skysight-inc/HackerNews huggingface dataset:
> In a real attack you may, depending on the circumstances, only have access to that (at first, at least).

You misunderstand the whole deal.

When imagining different potential attacks on your house you can't go laying down rules that the burglars have to follow. What if there are special circumstances (that you weren't aware of) that allows the burglars to bypass your restrictions under certain conditions? You plan for the worst case scenario, always!

Take password hashing+salting for instance. You could say that it's actually safe to store plaintext passwords because outsiders don't have credentials to access the database.

You could even run a contest where to say that you will give a million dollars to anybody who can get access and steal the passwords, and then insist that since nobody has claimed that million dollars yet, plaintext passwords are clearly safe.

But we all see how foolish that would be. You plan for the worst case scenario and hash+salt your passwords. You don't plan for the "average case scenario" where "normally attackers don't have access to the database".
I think it's a brilliant move from the people behind Telegram: all cryptographers will now keep the vulnerabilities they find to themselves until March 1st. This saves them from a lot of bad press now, and probably doesn't cost them anything.

If they were serious about using their $200k for their security they should have either:
a) Hired an actual independent cryptographer to do an audit.
b) Set up a bug bounty program that rewards any weakness found, not just this "all-or-nothing" contest they have now.
As a "boss" I'd love this.

The only downside I see is that some people will be disappointed because the salary reflects their skills and the value the company puts in them. For some this is hard to take if they are in the bottom 20% of people in their peer group.

Said that, it's probably a good idea to start with this compared to introducing this later.
@cdt5058, Yes the search functionality isn't that great but at least they have done wonderful job of curating the jobs in tech startups. Also, I personally use the "Browse by..." panel on the left. The "Shhh..." is popular for most of them as these startups don't want to share their initial VC investment.
This article is talking about internally transparent salaries. The salaries aren't disclosed to outside parties, so the policy doesn't help poachers.
Folk on the Street Free Android Game
Get ready for some Folk On The Street!!!
Learn to control the Clockwork Rooster and experience the genuine Podlachian folklore (you are probably wondering what the heck is "Podlachian" ? Podlasie is a beautiful region in Eastern Poland)
But more about the game:
- Dash through the Polish neighbourhoods!
- Jump or fly to forge obstacles!
- Unlock yummy achievements!
- Don't forget to collect oil drops to keep your machine going!
- Beware of psychedelic bosses! Defeat them to level up!
- Exchange oil drops and cold herrings to get some folky power- ups!

Are you fond of Slavic People? Can't come to Poland? Poland will come to YOU
This great, fast arcade game was made for you!
I am progressive enough to love all the things people are changing up in the business world to make things better. I am also conservative enough to be somewhat dubious that things that sound awesome are actually awesome. Usually (but not always) things are the way they are because other things have been tried and this was the optimum solution found at the time. Many times we forget the initial experiments and start fresh without learning from all the work that went on before. This can both be a good thing and a bad thing.

My point is that as readers we should be careful. We need to distinguish between stories that tell us things we are predisposed to like and things that actually work. Daniel (swombat) has done a great job of sharing some personal experiences. I say let us let the real world decide. If we can all work from the beach in a transparent organization where there are no bosses? Freaking count me in on some of that action. But either it works or it doesn't. A few stories here or there about small companies trying new things is more of a fun read than anything else.

Good luck to all these experiments, though. With so many cool things being tried, I expect to see some great results over the next few years as the marketplace sorts out the efficient business ideas from the popular ones. Really cool times ahead!
The Jesuits are outstandingly good, for a religious denomination, in their respect for scientific truth. Other parts of the Catholic church (I'm thinking of Franciscan institutes like the Christian Information Centre) lean creationist.
LOL.

We really need to make the world at large aware that a USP in the crypto area is a big red flag.

"We use up to date, standard protocols and crypto techniques" really ought to be the top of the marketing blurb. "Ours is better because we invented it" is really terrible.
I initially assumed your comment was a joke of some kind - but I think you might actually be serious? Could you explain how it's reasonable?
Kansas Board of Regents restricts free speech for academics
It looks like it only works for blocked sites. I assume that BBC content restrictions wouldn't look like a blocked site to this.
I've not had a coworker die but I've experienced immediate family loss (my mother when I was 10) and I know that being around things that reminds you of that person can be very difficult. I chose to move away (obviously not when I was 10, but as soon as I was 17 I moved a few towns over, now I live at the other end of the state, and as soon as possible I'll be leaving the country, but it seems that sometimes you can never go far enough).

It's interesting though, the way a conversation like this will turn in a community like HN. It goes into religion, but sort of the opposite of how it turns out in RL (or at least here in the bible belt of the U.S.) - most people will say "I'm praying for you and your family." and it's usually received with a "thank you" or similar, here on HN though (and in a lot of communities, such as at a university) these sorts of comments will be met with anger that someone believes something differently.

