skysight-inc/HackerNews huggingface dataset:
Because it's really convenient to communicate them to people in contexts where they can't just click a link. Perhaps telling someone a URL in conversation, or on a billboard or magazine.
So they have a patch to fix it, but can't apply it because that would void the FIPS certification status, and they won't apply it because they are disabling the use of Dual_EC_DRBG anyway.
Muğla jigolo sitesi
Just to muddy the waters further, most people are at work when the sun is strongest leading some to recommend that home PV arrays should be orientated towards the evening sun. Of course if your home and work electricity grid is connected then this could be mitigated.
Really? The fact that they addressed security concerns with "they're bullshit, here, we'll prove it - break out system!" and then had to pay out nearly immediately convinced you they're awesome?
I would imagine apps that work on undoing iOS7's visual changes are going to be popular. I personally would like one, at least for those icons.
Cool it with the hate, people.

There's no hate for Telegram here. There's concern for people's safety. https://news.ycombinator.com/item?id=6949842
I was thinking about this yesterday. I have a few small things, like setting chrome as default, etc. If it's simple enough, I may as well!
Why not have these on data? If they only get returned from one function call, you have to manually deal with them in each function. If attached to data, they can get aggregated over large chains of fn calls.
A comparison of the two-way binding in AngularJS, EmberJS and KnockoutJS
Messages in secret chats are stored on server until downloaded by recipient. So there is no such problem like in Skype.

Push notifications also work fine there, except on iOS they don't contain any message data, just "You have a new message", probably because server doesn't know what's inside encrypted message. Although havent tried their android client.
I think you just reinvented the "hosts" file there.
Regex can be painful in cases which go beyond the low-lying, easy ones. Also, people have different innate skills. I am one who does not do so well remembering esoteric character combinations. I use regex frequently enough to understand how it works, and what I need, but without fail, I lack the "muscle memory" to just know what to type when doing much more complex than a simple match. This usually leads me to Google, or to a tool like this.

I have similar trouble with odd terminal commands and flags. I am not afraid of them, but it simply not part of my mental make-up to remember them all. The ones I use frequently - no problem. Those I use only occasionally - Google. :-)

Let's face it - regex IS HARD if you are not a regex "power user" or if you are the sort, like myself, whose mental map is not optimized for such things.
Thats because NServiceBus is a Service Bus and not a broker: http://www.udidahan.com/2011/03/24/bus-and-broker-pubsub-dif...

For HA you simply run a distributor process for each logical event on windows cluster and add as many worker nodes as you see fit.

Because NServiceBus uses the store and forward pattern if a NServiceBus process/machine hosting it goes down, you are still guaranteed the eventual delivery of messages when the process/machine is resumed.
I don't think you actually read the article.

This article is good news, precisely because they show how willing they are to improve their service.

EDIT: Of course it's good PR. So what? That's how Google, Apple and most other big companies operate. They don't have to be altruistic to work and create value for people.
Wonderful analysis of something completely different from the actual article. You make several good and useful points, it's just a shame that they're irrelevant.

> I believe this even less than air-powered cars ...

Air-powered vehicles are quite common.

http://www.fastcoexist.com/1681429/this-air-powered-car-gets...

http://auto.howstuffworks.com/fuel-efficiency/vehicles/air-c...

http://www.dailymail.co.uk/news/article-2266632/Car-runs-air...

http://en.wikipedia.org/wiki/Compressed_air_car

http://www.popularmechanics.com/cars/news/preview-concept/42...
Given the complexity of bug this in cryptography terms, this was an astonishingly easy earner.

Insanely complex software bugs go for less.
The rate schedules are highly regulated. If they lose the peaks they are going to either get an increase in other rates or throw their hands in the air and turn it all off.

