skysight-inc/HackerNews huggingface dataset:
He's right that "security by obscurity" isn't the entire story -- it's more like a mnemonic device for the more complex idea that:

1. In the real world, security resources aren't free.

2. Security decisions are made by users.

3. Humans will engage in risk compensation [1]

4. Setting policy doesn't change people's brains, it just tells them what to do.

5. It doesn't matter what you intend, it matters what users actually do.

The upshot of this is that any security policy that is highly visible and highly inconvenient will reduce your security, and has to have a substantial benefit to justify its cost. You can say "I'll do stupid port reassignment tricks, and I'll also mandate that passwords are forbidden, and require that private keys be managed properly" but at three in the morning when the whatever is overdue and not working what you're gonna get is:

I'll just do password auth with root:root, nobody ever hits port 24601 anyway. Besides, look at this page [2], using a strange port makes me invisible like the Predator and makes me four thousand times more secure! I really want to believe this so I do.

Also, subverting scanners is an anti-security move, not a pro-security one. Scanners are a helpful tool to identify what the hell is running on your network. Your security efforts have to find every hole, the bad guys only have to find one. Don't put yourself at an even bigger disadvantage by making your systems harder to analyze.

[1] http://en.wikipedia.org/wiki/Risk_compensation

[2] http://www.danielmiessler.com/blog/security-and-obscurity-do...
I'm baffled as to why anyone would want to live off what is essentially tube-fed hospital food. But without even the benefit of medical expertise and monitoring to ensure safety.
I actually think this is a pretty substantial find, not just gossip. They're moving on a really cool concept.
The Other IPO Roadshow: Design Your Product To Attract Fortune 500 Enterprises
Biotechnologist here....As I see it there are three options:
1. Uptake of the thermic energy by an endothermic chemical reaction (like http://en.wikipedia.org/wiki/Instant_cold_pack)
2. Passive removal of the heat with a heat conducting material (you have to get rid of the heat somewhere else)
3. Active removal of the heat (see http://en.wikipedia.org/wiki/Cooling_vest)

I think thermoelectric cooling (http://en.wikipedia.org/wiki/Thermoelectric_cooling) would be suitable for your application. It is also compatible with Arduino technology I think.
Yup, the question is whether or not the treaty trumps California law otherwise it would have worked exactly that way.

I like the idea of working out a 'patch' to the treaty, although I don't think I've heard of that ever happening in practice, new treaties yes, but patching an old one not so much.
1. Car design, interiors: get rid of pedals and steering wheel, have a touch screen (possibly your phone) for communication. Cross an elevator with a tiny lounge, have a single central sliding door or whatever.

2. Insurance companies: basically, they operate on a margin over the volume of business. Which will go drastically down.

3. Switch over: I'll bet it will be more sudden than anticipated. Think "cash for clunkers", "buckle up your safety belt" and "dont drink and drive" programs all rolled up in one and magnified tenfold. Anything to get the murderous unsafe machines off the roads.

4. The smug, withering, contempt of news writers in twenty years will be something to behold: how could those primitives allow themselves that awful road carnage for so long?
I'm surprised how large some of the transactions are on that list. 134 Bitcoins just dumped into the government's pocket in one transaction? Am I reading that right?
I wonder if they're taking this approach because it's modular. You can add more barges and shipping containers a lot easier than another cruise liner.
so you are affirming all the network the white house used until obama's blackberry was not yet vetted?
A lot of people don't seem to get Snapchat, so I wrote a blog post about it here: http://www.brianchu.com/blog/2013/09/11/photo-embarrassment/.

Have people actually met/seen others using Snapchat? I'm in college so tons of my friends use Snapchat regularly (about every couple of hours). Snapchat is essentially used for picture messaging of frivolous images, almost like a picture-status-update of something funny or current. Nobody I know really uses it for "dirty" pics, though unflattering pics (of yourself or others) are fairly common. It's almost a foil to Instagram - Instagram encourages you to post by making your photos permanent but beautiful; Snapchat encourages you to post by making your funny/ridiculous/unflattering photos ephemeral. See the difference? It's ephemeral vs permanent, funny/ridiculous vs beautiful.
Ask HN: Relevant Search Suggestions
Hi HN,

We're trying to improve the search suggestions on our ecommerce website and wanted some tips. Until now we were using existing set of search terms to use as a data input for suggesting. However, as it is obvious it quickly became irrelevant when people started searching for products we don't sell.

Now, we are planning to use product names for search suggestion, but as we've seen in other sites (amazon, zappos, flipkart) search suggestions are typically not the product names. For ex. typing "ipho" gives a search suggestion of iphone 4s, iphone 4, iphone 5s, iphone 5 cases, iphone5 cover .... and so on , whereas typically the product names are "iPhone 4s Black - 16 GB". Are there any suggestions on how one could accomplish the same?

