skysight-inc/HackerNews huggingface dataset:
Web Developers: The best way to learn Defensive Security
Recently we started CTF365 which is a “Security Training Platform for IT industry” with a focus on Security Professionals, System Administrators and Web Developers that implements CTF (Capture The Flag) concepts and leverages gamification mechanics to improve retention rate and speed up the learning/training curve.

We did created an internet alike environment (domains registration included) to make it look like the real Internet where users can build their own servers and attack others while defend their own.

It is build such way that anyone can get Brute Force, SQLi, Deface, Take Over, CSFR, RCE and so on without any restriction.

What I discovered is that Information Security Professionals are an apart breed that can crack your setup but they can rarely build an awesome setup full of web apps as a web developer/designer would do.

My questions is:

Would CTF365 be a great opportunity for web developers to learn and improve their Defensive Security? As a web developer/designer, would you use such platform to analyze and learn how hackers would attack your setup?
This is an example of an interesting problem with "innovative" databases which is vaguely like the OSI networking model

The first layer is business need, without one there is no point. You need to start here. Facebook is empty here, so no need for innovation and no concrete ideas about what to innovate about, means no point discussing arch or later tech.

The next layer is architecture. Do you need joins? Well then use them. Do you need transactions, or not? Basically a big key value store?

The final step / layer is tech. You can do a boring key value store on mysql just fine. There might be a slightly faster or cheaper software choice. Or maybe not. Or maybe some nosql thing fits the architecture.

This is a huge problem I see with "the whole market is going to be disrupted totally and only I know how" type articles. So I herd cats around a quasi-geographic database at work (not directly geographic, but related). The only way to change its scale or business needs is to modify the geography of the United States or dramatic demographic changes that would even theoretically take generations to breed the eventual customers. So layer one can't change for that job.

The arch doesn't seem like it can be improved very much. So layer two can't change for that job.

Therefore because layer one and layer two are static, layer three will utterly change completely. Because he says so. LOL
Oracle's still the No. 1 database, but MySQL is on the rise
Node's event loop is very easy to work with since all the standard tools are async from the start. It's not like eventmachine where standard Ruby calls are synchronous and they can throw a wrench in your logic.

There's no need for a mature standard library. Things move faster nowadays and you can't wait for things to get standardized. Node embraces the open-source spirit and trusts that the best libraries will rise to the top eventually.

And then you do all of it in JavaScript.

JavaScript is actually a top notch language. Cream of the crop. Lambdas, higher-order functions, apply/call, and OO. What more could you ask for from a dynamic language?
I'm pretty sure it's common to install a breathalyzer in cars nowadays if you've been caught with driving under the influence (probably repeatedly or over a certain percentage) in various countries / states.
> Companies of course are exempt from vat, so other rules apply.

If a company buys a 1000 USD computer to sell it, then the ultimate buyer pays the VAT. However, what happens when a company buys a 1000 USD computer to replace a server rack? At what point does "consumption" happen?
Outside of magical unicorns, what kind of unicorn should guard things? I'm afraid automated systems don't offer either the coverage or the flexibility to provide what you think should be provided.
Allow me to disagree. Therms and ideologies do not only describe what someone works towards but also how he does so. In the case of anarcho-communism and anarcho-capitalism both are very different. A striking difference is how each one of those ideologies views open markets. Quoting from the wikipedia article on anarcho-communism:
Exactly. If they don't really know what it is, then they should've left it alone for now.
HN Meetup: Lausanne, Swiss
Best vid I did so far
What'll you take for the very last one, 'adangerousread.com'?
This looks pretty awesome. I will sure try it out.
I got thinking about almost exactly the same thing. But what value would such a service have over using a social login like Facebook, Twitter or Google, given that these are already well established?
There doesn't seem to be anything that jumps out as a reason to use aptitude over apt-get there. It mentions that the defaults for upgrading the distro are better for aptitude but doesn't say why or what differences there are.

