skysight-inc/HackerNews huggingface dataset:
How do you reward random difficulty?

People play games because it reward them. The learning process, the milestones, the journey.

Let's take your idea of randomness and apply to a genre, space combat. Let's say most people are conditioned to think, if they see ShipA bigger than ShipB, that ShipA is slower, and it's harder to kill. Now let's apply "randomness", and now the size of the ship isn't related to its speed, offensive, or defensive power.

How do you think a player would react if he can't make a choice to overcome the problem? Does he approach the ship as if it had a lot of hitpoints, does he circle-strafe, does he shoot and roll?

What I am trying to say is that a random set of conditions doesn't allow the player to feel more prepared for the next problem. If you can't reward the player, you don't have a game.

Also, Wikipedia and the dictionary mention many times the necessity of having rules for a "game".

So let's scrap the idea of removing skills in games.

What rewards skilled and non-skilled, smart and dumb players in the same amount? Gambling. More specifically, gambling where the outcome is truly (at least more) random, like Lottery, as opposed to blackjack (where at least there's some strategy involved in not-losing everything so fast).
it's remarkable to me to consider how outlandishly ineffective airport security is, and then to realize that it's just the typical sort of response. Why should we believe that any of the new financial regulations will be any more effective than making people throw away water bottles?

Why should we believe that "fixing healthcare" will be more effective than "fixing airport security"?
As a public company in the U.S., Apple shares are traded in markets regulated by the S.E.C. Amongst other things, any fact which could "materially alter" the performance of those shares in those markets must be disclosed.

The board need not disclose the specifics of Steve's medical condition, but it MUST disclose if, at any point, his health prevents him from performing his duties as demarcated by his employment contract.

In all likelihood, this was not done within the typical timelines, channels, and detail as proscribed by S.E.C. charters, but the S.E.C has extremely broad discretionary powers in these matters and could simply decide to do nothing.

Given the extreme congeniality of the Apple board and Steve's celebrity status, it's likely that they voted to offer no disclosure after Steve, himself, announced his condition following a pseudo off-the-record disclosure to the NYT.

The key thing is that Steve personally made the more detailed announcement--not Apple. The board only disclosed the 6 month medical leave and it's highly likley that no official board minutes will offer written record of these health discussions beyond the press release. This gives the board legally plausible, but weak, deniability regarding the details of Steve's health.

Buffett is correct, but given the various vestments of the parties involved (including the S.E.C.) it's likely that nothing will come of the matter barring a disgruntled board member or demands for an audit by a bloc of institutional investors.
Microsoft launches free smart home energy monitor 
Microsoft announced the launch of a new online home energy monitoring service. The service is called 'Hohm' and is being released as a beta to help people lower their energy bills by giving consumers detailed reports of energy usage. The service is completely free to consumers and runs algorithms developed by the Lawrence Berkeley Laboratory and the Department of Energy.
Using wikipedia as such a large reference that a significant portion of a book is paraphrased and even more so that word for word contributions were found even through editing out the copied work suggests a lack of knowledge as well as laziness in the writing of his book.
reminds me a lot of pownce's files implementation. anyone else feel the same way?
It'd be awesome if someone with great visual communication skills (Amy Hoy-/Dustin Curtis-/Bret Victor-style) teamed up with cperciva's intense summaries of encryption knowledge. That would be a helluva one-two punch.
Secrets of the "Clear" airport security line | Brad Ideas
absolutely, just surround yourself with good engineers and experienced startup professionals
I thought this added some interesting (if true) details about the business and politics behind "Clear". Arguably these entanglements strangled it as a business.
And, relevantly to YCombinator, a big missed opportunity for Justin.tv :-/
http://www.smartplanet.com/technology/blog/thinking-tech/boe...

