skysight-inc/HackerNews huggingface dataset:
Send me an email to dpalacio@authy.com and I'll give you access to our Authy OpenVPN plugin free.
Okay, the firefox issue was fixed and github is back. For those curious, looks like one of our new icons was not processed correctly by icomoon and ruined the whole font file. Lesson learned.

So, if you got the v1.2 version, download the new 1.2.2 version instead :)
I would configure your AWS instances inside a AWS VPC and then host the VPN endpoint inside the VPC. Then you can open up the VPN as needed via security groups. This gives you a secure channel directly to your instances -- something like this:

+------------------+
| AWS |
| +-----------+ |
| | VPC | |
+------+ | | +-----+ | |
| You | +----------->VPN | | |
+------+ | | +-----+ | |
| +-----------+ |
| |
+------------------+

AWS also provides a multi-factor authentication mechanism @ http://aws.amazon.com/mfa/
Its a shame that on the actual SafeSource site they don't seem to give much assurance:

Forbes does not make any representations or warranties as to SafeSource, and your use of SafeSource is on an "as is" basis, at your own risk.

I suppose it is just to cover them legally, but they could be a bit more reassuring to whistleblowers and informants who might not understand the technology very well or the credentials of those who have vouched for it like Schneier and others.
I'm from Germany. As much as New Englanders hate to hear it, you guys are all warm and welcoming in comparison.
You're right that formal methods do not guarantee absence of 'errors' in the sense of unforseen unwanted behavior.

But formal methods, which typically are based on computer-checked proofs, can help you to eliminate certain possibilities. They are severely underestimated and underused because of our dependence on C.

The formal methods do not 'fail' as such. They just fail to prove anything boyond the proven property. Such properties can very well (and often do) include failure (of whatever kind) of parts in the system.

Apart from AI, which as an approach to embedded systems is almost by definition the opposite, I only see one way forward from the mess we're in now: formal methods.
Let's Dream a Bit
You can do some cool stuff with background colors and all of that. But I agree, we'd love to do multi-color icons :)
FYI you can use ctrl + shift + c / ctrl + shift + v to copy / paste text in your terminal.
I just want to say: computer controlled cars have saved more lives than any other parts in a car. How different would the automotive world be without ABS and similar devices?
"For the bulk of this research, EDN consulted Michael Barr, CTO and co-founder of Barr Group, an embedded systems consulting firm, last week. As a primary expert witness for the plaintiffs, the in-depth analysis conducted by Barr and his colleagues illuminates a shameful example of software design and development"

Well, okay, so the article kindly submitted here takes the position of personal injury attorneys who just won a trial before an Oklahoma jury. And perhaps that is the correct factual position about what Toyota did and what Toyota should have done instead. (Disclosure: I am a lawyer, so I had law school courses that trained me to think on both sides of issues that go to litigation.) When "unintended acceleration" cases were first mentioned in the news media, including one case that occurred here in Minnesota, I was very wary of buying Toyota cars, and bought other brands instead. But as our previous cars wore out, we bought Toyotas, and Toyota vehicles are what we drive for all our driving now. I notice that both cars we bought have very clear warnings near the floor mats about attaching those securely and not using any floor mat that isn't attached securely. Toyota, from this point of view, seems to be acknowledging that floor mats used to get jammed up against accelerator pedals in a way that made cars hard to control. We have not had any problems with our vehicles. The news stories about unintended acceleration in Toyota cars seem to have diminished. Perhaps whatever was bad about the former designs has been fixed.
I did the same evaluation with the same conclusion a while back too. How much do they make per year on the ads I see? Why not let me bid for my own eyes? They can't come out worse. Somewhere in the serving of the ads, they check my profile to see what kind of ads to use for me, why not let me purchase a "blank" ad across swaths of my own activity?
For Ubuntu it's been figured out for years. I use Google Voice, play music, do audio in multiple accounts, it all just works.
You inadvertently gave the solution: "lunar apoapsis", "solar apoapsis", "earth apoapsis".

Much easier than "aposelene/apocynthion/apolune", "aphelion", "apogee".
If you don't let Google read my data, I'm ready for the 5k/y
I also run Linux on my laptop at home. Window snapping and auto tiling is a must-have nowadays.

Also, didn't know about #2 (setting window z-positions). Going to play with that later!
If /dev/null is fast in web scale I will use it. Is it web scale? Does /dev/null support sharding?
I wonder if this is a regional thing. Other than when in a group or when the driver was preoccupied on their cell, I've always made small talk with taxi drivers and uber drivers.
Ask HN: Is 'We Are Legion' worth watching?
I noticed 'We Are Legion: The Story of the Hacktivists' got decent reviews on RottenTomatoes(my go to movie review site) and was wondering if it was any good. I really can't stand Anonymous, but I'm always up for a good documentary.
I agree. With a Camry, shifting into N would have immediately remedied the problem. I remember hearing reports claiming: "Shifting to N didn't do anything".