I can see the search being useful though.

Seeing as my muscle memory is set at apt-get, i'll stick with it for the moment.
How is that 'treating as a financial instrument' ? If you earn money on resale, then it's taxed, no matter if it's a piano, a house, a bar of gold or a virtual coin.
Why must we compete?
Aside from the video titles mentioned below, Williams used the 6809 for every pinball machine built from 1990 to 1999. Probably a hundred thousand machines or so.

And I can also confirm that they also used the PSHS/PULU hack to do some very fast memory copies and blanks.
No. If you want more details, please use the email address on my profile.
I checked the network and it's not sending any packages to facebook while typing or on release or on delete... :) wtf? just check the info before writing such a big article about a lie :))))))
Instagram's Founder On Why Hearing No Can Mean You're On The Verge Of Brilliance
You spent a non-trivial amount of time creating a means to prevent wasting non-trivial amounts of time. That is a whole new realm of displacement activity. I am impressed.

To take matters further you should package your extension, place it on the Play Store (or whatever it is), create artwork for the icon and package write-up, document the code, write the FAQ and manual, create some UI controls for it, build an Easter Egg (e.g. a flight simulator) into it, liaise with the NSA to write a back door to it, get some bloggers to write about it and finally post it here for the benefit of others.

Based on feedback you could then write version 2, with a freemium business model, put together an ecommerce store to sell the full version, configure your payment gateways, build a ticketing system for support requests and SEO optimise your efforts.
First second-level .uk domains delegated
> too many people who believe in violence and seizing of others property loudly proclaim themselves 'anarchists'

Just like people committing computer fraud call themselves hackers.

The fact that fraudsters (and media, as is the case with both 'hacker' and 'anarchist') use the term wrongly doesn't diminish the original and correct meaning that dates back to the 19th century.
Did the possibility ever cross your mind that the fake accounts and users are simply an attempt by a very small fringe group to bulk up their numbers and look like a more legitimate political concern?
I'm guessing whoever changed it doesn't know what Ludum Dare is.
The definitive history of Bitcoin[Infographic]
https://news.ycombinator.com/item?id=6827554
should I type my passwords in there? ._.,
Meh, just sudo chmod ugoa+rw /etc/hosts and then put in one of those Firefox extensions to update/edit it for you... Problem solved.
This is all great, but it reads like a marketing speak. There was this imperfect world full of idiots, slow, ugly and dim lit and then we came along and lifted the gloom.

Sorry, you have to do better than "TLS/HTTPS is slow". Anything over TCP is slow on congested and lossy networks. That's given, but that's hardly a reason to reinvent the whole crypto stack.

How is your protocol superior / faster / better than DTLS with session resuming? Is it faster than IKE in Quick Mode or IKE v2, which are both datagram protocols designed to work over lossy networks? What are the inherent problems with adopting DTLS or IKE to your purposes? This is dead easy to do without touching original crypto design and it instantly removes all questions pertaining to the quality of your crypto design. So why not?

I'm not a professional cryptographer, but I know applied crypto well and I've seen my share of custom crypto designs. Virtually ALL of them are is a result of thinking that it's better and easier to invent something new than to diligently learn what exists and understand how it works. It's fine for some areas, but it is decidedly not a way to go in the cryptography domain.
Microsoft courts Samsung with massive Windows Phone payout
What do you mean 'leave it alone' ? You have to pay tax on any deals, and if something new appears, then the longest you can leave it alone is a few months, until people have to fill out the tax filings and need clarification on how to treat it.
This is all very cool, but I can't help but think that it would be easier to get a used 12" HP 2530p for ~$150, install 2 hard drives inside it, install whatever distribution of Linux you want and connect it via its fast Gigabit port.