The second would be a huge problem. The first is something lots of people are going to complain loudly about.
Evad3rs announce iOS 7 jailbreak for iPhone 5S, iPhone 5C, iPad Air
I'm on an MVNO who doesn't care, but the settings for the network the MVNO runs ontop of override it with a different APN. It's times like this I really hate Apple's operator-relationship BS.
I have been using redis as a write though cache(not just a read cache). So I used to have 1000 concurrent writes to my Postgres db. Obviously this had a negative impact on performance even with modern specs(64gb ram, 8 cores). I realized that a lot of those writes we're updating the same column for the same row but in different threads. So I basically use redis to buffer these queries and perform 1 single write instead of multiple writes for the same row.
It's an impressive sum of money. Have you considered they're doing this for marketing purposes, not out of concern for people's security?
Their effort here seems mostly to have been PR. Their messaging system still uses a bunch of out of date and weird constructions.

Sometimes negativity is not bias.
On it's own, it's great news. In context of everything Telegram have said and done before, it's not hard to come to the conclusion of 'disingenuous' or 'just for publicity'. A company that launches a crypto challenge which can only be for publicity / marketing purposes, gets called out on it and then starts handing out cash to anyone who finds a bug looks like a company that doesn't really know what they're doing.
Using good crypto is fortifying your home. People could easily learn information that could help them secretly enter my home if they could monitor my communications.
Depending on what kind of relationship Apple have with your carrier, different features are disabled or not. For instance, LTE is disabled unless an operator has their network whitelisted by Apple.
Why? They just announced that one of the main advertised features of their IM software - the secret chat functionality - was so badly broken that it was worse than not having it at all. It provided absolutely no protection against them eavesdropping on their users, yet those users were chatting under the illusion that they were secure against such eavesdropping. Worse, it seems like the Telegram developers consider this to be a theoretical problem rather than an actual compromise because you can trust them not to spy on you.
I have the same feeling about tagging/annotating struct fields with db-specific information in Golang.
The compiler implementation isn't really open source at the moment. On the other hand, they're very interested in new collaborations. Getting access to the source is not much harder than just dropping them an email.

If you (or anyone else) is interested, drop me an email (see HN profile) and I can get you in contact with them as most of the people involved are either current or old colleagues of mine.
Yes it does. Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. The weakness that they found could have easily been brushed off as non-exploitable, yet they didn't, instead encouraging more security experts to become involved by paying out immediately.
> This is a startup. There is no problem domain.

Is the startup just a game developers do on their free time? Because if it is trying to solve a problem, there is a problem domain, even if it's the wrong problem.
More important, how do I keep a site from changing what I copy / paste, because this is the crappiest UI change a site can make. I am rather sick of copying a phrase and getting a huge site advertisement and url attached.
C only has vectors (1D arrays), the implementation of higher dimensions is up to programmer. I know there is this idea to use vectors of vectors to emulate matrices but it is not at all a part of the language (nor efficient).
I had a chance to meet Mark at one of those VC /investor panel things, where he was the keynote speaker. After his speech, he hung around to talk to people. By and large, he struck me as a cool guy. He was in jeans and a polo shirt, and was seemed pretty laid-back for a billionaire. If you had not known who he was, you really wouldn't have realized that he was a celebrity or super-rich (well, other than the crowd of people mobbing around him, trying to get a piece of his attention).

He did also emphasize to the crowd that he does check his own email, reads it all, and is open to cold pitches. He even claims to have done deals entirely via email before, without even meeting the person on the other end face-to-face. So yeah, I'd say this story isn't exactly a surprise, given that it's Mark Cuban.

FWIW, I got to speak to him briefly about my startup, and his response was "Sounds good if you can just execute". We weren't pitching to raise money at the time, but if we ever do start trying to raise a round, I figure it'll be worth shooting him an email.

Edit: I just finished reading TFA and see that this actually is one of those cases where Mark invested without meeting face-to-face. Very cool. Also cool to see that Validic are locals here in the Raleigh/Durham area. Way to represent the Triangle! Congrats to you guys, if you're reading.
First things first, as an Indian,

Ms. Khobragade if she exploited the maid is in the wrong. The rich and the powerful do get away with a lot in India, which to the chagrin of Ms. Khobragade, she found out was not the case elsewhere.

