skysight-inc/HackerNews huggingface dataset:
For the last 2 years my investments outperformed DJ by 150% and S&P 500 by 100%. What did I do? Go with the winners! Every January you revise your portfolio and spread the basket among potential winners. Then you wait ... After 2-3 months check to determine loser/losers and dump them in favor of the winner. Bring in from time to time reps from hot areas. I have three specific examples: Auto, Biotech and European Nordic fund. First one is having the true renaissance in last couple of years, I bought a medium chunk of it in 2008 and it gave me 120% growth by now. Some biotech funds are more than 50% since 01/2013. What is there secret? They invest in a well-selected portfolio of companies with pending FDA approvals. If a product goes through clinical trials and gets the approval, that company is growing by the order of magnitude. If it doesn't, oh well, you can write off a single value. For the fund that I bought the success ratio is 2:1, which is great and that's why it's 50% just for last 9 months. And lastly, Europe has been marked as the undervalued commodity and specifically the Nordic geo with gas and oil reserves. The European Nordic fund is 15% in green just in last 3 months. As soon as any of your eggs in the baskets stops performing well, you switch it to your other egg or shop for what's hot now. Just for fun, if you have time and desire, leave a small change for daily/weekly trading to keep yourself busy, but that strictly optional.
I'm not sure where this FICO score rumor started.

Insurance pricing under the ACA can only vary based on your age, zip code of primary residence, and whether or not you admit to smoking tobacco.

See: http://www.acscan.org/pdf/healthcare/implementation/backgrou...
+95% of the article is about physical/hardware constraints: energy efficiency, architectural efficiency, etc. Haskell isn't going to solve these problems. Let me quote you: "I have the solution!"

It seems like you want to advertise a tool, instead of actually considering the issues.
Why Putting SSH On Another Port is a Good Idea
Oh I don't blindly believe what Google says either. Google is hardly the only one in this game. There many analysts in this field thinking the same thing. This is already going to affect toll roads being built in the next few years regarding risk propositions. The risk proposition will change. Go and talk to people at the Transpirtation Research Board next year. This is not just Google starry eyes but very serious.
Is there a good discussion site for books like this? ( Since I will probably not read anything, let alone the entire book before it is vanished from the HN frontpage.)
Yeah, thanks for that recipe. I've been drinking those shakes for a week or two now, and I think I feel better.

The recipe, for those who are curious:

- 1/2-1 cup raw oatmeal

- 1-2 tablespoon(s) peanut butter

- 1 scoop whey protein powder (I use Gold Standard Double Chocolate)

- 1 tablespoon flax seeds

- 1 banana

- 1-2 cups milk

Blend the oatmeal and flax seeds into small bits before adding the rest, then add the rest and blend. Chocolate-banana-peanut butter taste, and a pretty good mix of nutrients.
Yeah, yeah, IPO is coming, we know.
There are plenty of unassigned ports below 1024 that you could happily use without theoretically stepping on toes, why not use one of them? Further down the page there are several people stating tangible benefits for moving off port 22.
My guess is that the teenager/young adult demographic is highly coveted by advertisers because they tend to have disposable income (gross generalization) and are the most vocal/enthusiastic customers. they can act like 3d billboards for whatever they happen to be into. idk just a guess
An example might be a pet peeve I have with Windows: its tendency to 'discover new hardware' when one plugs a bog standard mouse or keyboard into a USB port for the umpteenth time. That in itself is baffling

It's not baffling, it's manufacturers implementing USB standards improperly, and Windows doing the least-bad thing.

http://blogs.msdn.com/b/oldnewthing/archive/2004/11/10/25504...
Oaks are so beautiful and grow so quickly. Definitely my favorite tree. Hardwood trees will grow to have wider canopies so that plot size definitely makes sense.
Regardless, it can be hard to pack enough protein and calories away for that kind of nutritional load if you're not constantly eating.
Right, adding obscurity doesn't decrease security. It might help... worst case it does nothing.
Steps You Can Take Right Now Against Internet Surveillance
ActivityRez launches new website for its tour booking platform
"Under more conservative (realistic) assumptions, multicore scaling provides a total performance gain of 3.7× (14% per year) over ten years."