Here is the conference call where they announced it
Let's not pretend that 'experts' are supposed to know everything. If you went for a programming interview and were rejected because you didn't have all of the regex syntax on the tip of your tongue, would you feel the same way? I don't think it indicates a lack of knowledge or laziness. It's just an acknowledgment of the central role that Wikipedia plays in research these days combined with the ease of copy-paste functionality in word processing systems. Had the same thing happened twenty years ago with the Encyclopedia Britannica that might be a different story. But Anderson intended to rework the sections he copied and forgot to. Sloppy work, yes, but it's so easy to see how someone could make this mistake innocently.
Adultery Rampant Among South Carolina Governors. This Must Be Craigslist’s Fault
Does this mean that Carmack is going to completely stop working on 3D engines in order to focus on rocketry or whatever he's into now?
My criticism was deliberately vague on the off chance that I got an answer and was just being opinionated, but I don't think you can justify it quite so easily. The article amounts to a search .... that's it. There was no expansion on the technology behind this and no real content. There are an abundance of topics available for discussion within this community that could stem from that article.

I had a quick look at the software, but couldn't be arsed to go beyond the "trial" limitations, but from what I saw the article is watered down and the author makes no attempt to range into the MANY areas open for debate. Like I said, language and etymology are interesting, but it's the theory that is interesting, I see little to no such thing here.

Not trying to call you out, gruseom - do a blog on it if it really interests you? I think it could make a very interesting topic, otherwise I wouldn't have made my comment in the first place.
Also impressive is that the improvement in speed from the software upgrade is only a tiny bit less than the improvement in speed from hardware...
The reason you want to use EAX or CCM instead of CTR+HMAC is that EAX and CCM are standard constructions. CTR+HMAC isn't.

Let's be clear about this, Colin. You're saying that EAX and CCM implementations are so untrustworthy that lay developers should implement their moral equivalents (substituting CBC-MAC and OMAC for HMAC) by hand.

In order to use CTR+HMAC, you have to design your own construction to do so. You likely have to implement HMAC yourself. You have to determine when to apply it, and where to put it in your messages.

CCM and EAX remove those degrees of freedom, which is exactly what you want: the fewer decisions a developer/designer needs to make, the fewer opportunities for things to blow up.

It's the places where primitives join together --- encryption with MAC, for instance --- where crypto protocols are broken. The person who uses OpenSSL is far more likely to make a fatal error than the OpenSSL developers themselves.

With all due respect to Colin, I think this take on how to minimize attack surface is, well, asinine. I think it's based on a bias against crypto library developers, based on the fact that Colin probably knows more about crypto than they do.

Stipulated.

But the point isn't that OpenSSL developers are better, or even comparable to Colin. It's that their code is 1000x more likely to be reviewed than anything anybody else writes. Your hand-hacked CTR + HMAC protocol isn't going to be reviewed by anyone who doesn't have a direct financial interest in your code.
I have no problem researching topics with wikipedia, if it is pertinent information and you can read you should be able to find a better source.

Does not compare in anyway to an interview and previous knowledge.
Protesting Using Computers = Cyberwar
There's sort of a catch 22.

If they made money by selling them to anyone who wanted one, that would imply that people who could afford one might want one. It would imply that these are viable to produce for a market.

In that case, what do we really need a non profit for? Get this hardware to developing country children? Put together a software package? Lobby the governments to allocate funds to the OLPC mission?

None of those are really OLPC.
Thanks for the response and link.

The "could get worse" standard is a slippery slope, unless the evidence suggests a very specific serious compromise or foreign active content. (Exiling a site because a few evil links appear in its comment threads, for example, would put almost every site at risk of removal. Indeed, that standard risks gaming by a site's rivals, using comment forms rather than 'hacks'.)

Also, looking at Carr's last comment, even though he's removed the bad links, he doesn't know what compromise allowed them to appear. So his site is still in the "can't be sure... won't soon become particularly malicious... [or] substantially compromised" category that justified its initial removal.