Most of the criticism we see in India about US actions and support for Ms. Khobragade isn't necessarily that. There are a couple of concerns which largely underlie the anger

(a) US diplomats (and diplomats of other nations) enjoy many privileges in India. These privileges are reciprocal and India feels that this reciprocity was not available when dealing with Ms. Khobragade. Older folks like my father who was a government officer for his entire working life understand that she should be prosecuted, they only expect an apology for the treatment meted out to Ms. Khobragade during and after the arrest, which is not forthcoming.

This reciprocity extends to looking the other way when granting permits and licenses such as those for importing liquor, visa for same sex couples, which is a grey area in Indian penal code and many other benefits which are not all clearly legal.

(b) US actions to grant visa and arrange for Ms. Sangeeta Richards and family be flown out of India despite requests by Indian government, which provided US with details of a missing persons/absconding report having been filed in India, undermine Indian Judiciary. The undercurrent claim, Ms. Richards would not be served justice in India.

It is debatable whether Ms. Richards would have justice served in India, what is not debatable is the wrong doing of the US to publicly undermine the Indian judiciary. Ms. Richards is an Indian citizen and needs to pursue cases under the Indian law.

(c) There has been for a time now, a proposal to contract and place positions like those of Ms. Richards directly under the preview of the Indian government. This proposal had not been approved by the parliament yet, however the US department of state was aware of this. It is expected to be approved and when it does pass the parliament, Ms. Richards would be paid wages in India and would be free to accept or decline the offered pay. Ms. Richards was in a similar situation and was free to return to India if she considered herself exploited.

This is the gray area reciprocity that India extends to US diplomats and expects the same in return.

Ms. Khobragade is a smoke screen for why India feels wrong.
Wickr, another secure messenger?
So what? They're still doing it.

Unless it turned out they'd set the whole thing up, which would be different.
That's interesting, I didn't interpret the news this way. I haven't seen secret chat functionality mentioned anywhere yet - I was assuming that secret chat shouldn't be affected by these nonce messages since the secret key shouldn't touch their servers according to their documentation. Do you have any source on this?
This is the outstanding example of how elevating special function return data into a type adds power, because you've just described a monad.
The guy (Cuban) is on TV for heaven's sake, and has a blog. I am sure he gets a zillion pitches already

It's not just that... he has, in the past, very publicly stated that he's open to cold-email pitches. He even puts (or did put) his email address up on the big displays in the arena during Mavericks games.
See my replies to makomk and ceejayoz.
GPL is open for a self-selected group of developers, BSD is open for all developers and a self-selected group passes their changes back.
What a terrible linkbait title.

This implies that Ubuntu hasn't "supported" SSDs and the discard mount option. That's inaccurate, TRIM has been in Linux since kernel 2.6.28–25 released in Dec 2008.

A more accurate title would be "Ubuntu 14.04 adds fstrim cron job, so you don't need to mount with discard anymore if you don't want to".
What I don't get about those discussions is why people assume databases that can ONLY do map/reduce are a good thing? SQL is perfectly able to express map/reduce operations, and they main relational databases handle it almost as well as it's possible.
Investing heavily is meaningless if you're investing badly.

Building an encrypted IM service with bad crypto is like investing in blacksmiths in the early 1900s.
How many companies have contributed to help OpenSSH??? Damn few.
And here is the screenshot: http://i.imgur.com/1ladSRs.png
So evad3rs encourages us to install pirate APP?
what about mobile clients?
Who should work at Apple?
Navy sailors have radiation sickness after Japan rescue
OK, I see where you are coming from now.

I agree, stealing from a client, that's still stealing. When I learn new tools/skills, I learn them on my own time unless there is an explicit understanding, $20 or not. I consider such things a "sharpen your saws" sort of activity, and that is best done in isolation from the crunch of deadlines anyway.

