skysight-inc/HackerNews huggingface dataset:
BTW my mention refers to a case in the UK not in Norway.
Modern password cracking is really quite sophisticated. They've taken to using words and phrases from common websites such as wikipedia in addition to ordinary words.
Why I’ll Never Return to Singapore
Metal "clay" is just a binder with real metal in it. The binder helps you work the material just like clay you get at a craft store. Once you put it into a kiln and fire it, the binder burns off, leaving pure metal behind. The metal is sintered into the final form, so it it isn't as strong as poured or rolled metal. It can also form cracks like the clay from the craft store. The metal can be copper, silver, gold, steel, or bronze and the clay costs 2-3 times the base metal. Professionals use the clay to create prototypes and then send the pieces to casters to create multiple products.

Source: Holly Gage http://www.hollygage.com/ helped me use metal clay to create the first CharityCoin
> The breaking of bread is one of the most important social aspects of humanity.

It's even in our languages: etymologically, a companion is literally a person with whom you share bread.
the smaller sites currently not using SSL will just be stuck on HTTP 1.1 forever

Is it a problem?
What makes this app better than all the others?

At the moment I am using this one: https://play.google.com/store/apps/details?id=org.hcilab.pro...

Edit: I see you can do manual pushes as well as notifications which is nice. But it seems to be way slower than on your demo video.
There was once a time when armed bank robbers would risk their lives and those of other people to illegally acquire US dollars.

Today, why would you steal worthless US dollars? We all know that Wall Street and the Fed have an enforced monopoly allowing them to 'steal' dollars anywhere possible!?

Rather, (non-bankster) criminals go where opportunity lies. Steal BTC and you don't need to risk anybody's life. Steal BTC and your heist will triple in value in a very short time.
I wonder if there is any relation between this set of vulnerabilities and the Datong system used by the UK authorities to mimic/replace mobile phone base stations. http://www.wired.com/threatlevel/2011/10/datong-surveillance...
Encryption without verification only protects you from passive attackers, though. Frankly I fail to see the point, since it's not secure enough for sensitive data, but still has the disadvantages (performance, cache busting) of SSL.
Also want more information about what you said.
I'm working with others on a FOSS toolstack that makes it easier to build decentralised systems. Take a look and let me know what you think. http://nymote.org/
Without validation, (public key) encryption is worthless, due to man in the middle attacks.
IDS is itself an unintended consequence of a) app layer bugs enabling the intrusion, and b) opportunistic mass malware that doesn't even consider itself worthy of using TLS.

Personally, I'd rather make life harder for the pervasive eavesdroppers and the semi-skilled attackers.
I'm in London and they are rolling out contactless applications for certain things now. Subway sandwiches all take them. London buses you can pay by swipign your debit card and there is one bank that has a debit card/oyster card(oyster card is use on all London transport).
i dont think lifestyle increases (i assume you mean improvements) should not be financed by debt. It should be financed by profit. I can understand financing education by debt - its an investment, which hopefully, should make a return afterwards in the form of higher productivity/output/value when doing a job.

Life style improvements - such as getting a better car, or going on holidays, or bigger tv etc, do are not improvements to your cashflow, and should never be financed by debt.
Unless there's somewhere that will let me do domain-only validation, I'm not interested in it either. Sick of places leaking my information that has been "secured".
Introduction to Hypercard (1987 video)
The former - afaik, in computing 'bignums' has always been taken to mean arbitrary-precision integers.
Seems like you could accomplish the same thing by CA pinning your site to Verisign (who runs the DNSSEC root).
Yes a profit version would be very interesting.
There is no confirmation whether baseband processor can be reached while device is OFF/in Airplane mod.

