skysight-inc/HackerNews huggingface dataset:
> Of course this rules out all 'cloud' software other than simple dumb data storage.

This is pretty much the conclusion that I've come to as well. Using cloud storage to keep thing in sync, but only doing decryption on the client. Even doing something like storing a SQLite database and encrypting all of the fields seems like it would be leaking information rather than just encrypting/syncing the entire database.
Drop me an email on d.grabov@gmail.com if you want any advise / help with getting one organised. It's totally worth it
That's really the only reason I can see to do it. But I can see plenty of cases where I don't care about that, so I don't think "you failed input validation" is at all accurate. The consequences are a more annoying UX, assuming it is something a user is interacting with. That doesn't sound like outright failure.
The petition is really very stupid, and anyone with basic knowledge of cryptography will know that. Linus is rightly annoyed, and is fully within his rights to attempt to discourage this stupid behaviour by reacting abrasively.
Checkout http://iblingbling.me
As two examples: Partial trust means you trust a key for different purposes, or for different levels of validity.

Different purposes: "Do I trust that this key correctly identifies this person?" is a separate question from "Do I trust this person to do proper verification before signing others' keys?" (i.e., trusted link in the Web of Trust)

Different validity: "I've met this person and verified they own the key", is different from, "They've identified themselves with two forms of government ID", is different from "I've known them all my life".
We wouldn't behaving this discussion if we had not created a situation via government meddling in which education is frequently not a good investment.

Don't deal in the fuzzy-wuzzies of how wonderful education is in a perfect world. Deal with the world in front of you, the one on the news, the one generating a trillion dollars in crushing debt on those least able to pay it back. People are exploiting your willingness to hide in glib, pretty generalities.
It's pretty common knowledge that Linus is abrasive and abrupt and frequently rude. It's typically speculated that he does it to manage his workload. This is a case where a response from him shouldn't have been necessary. Just read the code. That's one of the benefits of OSS after all, right?
Only if it's exploitable. This seems to be a hang, which doesn't constitute an exploitable vulnerability, just an annoyance.
We used a company called LeadLander for this when we were in the B2B space. Since qualifying leads and negotiating a deal were harder than lead identification for us, this was mostly a vanity / fun project, although it was successful in motivating us.
The author comments elsewhere that there's no plumbing[1], and that this is in the mountains of North Carolina[2] (presumably near Asheville, which his twitter bio lists as a location).

[1] https://news.ycombinator.com/item?id=6355787

[2] https://news.ycombinator.com/item?id=6355875
CSS Gameboy
Law professor to students: Don't Talk To Police
I really have a hard time believing that anyone can think someone who says "make me a sandwich" isn't making a sexist remark. Don't get me wrong, I agree that in some contexts it can be given and received as a joke, but it is absolutely sexist.

Just because males may receive gender-based outcasting in a home-ec class does not make that also sexist (are they harassing him to go bring her home a paycheck???), nor does it make the original case OK to disregard as "kids being kids".
You realize that your attack is predicated on the non-hardware RNG already being broken, right?
Right, but how would they know the output of the other RNG? At this point it's just a tinfoil hat theory, you might as well suspect the drivers of your ethernet card or the people who made the lock on your front door.
Right, because it's not like the US government has been able to pressure the Swiss banks into giving up the historically famous anonymity of their clients! Oh wait...
I would certainly love this more than typing OTP codes, but what's the recovery method for when I lose my phone? How do you solve the chicken-and-egg of getting users to install and configure the app in the first place?

Maybe this is meant for corporate intranets more than end-users?
South Korea aims more accurate GPS at navigation systems
Although, I should add that there's this API which uses the output of RdRand straight up:

/*
* Get a random word for internal kernel use only. Similar to urandom but
* with the goal of minimal entropy pool depletion. As a result, the random
* value is not cryptographically secure but for several uses the cost of
* depleting entropy is too high
*/
static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
unsigned int get_random_int(void)
{
__u32 *hash;
unsigned int ret;

if (arch_get_random_int(&ret))
return ret;

[...]

There's one interesting use of this in the Linux kernel: the output is used for randomization of the address space. So, I suppose we could say that if NSA can predict RdRand then they can predict memory layout and which might enable some sorts of interesting attacks.
The file he mentions:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....
Just so it's easy for everyone to find.
Sadly, a lot of folks in Silicon Valley believe in a form of social Darwinism. "If you can't code, it's your own damn fault."

