skysight-inc/HackerNews huggingface dataset:
> strl(cpy|cat)() is quite dangerous to just use blindly

Very true; people have caused serious issues by blindly doing things (supposedly making things secure or else), without bothering to understand what they're doing. However, for the specific (and reasonably common) scenario of dealing with proper C strings, the strl* functions are very simple and easy to use correctly, and their use is easy to audit.

> So say you have a big 20MB XML document, and as you are scanning along, you use strlcpy() to store a node name or value into another string. [..] If you keep doing this over the entire document, your parser will end up with quadratic overhead.

Right. It is going to be ridiculously slow (and that should be obvious). But this isn't the common scenario that strl* family of functions were designed for (and which a lot of people get wrong with standard C string functions). But chances are in code like this C strings' shortcomings would be problematic anyway.

> strlcat() [..] its return value is downright cryptic: it is strlen(source) + min(length, strlen(target)).

Sorry but that is just wrong.

> When it tries to compute strlen(), ignoring your requested length parameter, this means it will access out-of-bounds memory if that string is not properly null-terminated.

It's not "requested length", it's "this many bytes fit in my buffer". These functions are not supposed to validate your input any more than are they supposed to check the validity of your pointers, intent, etc. If you're passing a pointer to something that is not a string (if you don't have a NUL terminator, your array by definition does not contain a string), you have a problem that you shouldn't hope string handling functions to magically cope with.

> if you're absolutely paranoid about security, these functions not having both source size and target size parameters gives you a second way to go out-of-bounds.

Target size ought to be enough for simple code dealing with actual strings. But if what you're dealing with isn't a string (and you need extra reassurances because you're not sure what it is), then how are you going to compute the source size? But if you can just compute the source size, then you can make sure what you have is a real string.
I definitely agree, and the point about __strcpy_chk is an excellent one. However I still get the feeling that switching from strcpy to strlcpy is a pretty substantial and easy win even while the battle to get people to use bstrings or what-have-you continues apace. Perfect should not be the enemy of good, or at least better. Let's get the unwashed masses washed first before we get them pedicured and into tuxedos.
Interestingly, D has this and everybody considers it great. The community consensus is that pure should have been the default, but it is not changed for backwards compatibility.

http://qznc.github.io/d-tut/idiomatic.html#purity
Is there a reason why all fad "secure" products lately default to custom protocols and exotic solutions instead of using well tested and trusted solutions?

Designing a protocol so that is does not leak is very hard.
Dual_EC_DRBG is used:

http://security.stackexchange.com/questions/43164/which-prod...

> Since we know the RSA BSAFE library uses Dual_EC_DRBG (...) by default, I would guess that this would be the main vector.

> As for the use of BSAFE, I can easily find (hint: use your favourite search engine to search for the terms "This product includes" "RSA BSAFE") implementations, oddly skewed towards imaging and gaming devices:
surprisingly many printer/copier/fax devices use BSAFE, though for unknown purposes. Including Ricoh, Minolta, Océ/Canon, Brother, Fuji/Xerox, Epson ...
Your Playstation (PDF), PSP, or your Nintendo DS wifi (PDF)
Software from Adobe, Hitachi, Oracle and HP
Some Nokia phones(PDF)
Not sure how many people remember, but back in the PowerPC days of Macintosh, the OpenFirmware chips actually contained a Forth interpreter implemented in hardware. It always struck me that, should the need arise, you could use the Forth interpreter to write a bootstrap C compiler, then use that to build a proper C compiler and from there compile and load a minimal kernel. In other words, starting with bare metal you could, in theory, get to a fully functional desktop computer...

...one of these days maybe I'll actually have the time to find out if that really works in practice.
And yet, the fact that a bridge design contains a pillar that any expert expects to collapse after 30 years might tell you something about the designer's competence and thus about the viability of the whole design.

This is not so much about showing how to break their system, but about showing how their design methodology is likely to produce an unreliable system - because that (a) is much easier to do than actually breaking a system and (b) precisely because of that is how cryptographers usually work and (c) it is actually known to be possible to build systems that are more likely to be and to stay secure, so there is no point in compromising reliability for implementability.
Because I don't feel that an author should be allowed to restrict the distribution of his or her works, at all. It's exactly the concept of Death of the Author [1], just on a slightly different level.

If the author forbade, say, the translation of his work into French, or forbade the reading of it by people with brown hair, or forbade the reading of it on browsers other than Internet Explorer, I'm sure you'd agree with me that such a restriction is insane, and would refuse to cooperate with it.

This restriction he is trying to impose is a bit less crazy, but he has just as little right to make it.

[1] http://tvtropes.org/pmwiki/pmwiki.php/Main/DeathOfTheAuthor
A few months ago, I was on the losing end of a head-on motorcycle versus Jeep Cherokee crash and spent several days in the hospital. I had some pretty severe injuries but somehow managed to not smash my head in -- I don't wear a helmet and, although I had several broken bones, I somehow escaped with only had a few cuts and scrapes to my head.