Personally, I've never had much use for religion. Most of my family is highly religious, and it's never seemed to do them much good though it does help them cope when bad things happen. And that's where I see the value in it. I know it's unhealthy to try to runaway from past pain, but that's how I cope. And when my family says things like "Well, God works in mysterious ways." I know that they are just trying to cope as well, and I have no right to judge them for that.

Empathy is a very important thing, I think, and people who get all defensive when religion comes up should take a step back and think about their own beliefs. The majority of these people (myself included) will talk about science, how we believe in things we can prove. But the simple fact is that isn't really true, is it? I believe, for instance, in the speed of light, and that highly gravitational objects can bend light and even space itself. However, I personally have not measured light or the effect that gravity has on it. I've read papers about it, and I've watched documentaries. But it's still just faith.
Letter From A Psychopath
It seems like there is a 'No-Free-Lunch' tradeoff between bandwidth efficiency and traffic analysis resistance.
Manipulate is a weasel word.

Every trade will affect the price of a share but that's not manipulation, that's a functioning market. Unless you can explain why a trade made by HFT is somehow more devious or underhanded than a trade made by another actor in the market.
>> The word I was looking for is taboo. I believe that the baby boomers find talking about money to be a social taboo, while younger generations do not.

I'm the tail end of Gen X. Talking about your income is gauche, it inevitably leads to comparisons between peers (even unspoken ones) and can sow discord in a group.
Unless they've got someone on the inside...
The first question on StackOverflow site
The CVV2 is intentionally not stored on the card to make shopping online or over the phone with a skimmed card more difficult.

If Target has the CVV2 included in this data dump they're in for a whole world of hurt from the credit card companies since storing that number for any longer than it takes to verify a transaction is utterly forbidden.
> how many overflows have even the naive conversions of strc=>strl saved?

We should ask you.
I work at a great mid-sized (300+ employees) company that has a transparent, set pay scale, with an even simpler formula than Buffer. Each inter-level promotion is a 10% bump, and a level promotion is 20%, all the way up. I love it.

A positive side effect is that promotions become more of a "are you performing at this level?" question rather than a politicking game, and responsibilities at each level become much more clearly defined. I think that many companies could benefit from adopting similar structures.
I have a X220t and Linux runs great on it. Why did you have to use a hacked BIOS? What advantages does this BIOS give to you?
A massive proportion of Linux devices are actually using Bionic or uClibc instead of the gnu libc.

While superficially the reasoning may seem to be purely technical, freedom from Drepper is not an unacknowledged feature of these alternatives.
Sponsored/funded by KGB/FSB to destabilize US by creating an army of useful idiots.

Zeitgeist is a name to Marxism that doesn't suck. Anything green is left by definition. RT is official Russian Government propaganda channel. All the journalists you see there are FSB agents are have to cooperate with FSB.

At the same time US backed NGO in Russia are banned from receiving any money from the outside world and the Russian media are tightly controlled by Kremlin. There is no "voice of America" in Russia.

Why to fire bullets when soft skills of youth and intelligentsia indoctrination will do? It woke out great for them, hasn't it? We have a president Marxist, perfect product of the same forces in the educational system in the USA.

Just look how US becomes more and more like Russia as the years pass. I.e. oligarchs (the 1%), poor getting poorer, the police state, lack of democracy. The country is being russiaficated and nobody even notices what is the root of the evil. Genius!

http://www.youtube.com/watch?v=_doqvkC-jYk
Wow...this thing just keeps on giving. It's Christmas in crypto-fail land!
...Until we get tired or apathetic. Then we lose.

There are asymmetric levels of incentive here. Organizing large-scale political action against everyone in the first world who infringes on people's internet privacy rights is simply unsustainable.

You can't fight a problem that's essentially systemic by finding and painstakingly stamping out every instance of it happening. A systemic problem needs a systemic solution.
ColinWright thanks for sharing this excellent news article. Not that often we get to read about the algorithm for programs that were written in tech giants such as Google, Linkedin. A must-read! Here is the original Quora article link for more examples: http://www.quora.com/Algorithms/What-is-the-best-programming...
No More Joins - SilverStripe and OrientDB
Building Mac OS X apps with RubyMotion book
And tomorrow write somebody the article "I read about transparent salaries yesterday".

Dont miss on Sunday: "Show HN: How i read an article about an article that assumes, that transparent salaries make sense."

Sorry, i cant resist.
I was at a start-up that was essentially a bunch of young lads who had all been close friends since school. Without going into too much detail or focussing on the human tragedy, one of us died in an accident and, looking back, I think it really delayed the growth and progress of the company by a year (or maybe two) while everyone came to terms with loss, death and their place in the universe.

