skysight-inc/HackerNews huggingface dataset:
> In their eyes, the protocol was perfectly secure and most of it is of course.

That there is exactly the problem. There is no reason to believe the protocol is secure, and when looking at crypto you start from the assumption that it's "maybe broken", not "perfectly secure". Assuming that some new crypto is secure is hubris.
Yeah, it reads a lot like that "Has Anyone Really Been Far Even as Decided to Use Even Go Want to do Look More Like?" thing.
Is this how opensource usually works?
https://github.com/laravel/framework/pull/2952

I modified Laravel blade compiler: fixed few bugs and improved compilation speed in 40 times. But all what Ive got is: "we wont pull it as it doesnt follow our styling guide".
Is this how opensource works?
you don't have a doge i guess. Such miss.
Why do you think that they “rejected any attempt from the crypto community to help them”, especially after bug bounty proposition?

I've written about this pretty extensively: https://www.hnsearch.com/search#request/all&q=by%3Asillysaur...

It's an interesting contrast in cultures that you phrase it like "Why do you think Telegram lies more than TextSecure advocates?" .... As far as I'm aware, TextSecure advocates haven't lied at all. TextSecure's interest is in security, whereas Telegram's interest seems to be in money and power.

Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app

I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken.

Each of these messengers is safe to passive listening.

This is mistaken because Telegram has been proven vulnerable to MITM attacks. Even after they patch this latest security problem, it would be very unwise to trust them.
I don't know. It's a hard question. MongoDB is pretty much used in any hackathons simply because it's easy to setup, driver support is good, and schemaless. The last one is really why people use MongoDB over SQL DBMS.

I find that a poor argument. One can use an ORM that automatically creates a schema based on classes. E.g. I like Ebean with DDL generation. You just write classes and add @Entity annotations. Ebean automatically creates the schema. Combine this with an embedded database, such as h2, and there is virtually nothing to set up.

Once you are out of the rapid iteration phase, you can take the latest Ebean generated schema and use to proper migrations for later changes.
For example, XML databases are handy when you have large XML datasets that you like to query. The database indexes the XML, allowing you to execute most XPath queries and XQuery programs quickly.
Eh, I don't know. Always interviewed with C++ with great results. Probably because I know the language and the standard library well enough to be able to write out the solution without looking into google or a textbook. ALWAYS use the language you're most comfortable with. If it's Java, let it be Java. If it's Python, let it be Python. Also, NEVER try to show off by programming your solution in some language you read about on the internet the day before because it's just asking for trouble.
Snapchat creators claim (at least imply) that messages could not be saved which is untrue.

Most advices to telegram developers at previous HN discussion were to stop doing crypto and do something else. I would not consider them as “gentle advices”. The only help from the community to their application is the bug report x7mz user from habrahabr site.
What about iOS? I wish there was one go-to secure messenger for iOS, and I thought telegram would be it.
A silly comment.
Next in thread, David Johnson points out:

I have previously pointed this out as a bug in the FIPS spec. The need to
prevent matching pairs in random numbers by 4.8.2 in FIPS 140-2 reduces
the entropy.

The requirement in 4.8.2 applies to all SP800-90 DRBGs, not just the Dual
EC DRBG.

I submitted this as part of my comments to the re-opened SP800-90 comment
period.
We host the service for our clients. Our clients choose and pay for their own domain name. The majority of our clients are not-for-profit.

It certainly wouldn't break the bank but it is an additional cost to doing business. The question was a little sly - I was fishing for the solutions my peers used by posing a beginners question. I hadn't heard of StartSSL before so it has been a success.
It is good to see that you recognise modesty as a virtue.