Thanks!
> Those that want to get money with the free work of others, should give something back and most authors do offer commercial licenses when asked for.

Have you ever considered the fact that it's not all about money and proprietary software? This affect Open Source software as well. If I want to allow other to do as they will with my code, I won't touch a library with such a viral license because I don't want to subject myself or my users with having to even think about it. Also, have you considered...

> With licenses like BSD, the living proof is that most companies are leechers.

That's not a proof of anything... The same license you cite is a living proof that most[1] companies and regular people will contribute even more than they have to without you having to force them to do anything.

[1] most, for some definition of most, because if a company of individual have neither the expertise nor the resources to contribute, then what good does restricting their use of the code achieve? (rhetorical question)
because cellular data connection was written in the approved requirement.
all usa ones does that under sox when required by court. or something close to that...
There's been chatter from the lead developers about tagging coins as tainted. Not so much over these coins as for coins that for certainly stolen.

It's something that really would have to be done in the client, and for it to work everyone would have to agree to use the "official" client (or code derived from the official client).

My suspicion is that it would actually make client fragmentation more likely as there would be a clear financial incentive to deviate from the standard.
I did my mom's website for her small law firm and I was getting tons of bots even with hidden form fields and they didn't look targetted. Captcha helped a lot but the spam didn't stop until I used both combined with special rules, like the phone number field has to have a certain amount of numbers.
Light your work area with full spectrum light bulbs. Simulating outdoor light helps with eye strain. I can't code without them.
That's what file system permissions are for, on the private key.

(I might be wrong about this, but...) I've seen quite a few instances where SSH refuses to let people even try to log in if there's a chance that a private key has the wrong permissions applied, so as to minimize the risk of someone accidentally letting others read it -- as you suggested.

You'll find the default SSH config on the more noteworthy Linux distributions to do this 90% of the time time without even asking :)
There is also the option of alternative substrates, such as graphene, carbon nanotubes or doped diamond.

Diamond could operate at higher temperatures and frequencies (giving us better single-threaded performance again). Graphene would be more suited to the current manufacturing process. I don't know much about nanotube processors other than that they are in research too.
Was there a point in time when cars was outselling bikes in Asia?
Sure, if you have no context; Friend and I are totally aligned on what we think of the current state of the int environment is.

We work in tech. We share same aversions to certain activities.

He's talented IT guy, companies interested; had offer from several SV bigco's - had offer from this company as well, which we talked about in depth. He ended up making a different choice - and then later I had told him what I stated in my OP; the context and the parties between which this conversation happened; it was funny.

The core of the sentiment though is not: I personally am against companies which built their core business on supporting the surveillance state.

A lot more can be said on that topic; debates over proper use of tech, where lines are drawn, define core business, these problems apply to all industries, etc.

But the fact remains that there are companies who services are more greatly leveraged by the surveillance state. This company is one of them. I don't support them.
The person who "has more invested" in something, is the person who values it more. "Having more invested" is a particular idiom in English.

What you are talking about is "sunk cost."

So, in a given relationship, the man or the woman could value the children more.

In a given relationship, the man or the woman could value sex more.

It's not true that all men care less about (i.e., value less) their children, which is what you said, though I don't believe you meant it. That's why I said your statement was biased against men.

I don't see how the generalization "women are more invested in sex" in either your interpretation of that phrase, or mine, would be correct.
Per my understanding, there's less concern over unifying, say, the strong and electroweak interactions. You have to posit some ridiculous coincidences to explain facts like why the charge on protons and electrons are exactly opposite, but nothing whatsoever prevents you from doing so. Then you get separate, compatible theories describing separate domains. That's basically what the Standard Model is: QCD + electroweak, agglomerated as separate interactions, not unified.

However there's better reasons to be concerned with the relationship between general relativity and quantum mechanics. The problem is that while their domains are generally separate, we know they must intersect in cases like black holes or the early universe. And in these scenarios, the theories produce incompatible predictions, leading to issues like the black hole information paradox.

Physicists are very interested in any theory of gravity that makes predictions compatible with quantum mechanics. Some of the contenders unify with the other forces (string theory) while some do not (loop quantum gravity). A unified theory would be huge, but a non-unified "agglomerated" theory that nevertheless makes a single, unified prediction would be almost as exciting.

