skysight-inc/HackerNews huggingface dataset:
People always seem to think that comparing the security of a content-controlled Javascript runtime to that of an ISO image is somehow insightful, as if there was no meaningful difference between those trust models. But I don't think anyone making those comparisons believes what they're saying; I think it's sophistry.

Obviously, you cannot simply assume that an ISO you download off the Internet is secure. That's a problem that's been well known since the mid-1990s, when projects began publishing hashes and PGP signatures of their binaries, widely, so that a discrepancy between what you saw and what someone else saw would stand a good change of being noticed.

The problem with booting up crypto in a browser is that it forces you to do that kind of checking on every page load, often at sub-second rates. And not only that, but it complicates the trust evaluation by making it just about as hard as possible to figure out all the components that you actually need to evaluate.
"Transactional DDL is a dangerous game with any DBMS."

Can you give an example?
You can't securely load crypto into a browser without SSL, so the server is bearing that load anyways. All you're doing is adding additional load on the clients.
You might think that most people hold that view and I would guess that a lot of the people I socialize with would agree but the majority of Americans don't. That's why people like Jon Huntsman didn't win the Republican primary in 2012, Chris Dodd got almost no votes in 2008, and plenty of other candidates have fallen into the same trap (Chris Kelly, for instance, lost badly in the 2010 California Democratic Primary for Attorney General). If Americans really didn't agree with either party, you'd see them winning but the only real insurgent challenge is coming from the Tea Party on the far right.
CCFashionFactory Puts Out First Tutorial
US intelligence chief Clapper defends spying policy
Italy Plans to Wipe Out Pirate Sites and Unmask Owners
Distributed approach to BitCoin markets
Nice, thanks for this.

For others' ease of navigation, the quote above comes from http://ukrainianweek.com/Columns/50/74762
They are hard to categorize in terms of "left" and "right," as the terms are applied in the US. A distinction should be made here between economic and financial questions, on one hand, and other questions, on the other hand. In matters unrelated to economics and finance, they are generally quite progressive. In matters relating to economics and finance, they are invariably willing to justify and rationalize all manner of backwardness in the existing order (in my opinion); but occasionally they can be surprisingly forward-thinking in these areas as well.

Personally, I find their positions to be refreshingly orthogonal to those of news organizations based in the US.
> test their code in depth.

Failsafe design flaws are not uncovered by testing code.

Failsafe systems are designed not by "the code works therefore it is safe", but by "assume the code FAILS". Regardless of how much testing is done, you still ASSUME IT FAILS AND ACTS PERVERSELY. Then what?

(Note that acting perversely is hardly farfetched in these days of ubiquitous hacking.)
Email Marketing Wall of Shame - top newsletter unsubscribes
You're not the only one; astronomers have also been surprised. But you have to keep in mind that our data right now is very incomplete. Kepler only operated for four years. You'd need a minimum of three years to detect a planet with a one-year-long orbit. (The first two years give two blinks when the planet crossed in front of the star, and then the third blink should be exactly a year later.) As they analyze the data in more detail, they'll probably find planets with longer-period orbits, but possibilities are limited.
Nah, that would just create duplicates of your files, crash when you need it the most, and corrupt things beyond recognition and force you to blow the whistle again from the start.
This means you trust the average populations opinion.
That was another problem
> Really? So I can sign a contract to work for you for the rest of my life, and no judge will blink at it?

A judge might blink at it, but not because of the Rule Against Perpetuities, which, generally, requires that a valid interest must vest within 21 years after the death of some person alive at the time the interest was formed.

A contract in which all obligations are complete at the end of any life in existence at the time the contract is formed may be invalid for any of a variety of reasons, but the Rule Against Perpetuities isn't one of them.

> To the best of my knowledge, only the institution of marriage and the Church of Scientology offer a deal like that.

