skysight-inc/HackerNews huggingface dataset:
If professional scientists do genuine and not so genuine mistakes, imagine what programmers (who are generally clueless about statistics and theory of experiment) do with benchmark numbers!
It's not unusual for the baseband to control the application processor's boot sequence. Quite a lot of phone unlocking/rooting/jailbreak exploits go via the baseband.

I don't think baseband exploits exist for iPhone 5/5s

True, but that just means that people haven't broken into the baseband yet, not that if the had done that it would be impossible to break into the application processor.
Also, I think that "putting a roof over someone's head" and "putting a roof over someone who US government really wants to get" cost slightly different.
The rat does concern me. From the video they have a huge warehouse and 95% of it is for kickball and interviews. They mix they shit in a room Dexter wouldn't even kill in. Why not mix it in someones kitchen? It would be cleaner, mine is.
He lives in Russia.
completely agree, it's long overdue.

hardware manufacturers should be less concerned about what their firmware reveals about their IP and more concerned with what not revealing their firmware source code reveals about their security.

the fact that you can get DMA by compromising _any_ device on the bus is a problem too. imo, none of these peripherals should have unmitigated DMA.
HGST Ships 6TB UltraStar Helium-Filled Hard Drives
Bad execution plans are almost always the result of a missing or incompatible index, bad table statistics (corrected by running ANALYZE) or bad server configuration (corrected by adjusting memory parameters and cost parameters).

The query planner evaluates multiple query plans, and chooses the one with the lowest cost based. If that results in the wrong plan, you should attempt to correct the query planner input (that is, the statistics and the server configuration, and possibly the tables and their indices) so that it can better evaluate the possible query plans.

EXPLAIN is a great tool to debug query plans.
> applying pretty much any "software building codes" to the web app industry would probably kill startup culture entirely.

Not necessarily. To use the analogy with the building industry, there are different requirements depending on what the building will be used for. Startups holding or processing financial information might have one set of regulations, whereas those hosting cat pictures might be less rigorous.
The bit that helped most from the meteor post was this:

Well, the typical way that closures are implemented is that every function object has a link to a dictionary-style object representing its lexical scope. If both functions defined inside replaceThing actually used originalThing, it would be important that they both get the same object, even if originalThing gets assigned to over and over, so both functions share the same lexical environment.
How would you get around the unreliability of clocks in VMs?
Seems like deploying Riak in the cloud could be problematic.
'gaslighting' - we don't use that term often in the UK, looks like a good word though... Please can you explain what that word means in this context. Thanks!
> Let alone the instructions/warnings/risks, I know many Android users who barely go through the permissions they grant an app during installation.

There's a reason for this. I do go through the permissions that apps ask for, which is why I end up never upgrading any apps.

The hugest problem is that the permissions are all ridiculously open-ended. There are apps that ask for permissions there's no reason for them to have; that's not what I'm complaining about here. I've installed apps where every permission they ask for is something they obviously need in order to function at all -- or, I should say, includes something they obviously need in order to function. The permissions are so inclusive that every app is allowed to do terrible things if it's able to function at all. This isn't an improvement over the windows XP model of "everything runs as administrator".

And so, if you're going to be installing apps, there is no reason to read the permissions they request. Any permission you give is enough for the app to screw you over 1000 different ways.
Ask HN: software for project documentation?
I've taken over a legacy project that has no documentation, and no documentation infrastructure.

I need to start creating documentation and set up best practices. This isn't about per-class, per-method documentation, but covering the architecture of the web app, its style guide, where Redis is used etc.

Setting up Confluence would have too much overhead (as they don't see the need, they don't want to use my time for that). They're not using GitHub, so GitHub wikis are out (though not my preferred choice either).

Last time I looked for solutions was c. 2008 when dokuwiki was popular; what's appeared since? I am aware I could use virtually any CMS or Wiki, but I'd like to know what's worked for other teams.