Less headache (though not as fun!), more storage space, less latency, more processing power at a still very low power consumption :-)
personally, i'm not a fan of the "open" work environments, but you had a cat in there so that changes everything.
For the US, pretty much anything is covered under https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
But the whole idea of abstraction is that you don't have to have a mental model of the whole code — just the chunk you're working on right now.
Not sure how uploading all of your contact information to their servers counts as "taking back our right to privacy."
I have not run the app, but from the Android source code it looks like this "secure" app is uploading your contacts including full names and all their phone numbers into the "cloud":

MessagesController.readContacts() [0] is called on creation of the MessagesActivity. When invoked for the first time, it collects first names, last names and phone numbers from the Android Contacts interface, creates a table containing the data, and passes that to importContacts() [1], which performs an RPC call to "the cloud", passing the contact list upstream and obtaining a server-processed list as a reply.

For me this is a major trust breach, and makes all the fuzzy claims about the app's security absolutely worthless.

[0] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

[1] https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...
Alexander is not killing anyone. He is a bureaucrat and this is just the kind of stuff they say.
Several things. I claim it's still more high level than Capybara. And it's available for languages other than Ruby. Right now, you can download it for Python. But we'll also release bindings for (hopefully all) languages supported by Selenium.
I wasn't aware there was a tread on the satellite patch on hn, but seeing how it was featured on Ars Technica, I'm not surprised:

https://news.ycombinator.com/item?id=6880117

The second link is based on a book from 2007 that used FOIA requests to be able to study the patches, so part of the point is that it's nothing new...

Anyway, I don't fall into the camp that takes the patches very seriously -- in general, anything a covert organization/project projects about itself is bound to be either propaganda or misinformation.
Is it just me, or is this whole article a description of a full-stack web developer rather than a JS engineer?
Thanks! For now, it looks by (x, y) position on the web page.
Sure, you can find other actions on the docs page, http://heliumhq.com/docs/api_documentation
Everybody has a rant about the Sharing Economy so here’s mine
Beyoncé: How to sell whole albums in an age of 99¢ singles
I think we're largely making the same point : that science is largely based on a utilitarian definition of truth. A somewhat more direct way to state that is that scientific truth is simply

"What works for me"

And nothing more.

I do disagree on one point though. The standard model doesn't just "lack" gravity. It describes a world without gravity. Therefore that gravity exists must mean that the standard model is wrong. It describes a universe that is most certainly not the one we live in. I therefore find it hard to describe that theory as true. It is more akin to "currently the best-known least-wrong theory". Even best-known has to be in there since, for example, relativity theory was known long before Einstein got his ball rolling, and Newton's equation was known before the apple fell. So we do likely know about better theories than the standard model, we just currently have no way to distinguish them from either the standard model, or (more likely) the better theories are just failing to get enough attention from well-publicized physicists. Of course, when you don't know exactly which theories are in fact better, their existence doesn't matter.
>> There's a large body of literature that attempts to justify centralization of power

Of course there is. We've lived under centralized power for hundreds or thousands of years, after all. Why would The Powers That Be suddenly cease wanting to Be?

But centralized power cannot be justified, it can only be rationalized. If you think about the idea of the social contract for a moment, you should realize that it's not a contract at all, but merely a shackle for our minds, to keep us from finding a way out of the maze of our brainwashing.

For starters, you were never even asked, you never had a chance not to participate, and you can't just opt out of the system either. You're either inside a country, or you're freezing to death in Antarctica. It's not much of a choice, but a voluntary choice is necessary for any contract to be binding.

Read this: http://spot.colorado.edu/~huemer/book3.htm
Deutsche Post DHL tests delivery drone
Since when did anyone still consider 60 minutes serious journalism? They've long gone the way of "gee-whiz" reporting for the aging (and probably sleeping) baby-boomers. You want hard hitting journalism covering the worse situations around the world? Frontline has you covered.
We quit our daytime jobs to work on this project and have to live off something... Maybe you have a suggestion as to what we could do to allow us to sustain our development in another way?
This article is from the December 2011 issue, it's 2 years old now. However, the self-management principle at Morning Star still seems to be in effect: http://morningstarco.com/index.cgi?Page=Self-Management
Unrelated to your comment but relevant: I had my friend's number saved on my phone, but we were not in touch for over an year; one day I installed WhatsApp and saw him there - I pinged him; the response came, "Who the fk are you, you b*d! There is no <my friend's name> here. Go to hell!!".