Contracts granting life interests in real estate, which are also valid under the rule against perpetuities and were quite common when the rule first came into existence also involve commitments of similar duration. Commitments that last the length of a particular life (of a long fixed period of time, like 99 years) are not at all uncommon in contracts.
But it's not — at least not necessarily. That's the problem. It creates a potentially incredibly dangerous false sense of security, and nothing in the deck refutes that, or even argues against it.
And what is your definition of right wing?
That was the exact purpose of the introductory line "Brought to you courtesy of our legal counsel." :)

Coincidentally we just tweaked the language to match Apache and OpenSSL. It's pretty similar, but doesn't specifically name countries - it just refers to "whatever the rules happen to be under US regulation".

https://github.com/dotcloud/docker/commit/b48fc9657976091ff3...
Please don't, the LOLCODE market is competitive enough already.
Definitely pro-gun control to the point they promote the total-ban of guns. On the other hand, and I think this illustrates a type of pragmatism, they were skeptical of proposed reforms post-Sandy Hook.
Then where/how/why does this 'evaluation' you speak of happen?
Hi. Recently most of your published writings are about startups. I sometime hope you will write about a wider set of topics. Just saying...
before they partnered with the NSA, it used to be P2P to save server bandwidth... But I don't think the problem is with the company being a partner with the NSA, the problem is that the powers of the NSA are too broad (they can force companies to participate in these mass-surveillance programs, or throw them in jail).
> It seems fun to hate on "evil" doctors

I can only speak for myself; I made very good experiences with doctors whenever I myself was sick, but I also worked for 11 months on a cancer ward a while ago, and some of the stuff I saw there was kind of rage inducing. Nearly all nurses were fine, most doctors were fine, but the ones that weren't, really really made up for that. I don't think doctors are all evil, nowhere near, but the reservations and skepticism I do harbour, I don't harbour because it's "fun" to have them. It's merely a way to cope with real shitty stuff that does exist.

> I'm curious how you guys think medical professionals should actually be paid / how can pricing be done "fairly" in a system where there can never be "information symmetry"?

First off, of course there can be "information symmetry". Not between patient and doctor as much as among medical professionals and health insurance providers. Medicine isn't Voodoo, things are reasoned about and tested, usually, and given the right laws and enforcement of them, everything can be documented and subject to review.

As for how to improve the situation: while I haven't thought in-depth about this, but how about a flat hourly rate for doctors etc.? That is, not being paid for the kind of treatment, but rather for being on the job. Of course, the hospital would need money depending on what kind of treatments they do, but if there was no (legal) way to pass on that "profit" to the staff itself, there would be no incentive for malpractice based on greed. As I said, I haven't thought much about this and maybe I am overlooking other problems this might cause (like offloading patients that are too expensive and/or too much work to other specialists, like a hot potato), but I wanted to put this out there anyway.
Halloween Costumes for Web Developers
Lavabit legal fees fundraiser reaches $100,000
Sorry, about that, I unintentionally hit submit without putting the url in the url field

rally.org/lavabit
An ex-colleague of mine went into the pharmaceutical industry to work as a drug rep. They get $X to spend on each doctor they visit as part of their job. My colleague was quite moral, and she would only use the money for the stated purposes: improving the doctor's practise. Charts, equipment, training. Usually it's spent at discretion, and often spent on football tickets, holidays, etc.

She reported that some doctors already used it for practice-improving stuff. The middle set of doctors were a bit like "oh well, the gig is up". But the third set of doctors were outraged that she should tell them how to spend their money. They saw this drug company money as part of their personal income.
Yeah I'm sorry about that once the main website is finished a mobile app will be getting build. Sorry :(
Postdam University to create a MOOC about the futur of storytelling
Ten Things A Startup Founder Won't Tell You
Explorers selling Google Glass invites on eBay
How about instead of each newspaper creating its own system, they all just run a Mixmaster/Mixminion/Sphinx node, so that there is no single point of failure? The problem of anonymous communication has been well-studied and we know how to make practical systems for it. I should not have to connect to a server run by Forbes in order to communicate anonymously with Forbes.
If I were a whistleblower, the only way I would feel safe would be through an Airgap using Shoe Leather Protocol.