Your deep and sensitive checks for problems are definitely a public service... as long as the standards are clear and communications effective. Maybe notification should occur via a site's own comment functionality in addition to email? No details for third parties to exploit -- just a "please check Google Webmaster Tools" note.
I'd say it's more like they're also advertising their older series phones too, given the url for the page is not htc magic specific.
I'd rather have an Internet and atorvastatin than an ideologically pure government. But that's just me.
He has announced the existence of successors.
He knows. In his annual report he wrote that the Berkshire board knows who on the shortlist to appoint should something happen to him.
Interestingly though, a casual browse through the Pre's software that Palm have so far put up shows it's using the webkit engine from Safari3.2. With the various iPhone hardware and software combos present, it gets a bit more interesting. The original 3G with the numerous js and render engine improvments keeping pace with the superior on the hardware front Pre. With firmware 2.2 (probably) using the same Safari 3.2 engine as the Pre, it gets a pasting from the hardware improvements.
25+ Useful Infographics for Web Designers
I've got the G1 and I don't like the 'bend'. HTC should have made the scroll ball flush with the case if that's the reason behind it.
Ask HN: Free or very cheap marketing suggestions for startups
For a small (1 person) startup without any funding and looking for marketing strategies, what do you suggest?

I came up with a few ideas that I have been using lately, but would love to hear from you all.

My ideas:

-Register on forums/mailing lists that are close to what I am doing and start participating and when possible pointing out my product. I am noticing that sometimes with a good answer (even without pointing my product), people will follow the link on my profile ...

-Switching the referrer on my browser to always point to my domain ... Ok, I did that a while ago I am seeing people going to my site from their awstats/webalizer pages, but don't know if it can cause damage at the long run (just trying).

That's it...
The reason you want to use EAX or CCM instead of CTR+HMAC is that EAX and CCM are standard constructions. CTR+HMAC isn't.

I don't know from where you get the idea that Encrypt-then-MAC is not a standard construction. Encrypt-then-MAC was a standard construction long before EAX and CCM were invented -- in fact, in the paper where EAX is introduced, it is actually defined as an Encrypt-then-MAC composition!

It's the places where primitives join together --- encryption with MAC, for instance --- where crypto protocols are broken.

If you look carefully at recent breaks, they have been in Encrypt-and-MAC and MAC-then-Encrypt -- both of which I specifically mention as inferior to Encrypt-then-MAC.

With all due respect to Colin, I think this take on how to minimize attack surface is, well, asinine. I think it's based on a bias against crypto library developers, based on the fact that Colin probably knows more about crypto than they do.

I apply the same approach of minimizing attack surface even when it's only my own code which is being attacked. The question isn't how prone some code is to vulnerabilities (although in the examples I gave, there certainly is a poor track record) -- the issue is engineering code to eliminate potential risks.
Warren Buffett is not up on the legal disclosures required involved when the health of a CEO of a large public company is imperiled?

That's not what I said. What I said is that I'm sure Apple's lawyers went through the legal implications of non-disclosure, and OK'd it, whereas Warren is not a lawyer. I have a math degree and know how to fix a running toilet, but I probably shouldn't give tips to a highly competent team of plumbers on their plumbing decisions.
As the singularity trots backward in time toward us, these types of computer found solutions that humans can't comprehend are going to increase.
Encrypt-then-MAC is just an idiom.

By contrast, EAX is a NIST standard.

I don't find your argument particularly convincing. This "encrypt-then-MAC" thing is a total red herring. You're not advocating for the idiom. You're advocating for people to build their own nonstandard versions of it, because you don't like the library code that already exists for the standard versions.

Let's cut to the chase. I can point out HMAC vulnerabilities. Nate's Google Keyczar finding. SNMPv3. That's 15 seconds worth of research. [edit SSH screwed up HMAC as well.]