It's actually caused a lot of tension in the city of San Francisco.
I don't think $50k back in 1960 bought you as much as $400k buys you today. Keep in mind how cheap many products and services have gotten due to automation, globalization, and technological advancements. Comparing cost of living in 1960 to cost of living in 2013 as if it's comparing apples to apples is a mistake.
Show HN: Openmic - Give voice to images
A good friend of me said: anything that is science is just a special case of either mathematics or physics (and anything that does not satisfy this criterion is bullshit or rambling on and on; but surely not science).
IPhone with fingerprint reader is police wet dream
Fingerprint reader with a user's fingerprint data stored in Apple's cloud? Sounds like a police dept's wet dream.
For "life and death" doctors, which I'd include eye people, it's in part a defense mechanism. They know some day, if not already, they're going to make a mistake that will kill a patient, and they've got to be able to accept that and carry on.

One of the reasons I dropped that as a possible career, and one reason I like software and systems, for with a modicum of care you can recover from most mistakes.
The grandparent sounds like he [I can assume that it is a he, but I don't usually use gendered pronouns with an unknown speaker] is speaking from a very privileged prospective of not experiencing sexism himself, thus not realizing it is there.

Might want to check out the Male privilege checklist: http://amptoons.com/blog/the-male-privilege-checklist/
Yeah, indeed. I remember some thing posted here a while ago about about a prospective employer assuming something is wrong with a candidate with out a facebook profile for the prospective employer to snoop over prior to hiring.

Perhaps we should exercise our little grey cells more. Granted for a busy sales man or something that's impractical, but Im sure we could generally commit more exclusively to memory..

I posted this before, but to repeat... I think the legacy here is that we move more and more as a matter of habit or routine to a more secure way of living. No, we cant ever fully insulate ourselves from the NSA, but I think more and more of us will commit less to the internet, choose HTTPS via automatic extensions, use more secure software as a default, self censor, and so on.
That's not entirely true. While Rackspace does provide a shared private network for intra-DC communication, it also provides the Cloud Networks product that is capable of creating tenant specific networks. Think VLAN tagging for Cloud.

On that private network, you can use your own addressing, use multi-cast, etc. Much less limited and more secure than a shared private network. It's also free.

Mandatory Disclosure: I work for Rack.
RandoSnap
Send and receive random snap chats from other rando snappers.
Linux “HoT” bank Trojan: Failed malware
That deleted one was posted by me. After I posted it I felt guilty about triggering yet another gossipy discussion about Linus, so I deleted it. Not that I was blameless, choosing such a gossipy link to submit.
Samsung Sucks At Original Design
Show HN: Resthooks.org - Stop the polling madness
People who are concerned about cryptographic security should try learning about cryptographic security, seeing as the current debacle is all about who you should trust to provide cryptographic security solutions.
Of course if RdRand is aware of how it is to be used and looks at the place it is supposed to be XORed with, then including it would hurt.

But it would need to be actively aware of what is where in memory to do this.
Dunno how old you are, but I think most CS programs up until about 2003 werent accredited because no such program existed. Any BS from before that is just backed by the reputation of the school--which is basically the case save for the bottom of the barrel for every subject. (Because if you have to ask...)
When people have multiple servers, often they need/want those servers to communicate. For example, I might have a web server and a separate database server. So anything on my web server that needs to make a database query would have to communicate over the network to the database server. Prior to this change, Digital Ocean users would have to do that communication over the public internet interface (public IPs), and the traffic would count towards their quota. Now, the servers can have private-side interfaces that aren't internet-facing, allowing this internal communication to take place on the internal network, avoiding the public interfaces and not counting towards the traffic quotas.
This keeps going around. There's several ways to verify outpuf. For example, GCC has assembler output. You can easily verify assembly and, relatively easily, write an assembler from scratch, so it's actually easy at least verify output without writing a new compiler (or just write a new compiler)
NSA Tracks ALL iphone Via GeoLocation
Anyone remember that hack where we found out that iphone was tracking all your movements via a geolocation file on the phone?

This sounds like what the NSA might have implemented...

http://www.bbc.co.uk/news/technology-13145562
"Deal with it," is about the worst advice I've ever heard.

I've never had to deal with sexism. When I was bullied in high school my car was vandalized, I had to take time off from exams because my face was a wreck and I was being monitored for brain injuries. I skipped class because I didn't want to hear, "fag," for the thousandth time. I didn't want to deal with the food being thrown at me in the cafeteria or the snickers as a I walked past the gossiping kids in class. I've never had to deal with being discriminated against because of my gender but I cannot imagine that it hurts any less.

I was lucky. A friend of mine was beaten into a coma. The bullies showed up to his benefit concert to throw pennies and harass the attendees. He has been living the rest of his life with the effects of severe neurological trauma. Yeah, kids are mean.

It has been more than a decade since I escaped that hell-hole. I've since read articles about other unlucky kids who've died being stabbed to death by a mob. I've read about girls who have committed suicide because they couldn't deal with the slut shaming. Sure these cases are beyond the norm but I wonder if they are not indicators that things are just getting worse for kids these days.