As to Scott's writings, yes, that is what I was referring to. I get a distinct vibe from some of his writings that goes like: "we are mediocre, and that's okay, let's laugh it off!" Which is odd, considering some of his other writings which strongly imply that is not really what he thinks. Perhaps he just has sharp sense of self-deprecating humor. Perhaps he is just trying to be relatable to a community not known for exploration. Either way, I feel like it confuses his message. Mountains out of molehills, perhaps, but lately I have been trying to read text more carefully, looking for worldviews, which has added a new layer of depth to even development blogs.
Why restrict what a visitor can copy from your website? By reducing the site's utility they are less likely to revisit.

taye, I apologize if this isn't a constructive comment but this feature has annoyed me from time to time. Forbes.com just implemented it.
In the same way that Napster lost. Imagine if you'd invested in that one after the mainstream noticed it.
From Jay Freeman's (saurik) twitter:

So, I got no lead time on evasi0n7, nor was I asked for an official iOS 7 Cydia; I was not given builds, nor was I asked for things to test.

In fact, @evad3rs didn't even try my testing build of Substrate I gave core developers, so they didn't notice a fundamental incompatibility.

This means they are going to have to push a new version of their untether to fix this oversight before I can push newer builds of Substrate.

As there was also never a tethered jailbreak for iOS 7 that had fully working kernel patches I haven't been able to test much at all myself.

I thereby have no clue what will or will not work, or even what evasi0n7 includes; I hope that people bear with me as I figure this all out.

(In particular, I will point out that the build of "Cydia" included is not official, and couldn't really include the fixes I'd been making.)

(Also, it's 5 AM here; I'm quite tired and had been intending to go to sleep, so I don't have the brain power to react to this all quickly.)
But, that is a bit different. Function calls return one value because expressions evaluate to one value. Functions accept multiple arguments the same way any expression can be made up of multiple values. What the formal parameters allow is a kind of destructuring assignment to give new names to values. (This is especially clear in eg. Clojure.)
> precisely because they show how willing they are to improve their service.

Multiple people that know what they are doing have remarked that the system Telegram has created is a bad idea and it would be much better to use any established protocol. They have also pointed out multiple places where Telegram is committing obvious cryptographic blunders in their protocol.

Telegram decided to pay out $100k under contest rules that are weaker than known plaintext attacks. If they wanted to actually improve their security they would switch to a more secure protocol that doesn't require a server to actively participate in the conversation. I guess if they want to hemorrhage money via the hubris that is their crypto contest they should just keep on as they are.
Oh, please. Universities are a fine example of something that the state should fund. Knowledge is a public good. An educated populace is important societal infrastructure, especially in a democracy. Education is such a long-cycle thing that purely private funding of it is deeply problematic.

I grant that people working under the rules of wartime discipline have reasonable speech restrictions. And people whose job is to publicly represent the organization also have some limitations on their public speech. But there's no general reason that employers should be able to control employee speech except when they are directly working.
If the company is willing to contribute it back, it is probably good software and the company will probably be a good partner. If the only reason the contribute the code back is because of the license, I would imagine they will suck as a partner and the code probably won't be of good quality.

I look at BSD / MIT as foundational licenses that anyone can use. Those companies that don't understand the business case for getting their changes put back into the mainline of a project just aren't worth your time. It is a nice self selection process by companies and a good indicator if they will get the whole open source thing. Its like a spam filter for source code.

For example, Netflix is contributing source and money back.
Not sure hiring a US security firm is a safer approach than crowdsourcing using the power of the global community.

After all, Matasano's tptacek obviously did spend some of his time inspecting and criticizing Telegram this week. However, he overlooked the 100K vulnerability that was later discovered by a Russian guy who considers himself a newbie in cryptography.