Turns out my friend had changed the number, so the cell number was released and assigned to another user after few months but WhatsApp on my phone thought it was my friend on the other side.

That was when I knew WhatsApp is not revolutionary, it's just lazy, convenient and famous.
Most boots on the ground DBAs don't know anything about rational DB design. Codd Normal form? Whats that? Can't I just make one giant table? Indexes? Why would I want indexes? I heard they take up disk space and CPU so I won't use any, to increase performance. So they (poorly) implement key value stores regardless what the problem actually requires (if the only tool you know how to use is a nail...). Nothing funnier that watching a noob do a select * on a large table transferring gigs of data and use his RoR app to implement the WHERE using nested ruby if statements and string comparisons (or better regexes without understanding regexes, LOL) and god help me a bubble sort instead of an ORDER BY clause and of course hit another table once for each row selected from the first table because he doesn't know JOINs even exist, or heard they're "slow".

A RDBMS is a very slow key value store, so anything that can't do transactions or can't do anything else, is always going to be faster at its extremely limited set of abilities.

From an engineering perspective if you need 10 HP to run your 5 KW generator, a RDBMS is like installing a 10000 HP marine diesel and then not having any idea how to start or maintain it or even where to get the fuel. Obviously every objective performance metric would be better for a 10 HP lawnmower engine in that app, if all you'll ever plan to use is 10 HP and you have no idea how to use anything more advanced anyway.

There are also very loudly trumpeted anecdotal situations or contrived thought experiments where certain unusual technologies fit a unusual situation very well. This is, oddly enough, unusual.

I've read and experimented with the "7 DBs in 7 weeks" book and it IS very interesting but I can't find any business cases to actually use any of it, which is somewhat frustrating. And my experience is how you end up with people writing CRUD apps to store cooking recipes that none the less use NEO4J because they really, really, want to add a line to their resume that they used NEO4J, not because the app needed it.
FWIW, the essay is dated Feb. 23, 2011.

But I really came here to give a Simpson's quote. In "Much Apu About Nothing", Apu applies for US Citizenship:

Proctor: All right, here's your last question. What was the cause of
the Civil War?
Apu: Actually, there were numerous causes. Aside from the obvious
schism between the abolitionists and the anti-abolitionists,
there were economic factors, both domestic and inter--
Proctor: Wait, wait... just say slavery.
Apu: Slavery it is, sir.

Clip at http://www.youtube.com/watch?v=y8VCbvMoCV8 .
Look, existing media outlets are incapable of certain kinds of criticism. Its as unlikely that 60 minutes would take a anti-NSA stance as it would be to take an anti-Army stance. Establishment players are just that...im not even a 100% Snowden backer... but expecting anti-establishment journalism form the definition of the establishment is just going to give you indigestion.
I think the analogy's spot on, but that it /does/ diminish the original meaning.

Eg, I don't call myself a 'hacker' around people who aren't geeks because I know it will be misinterpreted, and additionally people who think that definition is a good thing will want to associate with me.
Having worked on similar applications, I can tell you that it was likely a graphical choice. It's difficult to balance legibility with screen space. 32x32 probably put too few tiles on the screen, and 16x16 probably didn't let him get enough detail in.
This. I would have replied here instead of posting a new thread if I saw your post first. Frontline is THE standard for in-depth reporting on TV.
I think that's what I meant. Still didn't work :-)
Google buys Boston Dynamics, maker of spectacular and terrifying robots
I bet they are. I do it too, particularly if you're looking for something that has changed since a certain date. An explanation of a math technique probably hasn't changed since whenever it was posted, but if I'm looking for reviews on laptops, I don't want laptops from 2009.