May I suggest that you guys take a leaf out of his book and rewrite the security claims in your FAQ to reflect the fact that the protocol is new and at this point there are likely to be some bugs but that you are working hard to make it secure.
I don't understand how you could read Steve's post as saying 'we have got this shit figured out' and 'proclaiming truth'. It's just someone's take on (crypto)currency; no reason to get all huffy about mistakes, let alone about disagreements.
yes. projects usually expect you to follow their coding style guides if they have one.
Awesome! I love being able to middle-click to open something in a new tab, especially the folder that I'm currently viewing.
Write max flow in one line.
> [...] is to me simply cheating the customer.

You become a customer, when you start paying them. Until then you are just a user. The license which most of the packages included in Ubuntu use says: "BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES", so what did you expect?
EU fury over claims UK and US spied on competition chief
Indeed, but his track record isn't absolutely perfect if you remember his misguided analysis of the Bitcoin blockchain, a paper which was subsequently withdrawn[1].

1. https://news.ycombinator.com/item?id=6804440
I had a quick Google and MSSQL [1], DB2 [2] and Oracle [3] all support indexing XML.

[1] http://technet.microsoft.com/en-us/library/ms191497.aspx

[2] http://publib.boulder.ibm.com/infocenter/db2luw/v9r5/index.j...

[3] http://docs.oracle.com/cd/B28359_01/appdev.111/b28369/xdb_in...
In Xcode. http://wiki.canby.k12.or.us/groups/ipodusergroup/wiki/a507f/...

Until recently, Xcode always offered a (non-functional since iOS 4 or so) way to downgrade your device.

Now, they didn't document it as such, but why else would you make a menu that shows only past versions of an OS and let's you "Restore" such a release? ;-)
Another reason to choose MongoDB is built-in array and nested dict support, with good enough indexing.

So you don't have to create bullshit m2m tables with tedious joins for a fucking tagging system
shouldnt they accept it as it is and then reformat code if they are unhappy with this?
My opinion is that it is better to have a non-very-styled but working code than cool looking slow code with bugs.
OSX is hardly tweakable at all in comparison - what tweakability are you referring to?
It would be unusual that someone would run slow queries against the production master, typically you either use a replica or a backup restored into a separate environment. In my experience SQL has been pretty good for exploratory querying. By the time a company grows out of that setup they'll probably understand what tools will answer the questions they've got at scale.
The GP is correct, this is bit-twiddling code to test for a single bit being set in the int, and therefore being a power of 2, not simply a multiple of 2.

Broadly speaking, and ignoring edge cases, if N is a power of 2 then it has a single bit set. Subtracting one unsets that bit, so the AND of N and (N-1) is zero. On the other hand, if N is not a power of two then subtracting 1 leaves the top bit still set, so the AND is non-zero. Therefore taking the boolean NOT gives the right answer.

00010000 Power of 2
00001111 N-1
--------
00000000 -> 0

00010110 Non power of 2
00010101 N-1
--------
00010100 -> Non 0

Thus power of 2 is NOT( N & (N-1) ). Your examples are wrong because "!" is not bit-wise NOT, but boolean NOT. !0 = True, !N = False when N is non-zero.

It's actually wrong on the edge case of N=1, which is a power of 2.
And they were sponsors at EuroBSD conference this year too.
"im_a_lawyer" is a little weird/poisonous. Ignore him.
I'm sure Larry got that idea. I suspect he refused to accept that doing what everyone else did was the only solution.
Most people are not bashing just for the sake of bashing. Some people need good cryptography software to avoid imprisonment, or torture, or state-killing. This isn't about stopping someone's teen-angsty poetry from being discovered by a sibling, it's about protecting political dissidents from an oppressive regime. In that context pointing out that a software is broken is not mindless bashing, it is a crucial part of the cryptography process.

I like your commentary it is level headed and explains the position of the non biased "other side".

I think the conflicted position of the lead bashers did not help their position. It would have been much more useful for a neutral party to do a comparative analysis and stated the pros and cons of each side.

As for me and most normal users, the security we need is not from NSA type of snooping but from mid level risks. There may be some sacrifices that may have to be made. Just like the position Ubuntu plays where Linux distros are concerned

For people like Snowden, Greenwald and others with NSA level adversaries, I do not expect them to rely on any third party application at all.