The other reason that makes me somewhat reluctant to spend money on hiring Matasano is the recent RSA-gate (and the strange role of tptacek in it).
Yeah, I end up using more a tool called vim macros found in vsvim. They are very powerful. There are only really two commands to remember: record and play. I highly recommend them to anyone who doesn't use regex enough to remember them.
I get the feeling you've considerably misinterpreted the article: "365 days: Nature's 10. Ten people who mattered this year." Instead of "The only ten things science accomplished this year".

I actually find your comment so outrageous I'm starting to wonder if it's a joke?
>if I notice PV at the larger or more convenient locations for it in my area

You might not notice them. Last time I took a plane, when landing I was surprised at the installations I didn't realise were there. Large rooftop installations are common on stores such as Walmart, Ikea and others.
I thought the problem was the recommended implementation of Dual EC PRNG that was broken - the specific point selection that was mandated to be suitable for government use - the one that RSA used?
I absolutely hated it when websites did this. If I wanted to copy the text or image, I was going to - whether it be by going to the page source or manipulating it with Firebug. As for those ads websites sometimes through in with whatever text that's being copied, I always delete it after pasting it into my text editor. I've never seen anyone else share those copy-and-pasted ads.

As for trying it on the linked site, I have NoScript installed. Good luck trying to prevent me from copy-and-pasting now.
I appreciate your candour. Can you point me to where this sort of thing is used in the Linux kernel? It looks like it is frowned on to me:

* http://linux-kernel.2935.n7.nabble.com/PATCH-drivers-net-ifb...

* http://linux-kernel.2935.n7.nabble.com/PATCH-1-4-silicom-che...

* http://linux-kernel.2935.n7.nabble.com/PATCH-0-4-Staging-sil...

Not to mention, checkpatch.pl checks for assignments in if statements:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.g...

I should point out that someone tried to add a backdoor into the Linux kernel source through the use of an assignment in an if statement in 2004. What are your thoughts on this?

https://freedom-to-tinker.com/blog/felten/the-linux-backdoor...

Also, where is the place in the C99 standard that details the exception? Genuinely curious. When I reviewed the standard, all that is said about the if statement is in section 6.8.4.1, and that says nothing about short circuited logic, certainly nothing about "exceptions to the rule". This seems compiler specific, but I'm happy to be shown to be wrong - if you can point me to the part in the standard.
How to Jailbreak your iOS 7.x iDevice with evasi0n 7
Los Zetas have built a country-spanning network of radio repeaters using kidnapped engineers. They are clearly cognizant of information security.

http://www.wired.com/dangerroom/2012/11/zeta-radio/
I've never actually noticed any site doing that to me as I usually browse with NoScript.

I wrote that post with the intention of using the solution in apps to copy/paste app data in plain text - eg. selecting multiple objects in a drawing app and copying them as a JSON string.

I guess NoScript/Ghostery/AdBlock Plus could be considered solutions to your problem.
Good to see awesome Durham companies getting attention here.
reply

Yes it is. Can't wait to see the Adzerk IPO announcement here on HN!

I think word is slowly trickling out that NC is more than just a bunch of rednecks running around drinking beer, shooting guns, and doing donuts with their 4WD pickups.

Not that I have a problem with beer, guns or 4WD trucks.
:-)
I'm really not sure and I've been too occupied to try things out.

Detecting a long hold and then selecting the text before the usual mobile context menu pops up could be good enough. I only devised this solution for a desktop app.
If you don't think "hire people that know what they are doing with crypto" is better advice than "have a contest that doesn't even prove security under known plaintext attacks and pay out $100k to someone who finds a MITM attack to prove you're serious", you're actually not qualified to determine who the right person to determine "reasonable effort" is. I know I sound like a complete jerk, but that's just the honest truth.

The fact is that it is highly inappropriate to have a new, completely unvetted cryptographic protocol in a context where people are relying on it to provide actual security, and they are flat-out ignoring advice from talented and knowledgable people.