so in 10 years haskell maybe as fast a C/C++ program without parallelism, not exactly my definition of future proof.
What OP points out is good for starters but If you were really serious about security, you'd be locking your servers behind VPN and 2 factor auths. Cloudpassage.com does a pretty good job for locking down your servers for truly serious.
NSA Boss Says US Gov't Needs To Stop Journalists Reporting On Snowden Leaks
It wasn't a molten reactor core that was being put out, but burning graphite control rods. The molten reactor core wasn't good, but it was a relatively local problem compared to the smoke from the burning rods escaping into the atmosphere and getting carried by the winds.
209. NSA Boss Says US Gov't Needs To Stop Journalists From Reporting On Snowden Leaks (techdirt.com)

4 points by 001sky 52 minutes ago | discuss | edit | delete

Flagged to #209 on HN, while still on #14 on the New Page.

http://www.techdirt.com/articles/20131024/18093325010/keith-...
I mashed together the best parts of hackerwebapp and hckr news:

http://hn.leftium.com/
It doesn't run on EC2. It runs on Google App Engine:

xyzzy:~ harryh$ host www.snapchat.com
www.snapchat.com is an alias for ghs.google.com.
ghs.google.com is an alias for ghs.l.google.com.
ghs.l.google.com has address 74.125.29.121
ghs.l.google.com has IPv6 address 2607:f8b0:400d:c04::79
Inside the CVE-2013-3893 Internet Explorer zero-day – Part 1
This is an awesome templating engine. I have heard about so many javascript templating engines, but not this one before, despite the fact that this appears to be better than all of them.
Red is nothing more than a marketing gimmick.

Apple has >$100 billion cash sitting overseas, unable to return to the USA to be distributed as dividends unless they can successfully lobby for a tax holiday.

If the board of directors and executive leadership of Apple truly wanted to help poor people in Africa, they could simply call a shareholders's meeting to vote on a proposal to donate, as an example, on an ongoing basis 1% of offshore (ex-USA) net profit after tax to a recognised pan-African charity.
I can't say for sure it would help in any useful way, but it won't reduce your security to run ssh on port 1023.
However fab process shrink is a very expensive endeavor and the article argues that: "We may stop scaling not because of the physical limitations, but because of the economics."

So while for awhile now we knew we were going to hit the physical limitation of silicon at some point, the reality might actually be even worse because due to dark silicon and the economical constraints it imposes, there may not be enough incentive to keep shrinking.
What in particular didn't you like about it?

I know it wasn't a perfect device, but most people seemed to love it when it was originally released.
I don't get it -- most of the transistors I administer are off at any given moment, way more than 50% of them. If there's heat-density issues, can't they just pack some nice relatively-cool DRAM and flash around each core and improve my bus bandwidth/latency situation?
It might actually decrease security, as it gives a false sense of security and people just take it as their only security measure in the end. Give them obscurity and they feel secure. There are countless examples of this, I don't believe I need to give some here.
To activate the credit cards? I'm pretty sure you don't - you just need to plug in any old address and phone number online which aren't verified (at least with the gift card ones), kind of like a burner cell phone.

You might need to get European cards, though, and I'm not sure how they work over there or how easy they are to get.
Your algorithm is making decisions on data that's 50ms older than the data the other guy in the ocean used, I suppose. I'm not into low-latency trading enough to know whether or not that 50ms-ahead data alone could make you money, but based on how much the trading guys go nuts over it I assume it could.
> So running SSH on a non-privileged port makes it potentially LESS secure, not MORE. You have no way of knowing if you are talking to the real SSH server or not.