And I join the crowd who think that is impossible. I bet someone would notice weird patterns if the baseband kept working despite of device off. (Speakers catching 2G, battery drain, interference with other devices, etc.)
GPL requires you to PAY your freedom to choose license for the freedom to access source code. So it's trade of freedoms, not free.
Can we know more about his style?
which i don't believe is a very high value segment - college and money don't mix very well imho.
Real growth
Facebook - Exploitation + Privacy = Blog

Kinda makes sense.
reason: $$
Isn't SSL often terminated at some network equipment in front of the real webserver? An IDS can still work behind that..
> Requiring a human to be in the loop in all circumstances is impractical
At least theoretically someone made the decision to kill and could be accountable, in case of killer robot with AI that decided to kill mistakenly who is responsible?
I see no reason for them being unable to do both: SIM identity and handset identity.
My main problem with Eclipse is the Maven plugin, which is close to worthless and the concept of perspectives. The Run Configurations are quite a mess too, but I usually can work around that.
It's a shame there's not much out there for OSX. :(
It's good enough now. They just have to give up on DRM.
war is a profitable business,wont happen.
Tesla’s Elon Musk Hints at His Next Big Project: Electric Airplanes
How about the TLD NICs sign your certificates when you register the domain?

Ideally they have already verified your name, company and address, and you have to trust them to some extend anyway, because they are responsible for the name servers
Reasons to consider linking in your HTTP APIs
My experience with mySQL (admittedly none of that experience is recent so things may have changed a lot since) suggested that it didn't have a planner at all and it just attacked things in the order of your FROM/JOIN clauses using indexes where obvious from the WHERE clauses and linking ON definitions: it wouldn't for instance see circumstances where it could hit the second table of a join first and so need to consider for less of the first larger table for instance, so reordering inner joins in a query could make a significant difference.

I use MSSQL a lot in my day job and sometimes the query planner there surprises us by being fairly bright about this and other optimisations. Of course it sometimes gets things very wrong and you have to use index hints to push it in the right direction, but generally speaking if your queries are complex enough to hit that problem you might need to consider refactoring your design for other reasons too.
Considering it breaks just to open this thing, shouldn't repairability be 0 or 1 (whatever the lowest rating is)
Ask HN: Browser based IDEs. Do they work?
Does anyone here work predominantly with a browser based IDE? There seems to be a lot of them popping up lately so I was hoping you could share your experience with which IDE you use and what you use it for.
DDD with Symfony2: Basic Persistence & Testing
Real-Time Grass Rendering
You're close, but the rub is, every single http request uses the same agent (globalAgent), unless specifically passed an individual http agent or "{agent: false}" in configuration. So it is effectively a global connection pool. This has caused all kinds of performance issues in production applications. It can be easily shut off but it is easy to miss in the docs. The default of 5 has met its demise in 0.11 - the new default is Infinity.
i dont believe a bank will just willy nilly lend any company 1 million USD without first checking the books.
Js2js is a revolutionary open-source compiler from JavaScript to JavaScript
Great decision! When Google started to work on SPDY and made it SSL-only, we saw what the future could be: people upgrade to the new protocol for performance, but get better security too. What's not to like! I was really afraid that the standardisation of HTTP/2.0 will break this, but now all seems well after all.

But this is not enough; we also need to work on opportunistic encryption, to be used for sites that do not use SSL today, without any certificates, in a completely transparent fashion that requires no end-user configuration. Such encryption would not be enough to defeat active main in the middle attacks, but it would defeat passive monitoring of non-encrypted communication.

To those complaining about the hassle of SSL: The biggest problem today is the fact that virtual SSL hosting (multiple sites sharing an IP address without sharing the certificate, otherwise known as Server Name Indication, or SNI) is not feasible. As soon as Windows XP (the only major platform that does not support SNI) goes away, SSL will become much easier; especially for hosted services.

That the cost (of certificates) is a problem is a myth. It might have been a problem in the past, but today there are so many CAs to choose from. There are CAs that give away free domain-validated certificates. There are CAs that give away free certificates to open source projects. And there are also companies that sell certificates for a couple of dollars only.