Thanks!
Server-Side Google Analytics
Your argument about not trusting anything can be applied to... anything. It's not hard to make one yourself, so if you're that worried about security, don't use a third party plug.
Models and Relationships at a Glance
Or: Obama is not going to start a war with Putin over Snowden. They're already spread thin (Syira, Iraq, Afghanistan, Iran, Korea, Pacific, etc).
Moving forward on improving HTTP's security
Well if you grep for MySQL gotchas you should find a bunch of them. One did bite me hard one day. I wanted to add a simple check constraint on a column, as I did often on PG. A quick glance at the doc, I send the ADD CONSTRAINT command, and, no news is good news, I thought everything was all set and good. But in fact the beast did just ignore my command! After careful check in the docs in some case the constraints are ignored because not implemented.

That's crazy. How would you rate a shell that just said nothing and copied nothing when asked to copy an important backup file somewhere? For me it is the hell of software, not even telling there is something wrong.

The vessel is in danger when the captain don't know her position, but in much greater danger when he is not even knowing he doesn't know where she is.
Except that baseband is both not feature rich and stable.
Actual CSS3 source code if anyone else interested > http://pastebin.com/1Ph90ppq
I heard Ladar speak on this topic. Apparently his apartment isn't on the first floor and only has a balcony out back. He just walked out the front door, as he says it.
Safety is not the same as feeling safe.

In Britain, about 10-15 years ago, they changed all the emergency services sirens to the same sound as the police have always used. You used to be able to tell the difference between an ambulance, a fire engine and a police car from the sound, now you can't. Also, these days a typical emergency medical response consists of 2 vehicles, a mobile ER doctor followed up by an ambulance.

So my point is that in a densely populated area, like London, it now sounds like the police are all over the place all the time. Actually it's usually a medical response to an elderly person having a fall or heart problems or such like but, because they all sound like police, people assume the worst.

If I were a politician and I wanted to introduce a rational and humane policy for treating the problem of criminality, like they have in Norway, the first thing I would do is change the sirens for all new fire and ambulance vehicle purchases so you can tell the difference from police. Then seed the media with the idea that there are less police sirens than there used to be. People would think crime had dropped precipitously and your policy would feel like it was a success as well as actually being a success.
http://www.thisplusthat.me/search/Germany%20-%20Fun
Germany - Fun = USA

:)
Things should make sense without reading documentation (I'm not saying that you don't need to read it) and boolean having a default doesn't make any sense. Argument about it having a default value in other frameworks isn't a real argument either.
It was my impression that an incorporated company is required to have a registered point of contact. A sole proprietor wouldn't be subject to that requirement, obviously, but most enterprises are not operated as proprietorships.
Part of me likes the part where he wrote "Don’t fall in love with you model".

Another part of me feels like that's saying "Don't fall in love with your future spouse".
Nucleus pretty much comprises of a very small foot print. With Architecture specific assembly isolated from like 95% of the code neatly. Rest is Ansi C. It contains tasks which are sort of equivalent of kernel level threads in POSIX but implementation logic is quite different i.e. RTOS constraints are handled by classifying interrupts at two levels. In terms of constraints, there is no dynamic loading i.e. you have to build a single binary. But at the same time it was pretty fascinating with os, networking stack, drivers all contained in a separate folder building up one project. Lately they have added power management, Android like UI and even some hyper-visor support. Most importantly, it is small and consistent enough for a programmer willing to learn through the entire stack. Helps with much better visualization from hardware to application. A couple of former colleagues (one of which incidentally now works with QNX and hence compared both) highlights both i.e. strengths vs weaknesses of each. But it didn't feel like one was superior to another. However, Nucleus severely lacks any certifications (and ability) to get into HARD real time industry such as aviation.
Microsoft, are you listening?
I don’t know anyone who has ever regretted choosing PostgreSQL or migrating to PostgreSQL. Not a single person. None.
Its effects: http://www.youtube.com/watch?v=M4l56AfUTnQ
Since he can never return to the US anyway, there are charges against him, it is kind of pointless.
Google rolls out Android 4.4 KitKat update for Nexus 7 and 10
What Combat Feels Like, Presented in the Style of a Graphic Novel
I wrote my Master's thesis on software platforms for smartcard applications in 1999. An interesting platform running javacard apart from SIMs is/was the Java iButton from Maxim (then Dallas Semiconductor).