Now your argument may be that they have created stuff for sexting teens and claimed to be good enough for Snowden. In that case, I would argue that it could have been pointed out that in a different and perhaps more polite way.

I would worry about anyone who has created any crypto tool who is not over confident in his product. I will also expect the person to be receptive to constructive feedback NOT "leave your product and join us" or "This is shit because no noted crypto person is on your team"

I remember when cperciva that built Tarsnap, an online "backup for paranoid users" launched, he was rather confident in his product and I did not see any intense bashing of him. As expected,there have been bugs in his system and he has fixed them as they have arisen.

We should help things grow right here on HN not hope for things to fail if they do not support the view of the crowd.
As a note for anyone using non-Apple SSDs in OS X, you'll need to enable TRIM yourself (free, sometimes needs re-applying after system updates): http://www.groths.org/software/trimenabler/

I run it on all my Macs. :)
That article suggests enabling automatic trim with the discard option, but that's not recommended any longer.

A more up to date article: http://askubuntu.com/questions/18903/how-to-enable-trim
> Current implementation of telegram api is prone to MiM attack but I would not consider TextSecure completely safe app

> I just don't know what to say to this. Telegram has been proven insecure, TextSecure hasn't. Telegram isn't designed by cryptographers, TextSecure is. There is absolutely every reason to assume Telegram is broken.

Textsecure is designed by cryptographers, and hasn't been broken yet, but that doesn't mean that it is secure. People need to risk assess when they're using any software.

> If you want to be secure from the NSA, use TextSecure [...]. It's really that simple.

That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software.

Most people do not have nearly enough operational discipline to withstand investigation by well funded government agencies. Merely using this software is not enough.
The intention was to announce the win for Boeing at the state visit that was cancelled.

The only thing the gripen has going for it is price. The F/A-18 is a far superior aircraft and the only hold up was the technology transfer that finally met Brazil's concerns.
> Why are you being so hostile? You're not making me want to share anything I know. I'm talking about the kinds of ecosystems that let people like you (that work on live-editing environments) focus on the parts that matter to you and you're behaving like a prick.

We were talking about how it would be nice to have a standard for interoperability IDE plugins, and you step in by saying Haskell gets it right by...not doing it at all. Unix was a great C dev environment, you had ed (later vi and emacs) for editing, and a bunch of command line tools for doing everything else. We tried to evolve that interoperability into Unix, but users wanted more tightly integrated tooling (hence the term "IDE"), and the unix shell model no longer cut it. Going back to the past won't help us much, especially when our tooling is increasingly interactive and not batch, where the former are very hard to write and standardize compared to the latter!

I'm sorry if my tone was hostile sounding. But as someone who works on IDEs full time, this rosy-tinted glasses belief that we were doing it the right way 30 years ago quickly annoys me.

I frankly don't buy the entire interop premise, the IDE is the language! How much do C and Haskell share in common? Not much beyond the foundation level, and people aren't really complaining about that, so why worry if IntelliJ doesn't share an architecture with Eclipse? Haskell has no popular IDE as far as I can tell; the community just isn't into them (though some exist, like Leksah), which is quite odd to me, as they have all that static type information sitting around!
Spotiamp: Lightweight Spotify player - Winamp style
> If you want to be secure from the NSA, use TextSecure [...]. It's really that simple.

That claim is far too confidant! If you want to be secure from NSA you need to do many things - have a look at the specifications for buildings that handle secret documents for example, as well as just using a piece of well designed but relatively untested software.

That's why I removed it 15 seconds after I wrote it. But perhaps it could be downgraded to "if you want to live in a world where it's very difficult for governments to vacuum up all your data by default, then use TextSecure, because it's the first step towards that." Telegram offers no such protection since it's vulnerable to MITM attacks (even after they fix this one).
Does this seem good to you? Damn, I feel I should stop worrying about my English.
How long does the full encryption of a say, typical email (kilobyte of plain text or so) takes? It shouldn't be that much long, in the range of a few milliseconds, or a few dozen samples of a microphone (44,100hz max).