Obtaining certificates is, no doubt, a hassle, but the fact remains that CA-issued certificates is the only practical option to deploy a secure web site today. There are also some issues with latency, but perhaps with HTTP/2.0 (and some possible improvements in TLS 1.3) those are going to be minimised, too.
Sorry, I forgot to put the necessary disclaimer in my post stating my intended meaning of open source. You're right, I used it in the 'visible' sense of the word, not 'libre'.
This story is total, complete, bullshit.

I've been to Ladars apartment multiple times, he lives on the 5th or 6th floor of a high rise. His "back door" is a sliding glass door that leads out onto a 5 square foot metal balcony.

So, unless Ladar happens to be spiderman, the FBI agent is lying through his teeth.
what actually happens when you declare bankruptcy?
Only if the middle man was already doing the attack on your first visit to the website. This is a whole lot better than no encryption at all.
No I'm not. Netflix has about 40 million subscribers. 5% of them ('low single digit percentile') would still be 2 million - easily enough to account for college students, people who travel a lot, children, etc once you discount those who have tablets.

There are 21 million college students in the US. 10% having Netflix accounts isn't completely out of the question, but it'd be a very impressive level of market penetration.
South still regularly complains at me for not using Postgress.
Before you have to read the whole article: even though the title suggests otherwise, the attack is not related to 4chan, but rather a "rival VPN service" as suspected by one TorGuard administrator. (TorGuard was the attacked website, a VPN provider)
Not only is his apartment not on the first floor, it's several hundred feet above ground level.
Js2js, a Javascript to Javascript compiler
That and an expensive *.example.com certificate would get you half of the way there. You still wouldn't be able to be your own CA, signing certificates for foo.example.com that other people can use. And it would require everyone to buy certificates from Verisign.

Nowadays national governments already setup their own CAs because they want to be able to issue certificates for all sorts of government organizations. With the setup I'm suggesting Germany would get .de signed, then they could sign gov.de and then have gov.de sign someagency.gov.de. somecompany.de would get their certificate from the DE registrar when they sign up for the domain and also be able to issue somepartner.somecompany.de or jabber.somecomapny.de certificates that if discovered only compromise part of their network, unlike having a wildcard certificate installed on every server.
One service I can recommend is https://www.startssl.com/ (no affiliation, just a customer) who offer free certs to individuals , and cheaper certs to businesses (their prices on wildcard certs and multiple domain certs are they best I've seen online $59).
I'll say that stack ranking was bad and any US company can fire troublemakers without it.
The pinch of pumpkin: how this mysterious artificial flavor is made
Apparently not patched out in Debian either (according to apt-get source chromium-browser). I've got a bit of a mongrel system, so I can't rebuild from source -- but it looks like it should be easy to patch that line to read:

bool is_whitelisted_url = false;

(If one should be so inclined).
Was that comment about internet available in more places than electricity meant to be factual?
I kinda connect it with Ninja-like capability of sensing environment conditions :) (in this case)
How You Can Help – Following Philippines Typhoon Haiyan
How You Can Help – Following Philippines Typhoon Haiyan
DANE TLSA is a possible (viable) alternative here.
Post-catharsis, pre-wake, in Limbo to get Saito, he has the ring. If letting go of Mal got rid of the ring, it wouldn't be there on him in Limbo.
Infographic: User management as a part of app development
Taskforce looks seriously cool. It deserves more attention on Hacker News and elsewhere.

Does Taskforce have badges or support banners for webmasters and bloggers to put on their sites and link to you?
Android 4.4 KitKat Update Starts for Nexus 7 and Nexus 10
Functional JavaScript London: November
Making it moreove fair.
The "shitty security" you are referring to is the defacto SSL standard implementation. The same implementation used by your bank, fortune 500 corporations, and the federal government.
No, proper DRM support is what will make it good.
I wasn't being very precise there, but I meant security "best practices" -- common precautions and programming habits that most security experts agree are good for security. Some examples for apps written in PHP:

- bcrypt (at least 10 work factor) or PBKDF2 (at least 10K iterations of sha256) for password hashing.

- PDO and prepared statements for all DB queries. Don't let me find a single `mysql_query()` function call in your codebase, the mysql extension is deprecated anyway.