Also, all ATM cards which are smartcards (i.e. almost all of them in countries such as France, Norway) can also hold several applications. The banks just doesn't allow it. In theory you could, even with today's technology, buy a blank card (say, with a David Bowie picture if that's your thing) and have the bank, visa, mastercard, grocery loyalty programme, library card, frequent flyer applications etc on it. Just carry one card! But no, everyone wants to own the card have their logo in it. Sigh.
I'd like my phone to ask for some pin or my fingerprint when I want to login something. No username, password or anything. Like bluetooth pairing, I'd pair my phone with services that I register and they could trigger my phone to ask my confirmation.
Then, when you get stopped by the cops you have to explain why your phone is wrapped in foil. For which there can only be one possible reason. You might as well also carry a set of lock picks, crowbar and an acetylene torch, perhaps with a set of scales so that you can be processed that bit easier...
I do not think the US government would bother to try to prosecute that. It is just not worth the resulting diplomatic drama.

I think right now the Obama administration is happy that people are starting to forget about the whole affair. The NSA's mass surveillance program is still on and it seems now accepted as the new normal.

Ultimately Snowden has failed. He exposed the program but the resulting outrage was not strong enough to bring it down. In fact, now that the US government got away with this they will probably get even more extreme in future..
Is your only use case to scrape a few pages for 1 user at a time? What if there was 1000 users requesting that scrape concurrently? or 10000?

Benchmarks with N=1 are complete bullshit and you cannot use it at all to reason what will happen with a different N.

Another annoying issue is how code is written. Well optimized code will still perform like shit in interpreters like PHP while typical JS code I see can be improved substantially (10x-100x) by writing code in a way that V8 expects. This speedup potential is usually completely ignored.
You're right - there is a tradeoff between features and stability, but "consumers vs companies" is an oversimplification. It's about the probability of something breaking, and the consequences of what happens when it does.

For a company with a large workforce, the probability of something breaking is higher - many different machines being used in different ways, and the cost of a botched upgrade can run into millions, with people losing their jobs, and legal action being taken.

For consumers, the risk is typically lower and less costly if it goes wrong. If a Facebook upgrade causes the app to crash repeatedly, it means I can't post for a while, so I'll just upgrade and hope for the best. But if a personal finance or medical app goes wrong the consequences could be extremely serious, so stability is more important.
Maybe he should ask Putin for some spare change.
Multicast Addresses
#UPSTAGRAM Fly over Paris with a creative hack into Instagram
Is he actually a felon?
Indeed. As Iran has found out, essentially the entire global financial system (via SWIFT, etc) will be closed off to you if the US is after you.
Displaying profit instead of revenue would have been more interesting, "Waooo!!! This company makes more money per second than what I make working a whole month!"
Looking for entrepreneurs and startup founders
Yep, that's it. The servers I run are all personal and their main workload is keeping my files safe. Being able to survive 2 drive failures in all situations is important. I just discovered in this thread that on that RAID6 array 2 drives are actually suffering from excessive head-parking. So having used RAID6 and bought 2 different types of drives bought me some insurance against the simultaneous failure of the two drives. The performance is fine anyway.
There is no problem of overpopulation. The population growth is declining. This means we hit peak population between 2050 and 2100.