So the answer to your question is that popular physics writing often uses "unification" as a shorthand for "unified prediction" rather than "a single interaction." That's what this article is doing: the referenced Wheeler-DeWitt equation is NOT a unified theory because it does not explain QCD or electroweak.
This is a very valid point and a good reason to choose a port in the privileged range if you use an alternative port for SSH. I wonder, though, what is the worst it can do if you don't use password authentication? E.g., to offer you a fake shell and try to capture your sudo password a rogue daemon would have to have access to your public key, which as an unprivileged user it shouldn't.
But, still no backup? Files only exist in Google Drive, and no where else?
Here is a C implementation I just banged together.
http://www.quelsolaar.com/crypto_test.c
(yet another possible source of embarrassment)

Ill try to put together a "test" for the algorithm.
ummm... i thought the "new" button up therer did exactl the same thing
No, they couldn't. sshd usually runs as root* so it can create shells for in user that's logging in. Therefore, only root could kill the daemon. Also, as mentioned by the sibling post, its configuration files are usually(if not you have a serious problem) only writeable by root so nobody else could modify them.

* Note, I guess you could run an sshd that only allows logging in to a single user and runs as that user but both points above still stand even in that case.
I don't name a specific model, because if you buy a monitor which is not the cheapest of the cheap it doesn't make that much of a difference, just a couple of tips:

First make sure you have a monitor with a quality panel - no TN. If its IPS or some S-PVA/P-MVA doesn't matter. Maybe take a look at different panels in a shop. I am personally very happy with my MVA-Panel monitor because of the good black levels. Try to avoid glare panels AND glare frames around the panel.

Next, make sure the monitor can be adjusted, not only in height but also tilt. I found that really useful adjusting the monitor to my seating position.

Regarding eye strain, the most common cause of this is setting the monitor backlight too high. Especially with LED backlights. Even in a normal lit room I only have set the backlight to around 10%. You may need to get adjusted to this first if you are used to normal settings (e.g. the default settings of the monitor which are always way too high), but for me it helped great deal with eye strain and headaches.
>it could not justify the big investments that are required to create a new process.

Not yet, perhaps. New processes are effectively guaranteed to be needed at some point though.
Is there a way to increase the privileged port range from 1024 in linux? If it's set to a high enough number, say 1024*1024, that would solve both problems (we could use a large port number for ssh and not allow non-root users to hijack the port).
So you're saying that only good comes from "social technology" while mixed things have come from "high technology", so working in social tech is "morally" better?

I think social technology has enabled the surveillance of more people than ever before in history - a more than mixed bag. Not only that, new graph theoretical approaches that come from Facebook, Google etc. can easily be used to track humans using non-social technology, as well.
Depending on what phenomena a set of equations describe, if the equations break down at some point it becomes of interest to figure out the reason. The situation cannot be ignored because it hints that the phenomena may not be properly understood.

The equations of general relativity do not hold on the quantum scale, and those of quantum mechanics cannot be used when gravity is large. This is a break down. The bridge between the two could be unifying the two
"worlds" or have a damn good reason why not. Nature has a good motivator for unifying called black-holes. Inside black-holes you have large gravity and also quantum scale stuff that has been eaten or squished together or just tiny space.

It would be rather difficult to solve the black-hole problem starting from scratch, as black-holes arise out of general relativity equations. So you start from quantum scale and cross-check with the other end or vice versa.

If you are weary of the word "unify" from a philosophical perspective, then it may help to realize that the word unify comes to apply because we (humanity) have discovered and built up more knowledge from imperfect bundles.

Suppose in 1906 (before quantum mechanics or general relativity) Einstein had come up with some universal theory/model that inherently worked everywhere, it probably would never have been termed as a unification theory.
There are indirect scanning techniques that induce and measure traffic from ordinary non-compromised hosts. When the attacker notices that he gets banned for scanning he'll do that.

http://nmap.org/book/idlescan.html but IIRC there are more ways than this to do it.
It is true https://twitter.com/search?q=uses%20AND%20facebook&src=typd&...
Could a non root user just read the host keys from sshd,

No, file permissions.

then kill it and serve them?

Users with uid != 0 cannot kill other user's processes.

Or could it even just MITM it?

No, host key verification ensures that you are talking to the intended ssh daemon without packets being intercepted. The host key is a public key of the SSH server, which is verified by the client to be the key registered for that particular host. Since only the server has corresponding private key, the MITM cannot eavesdrop on the key exchange.
Thanks! Its been driving me crazy to try to crack it. It cant be this easy right.....?

I thought a lot about the possible starting point for the algorithm, but i found having it just be "unknown" like this was all that was needed. A test to make sure, pos_a, pos_b, pos_c are never the same might be useful. The code obviously needs to be fixed to modulo pos_X never to be larger then the key size.
Wikipedia could add a category of academic editors whose identities have been verified in some way with their institutions, and who meet some definition of subject area expert. These editors would be given a presumption of innocence by other editors, so their changes should be researched for citations, rather than reverted.
Sigh. If you bothered to read the article, then you'd know that it doesn't say anything about donating to the EFF. There isn't even a link in the article to donate.