- Proper XSS filtering with HTMLPurifier or equivalent. BBCode and Markdown are not XSS filters, don't trust their regexps to keep you safe.

- Systematic protections against CSRF attacks. Don't do it manually. Don't trust plugin authors to get it right. Use a helper to insert a token to every form and every AJAX call. Validate the token automatically when submitted. No exceptions.

- Protections against arbitrary code execution via uploaded files (Never execute or `include` them!)

- Out-of-the-box compatibility with SSL (especially when generating absolute URLs), HTTP Strict Transport Security, set cookies with "secure" and "httponly" flags by default, etc.

- UTF-8 everything (primarily for convenience, but also helps protect against XSS and SQL injection using weird charsets)
I think it's just a sarcasm.
I think capitalism also needs the existence of capital markets (e.g., bonds, shares, commodities, speculative financing, reinsurance) that are dominant in financing business.
The first proposal doesn't require you to buy a certificate, see: http://tools.ietf.org/html/draft-nottingham-http2-encryption...

With that http will be encrypted with no certificate check and https will still have the good 'ol check.
Does Cobb know the ring indicates dream/reality?
Ehm no thank you, not all of us want to give away such information for personal projects, there are many reasons for people wanting to register domains privately (beside spammers harvesting whois)
I don't think so.

We are also "stuck" on IPv4 which hasn't been a problem.
He never said "I'm not going to let you", he offered to give them the snowden document dumps but the emails could not be decrypted without snowdens personal password. They demanded his SSL keys (something completely unprecedented) and Ladar refused on the grounds that it would compromise the security of all Lavabit users, not just Snowden.
People who grew up in Cold War West Germany (like me) got fed the propaganda that mass surveillance is totalitarian, communist evil because communist East Germany was infamous for it, so they are more likely to view these things as a serious infraction.

I think Germany has the strongest anti-surveillance, pro-privacy movement in the world in general. We have a special word for it "Datenschutz" ("data protection"), which means:

- protection against information about you being recorded without your consent

- information about you being passed around without your consent

We have a lot of Datenschutz laws and activists. And well the activists tend to be IT guys, and those tend to be well-paid. So lots of activist money available for the cause.
Possibly even more folks are familiar with the terms 'insert' and 'update'.

Also, s/side affecting/side effecting/.
My feelings about that are mixed.

On one hand, I try myself to avoid car battery acid as much as possible. It's legitimately nasty stuff, housed in a device where common use can lead to explosive venting of the battery's contents.

On the other hand, knowing enough about the acid to develop a healthy respect for it is vital to just about everyone in the US. Almost no one I know does jump starts correctly, and a starter battery explosion can permanently blind people.

Everyone ought to learn how to deal with things that are everywhere that can kill or permanently disable someone. Lead-acid batteries are everywhere, including children's toys. Knowing how to deal with them is vital knowledge in this society.
But the difference with MySQL is that you can easily forcibly make MySQL use the indexes you want it to, as long as it is possible.

With Postgres, while it usually seems to do a better job, when it refuses to use your indexes it can be a massive pain to coax it into doing what you want it to, even when you know it's making a bad choice.

Postgres has a number of issues like that, where ideological purity has a negative impact on usability. It still mainly use Postgres these days, but I regularly swear at it over things I know would be far simple than MySQL for those reasons (replication used to be a huge one, though that is now finally getting there, 8 years after I set up my first "large" replicated MySQL setup)
They run out of space for all those 0s
What will this mean for caching proxies? These can be really useful in datacentre environments.

For data that is nominally public anyway, I prefer to be able to stick a caching proxy somewhere, and rely on other means (eg. apt's gpg and hash verification) to ensure integrity.

The article says: "Alternate approaches to proxy caching (such as peer-to-peer caching protocols) may be proposed here or elsewhere, since traditional proxy caching use cases will no longer be met when TLS is in wider use."
SPACE - the FINAL FRONTIER: These are the images of the star probe Cassini
Once they served him with a warrant (this was several weeks before Snowden came public with anything) he could not skip town without getting nailed with an obstruction of justice charge and a subsequent trip to prison.