I think the company was quite lucky to get through the experience intact, and it was probably only the presence of a couple of older, more detached execs that made that happen.
Fully agree, not to forget the screen ratio of 3:4 which cannot be found any-more! This together with the excellent keyboard and the trackpoint are me is THE criteria for a developper laptop.

Just ordered one ;)
Nice bit of marketing from Spotify. I can't see myself using it but if it really is a lot more lightweight than the Spotify client it could be a great alternative for those on low powered machines.
As other said in the other thread, these are more or less market salaries. And people who wonder "what if your top developer asks you to match the 20% (or whatever) higher salary offer he got elsewhere, or she leaves? I guess these companies made the decision not to engage in those kinds of discussions. They have a policy already set, so the answer is no. Will people leave if they get offered a higher salary? Maybe. Again, this happens all the time anyway in any company, open salary or not. At least as an employee you know you're getting a good deal among your coworkers. I've personally felt bad after knowing that other coworkers that weren't more skilled than me and were hired after me, were making more. Maybe because they negotiated better, or had a better previous salary, or whatever. But it didn't sit well with me. And good luck going to management for a raise "because this other guy is just as good and has a better salary". It's just messy. And sure, most people don't usually talk about their salaries. But in my experience, when they do talk (and sooner or later the topic comes up), someone ends up feeling like they're being ripped off by the company or are undervalued. With open salaries, you know what you and everyone else is getting. You don't like it? Find a job elsewhere. But you can know all of that upfront instead of finding out later how your salary compares to others. Also, I guess these companies offer other benefits. For example, people were complaining in the other thread that Buffer's salaries were very low (at least for the Bay Area). I'd still would love to work for them (if I was in the market). They seem to be great people, love their culture and plus, they work remotely (so no need to live in an expensive area).
The Knight Capital incident isn't unique to HFT firms - any firm that does automated trading can fall foul of similar problems.
>> Well, if the algorithm is so broken then it should be trivial to break it even with their limitations.

This is the critical sentence from the article - "If you want to show that a system is secure, give the adversary as much power as possible, and if they still can’t break it, the security is good."

This is at the root of modern crypto systems, and without it a system is considered broken.

It may be that within the rules of the contest, breaking one message is non-trivial. That doesn't mean that I couldn't (for instance) collect and analyse multiple individual's traffic over time, or find a way to alter data in-flight, both of which are specifically ruled out of the contest.
Trust-public-key-on-first-use, just like SSH does. It leaves only the first connection ever, vulnerable to mitm for the duration of key usage.
Windows only and closed source. Sad times, this would be a lot of fun.

Can we have a version of soundcloud that looks like the old mp3.com so I can fully pretend it's 1997 again?
Hello, Mr. Moxie...I was just wondering if I understood you about what you said here...is the PGP model being considered a dead end because of the "store it forever in Utah" model of the NSA? Excuse my ignorance, but, don't all public key systems actually end up using a symmetric key to crypt a message and that key doesn't get re-used? How is that different from PFS? (If this is too grade school, a "RTFM" is cool...)
I beg to differ :)

Maybe it's the case at the beginning, when realtime can be overwhelming, but at higher level, people have a lot of different tactics, be it build orders (like chess openings), general game flow and timing, specific offensive tactics (there are actually so many that getting information about what your opponent is doing is one of the most critical part of the game) and choosing army composition based on opponent's one weak points.

As for strategy, I think fast decision making should be considered in the field of strategy too : you have to act quick while still following a bigger plan, and be quick to change it in case of problem. After all, nobody would say blitz chess games are not about strategy. But yes, it can feel totally random for casual players, just like blitz chess.
Yes, the never ending and hard to pin down boogeyman. Today it's HFT, tomorrow it's day traders, the next private equity. All these thing are so evil, so easy to do, and the people who do them are making so much money, which should be our money really because they're robbing our 401Ks blind.

Of course, I'm being sarcastic, but this is what media is selling and most people are buying it without any pause for reflection.
I did the course about 1 year ago (or maybe 2? not sure now).

The only thing I really remember from top of my head is don't implement your own crypto.

I guess I remembered the most important lesson.
>Strikes me that HFT is extracting value from the market. The prices are usually relatively stable they're increasing the draw of money away from smaller traders but also removing value overall (in the form of money) from the system and not adding much value.

Can you explain how that works?
I saw an episode of Top Gear (UK) where they went to India and the driving situation looked terrifying. I still want to go sometime :-)
Show HN: Fast food for search engines
Apparantly, Winamp might not be dead after all: http://tech2.in.com/news/software/winamp-may-not-be-killed-b...
They didn't have hosts files in the UK before?
I think people should keep quiet if they cant break their system. What good is a cryptographer, if its only good for pointing fingers?
I created a new algorithm for finding the maximum common subgraph isomorphism (MCS) for a set of N colored graphs (ie, molecules), then extended it to find the MCS which is in at least M of N graphs.

