slavishly followed orders seems unrealistic to me.

"Snowden is a significant outlier... hiring policies are intended to prevent the hire of the kind of person who would do what he did. The scary thing is that Google's hiring practices achieve the same thing."

Google as a company would arguably not exist anymore, if its developers/admins constantly leaked data.

The survival of the NSA does not depend on public trust and a positive public image - Google does.
o = (function() {
p = 'programmer';
d = 'day';
h = 'Happy';
r = Math.floor((Math.random()*10000));
(r % 2 === 0)?ap="'s":ap="s'";
return h + ' ' + p + ap + ' ' + d;
});
o();

awaits correction