What i can't understand is how you can compress a whole RSA decryption key, which is say 4096 bits, into space SMALLER than itself (source data from microphone with 16 bits per sample, mono, at 44,100 hz, will take 6ms to accumulate 4096 bits - for sure encryption of a short email will take less!). So it sounds like a hoax.

Obviously the key can't be 'comperssed' because it's ramdom data with a high quality of randomness. And you cannot pull it out of SMALLER amount of data recorded by the microphone in the time it takes to make an encryption. That is, if anything happening within the processor can make acoustic noise loud enough for microphone to detect, which i really doubt.

I believe this even less than air-powered cars, or cold fusion.
I'm having trouble interpreting your numbers; is the short-term insurance $50/year or $50/month? (Looking on ehealthinsurance.com, I don't see any short-term plans under $100/month, but that might be my age/zip.)

And why is $95 your estimate for the penalty? Won't most people with non-poverty incomes be paying the larger, 1%-of-income-over-the-filing-threshold, penalty?
I wholeheartedly disagree. For any user, the security we need is prevent eavesdropping & data mining by our governments. They use it to profile us, to find thoughtcrime and to secure their standing in a surveillance society. We should not let that happen.
Obligatory JSON and hstore in Postgres comment.
Strongly disagree with the article as simplification always looks shiny. Start-Ups should sit back for a few hour and days and invest the work to answer some serious questions as these http://nosql-database.org/select-the-right-database.html (there are other cataloges like this one).

Then you get a little closer to the truth.
I think that is incorrect. This is a problem with the protocol which is the main thing people were raising as having a distinct smell and being novel for no good reason so while most of the comments were not about specific flaws they were not unrelated. IGE and SHA1 were the obvious red flags that people involved were not up to date with the latest crypto research.

[Edit: I can't find the comment so I withdraw this claim:

There was at least one comment possibly from moxie mentioning odd use of nonces that may have been in this area, if so it was right on target.]

To make a harsh analogy it's like using a colander for a boat and then complaining that a particular hole wasn't pointed out to them.
Thank You for Hacking Me
Newer Cisco IOS versions (IOS XE for example) are running as a process in linux. Old IOSes were linux-based too. Don't mix up Cisco IOS with Apple iOS (which has roots in BSD).
This is nothing new, Germany had similar issues several years ago:

http://www.bloomberg.com/news/2011-09-29/utilities-giving-aw...
This comes up every now and then on HN. There are plenty of NoSQL horror stories.

Thing is. Most SQL database at scale is a bit of a horror too. Have you seen real-life production relational databases? Gawd. Hacks on hacks. Then you add another database. And another analytics database. And a bunch of point to point data feeds. Argh.

But hey. That's data.

If you think choosing SQL will solve your analytics woes down the line -- it's just not true. You're in for some pain no matter what you do.

... That's unless you get a porcelain schema first time. Which, if you're in a startup, probably means you're working on the wrong problem.

That's not an argument for using NoSQL (I used MongoDB daily, but I've got plenty of love for PostgreSQL). It's a rebuttal that SQL magically solves a different problem.
Australia.

"A party to a tenancy agreement who changes any external door or window lock must as soon as practicable give a key to the lock to the other party."

"A tenant who wishes to change a lock in a master key system must obtain the landlord's consent before changing that lock."

Our tenancy law is extremely specific and breaches of it either end in termination, mediation, or disciplinary action against the landlord. It's very effective so long as long as everybody understands their rights and responsibilities. I know of people who've changed their locks and been evicted as a direct result.

http://www.austlii.edu.au/au/legis/vic/consol_act/rta1997207...
Since when is tree traversal "pure academic"? It's like one of the most mundane things, it's like sorting or hashing, it's something you run into on a regular basis, and the fact that it's wrapped into a library doesn't give you an excuse to not know it, because that knowledge is necessary to use the library correctly (i.e. answering questions like "do I use TreeSet or HashSet here?").