All last point asks is people to support Stop Watching Us rally and other campaigns against bulk spying, run a Tor node, or hold a cryptoparty.

Your comments on surveillance tactics/hunger/climate change is just bringing up irrelevant arguments, so I won't address them.

P.S. Sorry to go on a rant, but I miss the days when people actually RTFA. (aka never gonna happen).
How would you go about this? Obviously the key is smaller then the message (otherwise we would use one time pad and be done with it) The key needs to be large enough that A, it cant be guessed, and B so that the branches of possible positions in it quickly becomes unmanageable.
'Offers In-App Purchases' and new iOS 7 receipts
For one, we could start programming efficiently and natively again instead of going through layers of interpreted languages and abstractions. Also, shared-nothing architectures are still scaling well for many workloads.
from selling two productivity related products I often run into customers telling me "Revenue, Cost, Productivity" is the priority and productivity is a long way behind cost, so I fingers crossed you have a cost or revenue idea :-)
I agree with your comment, but the ASCII art is out of place on HN.
Inside Julian Assange’s Alleged Plot to Steal The Fifth Estate Book
To give you some pointers to the literature, you are trying to create a stream cipher here. (See https://simple.wikipedia.org/wiki/Stream_cipher)

As always, it's terrible easy to create an encryption algorithm that's complicated enough that you yourself can't break it. That doesn't make it safe. (It might still be a fun exercise for you.)

Have you tried breaking any ciphers, yet? Even obviously weak ones require some thought to break.
Simple answer -- There are situations (like black holes, or early universe physics) where gravity becomes very strong and important, and so do quantum effects. To understand physics in those regimes, we need a consistent way to put together gravity and quantum mechanics.

The explanation that gravity corresponds to the physics of the large scales and quantum mechanics to the physics of small scales is not quite true -- this description applies in our daily experience, but is not always the case.
Interesting.

As a world expert on some topics (Machinima filmmaking) for which the primary source of some relevant information resides largely in my head, I was wondering if this was the best way to approach Wikipedia edits. Thanks for the info: I may actually make some contributions soon!
I agree with the sentiment of your post, however, I'm not sure if for the kind of user who would put a root:root shell on port 24601 the alternative in the absence of the article [2] wouldn't be putting the same shell on port 22. The former at least has a better chance to stay uncompromised until somebody comes in to fix it.

Edit: I also wonder if a passwordless root Telnet would last longer. :-)
What would improve the tone of discourse is if every time someone posted a GPL'd project, the thread didn't fill up with entitled jerks whining about the terms under which they've been offered free stuff.
And take steroids.
> the library is unusable with this license

No, it isn't. I can use it. So can millions of others. That you can't is most likely the fault of shitty lawyers. Not the authors' problem.
I'm not sure what you'd have him say.

McDonalds is surely turning aways scads of customers by not providing their food for free.

Certainly there are many things Wikipedia could do to be more welcoming. But not permitting editing by others and/or paying people to edit are not within the Wikipedia model any more than McDonalds giving away all their food would be.

There is nothing wrong with being polite but firm about what something is and what it isn't.
But what if you don't care about building reputation, and you just want to comment on something that desperately needs a comment (50 points required)?
Amend the title to include (if you run only one SSH daemon and you're the only one who needs to access it).

Then I agree.

Otherwise, hell no.
This is just nuts to me. Why aren't people doing one of the simple joys of life - cooking and eating delicious food, even simple recipes can result in really delicious food. Come on people, get back to basics!
Comments are only available at 50 reputation points (or some number requiring a large number of previous reputation building actions), which a new user wouldn't have.
No adblock installed? It's just a one-of-many-of-its-kind boring forum when I clicked on the link?

Also; fucked up shit; I guess you are talking about 'normal' modern porn? Where they let 20somethings look like 16-18? Or it is something else / worse?
I thought Wikipedia wanted secondary sources (i.e. newspapers, journals, textbooks, biographies) that have reported on primary sources (individual papers, original research).

I also thought it was frowned upon to cite your own research.

Have these positions changed?
An open game standard: all indie under a single star
I think you could insert any large system (Facebook, bigcorps, governments, etc.) in the place of Wikipedia in your comment and it would be accurate. What can be done about it?
Bing ads are surprisingly not terrible.
I don't see this as a good/bad/moral calculation. I see it as a practical calculation. We don't need to go into the moral domain when the cause and effect domain is capable of completely outlining the problem.

Working on high tech is dangerous as long as the world is run by warlords and the USA is a surveillance/police state. The last several rounds of high-tech have been utilized by a dynastic, authoritarian power-class to make the world a more horrible place while benefiting themselves, their families, friends, and other cronies.