If only the media could be trusted.
At the time this project was put together, IAM didn't exist. But I agree that this would be the best approach going forward.
the original title, "Programmers", fit this much better. Regardless... good stuff!
Emscripten compiles the input source with LLVM, then converts the LLVM bytecode to JS. Most of the optimization passes are done by the LLVM compiler. Are you suggesting that LLVM (or optimizing compilers in general) should not be used to compile crypto libraries?

I completely agree that further analysis is needed on js-nacl, but I hadn't considered that compiler optimizations might lead to vulnerabilities.
If i have to work on algorithms; nothing,

If it requires mental focus; Ratatat, Amon Tobin

otherwise; Steve Vai, Dio, Pink Floyd, XYZ, Led Zeppelin, Mezarkabul, Bulutsuzluk Ozlemi, Baris Manco, Erkin Koray, Cem Karaca etc.
> it does not allow you to switch into neutral if you're traveling above a certain speed.

I don't think this is correct (at least for 1997 - 2009 models). Could you offer a citation?
The hiring system we live with today–resumes, jobs descriptions, recruiters, HR interviews, and the rest–is massively antiquated. In the past 50 years only distribution has improved.

A communications gap exists: resumes don't speak to candidates' wants and desires, and job descriptions don't accurately depict a day in the life on the job. Today, recruiters, both internal and external, work to overcome this communications deficit. However, their presence and business models introduce agency problems.

My company, Mighty Spring, is an effort to bridge this communication gap in a scalable way, putting candidates and employers in direct contact. We provide candidates a platform to be transparent about their interests and needs without risk (utilizing anonymity), and help employers communicate the finer points of their jobs better than the walls of text they produce today.

This is Mighty Spring (https://www.mightyspring.com) — the easiest way to find new opportunities with startups.
They are a U.K. publication. As far as I know, there isn't much diversity of opinion on the topic of gun control in the U.K.

They don't like guns, but they don't like impractical or pointless gun control measures either.
Square open sources Shuttle
I think Google has expanded its team 37%
I laughed at high availability /dev/null cluster.
While I can't say I'm right, I don't neccessarily think that "John Huntsman did not win the 2012 primaries" -> "Most people hold that view"

I.e. primaries are very different from elections, you have to have a different support system/funding/incumbent endorsement etc. to succeed in these different situations
Yes really. It's an OO language based on Self's prototypical OO model rather than a class based OO model. Prototypical OO is still OO, unless you're claiming Self isn't OO, but the Smalltalker's who invented Self would very much disagree. Prototypes are objects, no closures or classes required.
Case in point: A whole generation of tablets were born and died around '99-2003 (I worked on one through '99). In retrospect it is easy to see why they were too early, but working on one it was easy to be seduced by the idea and not see how badly the limitations imposed by the technology available compromised the end-result.
If you're evaluating an Apple product based on how many options it gives you, or how it might bend to your individual desire, you're gonna have a bad time. Apple is opinionated, and there are usability benefits to be gained from that. Mission control would not work with a grid.
To me it always seems like the driver tries to gage if you want small talk. I'm not a big talker in the cab, so usually the driver says one or two things and then stops talking. But when I'm in the car with some talkers, they have full conversations.
That's why people like Jon Huntsman didn't win the Republican primary in 2012,

Well part of that is that primaries are mostly voted on by the extremists within the parties. The majority of republicans may well have supported Huntsman, but since most of them don't vote in the primary we never got a chance to find out.

When you consider that roughly 40% of eligible voters didn't vote at all in the latest presidential election -- more than either major party were able to muster -- it seems reasonable to say that the electorate isn't pleased with the current situation but isn't empowered enough to do anything about it.
What's up with HN today? Lots of reddit-style garbage in the front page.
For a non-American - what are the reporting requirements for hiring in the US that you're referring to?
A couple articles I wrote on the topic:

"Safe Systems from Unreliable Parts"

http://www.drdobbs.com/architecture-and-design/safe-systems-...

