skysight-inc/HackerNews huggingface dataset:
> If you are going to switch to some different API in the hope of no longer having an exploitable vulnerability, how about just using a real string library, rather than trading in one class of bug for another one that you are hoping is less dangerous?

Sure. Hell, I apply this to entire languages and prefer C# where you generally have to opt into rather than opt out of corrupting buffer overflows, and where finding the length of a native string literal is an O(1) operation rather than an O(N) operation.

But 3rd party APIs mean you will at some point have to deal with fixed length character buffers both for reading and for writing. Even in C#, if you ever find yourself needing to do native interop, you'll almost certainly eventually run into them.

> nor is the panacea that people make it out to be: it is seriously dangerous for people to keep proselytizing that strlcpy is so fundamentally more safe that it can be used with reckless abandon

I think the linked article shows we have a much bigger problem: people simply do not care about security and use strcpy with reckless abandon. I won't say "don't add strlcpy to your banned.h". I won't say, "don't annotate the documentation to point programmers to better alternatives". I won't say, "make use of the function generate warnings or errors in the default settings of your project, standard library, or compiler configuration".

But I'm unconvinced that strlcpy is ineffective at harm reduction, and thus that Christoph Hellwig's stance is the correct one.
The thing is though, the only society that allows individuals to "agree to disagree" and still live peacefully is a purely libertarian model. Perhaps you do believe in a different version of freedom --- no one in such a model is stopping you from organizing an opt-in commune, or a public, collectively financed school, or an employee-owned coffee shop. You can have those things, but they have to be purely voluntary. Once any degree of force is introduced into the equation, then we are not peacefully disagreeing but instead actively oppressing.

And using words like "plunder" and "horde" suggest to me you are conflating free markets with capitalist imperialism, which is a very common myth. Imperialism is force, of course, and is intolerable.
Interesting read, but about half-way through I realized he could be manipulating me into thinking he was decent person, just misunderstood.

Anyways, it is scary to realize that there are lots of powerful people out there like this.

Actually, I think there are many powerful CEO's and political leaders that are psychopaths.

How else could they convince people to give them the power, money, and influence they have?
I believe this is what Apple did brilliantly with their Christmas commercial (http://www.youtube.com/watch?v=ImlmVqH_5HM).
In SF they have permission yet people still protest. Some shuttle stops even have signs which look like they've been installed by the city, ie "No Parking/Shuttle Stop 6am-10am" on Van Ness
I just checked my CC account, and found a transaction at Target in that time period. I checked my other transactions, and everything was OK. However, I decided to cancel the card anyway and get it re-issued, just to be safe.

I have other cards I can use, so it is not inconvenience. I feel I dodged some trouble.
It's difficult to sense tone in a comment.
It also mentions that auto filling is the default for two of them.
Which is exactly what "they" are afraid of.
I hadn't seen this yet...

http://www.usatoday.com/story/life/music/2013/12/19/pussy-ri...
Fair enough, but when i lived there, every single person i knew had a car and real estate in SF is so astronomically expensive that none of my friends, all of them highly paid, live IN the city. So living in SF but never getting in a car doesnt seem realistic unless you dont mind never visiting your friends. I suppose that makes SF liveable without a car
I imagine it's the only way lawyers could off-set liabilities onto someone else if something else ever did happen where confidential information was breached - and they'd be the best ones to know.
Google + Apple employees combined count is less than 1% of Bay Area population. If you include all other rich tech firms, their total employees would probably account for less than 3% of population in Bay Area. So it seems incorrect to think that these people are driving others from their neighborhoods.

My view on California real estate is a giant bubble that fuels itself by boom in tech industry but ignoring above numbers. Last time it tried to bust it got deflated only by 25% and it back up to those levels again and going up even more. If you wanted to short some market this is probably it.
Algae go in, biocrude oil comes out
I see talks of facts and no substantiation.
No problems here. Mostly browsing from an Android tablet.