Several of the doctors and nurses said (words to the effect of) "someone upstairs must have been looking out for you". I'm an athiest and I get really annoyed when people say such things but, at the time, the best way I could think of to respond was to simply keep my mouth shut and not respond at all, so I said nothing.

It was about the fourth or fifth person who made such a remark when I finally went off. "Oh!? Well why the fk wasn't he looking out for me a few seconds earlier? He could have stopped that Jeep from turning in front of me -- but he didn't, did he? Get out of here with your religious bullsh*t!"

I really hate to be like that or respond to people that way but I just couldn't take it anymore. Apparently, however, "the word spread" as not one more person said anything even remotely similar to me the rest of the time I was there.

(Similar/related: all the "praying for you" comments posted to my Facebook page. I responded to those with something along the lines of "I don't believe in God so don't waste your time praying but, if you must, pray for the doctors who are operating on me instead.")
Web-based HTML5 Adobe Photoshop clone
The word "punishment" does not mean what I think (hope) you want to say. Punishment implies a crime, ie. something you knew to be wrong, could have chosen not to do, but since you did do it, you're being punished. That sentiment, of course, is offensive.

That said, I think the bulk of the vitriol fueling the down votes is the mention of God - that's also what the comments are all about. It's sad how the inclusiveness and tolerance of the modern rationalist ends abruptly at religion.
I think the dystopian worry isn't that they're giving individuals access to filtering software. That would be a worthy goal.

The real worry is that this system is Government controlled and built into everyone's internet connection.

Personally, I'm expecting it to soon have three settings, not two:

a) Family friendly browsing (opt-in)

b) Access to more adult sites (opt-out)

c) Blocking of whatever the government deems objectionable (no choice).

... and my guess is that they'll then make it illegal to bypass the filter or do anything other than use the official choice buttons.

This is why a lot of people don't like it: because we're building the machinery of censorship "for the sake of the children."
This is a reference to this XKCD comic: http://xkcd.com/224/
Verizon to disclose government requests for customer data
How is RT or Zeitgeist (bleurgh) a primary source for any of this? If they aren't, why bring them up? And what does Greenpeace have to do with anything?
Unique Selling Point
I'm an MD and have also done extensive software development in the health care field. You can't get in touch with me if you'd like more info albin (dot) stigo (at) gmail (dot) com.
Yesterday's article A Crypto Challenge For The Telegram Developers was a good analysis on why Telegram's challenge fails to prove anything.
I've been a constant learner since the beginning and it just hinders me from doing anything meaningful. Anytime I read about something new, I always want to start my project from scratch using that new technology. I started something in plain PHP, migrated over to Ruby/Sinatra/HAML, then to Angular + Node.js. It's been very time consuming and oh so useless.

So I guess I won't be learning new tech in 2014. I'll be focusing on writing, basic marketing, building an audience for my future product and just shipping the damn thing.
Data Science Weekly Newsletter - Issue 4
I was feeling pretty good that I wasn't a stereotype, until I got to the Agitator.

I'm just really tired of people putting junior devs as team lead over me. I'd really like a lead that has tried different tech stacks, project management methods, and programming language paradigms. It's hard to respect someone making a novice decision based on their limited experience.

I don't think I am curable. I don't see how telling my manager and team lead why they are wrong, is something I should change.
Tibetan monks have attempted the same and due to differing circumstances they have lost. It's interesting how similar techniques offer varying success rates based on all the other factors at play.
I understand your concerns, however there are so many people who already have their salary info public. For example government employees including military. There is already some idea if you know what someone does. If I work fast food, everyone knows I am going to earn around minium wage. Most people know a ballpark figure for most jobs, I have a doctor friend an administrative assistant friend, nurse friend, police friend, and someone who works in retail. I know about what they all make income wise and they know about what I make as well.
Starcraft II is a pretty even mix of both skill and strategy. I think it was definitely not intended to be just a strategy game
I agree with you there.

It just seems as though policy is being improvised on the spot based on who gets loudest and most hysterical, rather than policy being based on logic, reason, and principles that can be cited.

And maybe that's OK - Bitbucket and Github are businesses, and it's not necessarily their interest to host material that attracts unwanted public attention.

But it's unfortunate to know that for all the rhetoric about openness and free expression in internet culture, the reality is that a distributed witch hunt can get something shut down hard, with minimal warning.
I don't like the name. It's too tied to the current leader of the Conservative Party. If internet censorship is tied to David Cameron, then a party could pretend to be anti-censorship by changing leader (happens often).