It irritates me because it's not even remotely "academic". Category theory is academic, this is mundane things. It probably is the bare minimum one has to know if they hope to work on anything interesting.
Battle of Britain was won because the Canadian air force shot down huge numbers of Messerschmitts, and because a German pilot screwed up and bombed London against orders not to do so, instead of focusing on air strips and bases. Result was Allies bombed German cities in retaliation and Hitler ordered London destroyed which took the focus off disabling the Royal AF, and allowed Britain to regain air superiority and stop the attack. Anyways this has nothing to do with RSA taking a bribe to sell feeble crypto products
I don't think your arguments make a lot of sense:

> It would have been much more useful for a neutral party to do a comparative analysis and stated the pros and cons of each side.

And what would this neutral party be?

> As for me and most normal users, the security we need is not from NSA type of snooping but from mid level risks. There may be some sacrifices that may have to be made. Just like the position Ubuntu plays where Linux distros are concerned

You make it sound as if having government-grade encryption was very hard or very costly but that's obviously not the case, there are many open encryption standard who wouldn't have had the kind of issues Telegram has. Do you want to start a new contest targeting a properly configured openSSH for instance? There is no need for tradeoff there.

> I remember when cperciva that built Tarsnap, an online "backup for paranoid users" launched, he was rather confident in his product and I did not see any intense bashing of him. As expected,there have been bugs in his system and he has fixed them as they have arisen.

Colin Percival has credentials and experience in the cryptoworld. When he makes "new" crypto like scrypt he publishes it and it's been thoroughly reviewed. It also has distinct advantages over previous technologies, it's not just new for the sake of being new.

Crypto is serious business, people can get hurt. Toying with crypto, proposing new ideas is of course to be encouraged, but be humble about it and listen to the feedback. Actually, this last part is true for everything.
this comment reads like something straight out of /r/programmingcirclejerk
Bruce Schneier and Eben Moglen discuss a post-Snowden Internet
Second comment (W_K) is by Nick Durov, the leading author of MTProto, Telegram's protocol.
It's very difficult to find questions of the correct difficulty for an interview that don't require arbitrary knowledge that the candidate might not have.

The binary tree question has a short definition, requires only knowledge that any candidate will have, and is easy for any logical thinker.

If I am administering a practical test for a junior programmer position, as in, a fresh graduate, the binary tree test is a great one.

I put them in front of an IDE, sit with them, and ask them to write a unbalanced binary tree container with insert, find and delete functions.

Watching a candidate do this tests basic implementation skill, API design, debugging and testing methodology. By the end of it, I have a pretty good idea if they will make a good hire.
I didn't read that book, but I did read Mark 'Chopper' Read's How to Shoot Friends and Influence People.
historically, scientific advancement has come in intense bursts. not that i like the fact there are less exciting years, but it isn't really surprising that scientific advancement doesn't progress as a steady rate.
I was curious to see what parts of India have Street View coverage (I wasn't expecting any). However, a bit of clicking around in Kochi (Kerala) gave me the interior of this house [1]: http://goo.gl/IoSr7N

Possibly, there are legal reasons why Google hasn't mapped Indian streets thoroughly, although it must be possible to work around those since there's one company that has a similar product. [2]

1. http://kochimuzirisbiennale.org/aspinwallhouse/

2. http://www.zdnet.com/in/wonobo-launches-street-view-maps-for...
This could have been prevented. Oblivious Turing Machines: http://stackoverflow.com/questions/14847080/how-does-an-obli...
Interesting. I'm wondering about Threema, I think Moxie is already on them.
This is a pretty interesting (albeit lengthy) read for anyone who missed it - http://www.nytimes.com/2013/12/15/magazine/googles-plan-for-...
any one call telme how can i submit a link