Sounds like your browser is messed up, or your computer is infected.
Samba CTDB support for Amazon AWS under VPC (Virtual Private Cloud)
Snapchat Sacrifices Ephemerality With New Replay Feature
It's right there, did you not read it?

"Currently, those buses are using Muni stops without permission and without paying a cent."

I just want to edit this to say, I'm really disappointed in you. I had a lot of respect for your comments, but you don't bother to even read a reply and post a sarcastic response, just very disappointing.
Very cool extension. Is there any way to use Clef/Walz to login on a phone?
This is SV, which is like a giant office park. NYPD is more like the army than what is the police in SV.
This really drove the point home for me.
Likely the source of the loose attitude on privacy.
A third state of consciousness could exist, say researchers
The issue is, imo, very murky but as I understand it:

NSA approached Nacchio and Qwest to do what they were doing with AT&T and Verizon. Qwest had previously helped the NSA intercept all comms in Salt Lake City during the Olympics but told the NSA they weren't interested in cooperating. Nacchio sells some stock. Qwest is suddenly dropped as the favored vendor for a huge government contract leading to a drop in Qwest's share price and earnings.

The US federal goverment's position was that Nacchio knew the contract was going to get dropped and cashed out early - insider trading. Nacchio contended that he was just selling stock and that the government had pulled the contract to entrap and prosecute him in the current case.
looks pretty good here: http://www.rootmetrics.com/check-coverage/

I've heard Tmo is good in cities from friends that use it, it's the non-city areas that you'd have to watch out for.
The big advantage of dynamic typing is that you don't have to specify it, so your code is easier to write and easier to read.
Silk Road didn't sell anything, they were just the marketplace.
good (nob hill here)
bit slow during peak hours (HSDPA/LTE?) and degrades very fast if you exit the city going toward socal.
I am at a highly ranked school right now and they are not covered in any CS class. Computer Engineering majors learn them in their introductory course.
I agree.

Facebook is a company with an awful product, but great byproducts like all the open source projects listed here.
I very specifically used the word "condone" because it's meaning generally is around failing to stop or disagree with unacceptable actions. Criminals can't, for example, condone crime—rather, they participate in it. Its police who condone it by standing by.

Likewise, leaders of a protest movement have to specifically say that violence is an unacceptable tool in their movement. (See MLK.)

The other protestors didn't remain silent. They were interviewed and given the chance to respond to the violence of the other protestors and deliberately phrased their responses so as to not condemn violence.

> Consider: you're either with us or you're with the terrorists. But wait, what if I'm not with either of you? What then?

Perhaps you're a Muslim cleric, or one of the many people who simultaneously condemn terrorism and American foreign policy.
Introduction to Multi-core - Architecture of Modern Multi-Core Node [video]
UX Principles: Naming Features is Like Golf, Not Pool
Wow, those Qt demos are actually really quick and responsive.
Nice. Does this finally mean that you guys will have enough cafeteria space?
As far as I'm concerned those kids made a choice. If they choose to help the NSA in any capacity, well then yeah I'd consider them tainted. They require a certain kind of person, and I don't think they have the best interests of worldwide privacy at heart.

FYI, you shouldn't have been downvoted, your argument has merit even if I disagree with it. Upvoted.
backreferencing is new to me, but why this:
(...).*(...)

isn't working !! ain't I back referencing the first group which is (...) ?
The best defence is a good offence.
RSA is commercially dead. There's no excuse.

Also, closed-source hardware HSMs are blackboxes that are fundamentally paranoia-inducing. There's no reason to trust that the vendor, supply chain and/or manufacturers didn't backdoor them or introduce other attack surfaces. The only way to trust an implementation is decap a sample of ASICs and match features against masks you generated... from sources you trust (whether open source or yours).

If it's a black box, there's no way to trust it (all modern CPUs, N/S-bridge, memory, flash (ssd), hd controllers, on and on.)