It doesn't have to be this way. We can single people out who make sexist jokes and correct them, loudly and publicly, and try to help them understand that they're not funny, clever, or cool. I agree with the author that teachers can be a part of the solution. But I don't think that is the final word (and it never is when trying to change prevailing attitudes and norms): parents need to tell their kids to stick up for people who are being bullied, that it's not funny, and that it's dangerous to not say anything when they hear someone spout off something hateful.
>Most other providers do not restrict private network either

EC2 has security groups, and the default group would be that non-tenant machines could not access your services (this is external to your image, at presumably the hypervisor or networking level. What you do in ufw/iptables is above and beyond this). I don't see any similar mechanism in the Digital Ocean world.
Amazon supports this as well with their Virtual Private Cloud(VPC)
Fails to parse http://io/ as valid URL. Same with IDNs, http://пример.испытание/. Okay, that's obscure cases, but when you're writing yet another link shortener you really should know quite a bit about URIs (and IRIs).

Practical problem is, service does not make distinction between http and https schemes - typing in https://example.org/ yields http://www.donotlink.com/ZG which leads to http://example.org/.
Since the Panda update everybody should be using rel="nofollow" on all outbound links, otherwise you risk getting knocked back to page 100 should any of the sites you ever link to trip a flag that leads google to classify them as a spammer.
Understanding ECMAScript 6 arrow functions
It certainly isn't hard and we've done this previously as a one-off in-joke kind of thing. It just creates a lot of useless energy consumption since there are large parts of those game-engines running that you don't need. It isn't that hard to be proficient enough in both Android and iOS Development to build "good" CRUD Apps, while also becoming proficient in Unity3D. Making money with all three at the same time without focusing on one is hard to sell though.
Sounds great - will we see web app / browser support? Looks promising!
> "The government would come down hard on any school which says "you pass all the enrollment criteria, but we have a nagging feeling you won't complete the degree so we're not letting you in."

No it wouldn't. Admission to selective schools isn't based on criteria, it's competitive among the other applicants in the pool for a limited number of slots. Counselors routinely state that the vast majority of their applicants are academically qualified; students are selected based on interestingness (communicated through essays & recommendations), extracurricular talents, race, gender, and other factors. Sometimes even virtuosos are rejected because there are already enough virtuosos with that particular talent in the university.

As far as I know, it is only very low-end schools in the US that run admission solely off of standards.
Yes; it leads to unexpected consequences. The worst students are the ones the that the professor has the most incentive to graduate. So paradoxically the better you are, the less likely you are to be done quickly.
EdX Announces Partnership with Google to Expand Open Source Platform
Unity 4.3 is gaining "native" 2d tooling: http://blogs.unity3d.com/2013/08/28/unity-native-2d-tools/
The answer? “I really blame the board,” said Sculley, who was recruited from Pepsi in 1983 to bring order to Apple – and Jobs.

So much for the buck stopping at the CEO. At least he shows more humility in the end.

Sculley’s biggest regret? “I feel most badly, though, [because] after 10 years, I was at the company, I wanted to go back to New York where I was from. Why I didn’t go to Steve Jobs and say, ‘Steve, let’s figure out how you can come back and lead your company.’ I didn’t do that, it was a terrible mistake on my part. I can’t figure out why I didn’t have the wisdom to do that. But I didn’t. And as life has it, shortly after that, I was fired.”
The original petition is an utter waste of time.[0] It provides no insight to the problem, no analysis, no debug, no "if this, then that". It's petitions like this that are "clearly identifiable, consistent behavior" of people who shouldn't be petitioning FREE, OPEN-SOURCE, SOFTWARE. Put an issue in github if this is such a big deal...no one asked this petitioner to use Linux, nor paid for it.

Development is complicated. We should all keep learning from one another and encourage communications

Yes, but calling out the BDFL of one of the most influential pieces of technology is straight up utter poor communication. Linus should have ignored this.

Where do I start a petition to make people aware of what a complete a-hole Linus Torvalds is?

You know what you do with people who are assholes? Ignore them. I find it quite funny that people criticize Linus for his attitude. Personally, I don't condone it and would be my prime reason for not working with him. But you know what? I don't have the capability or know how to contribute to the Linux kernel, so who am I to judge an organization's "style of communication" for providing something that has created massive value to my everyday work?

[0] http://www.change.org/en-GB/petitions/linus-torvalds-remove-...
"Too-friendly" creepiness is one thing. It's hard to blame awkward lonely guys for being awkward lonely guys.

Outright misogyny is a whole other kettle of fish.
No, that wouldn't work. The server wouldn't know if the random number they got back really came from the correct phone or was spoofed. The only thing the servwr can control is where it sends the code to - so the best security is sending it to a different device from the one the attacker might be using, the computer.
Ask HN: Amazon API Question
My programmers and I are trying to figure out if this is possible. I would much appreciate any input.