He had no idea the warrant was related to Snowden until several weeks after it had been issued.
His building doesn't have a back door?

You're being very literal minded if you interpret 'leave the rear of his apartment, get in his car, and drive away.' wrongly. I mean, his car wasn't parked on his balcony, was it? It's obvious what is being referred to unless you're picking nits.
It's worthless in the face on an active adversary, but it works very well as a countermeasure for passive mass surveillance.

I do think it's a dangerous idea, though. The difference between 'secure' and 'insecure' is (at least partially) understood by most technical and non-technical people, and sometimes they can make a good decision on their requirements. The difference between passive and active adversaries is much more subtle, and I doubt people can think this through with as much clarity.
It would of course be hard to avoid read-only flash no matter what you did - both bios and pxe rom from the ethernet card would presumably be read only flash today (that is writeable, but in practice only used for reading).
Yes. Note the important point though: it's based on the fact that a crime has other sources of evidence which would independently confirm a crime if they are found, which would be legal to pursue if they were discovered by other means.

i.e. the murder victim, the weapon and the security tape you buried in the local national park. The police might not find them, but they also don't need a search warrant to go looking.

Claiming you should for some reason be above the law entirely is absurd - the general point is to provide protection from stuff like "thought-crime" prosecutions, or at least a warning sign if that would otherwise be a thing.
They followed him. Ladar freaked out because he had no idea what was going on, he didn't realize the people tailing him were government agents.
How exactly does a drone replace boots on the ground - bipedal robots at the moment are fabulously expensive corporate toys - I doubt that asimo is going to be replacing a squaddie anytime soon
The point is not that time synchronization is inherently bad, only that it's usually not the correct thing for a distributed database to resolve update conflicts with.
How to transform business with Magento Extensions. 
Are you looking for some success story to inspire you? Take a look at how our customers are transforming their business with Magento Extensions.See the story and find out how.
All I get is a spinning blue dot. Your site is unfriendly to people who take their security seriously. That's not a good sign.
i personally think that it is a GOOD thing that we lose sons and brothers in wars. It makes everyone think twice before engaging in war. It also gives you an incentive to stop (or to your citizens to pressurize you to stop).

If these machines are allowed to be used, war would be a push of the button away. And that is never a good thing.

Sure ideally, war should be ONLY between machines so no one on either side dies, but as the parent pointed out, this tech is for the rich kids. The poorer countries would suffer immensely in such bloodbaths
> Only if the middle man was already doing the attack on your first visit to the website.

Keep in mind certificate pinning is a fairly (very!) recent addition to the internet security landscape. Before then MITM more or less completely broke encryption.
Juice Feasting-bestcbstore.com
Snarky answer: He wants to be able to spy on his users in order to protect them from themselves.
Any password that is likely to be duplicated will fall within 20 seconds to a brute force attack, as it is likely to be one of the first 7 trillion (yes, trillion) password that can be hashed in that amount of time. That's 70 terabytes worth of rainbow tables. Run it for 3 minutes and you've got 700 terabytes of rainbow tables. I don't think 700 terabyte rainbow tables exist.

Salts were critical from 1990s to around 2010, at which point they became mostly irrelevant for cracking accounts because of the increasingly parallel processing power that has exceeded the storage capacity of rainbow tables.

scrypt/bcrypt do the right thing, regardless, and generate unique password hash for the same plaintext, so if you use them you are covered both ways.
There already are such things - see COBIT.
The irony is that in that situation http with ssl and a randomly generated cert will be more secure than HTTPS which uses the CA's Cert, hell I'd like the HTTPS to use the CA's cert for identity but use a self-signed cert for actual data transfers.

CA's are a single point of failure for security.
Is there a e-book editor web app for team?
Is there an e-book editor web app that publishing companies use for creating e-books in epub format?