Conclusion: We need more open-source hardware that is production-quality (BSD licensed)! This would be very expensive in terms of people time, but it's necessary move since corporations can't be trusted.
Exactly, people don't remember what SF was like in the 80's. It was a dump. The city was slumping, people were leaving the city (net negative migration). Real Estate was in a funk (RE agents were leaving). Walking Market was a gamble. SOMA was more like 6th and 5th streets --but all over.

The slow rise in tech in the early 90s pushed SJ and SF out of their slumber and downward trend. Now that wealth from tech is permeating the city and bringing economic benefits, non tech people want the benefits derived from tech wealth without the side-effects. Thing is, if everyone of the 6million plus people in the Bay area earned 150k/year, we'd still have the same problems. You can't fit 6 million people in a city with low housing stock and insignificant housing stock coming online. So, some of those 150k earners will do better finances and be able to leverage their earnings to buy --the less financially savvy would be unable to afford SF --and then we'd be back to 'being priced out'.
I see your anecdotal evidence and raise you:

1) I have no idea how socially liberal SF tax accountants are.
2) I raise you that I don't know any engineers that go to church but I know a lot that go to burning man. I can name 12. That's more than "Most" which is not a number in the real number system.
3) I don't know any software engineer who complains about taxes. Well one, Dukeness, but he also complains about the SEC, Weather, Obama, Bush, The Rams, and a lot of other things.
4) I have no idea what you are trying to say. Construction sentence communist. Also who is everyengineer?
It's neither.

Landlords have a right to charge as much as they can, and tech companies have a right to pay as much as they like (in fact, I encourage it).

The real problems are (1) artificial restrictions on housing supply, and (2) people not being unable to deal with the harsh realities of the market. The free market means you can use money to buy things that other people also would have wanted. In fact, there would be little point in working if we couldn't. There is no reason to feel particularly sympathetic to the people who happened to be living in an area where rents increased. If the adjustment costs are very high, I also have nothing against increased aid to the people affected. But unless a person owns something, they don't have the right to it, and so people who have been renting a long time don't have the right to keep renting indefinitely at that price.
And since jrockway deleted his comment where he was "99.9% sure that Google has permission", without any evidence of course, and then when presented with evidence, doesn't even read it and posts a sarcastic response to a youtube video, I'll take the time to note here, there is plenty more news out there reporting the same thing, that Google does not have permission, this doesn't mean they don't have some hidden deal hence why I still think it'd be valuable to get a MUNI spokesman to comment on the matter, but you can see in the archives of their meeting there are numerous mentions of citizens questioning if Google has permission:

http://archives.sfmta.com/cms/cmta/httpwww.sfmta.comcmscmtaS...
http://archives.sfmta.com/cms/cmta/SFMTABoardNovember62007mi...
etc...
Right, and that default should probably be changed.

But that doesn't justify this clickbait title which is simply untrue as nowhere in the report does it say that passwords are shared "everywhere."
They do. It's called YouTube. It's not that good...
When compared to Scala? HAHAHAHAHA.

Type inference that removes most types from code and provides fast native code is nice.

Scala may have type inference, but it is not nice.

http://overwatering.org/blog/2013/12/scala-1-star-would-not-...

http://www.reddit.com/r/programming/comments/1rvltx/scala_1_...

I like ToffeeScript, CoffeeScript, or LiveScript maybe if I am feeling smart. Scala is for sadomasochists.
After reading these comments, I'm fairly certain my cat is a psychopath.
> You need to be deliberate about signing and encrypting because security should be a careful and deliberate act.

Why? You don't have to be 'deliberate' about encrypting when you're using SSH or HTTPS.
By that logic, we should also put some brakes on Bart/Caltrain because it makes it easier to work in Silicon Valley and live in the city.
Not surprised.

One of the security guys who worked for General Magic (GM made an early mobile OS with some security features) told me that he had a visit from the NSA. The NSA tried to get him to leak bits of the keys in the GM protocols. "Just here and there. I've got dozens of these," said one of the NSA reps.