The explanation always seemed obvious to me: Non-technical driver experiences UA. In a panic shifts into neutral. Hears engine scream. Thinks, "The car is still going!" and doesn't realize that despite the sound, the car is actually slowing down.

I know this to be a common misconception in my experience. People commonly misinterpret high revs with "going fast".
I'm perfectly happy with Adium right now. If you want my $10, there better be a trial to convince me to switch.
It would be nice if pasting with the middle click ignored the newline character.

I use always-on-top.exe[1] on windows

One feature I would really like is the ability to lock a window to a region of the screen and allow other windows to be snapped around it.

Firstly you should be able to snap a window into the four corners by pushing the mouse into the corner for x seconds.
(like ctrl+alt+numpad 1, 3, 7, 9)

If you had a window locked to the right side of the screen you could still snap another window to 50% of what's left. And if you manually re sized it to be small be able to snap another window to be 50% of the screen space that is left after two windows have been locked.

If this is possible please let me know.

1: http://www.labnol.org/software/tutorials/keep-window-always-...
There may still be. The first two I opened were closed pointing to docs on how to set the writing stuff. The reproduction is pretty easy, if a shard tries to write its results to a shard that is write locked, none of that shard's map reduced data after that point is written to any shard. The more evenly distributed your data, and the more shards you have, the more likely you'll hit the condition. Combined with the fact that all unsharded collections always go to the same shard, the whole system becomes useless unless you can fit your entire dataset in all collections in ram on a single box.
But is that that really the standard you want to hold yourself to when building a multi-billion dollar company? Being better than waiting for a cab in the rain? Uber is a premium service, and exists because of how bad the incumbent is/was. I commend Travis for holding Uber to a higher standard, and I think it is the role of users/fans to let him know when they fail to meet their standards.
You deal with the DOM before waiting for the document to load?
Interesting! At work I hacked together a video writer that compiles still frames to a movie using OpenCV. But it is slow --ungodly slow. I'll have to check out ffmpeg!
Damn you I was going to come post your storyboard. :(
Still not profitable. It's good idea for Nokia to get out. MS has the money to burn.
The dismantling of the British Empire.
Shouldn't it return the status code "410 Gone"?
Always. Dub-step, rock, jam bands, or jazz.
It also doesn't make any sense that the other city would be Portland Maine! (i.e. where a similar container was spotted)
I want to work on that!

I submitted my application a couple weeks ago and haven't heard back. I know it says "We are not actively filling this role" but one could hope right?

Let me know if you're interested in having an ambitious software engineer on your team!
You know, this is popular to say, but it's an incredibly stupid statement.

The Onion is about absurdist humor. Absurdism makes some sense as political satire, but it's also anti-progress satire.

The inability to differentiate the absurd from reality is just as likely to be due to the fact that we've achieved something previously thought, and still popularly held, to be absurd.

"What's next? You'll let women vote?"
I have four virtual desktops mapped to WinKey+{a,s,z,x}. I've used this scheme for so long that the keys are hardwired in my brain and I can switch desktops without even thinking about it. In particular, I don't care if the window manager organizes the desktops in a matrix or linearly, since I don't need a visual representation.

As an aside, my biggest gripe with Ubuntu is that they hard code the Win key to something else, which breaks my desktop switching habits.
If this is a case of bad design in cars we have come a long way. It was not long ago that the Ford Pinto was catching fire due to a known bad physical design.
Client side cryptography is almost always about providing a solution that doesn't require server trust. This article mentions end-to-end encrypted messaging, for instance, which provides the nice property that not even the messaging server can read the message contents.

The problem with webapp-based javascript cryptography is that if the crypto code is delivered by the server, then the client is back to trusting the server. The server operator, an attacker who can compromise the server, or an attacker who can compromise the SSL connection from the browser to the server can modify the JS to spray plaintext wherever they'd like.

Basically, the JS crypto is reducible to the strength of the SSL connection. Anyone on the other end of the SSL connection, or anyone who can break the SSL connection, can get your plaintext. This makes the JS crypto nothing but overhead. It's just hand-waving at that point.

This is not a theoretical weakness. This is exactly happened to both Lavabit and Hushmail. The experiment has been tried and the hand waving didn't amount to much. There's no need (and no excuse!) to try it again.
Building your b2c startup: Idea to prototype
I am also pretty disappointed with Chrome these days. I switched to Safari because it's just way smoother/faster for me.
It's annoying because the sluggishness is still evident on Android.
WalterBright wrote: "engineers are often not aware of basic principles of fail safe design."

I would suggest they should not be called "engineers" then. And in many countries, they're not. Part of the problem is that the tech community includes a lot of different people. Some are programmers, some are program managers, some went to engineering school, some are licensed engineers (in some other discipline). In the US, these are all commonly called engineers. Sadly, I think a lot of web programmers just don't know the true scope of the software industry and its practices.