Of course you do: the SSH host keys. They are an integral part of the SSH trust model. If you blindly accept any host key thrown at you, for a machine you didn't just boot for the first time, then nothing can help you as you can easily be man-in-the-middled even if you are using port 22 (say from the cafe wireless you are using).
It's a bit of a counterfactual, because startups with large traction having difficulty monetizing don't typically go bankrupt, but sell

Interesting side or foot-note was that myspace went from 600m to 50m, first purchases (enabling vcs to exit) and then disposed of (by its BigCo purhaser) after not monetizing.
It's like being forced to live in a small town. Some people (actually, I'm betting a lot) can't deal with it.
I agree for a few select industries like healthcare and finance, but explain Square, Airbnb, Pinterest, Uber.
Hell, passwords and keys are just obscure strings.

Security through obscurity is only a problem if it's the only security.
It cleans up your log files, that's why I do it. If you run ssh on port 22 your log files with be full of script kiddies with turnkey exploits spamming every IP address they can find. Change the port and suddenly that the logs get much, much quieter. So it's not really a security technique, it's a convenience technique.
Obscurity is only a poor security layer if it's used as a substitute for security instead of a supplement.

http://www.danielmiessler.com/blog/putting-ssh-another-port-...

Camouflage on tanks doesn't remove the armor; it just lowers the chance that it'll be needed.
That's called the "dark text problem." ;-)
http://www.danielmiessler.com/study/security_and_obscurity/
Do American Schools Need to Change?
So this whole ordeal is pretty confusing. State law says that the public is allowed access to the coast below the median high tide line, but it does not necessarily give you the right to cross through private land. So technically, you could boat or swim over to Martins Beach and you wouldn't be trespassing. However because the previous owner allowed public access (for a small fee), I guess he set some precedent to access which is covered by state law (although apparently treaties with Mexico supercede that).

To make things even weirder, there are a bunch of cottages/houses on the property that are being leased to occupants (this was done by the previous owner). From what I understand, they have a few more years on those leases before they can be evicted (I am very rough on these details). So if you know someone in those units, they can hook you up with access to the beach (I think).

Bascially, it's a crappy situation for everyone. I get that Khosla wants some private beach front property to dump his money into. And really, the previous owner should have set up an easement (easements are the primary reason Malibu is still publicly accessible), although he probably would have got a much lower sales price. And of course, if Khosla gets his way, the public will be getting screwed over pretty bad. With the growing population, beach/coastal access is getting harder and harder (try going to the beach on a warm, sunny weekend, it can be a parking/traffic nightmare). Reducing the number of coastal access points is just going to make things worse, and it is going to continue to have an impact on the next generation of Californians.
How is it expensive? Local farms market for fruits/veggies. Some meat shop/costco for meat in bulk.
Here's my response to this, point by point:

http://www.danielmiessler.com/blog/putting-ssh-another-port-...
I tried all the of Chrome extensions mentioned in this thread, and this one is the least obtrusive. I like it.
I currently live near D.C. and absolutely hate the public transit here. I could list a laundry list of the problems, but honestly, compared to SF it's like a euphoric utopic vision of perfect public transport gifted by a benevolent god.

D.C. has many similar problems like S.F. (NIMBYism, weird property issues, right of way, long commutes) with the added fun of having to work with three different State level territories (VA, MD and DC) to get anything done.

Honestly the gold standard in the U.S. for public transit is NYC, and I love when I'm living/working there (which are far too short and far between), but let's be honest, NYC's public transit isn't really all that nice. What it is is comprehensive and not ridiculously expensive. At least as comprehensive as any major European city and less than half the price of the D.C. system on most days w/r to fares.

But really you can visit any major European city and find a transit system at least as good as D.C.s...which is the second busiest in the U.S. and 3rd by length. Visit Asia and have all sense of what a good system is blown right out of your mind.

The level of quality in the U.S. mass transit system is really inexcusable. A nearby system, Baltimore's, is so bad that, despite living just a couple hours away for most of my life and having visited the city numerous times, I wasn't even aware the city had a subway system until a couple years ago - it's virtually invisible.