Also there are enough resources to allow a decent life for everybody. It is all just a matter of distribution.
RoboVM status update (Slideshare)
Does it also have access to internal debug registers in the cpu? Because some techniques(TREZOR) encrypt memory and store the key in those registers, as an antu-malware technique.
With Silverlight and Flash dying there is no longer a good platform on the web for their kind of experience. They might just wait 5 years until HTML5 is finally good enough.
it confirms that most mac users have extremely short passwords (airhorn)

-> the mac user
How we cut down our timesheets routine from 3h to 30min
The MD5 passwords are not the issue here. The main issue is that the hacker logged in with the admin credentials.

Ofcourse the passwords should be encrypted but what about all the other data?

So the question is: should we store all data encrypted? Because it's not if, but when will the data get exposed.
I'm glad this happened. It was a completely necessary move. I hope it's not just a surface change while they twist things to keep it all going. Backstabbing and not collaborating to ensure you're not the one at the bottom of the curve is no way to work. And having to worry about and deal with backstabbers everyday quickly leads to a toxic work environment. Good riddance.
Well looking at the comments, some germans make comparisons to growing up in east germany, the stasi, etc. And germany is the better performing economy in europe right now.
I guess you mean this: http://en.wikipedia.org/wiki/Gaslighting
The Humanities Crisis
"Science can help us to attain the life we want, but it cannot teach us what kind of life is worth wanting."
> technically haskell is non-strict, not lazy.

What do you mean by that?

> (a + (b * c)) evaluates + then * instead of * then +.

AIUI,

head 2 [1, 2, (digit_of_pi 1000000000) ]

is forbidden from calculating the billionth digit of pi. That's a pretty strict (play on words intended) kind of laziness, even if not the theoretically maximal definition.
"Science can help us to attain the life we want, but it cannot teach us what kind of life is worth wanting.
But if the records are not maintained electronically, then there is no requirement to provide them electronically. The paragraph before the one you quoted, ends with:

>if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.

If the records are only hard copy, then there is no requirement to convert them into an electronic format just to provide them to an individual. I know this is the case with my primary care physician and I think it may be the case with other smaller practices. Many of these may be small practices run by older doctors, so they may simply retire. If you've been practicing since say 1970 or so and haven't converted everything to electronic format by now, why bother?
Pretty impressive for my first try.

iPad - cool -> Windows Phone
Rainbow tables remove the need for doing hash(anyPwComboThereIs). They are huge hash->plaintext dictionaries where you just enter the hash and get the plaintext. If the website adds salt to the hashes, you need a rainbow table for every hash, which is practically unfeasible, so you have to revert to attempting to guess the password.
It seems many Galaxy Nexus users should have bought other handset, given the feedback on the comments stream.
PCI compliance already exists, as a counterexample.
A small matter of engineering
well, its worked with nukes so far (mostly).
Here's hoping we have a viable, popular alternative to the current (expensive, corrupt..) system of SSL certificate signing long before HTTP(S) 2.0 becomes prevalent..
how could that work?
I'm not surprised, this does simplify things in many ways, and to be honest, there isn't a good reason not to use SSL anyway in many cases.

What we need next is a browser happy way to use HTTPS only for encryption and not for verification (yes, I know!), but it would make this migration much easier. This would reduce the reliance on CAs, and would make SSL certs free in many cases.
And what about WebSockets? I know it's a different specification, but we should be using wss:// too.
This made me sigh.

Don't get me wrong... As a lifelong time security guy, I'm happy to see more encryption. But implementing more security at one layer adversely impacts security at other layers. (e.g. IDS)

We're really bad (as a species) at unintended consequences....
There's an irony in how aggressive people are in downvoting any comment which doesn't toe the "Snowden is clearly right" line loudly.

Dissent, ironically, must be crushed on this issue it seems.
I once wrote a tool to insert Apache logfiles into a SQLite database to run queries against.

I'm frequently surprised by how popular that project remains:

* http://steve.org.uk/Software/asql
It's a look up table operation vs. a per-item computation, essentially.