Is it possible to create a website where people can create accounts with a credit card and shipping info and purchase Amazon products from this separate site? As in, our site would store CC and shipping info and transfer them to Amazon when a sale is made so that they fulfill the order (and still receive a cut or commission).

Came across Amazon MWS (https://developer.amazonservices.com/gp/mws/index.html/183-8675474-3819327) and thought it may potentially help make this possible.

What do you guys think? Is it technically possible?
Good job! I can see using it with my designer to discuss mockups.
I actually talked to Google yesterday. Minimum tier is 100k per day at $17.5k per year. Very fair price (If you think that is expensive, then you clearly do not work in commercial GIS, where licensing of software and data is insanely expensive). At the same time, they force you to use the data on a Google Map component (yes, even for the paid accounts), and while their api is acceptable, their js map control is severely lacking in features compared to something like leaflet, openlayers, or esri's js component. This may have very well been simply an arbitrary decision, but it has the effect of snuffing out any small companies or start ups that want to use their apis to build new, innovative applications. Considering the big few companies in this space bought up just about all the data companies that originally compiled the underlying data, this seems completely anti-competitive to me. I am not saying they should give it away for free, but there should definitely be some smaller paid plans with more open terms of use, considering that Google and the couple other competitors basically just purchased a cartel together over the last decade.
So how is he actually making money on HTML5 games? By selling the games for a one-time fee to companies that wish to use them on their website?
Your dismissive tone is rude and uncalled for. There's nothing fundamentally impossible about the method tlb is suggesting. It would actually be quite a clever hack.
You can be a hacker and still know nothing about how modern website backends are designed.
Not true. If we're going to put on a tinfoil hat, the hardware RNG only needs to be able to have access to memory to figure out where it is likely to be used.
Hence Google is probably going to end up ignoring nofollow
Yes. Clearly no value of any sort has ever been created from the digital economy, and the richest companies in the world definitely produce nothing to do with content creation and distribution over the internet.
When will they introduce IPv6? They could then allocate a /64 to each customer and the customer can then firewall off their own little corner. 2013 is not a year when IPv6 is optional.
REST Hooks - Stop the polling madness
This just leads to a redirect loop for me, probably because they rely on cookies. Anyone got a plain link to the text?
Oh totally. And each computer was significantly different so while some knowledge was transferable, a lot may not have been.

Sorry if it came across as if I was undermining Graces achievements. I really didn't mean it that way at all. I was just enquiring about the classifications of early 'computers' and which came first as computers back then differed quite substantially from now and even from each other, so you get several different machines that claim to be the 'first' for various different reasons.
Likewise, you can probably construct a more sophisticated argument than calling people "reactionary dullards", but you curiously choose not to. Somehow that isn't a lowbrow dismissal.
(3) I would definitely like to avoid modifying files by hand. I knew about this method but it just does not work for me. I am automatically creating many volumes with cli and modifying them in configuration file is not convenient. I guess it is also not possible for cinder devs to implement it reasonably well.
Yes, sure, that's a possibility. You could imagine a situation where a microcode update to the Intel processor is written to modify RdRand in the knowledge of specific Linux versions and it would alter the values being returned because it would be aware of where it is used. You might even imagine some cleverness that actually alters the surrounding program's execution.

In a past life I did stuff like this where a device driver actually modified a running program to patch it to fix bugs/compatibility. It's not a complete fantasy to imagine that this might be possible.

But, hey, it's software. Anything possible; with computers it's best to look for what's likely, not what's possible.
All that may be true, but as dalek_cannes says, it gives us perspective on how to understand the Constitution. In particular, it informs us that the Bill of Rights is not granting rights to the people, but is instead taking note of certain rights that all people have inherently.
I agree that VB's build-run-debug cycle is highly gratifying, but so is JavaScript's if properly taught, and it has the advantage of -- as I said -- being the underpinning of something they actually use.

If you want to show the joy of a VB-like build-run-debug cycle, use Unity and C# (or Unityscript) and it's (a) free, (b) runs on Macs, and (again) (c) builds stuff they might actually care about.
Not everyone is born with intrinsic knowledge of systems administration. Deriding someone for attempting to expand their knowledge is disgusting and needs to stop.
Whatever the URI is, it's still going to be a sub-resource of some collection, right? That's the only way of defining how to stuff it into the DB. I didn't see any way of defining schemata for "one-off" top-level resources. Since these resources are just members of collections, I don't see the problem with using internally-generated identifiers for them.

If you want to allow "/people/12345" to be accessed at "/people/johnson" or even "/johnson", it seems Flask routing would make that trivial. I don't think Eve itself has to care. [EDIT: even so, I see now that "/people/johnson" is possible through "custom item endpoints".]

By the way, I might be in love with this framework.
Very cool. The exploding icon is funy too. Can I somehow close it at a certain point?