If you consider that D.C. is bottom of the barrel then by European and Asian standards, S.F.'s is just a bad joke.
>>Not "I'm a wannabe entrepreneur" -> "I have no domain specific expert knowledge" -> "let's randomly find something we guess people care about and overspecialize" -> start coding blindly or find a Rails dev on Odesk. Seen that one fail innumerable times.

What kind of domain specific expertise did Mark Zuckerberg have when he wrote Facemash (Facebook's predecessor)?

The answer is "none." It was a pure hobby project - he didn't even plan on monetizing it. Yet here we are.
Thank you. Everytime I hear someone say that I cringe. So sick of hearing it. It's useful, just not the only thing you should be doing.
From The Mind of John McAfee, Future Tense Central
I think a strong argument could be made that they're still there, they're just non-notable:

http://en.wikipedia.org/wiki/Grigori_Perelman

As a primary example - I'm pretty sure he knows better than to become famous for his work.
The saddest bit of all of this is that global warming will derail any AI future breakthrough
So many problems with this article, it's very hard to take seriously. Let's start with not giving us reasons to protect the innocent. Oooh. Scary! He must be a real pro at security! He's keeping secrets that are too valuable to share! Please.

Next, he talks about anyone setting up a script to listen on a non privileged port to collect passwords. Okay. So, are you saying I shouldn't connect to your server then? Because if I set MY server's SSH port on 2222, I'm not worried about anyone collecting passwords on MY server. Unless they have root. Then I have bigger problems, and they can also collect my password when logging on to port 22.

Also, security through obscurity is hardly useless. Sure, don't use it as your only security defense, but it does have value. Obscurity means hiding something of value from plain sight. Can you find that object? Sure. That doesn't mean stealth is pointless. If so, we wouldn't have camouflage, stealth bombers, and the NSA. Stealth can be be valuable.

Lastly is keys over passwords. Again, unless you have root on the box, you're not getting the login password without brute force, or some protocol vulnerability. And, if your password is weak, what makes you think using keys is any stronger? First, you can create SSH keys without encrypting it with a password. If you choose to encrypt it with a password, what makes you think that password will be any stronger? Sure, remote password brute forcing us infeasible, but scanning Github for private keys isn't. What's one server versus another, unless you're targeting the user?

No, this article isn't thought through.
Yes, unequivocally a genius. I would also put DJB up there.
Well, just wrap your whole body in aluminum foil ... Is this serious? Also what stops this from going into non autonomous cars, the tracking bits, anyway?
Security through obscurity is not to be avoided outright, using only security through obscurity is to be avoided outright. If you have an otherwise secure system and then you obscure it in some ways, the worst that can happen is that it has no effect. So the problem is in thinking it alone will protect you, but it is not harmful in itself.

I think people throw this phrase out because it scans nicely and makes you sound like you know what you're talking about, especially to yourself.
Filesharing site revealed to be anti-piracy ‘honeypot’
The idea of a bunch of non-citizen engineers working (and living?) in a windowless floating cargo container doesn't seem to me to be something that would be a great idea, PR-wise.
> Frankly that sounds like a great task for editors that aren't subject experts.

I disagree. Hunting citations doesn't take specialized knowledge, but it does take time. I doubt that the ratio of editors to article churn would sustain them being responsible for hunting citations.

I think that's really the core of most issues with wikipedia: neither side has the time. Individual contributors don't have the dedicated time to comply with all quality-control policies themselves, and editors are spread too thin to provide any feedback beyond quoting chapter and verse.
To be fair, the worst thing someone could do with your NSLSC password is pay off your student loan for you. ;)
> This would mean the White House Communications Agency has to carry such a secure base station wherever the president goes.

If they're already doing that, the rest of this seems a bit silly. Why bother with a cellular-modem connection at all, if you're just going to route it (presumably using a 4G picocell) back out over IP? I can understand the custom encryption, but you can do that just as effectively over wi-fi.
Ouch, camouflage on a tank is a good analogy. Nice response post.