This would have been early 90s.

The NSA has been doing domestic stuff like this for a long time.
What purpose do the "plain strings" serve?
Researchers sent a text message using only vodka and a fan
That would almost make sense if Bart and Caltrain were limited to employees of major tech companies, instead of a public service.
Following orders is the problem.
> Why Western media keeps referring to him as a 'political prisoner' and 'freed dissident' (http://www.bbc.co.uk/news/world-europe-25472250)?

Could it be that our journalists have zero integrity?
When You Criticize Someone, You Make It Harder for that Person to Change
Your boss wants to be Nate Silver
Isn't the solution obvious? Use the password manager to remember a unique password for each site but combine it with something you know. Prepend a password, mix your password in the middle, append it, etc. Problem solved?
I got a solution. No more private property and money. Done.
Implementing Smart Search with Laravel and Selectize
The reaction from the average IT architect is to just select another vendor that provides yet another closed-source, blackbox hardware security solution, backdoored by who know which government(s) &| other entities. Open source hardware is (un)fortunately a necessary requirement (verilog/vhdl, firmware sources and no blackbox SoCs), samples of which are periodically verified by destructive and nondestructive means. Very, very costly, but doable and raises confidence.
They weren't riding bikes, so I doubt the NYPD would care.

(Though honestly, the NYPD has been pretty nice to me while riding a bike. But I'm new around here.)
Why don't they take Muni?
Morality for Exploded Minds
I wasn't aware of a shortage, but then again, I've only visited the Chicago office once! (I moved to NYC to work for Google. Strange, eh...)
Buy Chris Lema (The most generous man in WordPress) a Mac Pro
Hey, I agree with you. I don't live in San Francisco. I don't live in California. I don't even live on the West Coast. I don't work for Google's transportation team. I don't work for Muni. Why am I even commenting? More speculation isn't helping anything in this already overheated thread.

I did like my sarcastic YouTube link, though. In that respect, I regret nothing :)
Accomplice would be the word used to associated guilt..
MUNI routes are not optimized for all people and some people work in a different municipality, etc. Academy of Art College, UCSF, etc. all have private buses and shuttles to address that shortcoming. I can almost hear the outcry that 'techies' are overcrowding our buses!
I would imagine some examples would be:

- personal drug use (of any kind)
- bans on same-sex marriage (which I just looked up, and seems to be legal in Canada anyway)
- any form of gun control

I'm not saying that I do or do not think the above should be legal, but they all are examples of "we know what's best for you". I think that's what the GP commenter was alluding to.
Attacking a bus is not attacking the people.
> But beyond the terror you could see, there was nothing -- just pure cold and calculating rational self-serving thought.

Apart from his feelings he didn't have feelings? I appreciate you telling your story and I realize you were taken advantage of, and he treated you unquestionably bad, but painting this person as completly unhuman is not very helpful.

It seems to me that the things you describe here is an extreme end of human nature, but in way outside human nature. The best laws of physics are the one that are valid from all perspectives, so it is with the laws of human nature. Having a completly ad-hoc theory for someone elses behaviour is not emphatic or useful.
Chicago is a 40 minute train ride preceded and followed by 15 minutes of getting to and from the train.

If I had to design hell, it would look something like 2 and a half hours commuting each day.
Do tell more about how to use github to order vegan lunches.
From the bottom of my heart,thank you!
>Disclosure: underground tunneling is my profession.

That is the best thing I've read all week :) That's an awesome job! How common is that? Do you get hired for individual contracts, or are there entire companies that tunnelling is what they do 24/7?
My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied.

The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.
The point, I think, is that if you live in SF you're probably fairly socially liberal, regardless of job.
It's about Ruby conditionals, but they didn't talk about my favorite part.

eat_gruel unless has_parents?
puts "Please sir, I want some more" if shortest_straw?
I noticed some things that concern me, and while I neither have an active attack, or the time* to formalize one, I'll leave these concerns here for discussion, and take part when time permits.