Based on my literature search so far, it can be seen as an improvement on an algorithm from the 1970s. Interestingly, there is an influential paper from around 2000 which rejected the approach, with the hand-waving argument that it would be too slow.
TextSecure is also using a protocol of its own design. I think the difference is largely the motivation at the other end. Moxie is genuinely engaged and interested in crypto and, much much more importantly, improving the trust models associated with it (see Convergence as another example). The Telegram guys seem more interested in being a 'hip' app with the latest secure IM solution. This doesn't even necessarily mean someone with far far less crypto knowledge than Moxie can't make a secure solution, it just means Telegram are suffering from a little arrogance and over-eagerness.

It's far too easy for people outside crypto circles to see cryptography as a panacea. Inside crypto circles however, it's my impression that everyone lives with a slight unease that much of the math they rely on has unproven lower bound complexity, the majority of implementations in existence are horrific, and the key management and trust models we all depend on are terrible and obscured from the users view and understanding. If you pay attention, all the rock star cryptographers spend most of their time talking about trust, not algorithms and protocols.

Designing a simple and secure crypto protocol isn't actually that hard. There are mathematical pitfalls us mortals can't hope to understand, but if you trust and understand the primitives as black boxes, and have the right mindset when analysing protocols, you can still build very secure systems. I'm a casual crypto hobbiest, and still spotted the issues raised in the Telegram protocol as soon as I looked at the diagram presented in the article. None of these weaknesses are outside of a good programmers comprehension.

So why is a custom protocol a bad idea? The same reason it's a bad idea to go and reimplement any other protocol... that problem has been solved, why are you remaking it without a strong incentive?

There are examples of crypto being used by amateurs with success though. Bitcoin has multiple extensions, like deterministic hierarchical wallets, which are easy to understand and reason about but I know for a fact weren't designed by world class crypto-experts. In that case, there was a strong incentive. Asynchronous key splitting to ensure safe generation of vanity addresses by 3rd parties is another example. Nobody should say these solutions aren't innovative and useful.
We did not have the resources to make a Mac and Linux version unfortunately.
Google glass worn by MMA referee
Why Christmas is the perfect time to apply for jobs at London startups
Wow. Just Wow. As much as I love Spotify for its music, I have long missed the minimalist winamp interface. This is now my default spotify player. Amazing. Thank you.
From your comment everyone can immediately surmise that you lack the practical knowledge of using cryptography for real world applications that people like tptacek and moxie have.

They are known experts and have been quite clear on the questionable nature of Telegram's choice of cryptographic primitives and their composition. Their objection is not 'this is obviously broken'. Their objection is 'this does not obviously work and there are some red flags'. This blog post merely mirrors that objection.

The crucial point is that the past has shown that no proof of brokenness is required. In cryptography, if it doesn't obviously work, it is probably broken, because it is incredibly hard to get right and because an incredible amount of money and effort is available to find the tiniest crack. You are dealing with criminals and governments who have deep pockets. Either you prove it works or you assume it doesn't work. The proof is missing.
Religionists show no consistency in what they consider literal or not. I was raised catholic, am quite seriously offended by religion, and have had more arguments with religionists than I care to remember. What is literal to one person is not literal to the next. Further, when cornered a person will change their mind as it suits them. Discussion of religion is a quagmire, and the pursuit of fools.
BMeF   Music Electronic Live
Best quote: "Telegram’s design seems to disregard all of the important crypto research from the past two decades."
Winamp may not be killed by AOL today, after all
Transparency makes sense in the right context, but adding this qualification makes the suggestion less controversial, and therefore less noteworthy, since almost anything can make sense in the right context.

One of the contexts in which full transparency is less appropriate is where a business has a legacy of inconsistent approaches to hiring and remuneration, meaning that person A is paid significantly more or less than person B, even though both do the same job at the same level. We might all agree this isn't fair, but at the same time it isn't necessarily something that is easily fixed. A business might simply not be able to afford to fix salary disparity in one hit. Transparency in this context might do more harm than good because it brings the disparity to the fore gives it a focus it would not otherwise have. It reduces the options available to the company that wants to fix this disparity, in particular it reduces the timeframe in which the disparity might be removed.

In fact, this is my recommendation for fixing a problem of salary disparity; institute a policy toward salary adjustment that makes it clear that discrepancies will over time tend to be eliminated. You can be fully open about this policy without disclosing individual salaries, and you can adjust the timeframe to fit your business context. If you're cash-poor you can take longer to fix the problem.

In other words, we should be transparent about the approach to setting and adjusting salaries, but the situation with individual salaries is more complicated.