It should be at least as easy for you to give me two published implementation flaws in a CCM or EAX implementation. Go.
Not to discredit any hard work but I think FF should consider how this file sharing implementation is any better and/or more efficient than email

How is Twitter any different from shouting out a window then? You reach about the same audience, and your average voice is lost within an indistinguishable stream of noise.
Well, thanks for at least providing some insight into that mindset.

The "small amount" part (wrt 500k annual) is what I just don't get into my head.
I doubt that millions of people care about Tom. I doubt that myspace would lose upwards of 500k per year if he went away. But you are ofcourse right, I am not Rupert Murdoch and my observation that myspace is tanking is merely from the frog perspective.
Because it isn't about being effective, it's about doing something, or rather, appearing to do something. It's all about appearances, as many things in life are for better or worse.
Social Skydiving Day Two: Still Haven't Embarassed Myself
That's different from knowing who will succeed him should the trial period end uneventfully and he pick his successor normally...

Though one could argue that just who his successor is in the event of death is still a "material fact"...
Thank you for your insight.
"Much work needs to be done before we announce to the world that much work needs to be done"
I can point out HMAC vulnerabilities. Nate's Google Keyczar finding.

Funny you mention that. The flaw Nate pointed out in Google keyczar can also affect CCM or EAX (or, for that matter, any authenticated encryption method).

It should be at least as easy for you to give me two published implementation flaws in a CCM or EAX implementation. Go.

Sure:

http://people.csail.mit.edu/tromer/papers/cache.pdf
http://cr.yp.to/antiforgery/cachetiming-20050414.pdf

Of course, neither of these two papers mention CCM or EAX -- but the flaws they mention apply to both CCM and EAX (because an attacker can cause you to input a block of his choice to your AES core) while not affecting CTR-then-HMAC.
Handy netmask reference
"Now I _always_ buy the OEM part. Some examples:"

I thought I would provide another example as this was one of those things that always amused me.

Back when my brother was alive, he was a Porsche enthusiast, he owned several at the same time (4) and his first love was his 944 that he raced.

Anyway, the door handles on a 944 are the same as a standard VW part, with one slight difference. One has "PORSCHE" etched into the plastic while the other didn't. A luxury that increased the cost of the part by nearly 15 times.

The funny thing was that with the 944 series, there were many non porsche parts used in the production of the car. The body was made by Audi (which we learnt one summer while stripping all of the noice cancelling rubber off the body... not a fun job)
Hear. Hear. I was just on flights out of town over the weekend, and it occurred to me that the terrorists have won by making air travel so inconvenient and annoying for every American who ever flies domestically.

"Maybe Secure Flight is a good use of our money; maybe it isn't. But let's have debates like that in the open, as part of the budget process, where it belongs." This is the general answer for review of current security procedures: we should check whether they are worthwhile for the amount of improved security they promise to provide.
Maybe it's just me, but the industrial steel roof structure over the house is genuinely ugly. There is no integration between the house and this roof. The functional climatic solution could be done elegantly and in a more integrated way.
The funny thing to me is that given Anderson's message, he could reasonably have used many large, credited excerpts as an example of how great 'free' is.
First look at James Cameron's Movie: Avatar
Or he didn't know how bad it was yet when he said that. In any case, it's not a lie in any strict legal sense.
If you're willing to understand the program behind the proof, I think it's more acceptable than a handwritten proof.
Hey Gojomo, appreciate the input!

I definitely hear you on the slippery-slope issue, and perhaps I could have worded my initial note more carefully. We have reasonably conservative heuristics in place to assess whether a site has been actually hacked vs. just someone adding, say, a link to a nasty site in a comment. Also, in our experience, once a site or server's been compromised, there's a good chance that, well, where there's smoke, there's fire.

Regarding giving more information... I believe we do generally show specific examples re: hacking and malware via our Webmaster Tools, though I can't say for sure what we presented in Nick's case. Generally, we've seen that webmasters are able to catch the root vulnerability (via their own unpatched software or via their server), which prevents the same problem from recurring. (and speaking of unpatched software... from my own spot checks, that seems to be one of the most major culprits!)