Maybe "Go Away, Mary Whitehouse" might be better?
> "Oh!? Well why the fk wasn't he looking out for me a few seconds earlier? He could have stopped that Jeep from turning in front of me -- but he didn't, did he? Get out of here with your religious bullsh*t!"

So supposedly you were the rational party to the exchange, yet you failed to see that people (although you don't share their exact worldview) were just trying to be nice and went full-on asshole in return. No wonder the word spread quickly.

I'm not religious, but I have enough empathy to understand that when someone says "god bless" or similar, it's meant sincerely, and I care much more about a world in which strangers are sincere to each other than one where everybody understands there is no god.
The electrons are round after all
How do we incentivize people to fight back against every single law that could potentially harm privacy or force censorship? The people making these laws have every bit of incentive to do so, while the regular people have limited willpower, limited resources and limited time.

Sure we can pull off another SOPA blackout, but I don't think we can do it consistently. They'll keep proposing harmful laws and we can't stop them all.
Artistic license. I read the word karoshi years ago in some panicked news article in the USA.
first, i'd like to say i quite enjoy the UK, both as a country and its people. however, politicians in the UK have a history of doing some very extreme and very stupid things. since i am not a citizen of the UK, i cannot vote to try to change the current censorship regime, but i can say that (1) i will not be visiting the UK unless absolutely necessary until these rules change and (2) i think this is a further reason for Scotland to secede from the UK.

this is a great plugin and i commend the author's defiance of these draconian internet filtering rules. while i agree that, fundamentally, this is a political problem and not a technological one, a technological solution is needed to prevent smart people from being drowned in an ocean of stupidity. if you're a UK citizen, don't forget that you need to mobilize politically to truly fix this. talk to your friends, develop a consensus.

cameron (and everyone who supported this censorship crap) needs to go, he is a muppet of the highest degree and a disgrace to the legacy of the UK. keep jerking off and carry on.
Why transparent salaries make sense
Censorship is an excellent demonstration of why network level blocking is a complete lost cause. You hardly need Tor, VPN, or a special browser when SSL is impossible to block in a non-destructive way. You can never effectively control what people do on their computer without controlling the computer itself.

It would be much more effective to make blocking the responsibility of web browsers. This would allow settings at the user level, and circumvention prevented by normal OS security. Parents could enable or disable as they please.
For what it's worth, we bought the lease for our office from a firm who's business it was to provide filtering solutions to schools.

Upon moving in, we decided to take a look at what was on the stacks of hardware that had just been left in piles here.

To our complete lack of surprise, they were full of the personal details of children, their browsing histories, and even poorly configured squid caches full of things like views of hotmail accounts.

Needless to say, disks were removed and turned into appropriate bits of broken metal. Were we bad actors, we could have run a magnificent identity theft and child-stalking ring.

Censorship in and of itself is a problem.

Censorship by incompetent buffoons is an even greater problem.
How can I test if my connection is being censored? I've lost track if it's particular ISPs or all ISPs that have put blacklists in place which block more sites than they should.
What is an average Joe optimal use case of a cloud-based OS?
pyrocat told lies.

She stated in several places a 1-in-6 statistic for female sexual harassment, which is a lie.

http://falserapesociety.blogspot.com/2011/02/one-in-four-lie...

She also stated in several places that females are the victims of rape more often, which is again a lie.

http://betweenletters.quora.com/More-Men-Are-Raped-In-the-US...

I've made these corrections at several location throughout the thread, wherever I could catch her doing it. It's very unlikely for you to not have seen them.

I can only conclude that your mobbing campaign against me is knowingly malicious, and that you are in cahoots with pyrocat, if not the same person.
Are those filters simple DNS filters or do they do deep packet inspection?
And you obviously know that i know nothing of on the subject?
http://en.wikipedia.org/wiki/Knightmare_Chess
Tracking changes in postgresql
There are different filters. Some of them already have granularity.

> c) Blocking of whatever the government deems objectionable (no choice).

This already exists. The IWF provide sites that must be blocked and ISPs block those sites. It also happens when a company uses a court order to force and ISP to block a site.
Or alternatively that it'll be used in court cases or job interviews. What happens when schools start demanding that all their teachers "opt-in"? At a recent obscenity trial in UK, a prosecutor claimed that people who attend sexual health clinics engage in more risky behaviour. What happens if you're asking in court if you've "opted in" to porn?
The former cites its source, and the latter is US Justice Department figures.

You're a typical female supremacist. You try to ban what you can't shout down. You're sickening.
Sex isn't something that women 'have' and are refusing to share, it is a collaborative activity.
They just make your income tax form public.
It's US Justice Department figures.
What is collection in NoSQL databases? Specifically in MongoDB
The only reason that chess is balanced today is that the teams have the same pieces. Any game would be balanced if the board is symmetric and both sides pieces are the same. The issue is who goes first.

You can't just add 5 new races to the game and expect it to work out perfectly.