"Designing Safe Software Systems"

http://www.drdobbs.com/architecture-and-design/designing-saf...
Some of the issues identified in this review could have led directly to unintended behavior (e.g, lack of ECC memory, and coding practices that could lead to stack overruns).
How did this entrepreneur sell 1000 units in 2 days?
It seems you are misunderstanding me. I am not talking about library APIs here. I am talking about internal function signatures inside a single product developed by multiple codevelopers.

All your replies about external APIs changing are irrelevant. A codeveloper touching functions that call your functions or defining functions called by you will integrate with your work with an innocuous "git pull" and force you to review everything just to rule out what JS could have easily detected.

> If a change in a dependency causes you to have a ripple effect of completely broken code - then yes, your code is tightly coupled.

Again, I'm not talking about "dependencies" or libraries here at all.

> In my job, if somebody commits and pushes something which is going to completely fuck the rest of the development team, then they're told to piss off and fix it.

The push was completely benign. The integration of that push with your current work will be broken in cryptic ways. Not necessarily ones that show up in the testing suites.

> If you absolutely must change a function signature which is part of an API that others may be depending on, then you fucking document it and alert your users. Again, not JS. Sort your process out.

Every single function signature can break things, not just exposed APIs. Two developers might work on the same piece of code. There's not necessarily any obvious point to notify here and still breakage may arise.

> Except it doesn't, because who updates a dependency without checking that they can actually depend on it? The clue's in the name.

You clearly haven't understood the scenario involved, I'll try to describe it again:

1) Developer A adds a new function FOO that calls internal function BAR in his unpushed working tree.

2) Developer B changes the signature of internal function BAR, and pushes this change to "master".

3) Developer A pulls from master, his code is now broken, but JS doesn't even warn him when he executes it. Instead, wrong results (or accidentally correct results for any given test case) arise.

4) The test suites don't catch the error. Developer A unwittingly pushes the broken code to master.
"It seems they often assert controversial opinions as accepted truth."

This would be my main content complaint as well. But what I really find objectionable is the non-student subscription price, > $200 for a renewal.
> The problem with booting up crypto in a browser is that it forces you to do that kind of checking on every page load, often at sub-second rates.

You ignored the second half of my statement: that by using offline storage and application manifests, URLs become effectively a reference to an application stored in the browser's cache (which can update itself from the web if it wants to), rather than something to be retrieved on each request. It then becomes exactly equivalent in security to, say, a second-party Ubuntu PPA repository, like the nginx.org PPAs. (With the difference that, even when trusted, the compromised webapp will still run in a browser sandbox, while the compromised PPA gets root access to run scripts.)
The best description of The Economist's editorial position I've come across is the one mentioned in the linked article: classically liberal. The preceding comment about left-and-right clarifies nothing and is ironic given that the original article rejects the left-right characterization.

Also, you only need to read a few articles in the Economist before coming across the phrase 'this newspaper believes' which should eradicate any suspicions of objectivity, pseudo or otherwise.
As I said, the question is how you escape the "local optimum" given that you are in it. Clearly neither parties have any interest in changing up the current electoral system.
SecureDrop is going to end up being so important to journalism and overall freedom I just want to cry endlessly about Swartz's fate, which came far before he (or we) knew about his potential effects on the world.
To contrast it with Google. Activate your humor subroutines and scan again.
Google has Announced Custom URLs for Everyone
Or, could use pepper.js.

http://trypepperjs.appspot.com/

https://github.com/google/pepper.js

(note the `google` in the link).
Guido van Rossum talk on Tulip: Async I/O for Python 3
at the micro level, it's true that those activities are different, but in the big picture, they are so close, and those people are interacting so much with each other.