In addition to, as the author encourages, being "weary of the 'by obscurity'" argument (as I'm sure we all already are), I would also advocate being wary of it :)
It sends a notification back to the sender if you do that.
> If you are, then the author is 100% correct that it is not a good idea to run a SSH server above port 1024, or any port other than 22.

Ok, but you haven't explained why. The author's stated claim is that running an SSH server over 1024 means the connecting party cannot trust the server, but that of course doesn't apply if you are running the server.

If you want to truly secure your server, then yeah, changing the port doesn't really do much but there are some minor benefits (see other responses in this thread, and on the internet). I'm still not seeing the harm.
> We camouflage tanks. We build stealth fighters.

A lot of the army forces are wearing camo fatigues 100% of the time while in combat zones, I'm sure they would have a lot to learn from you.

Sarcasm aside, security through obscurity is not very useful when it's the only defense vector used but it's very important when it's part of a multi-angle defense. The more hurdles you put on the path of hackers, the more time you buy to defend against them.
SEEKING FREELANCERS URGENTLY - Sydney, Australia - No Remotes
We are looking for a gun Ruby or Java developer, seeking to use their talent to help a focused airline team develop a services layer to facilitate authentication and secure access to corporate information.
Work to include interaction with social login and Single Sign On components provided by Janrain. The services layer will be deployed in the cloud with integration back into corporate systems.

- You will be fluent in English and be able to confidently communicate.
- You will be very experienced in the development of web services.
- You will be delivery focused and have the opportunity to influence the approach.
- Your experience, enthusiasm, innovation mindset and commitment will be rewarded.

Initially your presence will be required at the office in Sydney, however; demonstration of experience, understanding of requirements and deliverables will minimise onsite time.

The contract length is expected to be 1-3 months.

Contact us by email to recruitment@7skies.com with your location, skillset, portfolio link and remuneration expectation.
a) Nobody doing this expects that it will increase the difficulty of cracking the server via SSH, or at least nobody I've talked to does it for this reason and I certainly don't.
b) Since when is the uid that started a process a form of authentication?
c) Who cares what the default settings are for most SSH clients? It's trivial to put it in your config file and forget about it.
d) Using port 443 for SSH is a legitimate use to get around firewalls/traffic shapers.
2. Next he talks about this non-root listener issue. He
claims that you shouldn’t run your SSH daemon on a
non-privileged port because anyone can spin up a daemon
up there. Great point, except you can still do that even
if you run your main one on 22.

I don't think I understand this point at all. What is it that you're trying to say?

Are you sure you understood the original post's point?

djc@capelis.dj:~$ nc -l -p 14
nc: bind to source :: 14 failed: Permission denied
nc: bind to source 0.0.0.0 14 failed: Permission denied
nc: failed to bind to any local addr/port
djc@capelis.dj:~$ nc -l -p 1414
^C

See the difference?

(Edit: The original blog entry has now been edited to slightly clarify the wording. But the update mostly seems like an attempt to rapidly justify the author's original point.)
Google knows your searches, and I am pretty sure google knows every site you visit, via google analytics, which most sites run.

Combine this with browser fingerprinting (your browser's fingerprint is incredibly unique), and the fact that you probably have a google account. There is a high probability they know who you are. From your history they can determine if you're human or not.
http://www.edmunds.com/tco.html
At some point in the future, someone who decides to drive manually and gets in an accident may be liable for much more than they are now.
It is illegal in the US for a company to collect information from a child under the age of 13. COPPA.

That is why the TOS are all what they are.
That was very fair response. Kudos for being able to attack the points, not the person.
Rebound, a java library to model spring dynamics in Android UIs by FB
Rust Front-End to GCC
I said above 1024 and picking on other than 22 is just Security Through Obscurity. I can banner grab you in less than a second and figure out which port is running an ssh server. If you really want to then go for it. But above 1024 is a no go.