I realize that date of publication of the particular article can be different from date of most recent publication, so I don't immediately throw out the site, but if it looks dormant I may leave and go to another site.
> Statism : 90s Microsoft :: Anarchism : Web Standards

Maybe I'm nitpicking, but Web Standards are mandated by the W3C, which I don't see as an anarchistic organization, but more as an extended oligarchy.

To participate, an organization (from what I found, individuals cannot join) needs at least 1950.00 EUR per year.[1]

[1] http://www.w3.org/Consortium/fees

I'm not criticizing W3C per se, just the fact that it's being compared to an anarchist way of doing things.
I would suggest also allowing CSS selectors as a fallback. Text changes often whereas a selector will change less often, producing a more reliable point of interaction.

I would also suggest you put a screencast of a hello world. With many people new to testing using headless webkit, they may have the wrong perception of how selenium tests are run. Additionally what may not be obvious to people used to javascript-based headless webkit tests is that Selenium/Helium tests are written in python. Might want to clarify that as well.

Good luck!
Is NSA going through 5 stages of grief (http://en.wikipedia.org/wiki/K%C3%BCbler-Ross_model#Stages)? Reading this article seems like this is making me feel like they are at stage 3.
Glad to see xakep.ru is still around.
Because we need it?
You Should Change Your Python Shell
They did not roll their own crypto, it's using AES with Diffie-Hellman key generation. [0]

You can now argue whether that's still "from scratch". (Is building something on top of TCP "from scratch"?)

[0] http://core.telegram.org/api/end-to-end
No specific examples, but all of my best optimizations as in biggest-speedup were of algorithmic nature that actually improved asymptotic complexity.

In terms of my favorite ones, it's probably a piece of C code using SSE intrinsics to speed up intersection checking for a voxel raytracer I've been playing with last summer. After about 1.5 days of hacking I've managed to shave about 50% off the rendering time per frame. Nice learning experience but completely pointless in the end. Since it was still way too slow for any practical use, I started rewriting it and eventually stopped halfway through.
Precisely! And that's why we have two (logical) levels of commit.
Interviewing Engineers? Enough with the Whiteboard Coding
This reminded me of a game programming hack I did back in highschool. I had just started a school course on Pascal and decided to code a small game of snake, just for fun. I knew very little about actual programming, I was a real novice. The game was very simple, it was running in a windows console (cmd) without any graphics, the actual assets were ASCII art. The grid of the game was represented with asterisks and the snake was dots with a smiley face (one of those weird ASCII symbols nobody knows why it's there). Every game update I would redraw the whole grid, snake and the comma that was used to output the food.

The problem was that this was terribly slow, it flickered like crazy and it was unplayable. I was very sad because my game was working but unplayable for anybody so I tried to engineer a way to make it stop flickering. The solution came when I found out about a couple of functions in pascal that let you clear a specific character in the console at a specific X,Y coordinate and write another character that that coordinate. What I ended up doing was keep track of all the changes in the game for each frame (snake movements, food position) and just re-draw only the portions of screen that had changed.

This was great, no more flickering and the game was playable. (Nobody really played it because nobody cared but I was really proud of it).

Found out years later that this approach is pretty much what Carmack did in his old games: Adaptive Tile Refresh[1]

[1]https://en.wikipedia.org/wiki/Adaptive_tile_refresh
The Acorn System computers are rack mounted computers that pre-date the Acorn Atom - http://fjkraan.home.xs4all.nl/comp/atom/history/index.html
Ever seen the monty python sketch where hitler, goebbels, etc. are put on trial and their defense is, basically, "we didn't kill anyone, we only gave the orders"

Sorry, i do not mean to compare alexander to a nazi, i'm just ridiculing the idea that the head of the nsa, a general, is merely a bureaucrat.