There is also the big offense/defense hypocrisy, like buying guns and missiles to protect people (instead of armors and bunkers), and mixing offense and defense to make some behavior more publicly acceptable.
Here's the testimony from the trial. They're starting to post it on EE Times. First part is about Task X. http://www.eetimes.com/document.asp?doc_id=1319936&
Software Controls Cache Memory to Speed CPUs
I think I expressed myself poorly. Undoubtedly it would be good if it did the on-disk data changes in the background, and a schema update seemed like an instant atomic action. But it's still a sequence point, and I see no way that transactions after it could complete while the schema update is uncommitted. So what do you actually gain by being able to do the schema update in a transaction?
> Mises, sometimes called the last knight of liberalism

By whom?
This has been discussed before. If you allow comments, the posts would quickly devolve into a series of tangents and shift focus from the real point of the posts.

EDIT: https://news.ycombinator.com/item?id=2022116
While these known issues are true, and still need to be worked out, I don't think stopping all work on crypto in the browser is the best course of action.

There are technical ways we could mitigate these vulnerabilities (signing of JS downloaded from a site, for example). Maybe having crypto in the browser become a thing is the way that these features get the support to be implemented.
Germany had the Free Democratic Party (http://en.wikipedia.org/wiki/Free_Democratic_Party_(Germany)) which unfortunately just vanished below the 5% (after receiving 17% the previous elections.

The problem with libetarian parties I guess could be that they are perceived to be dominated by corporate interests.
The Economist's endorsement of Obama in 2012 was pretty narrow. I think they switched twice over the course of the summer, and the final endorsement basically amounted to "we don't like Obama's policies, but we distrust Romney".

I rather liked their "True Progressivism" issue last year.

Overview:
http://www.economist.com/node/21564556

Inequality in America:
http://www.economist.com/node/21564418
I like the first impression - nice and dense - and I get what you're trying to do, but beyond the first impression I find that the multiple tile sizes make it hard to skim the page. Additionally, on the tiles where text is overlaid onto the images, I find it hard to visually parse the text. The tiles where text is above and below the pictures are a lot easier to read.

My suggestion would be to stick with the tiles, but use only those that place text separate from the image, then group tiles in rows of similar dimension. For example, a row of 2x2, a row of 2x1, a row of 1x2, a gutter of 1x1 on the right-hand side, etc. I feel like this type of grouping would help the eyes scan the page, and feel a little less random and hodge-podge to the user.

Just a couple suggestions. Keep up the great work!
Uber could know with 100% confidence based on past data that a driver passes by a certain address almost daily. For him to deliver a courier to that address would be significantly less work to driving a few miles only to deliver the coirier(the assumption in your argument).

I still don't know if the financials make sense in my particular example but it does tell you the optimizations Uber can make based on the historical data.
I get 404 on all of those.
> certain chemical changes happen in the surface of the brake pad due to the temps

In laymen's terms, we call that "burning" :-)
Seems like a genuine joke to me. This is the guy behind it:
http://noqqe.de

"About
Florian Baumann (24). Arbeite bei der GfK SE und interessiere mich für allerhand Dinge unter anderem Debian, BSD, OpenSource, R, Statistik, Scripting, Hacks, Administration.

Was das alles so mit sich bringt schreibe ich manchmal hier auf. Manchmal nicht. Außerdem sammle ich hier ohne Sinn und Schema Zeug das ich nie wieder brauche."
There are too many perverse incentives to trust job descriptions and supposedly open positions. H1-B visas, political advantages from complaining about a "training gap," etc.

Maybe job postings should be bonded. Put up $20k per position and forfeit it if you have not filled the position in X months.
It sort of depends on the location, but yeah, some places in the U.S. seem to have super chatty drivers; I've heard some great stories that way.

Interestingly, this hasn't been the case any time I've taken a taxi in NYC (where taxis seem even more a fundamental part of everyday life than most places) in the last decade or two. Now the drivers usually just yell into a cellphone nonstop for the entire ride...
Been playing with the datastore and the data is not visible in the Dropbox folder. I'm sure it's somewhere there buried under a safe blanket. So far only it's data sync limitations are a small annoyance but that can be resolved.