If you have passwords hashed using md5 and no salt then you just go get a giant pre-computed library of hashes and you go through each hash and figure out if it's in your library. This is EXTREMELY fast, and with modern computing power and memory/storage capacities these libraries can be huge and won't just include things like common passwords and dictionary words but also random strings of characters up to fairly long lengths. With this sort of attack you just filter the list of hashes through your table and you end up with a list of passwords.

The important thing about un-salted hashes is that no matter how much work is put into building the table it's amortized over the total number of passwords attacked, over all time. Which drastically lowers the amount of effort per password.

With a per-entry salt this sort of attack is no longer possible. Instead you are forced to do a brute force attack on each and every password. If, hypothetically, it took a week to generate a really good rainbow table then it would take essentially just one week to crack nearly 860,000 passwords. Whereas with unique salts it would take 860,000 weeks.

However, that's only in the hypothetical case. In practice many people have weak passwords, and a well-built system can compute a huge number of md5 hashes per second. Someone built a multi-GPU monster system that could compute 180 billion md5 hashes per second while only taking up about half of a standard server rack of space (5x 4U). So if you toss an extremely large dictionary of password guesses with even millions or tens of millions of entries it will still take only a fraction of a second to check each hash, so you can crack a significant number of passwords (at leas the ones that aren't incredibly strong) in only a matter of days.
Have you tried exploded deployment? I don't have a problem with it usually
Hey this is pretty cool!

superman - male + female:

- Lex Luthor (hmm..)
- Superman's pal Jimmy Olsen (haha, what?)
- Wonder Woman (That'll do it!)
Unless this is what has changed I'd say the default is sane and has a good reason. The doc (http://nodejs.org/docs/latest/api/http.html#http_agent_maxso...) states:

> agent.maxSockets: By default set to 5. Determines how many concurrent sockets the agent can have open per host.

This stops you accidentally overloading a single host that you are scraping. It would not (assuming it works as described) affect your app if you are making requests to many hosts to collate data. Many applications (scrapers like httrack for instance) implement similar limits by default. If you are piling requests onto a single host but you either know the host is happy for you to do that (i.e. it is your own service or you have a relevant agreement) or have put measures in place yourself to not overload the target then by all means increase the connection limit.
You might want to look into parallel construction.

"Parallel construction is a police process of building a parallel - or separate - evidentiary basis for a criminal investigation which otherwise would rely upon evidence or tips received either from a confidential source or that might fall under the category of fruit of the poisonous tree. By building a separate evidentiary basis for an investigation, such as corroborating evidence using other resources or finding other valid reasons to investigate, prosecutors are able to avoid disclosing confidential or otherwise unusable evidence."
(From: http://en.wikipedia.org/wiki/Parallel_construction)
This is a dumb idea unless CAs becomes automatic and free or are completely replaced by something better.

The reason why HTTPS isn't used more is because it's a major hassle and it's quite expensive (can easily double the yearly cost for smaller sites).

If using HTTP 2.0 requires buying SSL certificates, the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever.
As a security novice could you expand?
What we need is to do away with CAs entirely and use the DNS hierarchy to distribute keys (with DNSSEC for example). That way you only have to trust your own registrar (that you already need to trust anyway) and not any random CA in the world. So if you own example.com you get the COM registrar to sign your key and become your own CA for *.example.com.
Yeah. In trading it's called a Dark Pool.
Requiem for the American Dream - Chomsky Documentary on Kickstarters
Certificate currently has two goals:

- Verification
- Encryption

The CA is supposed to verify and say "hey this certificate belongs to this company".

What we need is for anyone to setup their cert without a CA (self-signed) and then the CA provides the verification is companies really want it.

This is what happens when you try and dual purpose something. If the certificate was just about encryption then my assumption is that you wouldn't really need CAs.
Moxie Marlinspike's Convergence (http://www.convergence.io/) seems the best proposal, at least for the time being.