Lastly, re: your suggestion about notification on the site's comment functionality itself... that's a fascinating idea! I think that it'd be a bit challenging to implement, given the diverse array of registration requirements, captchas, etc. (our bots are smart, but not as smart as humans!), but I know that our team is looking into more ways that we can let webmasters know of issues more effectively. Thanks for the suggestion!
The fee is insignificant compared to the cost of the bill, or the cost of a chargeback if a card holder disputes a charge.
Yes, when I went to school, kids were taught in junior high to THINK and to digest what they read, and then write in their own words the overall facts about the issue they were writing about. That much verbatim copying is just sloppiness as a nonfiction writer, and inexcusable if it isn't introduced with indications of the source.

Moreover, anyone who has looked at advice on proper citation form since the mid-1990s knows that it's standard in many citation rules to include the download date (file access date) when the author saw the online source in the citation. That is precisely because online documents are particularly likely to change over time.

http://www.chicagomanualofstyle.org/tools_citationguide.html
First, the flaw in Keyczar didn't affect CCM (or CBC-MAC) or EAX (or OMAC).

Second, I cited SSH, SNMPv3, and Keyczar. You responded with localhost cache timing of AES and remote cache timing of naked AES. There's an obvious difference between the two sets: one consists of real attacks, the other of speculative attacks. If your point is valid, it shouldn't be hard for you to name one system in which CCM or EAX were "broken" --- and I'll give you any definition of broken you choose --- because of these papers.

They're both great papers. But I don't think they make the argument you think they do.
I'm not sure if you'll read this, since it's been so long, but here goes.

Depending on what you plan to do, if you want to be 'standards compliant', I'd look into SIP, and it's IM extension called SIMPLE.

What's interesting here is, that the 3GPP body - defining the telco standards of the future - has chosen SIP as it's signalling protocol for media sessions (voice + video), but also for IM. In addition there is a 'network address book' (= server side contact list) standard based on XCAP.

All of the above are part of what's called IMS, the IP based communications infrastructure for future telco networks.

A good library for SIP client development is PJSIP.

If you are just in need of a good IM infrastructure, XMPP/Jabber seems to be better suited.
Flutes Offer Clues to Stone-Age Music
Ooh, my head hurts. Too many options, but this article is a good place to see the variety post-relational databases. It's also good to see that innovation is alive an well in the database arena. I think that it is also good that all the options will make a good architect think about his design. To use these highly distributed designs you give up things, like umpteen indexes per table, ACID compliance, a column for every day of the year, and 20-way joins.

I think its a good to go away from relational and look at these things and come back and look at your current practices. Maybe every attribute doesn't need a column and an index. Maybe use a JSON bag to hold the loose parts. Maybe throw away a bunch of indexes; create them on the fly for the monthly report. Maybe you can give away some of your referential integrity.
TOP Article Directories Article Marketers Should Focus On First
With article marketing being one of the most popular and leveragable online marketing practices today one often asks themselves how they can maximize there articles exposure once written and ready for publishing.
Given the recent commentary on the new design for a folding version of the UK mains plug, I should share a tip a friend gave me - you can put a UK mains plug in 'upside down' to an adapter strip.

This means only the earth pin is connected, thus earthing your case but without running the risk of having live connected, even if isolated via a switch on the PSU.
These really are pretty amazing... I found watching the various videos of them was fairly mesmerizing
reminds me of when the four color theorem was proved using a computer program. They had to convince everyone the proof was valid. There were lots of questions about the validity of the program.
Why would one care about such a thing? If you believe there is an afterlife, do you also believe that it is connected in some way to Earth complete with internet access?
The Kaufmann Desert House (designed by Richard Neutra) is a whole lot more aesthetically pleasing imho:

http://en.wikipedia.org/wiki/Kaufmann_Desert_House

http://www.latimes.com/classified/realestate/la-fi-home26-20...