First, the KDF really bugs me. Essentially, 128 bits of the data that's used to generate the AES key is derived from msg_key, which is the SHA-1 of plaintext+some_other_jazz. Also, only some of the auth_key's bits are used, along with the plaintext-dependent msg_key, as food for the KDF. What this could mean is that you're really diluting your effective keyspace. (Partially) deriving a key from the hash of public data doesn't smell like good crypto-hygiene, and intuition tells me there's the potential for leaking key bits if I query it enough, or collect a lot of ciphertext traffic.

Second, there's no integrity checking going on with the ciphertext, so I could easily ask the server to decrypt anything; don't give me that freedom, because maybe I can fool you into doing something worse. Also, if you were doing Encrypt-then-MAC, like any good boy should, you'd save yourself from wasting decryptions on bogus ciphertext. This is one reason I can't buy the performance-driven reasoning for using Methuselah's hand-me-down modes; modern modes are safer and likely faster. It's akin to paying more for used, squeaky parts, when you can pay less for new, more efficient parts.

To a cryptographer, the one thing we learn early in our careers is that it doesn't pay to be different when it comes to choosing primitives and protocols. When we find things that work, and have earned their bones, we recycle them in new designs and continue building upon the confidence we have in them by carrying on with cryptanalysis, building and breaking proofs, and so forth. There are no bonus points for those who deviate, because, really, the battle we're losing isn't that of the cryptography itself; rather, it's the way we implement it and the way we interface it. Implementation is the friend of no one; do not make it harder for yourself.

I've been a little candid, I know, but mostly because to many of us, what we're looking at is a Goldbergian gauntlet of decision-making that leaves us asking ourselves, "Okay, they took the long way home, but did they get there?" If there's a gain, I'm not seeing it, and the defense isn't leaving me optimistic that we will.

With all sincerity, and admiration for your desire to help others reap the benefits of cryptography, if enough of us tell you that there's a better, safer, and quicker way to getting this right, would you lend us an ear?

- Justin

P.S. I'm okay with being wrong, but I'm more concerned with helping you get things right.

*I have a toddler.
I don't think too many people prefer the concrete-and-wall environs of HK compared to the Victorian promenades of SF. However, we are all constrained by reality and scarcity. There is scarcity of space in SF. It must be alleviated by either increasing supply or suppressing/diverting demand. If supply is increased to a much larger extent, an HK scenario is possible which might decrease subsequent demand due to reduced aesthetic value. There are no perfect states here, and choices must be made. Restrictions can stay in place, however, no one should delude themselves into thinking that this isn't a cartelized capture of value by existing property owners in bed with the city council. It doesn't mean you can't support this option, but the reality must be kept in mind.
I thought nerd was a good term now a days. Just as other disparaged groups had done with their derogatory term to make it hip.
Right, for instance, if you actually do store all of your customer's data in your apartment on a previous-gen gaming rig...
clearly the markets are not working for everyone.
It sounds great and I'm a partner in a startup that I think this could be super helpful for but I can't get the page to load. curl -L http://www.compass.co gets websites are turned off message and the latest safari and chrome on OS X 10.9.1 get blank responses back.
Comes from an understanding of how service providers actually get gagged: the courts actively issue a gag rule based on orders they themselves issued. That's can't be true of basic science.
Anti-ageing compound set for human trials after turning clock back for mice
Well, you just made it painfully clear that at least one member of your team doesn't understand what a replay is.

In light of that, why would anyone in their right mind use a security product your organization developed?
For example, every software developer at Facebook has root access to all production servers and databases.
Sorry, I didn't realize which direction the hate was going in regard to this article.

Jesus loves engineers! The hedonists bus people who love burning man must die!

This is the problem of replying directly to stupidity instead of understanding the context of the stupidity and then attacking where the wind flys.

The King is DEAD! Long Live the King!
trying to fix that atm