If you want to design/build a bridge, you need a state license and insurance. The software industry isn't regulated like that. Anyone can design the software that controls a car. That's probably OK since web apps are non-critical systems. But I can't help but wonder if net security wouldn't be better if more programmers had better training in recognizing and improving the total impact of a system.

It is only the reputation of the company and potential damages in a lawsuit such as this one that put pressure on the car manufacturer and web-app startup to test their code in depth. Actually, I do wonder how much the US auto safety regulations are involved with firmware--or do they just test the macro behavior of the car?
"programmers who are good at crafting defenses for their own systems know how to penetrate other people’s computers, too"

This is not strictly true. There is a big difference between identifying/exploiting bugs in software and defending a network from attack. Within the context of government spending, this is the difference between funding reverse engineering/binary analysis/buying 0days and funding the training of systems administrators.
Best practice would be to create an IAM user for each purpose rather than sharing the same AWS key across all of your apps, for this exact reason
I think in those cases you may not be legally allowed to use a 3rd party managed service to handle the data, although it probably depends on the country where your company is operating.

Also that "god mode" only makes things easier, if you're hiring a managed service by definition it means someone must have access to manage the service.

The answer is: manage it yourself effectively locking access to any 3rd party.
Not really, from what I gather it's closer to a functional language that lets you implement objects with private data by using closures.
I've already launched a competitive /dev/urandom service!
I guess You meant "using" not "suing".
Kirkpatrick: Apple Still Defined by Great Products
The intelligence is usually in the driver.
Right, I think having a non-split tunneling VPN forces employees remote computers onto the "corporate" network where they are governed by the rules of that network and establishing rules for access to internal resources is done centrally.

I just wouldn't trust having something critical like "impersonate user" on the open internet - even if secured by https + 2fa.
> USA is neither for or against something , USA has interests

Sure, but his point and the point of the author was that they have been hypocritical about it, and making people believe that they are for certain things, such as democracy, and so on. They were very convenient excuses to start attacking other countries.

Now they say they are "against terror", while causing themselves terror to many others in Middle East, and creating situations that instead of making US safe, they put it in more danger with their actions.

So their points are that the leaking age, is the age where such hypocrisy will have very short lifespan.
Apple mail “bug” turns out to be user script after all
The Chicken-Egg problem is Problem 0 with Javascript crypto. Until you can solve that, everything else is just farting into the wind.
Is there no way to independently verify that a) the scripts are what they are, and b) that the values change before going to the server?
haha 4 downvotes for finding a comment humorous, I think the first paragraph of the article is quite powerful and a good contextual way of starting things off. Worth a read.
Mmm.. I disagree with the assertion (both yours and the link to the other comment) that advertising is evil.

There are types of advertising that are evil (that which is extremely manipulative or false/misleading), but suggesting that showing me a picture of a specific brand of hamburger, telling me why it's awesome, and suggesting that I buy one, is somehow morally wrong, doesn't even pass the laugh test.

Only sith deal in absolutes. (How meta.)
While I commend the team at MongoHQ for detailing the attack, the strategy used to restrict any further damage and implementing new processes and additional security, I've heard this story one too many times.

When are companies going to realize that security is a critical aspect of their business? Why are people only acting when there's some big security breach, using trivial systems before this?
Oh, NSA did not fill.
LinkedIn is great :)
They are scaled to the assets most people need to protect, not the nominal liability they might incur.
Very well said. The focus on convenience and cool features over safety makes me really sad, and want to force automotive engineers to watch some Alan Kay talks. He loves to talk how people who don't know the history and basics of their craft will arrive at inferior solutions, for example in this one:
http://www.youtube.com/watch?v=FvmTSpJU-Xc
Living alone and working from home, I don't see the need to have that much computers for myself but I can understand the need for you.
That sounds really awesome! But as a military system, this project likely had a lot of mandated quality processes.
Hipster VCs
I wonder whether it's intentional that the tutorial isn't "copy-pastable".

Specifically, it does not spell out any of the imports, and uses very large except clauses.
You would assume rightly, of course. Unfortunately, Mozilla documentation, which is the best around, is sorely lacking on the details of the HTML5 audio implementation, like proper usage of the load() method, and when it's supposed to be called or not called and when. [1] And I don't really know what Google documentation you're talking about.

So that's the whole point. People who go on about "feature detection" and "follow the spec", and think it's that simple, really don't seem to understand what's actually going on.