Agreed, however it may make it more interesting to a lot of people.
I knew Java was buggy but that's really a desaster.
Don't believe this poster. She's garbage designed to pander to man-hating female supremacists - a group that the person I just replied to has no problem flaunting her affiliation with.
Let me get this straight: Instead of entrusting my ISP with my preference for porn, I'm entrusting you.

I fail to see how this is any better. You're a recent compsci graduate and I'm sure you have good intentions. Can you explain how your "private proxy" servers work, so that it's infeasable for an attacker, or even yourself, to know which websites I've accessed?

ProTip: Saying "we don't store logs" doesn't really give me the proof I need.

This isn't how the internet is supposed to work.
What's immature about calling out lies and hate speech?
It cites its source. It's a link. Try clicking on it.
But it is not normal to light candles, create movies and put people who have passed away's photos up in the workplace.

Not normal for whom? It seems like a respectful thing to do.
The solution is to make those that support these bill pay the price (as high as possible - in votes, revenue, public image,...) for it. One by one...
Please go back to SomethingAwful. Your sexism and hate speech on this website is complete shit.
Well, none of this is communicated by your blog post. The "more" to your story is actually key to your story, it seems to me. Why did you not include it?
The difference being that this is centrally controlled. Because of this, it's speed of censorship will be much quicker.

Places I expect this to block in future:

1. Discussions of how to bypass the filter (eg Tor)

2. News articles the Government doesn't like (eg discussions barred by injunction such as Ryan Giggs)

3. Information during times of disorder (eg the tweeting by people involved in the Arab Spring).

4. Whatever the government of the day deems extreme porn/extremist/dissident. The future internet won't come with optional DA notices. Any new discussion like Snowden simply won't appear.

Essentially, it's a selective kill-switch for the internet, and I think Edward Snowden said it best. This is about power, not safety. This is a mechanism for the establishment to protect itself.
Flexible Rails Environment Configuration
Yes. This is generally known. Few people will call a stick-thin figure with a bloated stomach fat, though.
There used to be a time when people put skulls on their desks to be reminded.

Now we have twitter accounts for that
https://twitter.com/mementomorrow
Haha, I call them "Cassandra" usally. :)

I like working with them and having at least one on the team, because they're a great addition to the "naive optimist" or the "carefree hacker-fixer" who always see the solution around the corner - in a couple of minutes of course. ;)

And: There's a lot of tech scenarios where being overly careful and actually seeing the impending technical doom in every corner is an advantage.

Similar to the pedantry you get by the human robot, Cassandras have their place - and good management and coworkers know exactly where and how to take them.
It's not the job of your interlocutor to make your argument for you. If you can't make your own argument, you don't have an argument.
Please explain how it does.
That's not how advertising works, it's how advertising is insane and broken.
> how well he understood how to defeat those that employ violence

How well did he? He was rotting away in prison when the most important aspects of India and Pakistans independence was negotiated by more pragmatic leaders.

The British decision to grant independence happened at a time when Congress had lost massive amounts of influence due to their stance on the war, and the other parts of the independence movement had used the opportunity to strengthen their positions.

Because he was out of the picture when the most important decisions was made, he lost his chance at preventing the partition, for example.

It's clear he was an important leader, but there were many others.
King: Rand Paul owes Clapper an apology
The best thing eBay could do is copy Amazon in how a third party listing works. On Amazon we can throw up a feed of our entire inventory. On eBay you need to create a separate listing for each product you want to list. In effect it means more complicated software and overhead to maintain the same level of listings.

Additionally it gives customers the impression that one unit of a product listed on eBay is one physical unit the merchant has and is specifically holding for an eBay listing, which are rarely the case.

Basically this is the result of eBay shoehorning fixed price multichannel merchants into the traditional auction listing model that they started with.
Seems to me like none of these descriptions is an actual terrible programmer (well maybe the "illiterate" or "stream of consciousness").

Actual terrible programmers write incredibly bad code. Their motivations are generally not the problem. I'd probably come up with a taxonomy like this:

The approximationist -- writes code that kind of does what was intended, and then writes more code to get closer to the intention, and then more code to get closer to the intention, and then more...

The design patternist -- writes implementations of design patterns instead of implementations of the specification.

The classicist -- related to the overnormalizing database designer, breaks EVERYTHING down into classes.

Etc.

And that's just covering terrible CS graduates.
What happened to the laptop?
> Needless to say, disks were removed and turned into appropriate bits of broken metal. Were we bad actors,

You were bad actors. A serious criminal offence had been committed and you not only didn't report it, but you destroyed the evidence.
What’s with memorization? I give mostly short presentations, but usually I just need few bullet points on a slide and some solid eye brain control to calm down my nerves. Remember to talk slow, don’t wave too much, don’t stand too still, make it about few core ideas, nobody will get more than few ideas from your speech anyway.