[1] https://developer.mozilla.org/en-US/docs/Web/API/HTMLMediaEl...
I'd have to agree with your decisions. I'm on Slack, but almost the same setup: i3, tmux, urxvt, vim. The setup is unstoppable. I've found that I no longer need quick launch links (just define/use shortcuts for whatever you need). Switching desktops is really fast and easy (you don't drown in ridiculous animations just by switching to the "browser" desktop), and floating/hidden windows make opening a quick shell really simple. Doing everything via keyboard saves so much time...however I do come from the vim world, so I may be biased =]. On top of all that, i3's config is really, really easy.

Admittedly, I haven't used any other tiling window managers. I did a bunch of research after deciding to try one out, landed on i3, and haven't really looked back. Would definitely recommend it to an efficiency-minded person.

Also the simplicity of i3 is beautiful. Combine its minimal interface with a few shell windows with opacity=.85 and you've got an incredible looking desktop that's easy to navigate, responsive, and efficient. Even my not-very-tech-savvy girlfriend saw me working in it and said "Wow, that's pretty!"
If anyone has any other handy tricks to help out in these early stages of product development, let me know. :)
Failsafes don't always fail safely. Take the unmanned Chicago subway train that cruised through the failsafes and crashed into another train, two weeks ago. Another article quotes a CTA official as not knowing how it could have escaped the yard without the brakes tripping.

http://www.huffingtonpost.com/2013/10/04/cta-blue-line-crash...
Roger that. I keep thinking of my customer support people as non-technical and for whom ssh keys, port forwarding & bastion hosts are way over their heads but your point is taken. There are other (cheaper!) ways to secure an internal network.
Utterly disagree - massive large scale "protest" is what got SOPA killed.

I have yet to see the cynics suggest a better reasonable course of action.

I also wish that people who have nothing constructive to add would kindly STFU instead of dumping all over everyone else's ideas and enthusiasm. I can think of no better way to ensure things never change.
> I'm not missing the point, and I don't agree that it hides an error and gives a cryptic bug.

It hides the error by carrying on, despite having the wrong number of arguments, and executing code with thus necessarily wrong inputs.

> Messing with a function signature and not updating callers of that function is not a bug in the language, it's a bug in the programmer

When editing code, you routinely change the function signatures of hundreds of functions. Of course you're going to miss some, some of the time. Human errors happen, and good languages help us deal with them.

Also, every time you pull code from another repository, function signatures all over the place change. Some of those may be functions your currently edited code is calling. This means every little divergence requires reviewing every single signature change or cryptic bugs will result.

> and will result in runtime bugs in any dynamic language.

It will result in runtime errors in dynamic languages. Errors that are visible, and difficult to ignore. That means the code gets fixed. UT triggers it trivially.

Whereas with Javascript, even code under UT can easily pass accidentally when wrong numbers of arguments are used.

This Dijkstra quote is relevant:

> It was a significant improvement that now many a silly mistake did result in an error message instead of in an erroneous answer. (And even this improvement wasn't universally appreciated: some people found error messages they couldn't ignore more annoying than wrong results, and, when judging the relative merits of programming languages, some still seem to equate "the ease of programming" with the ease of making undetected mistakes.)

> If you require X number of args, then assert that they aren't undefined

That captures half of the bugs (too few arguments), for a large overhead (an extra line for almost every argument in every function).

> If you presume callers pass in X number of args in a variable args language, and then change the required args, you're the bug, not the language

Every time you change code, there is potential to insert bugs. Of course all bugs originate from programmer errors. The tools can work with us to find these errors and mitigate them, or they can give us hell.
- Package management

- Everything can be done via CL in case of emergency

- Switch terminals via F1, F2, F3... if the GUI terminal (F7) messes up

- Use whatever window manager I want with no hassle

- Most distros recognize hw and install drivers automatically (versus needing a rescue disk to install Windows)

- Develop apps locally using exact same environment used on server

- No worries about losing support for my hw (try installing Windows 8 or the latest OSX on an old machine)

- Option to show WiFi password (why the f can't you do this in windows?)

- Fingers crossed for more Steam games coming soon
For the establishment, when it comes to secular vs. theocratic regimes, the the key factor is not whether the regime is secular/theocratic or really any other type. The key factor is how is this or that regime going to help get cheap energy into the US's hands. They can talk a good game about promoting secular democratic governments in the world, and they have to talk that game, because it's the only quasilegitimate game they can talk, but it's often a lot easier to buy oil from a dictator. If the dictator doesn't want to play ball, they can campaign for regime change, in the name of democracy.
I did a something similar that allows you to search for and graph IMDb TV show ratings.

http://graphtv.kevinformatics.com
I have seen people point to using plugins to verify assets delivered by the server, but at that point, why not just do the crypto with the plugin.
Disable login via password, install fail2ban to help with the extra overhead/traffic.
As a Linux user, what I miss most when I use Windows is focus-follows-mouse.
Specifically, the error I couldn't figure out how to remedy was the line break caused by the included statement that was in this commit:

https://github.com/philipithomas/www.philipithomas.com/commi...