skysight-inc/HackerNews huggingface dataset:
(author here): GPG support for the web can be easily done with @okTurtles, and was part of the plan from the start. It's very easy to do that compared to the rest of the goals of @okTurtles.

One thing about that though, is that GPG-based communication suffers from all the problems described in the OTR docs (and the overview paper on the site, see sections on plausible deniability and PFS). But if you want it, again, it's very simple to transparently support GPG on the web (once the rest of the foundation is implemented), and I can definitely see how people would find that useful for forums, reddit, HN, etc.
Best.Comedy.Evar.

My cynical self was caught off guard and laughed to tears on at least 4 occasions reading these essays. Priceless.

Last time I laughed so hard was while watching a Dave Chapelle Show...
Hey Gibsonsecurity,

Just wondering about Snapchat's claim to have 70% users.

Could they have possibly run the names of users through a gender DB to get a rough percentage?
There's a special kind of a-player who doesn't (or even can't) code, though understands the work of others. For example, Jobs early in his career and later on as well certainly seemed to fill your definition of an A-player force multiplier, with one exception: he did not code personally at all, according to Woz.

It is very interesting that he still fit the rest of your description, as far as I understand.
It never really meant anything, it was just a marketing term that went too far, encompassing so many different technologies and services that it could be applied to pretty much anything.
Author here: yes, support for GPG is one way of using @okTurtles (e.g. with OTR off).

Your comment would be instantly readable to whoever the intended recipient(s) are, with no manual intervention on their part. (see also reply 'rakoo': https://news.ycombinator.com/item?id=6963081)
Lobster: one-dollar photo marketplace
No. You need his public key. His private key should be known only by him. That said, he also needed the recipients public key to encrypt it.

Private keys are private. Public keys are public.

Edit: I realise this is unclear. He needs his private key and the public key of the recipient to encrypt the message. Then only the recipient can decrypt the message. To do this, the recipient needs his private key and the encryptor's public key. Hope that helps.
See section "6.3 Note on JavaScript Cryptography" in the paper: http://okturtles.com/other/dnsnmc_okturtles_overview.pdf
You have elucidated my experiences to a T. Thank you for this.

Simply. Having. A wonderful Christmas time.

:(
The latter. The world looks markedly different, and one has a radically different experience of it, if one wasn't fortunate enough to have won the "born the 'right' {sex, race, orientation, nationality, &c} lottery".

Reminding yourself of that on a regular basis helps keep you sympathetic to folks who don't have it, as you say, "as sweet as you."
It's amazing how many people enjoy Nickelback. Thankfully, I'm in Canada where everyone (save 5-10 people in this country) hate them. :)
Nursing Scholar Sheds Light on Bullying in Academia
You don't need such a _compiler_ directive. The compiler can only optimize the call away because it can assume that std::memset does what the standard proscribes.

Whenever you call an external function that is not in the standard library, the compiler can't know what it does and, hence, can't optimize it away.

The linker, on the other hand, might do across-library optimizations that lead to it removing the call. So, at worst, you need a linker directive.

Also, I am not sure you want this tagged to the function signature. There may be cases where optimizing the call away is perfectly valid.
I'd like to point out that you acting like a jerk does not make you look more competent.

Java has a reputation of a bad community, and you just underline it here.
Chad here.

First off I'd like to give props to the gibsonsec.org guys, that is a really high quality protocol breakdown and the attack is neat. I see nothing wrong with going full disclosure after being ignored this long.

The key point is to understand that I, as a protocol reverse engineer/attacker/professional bad dude have access to _everything_ the Snapchat app has. I own the network and the device the app is running on. I can look at every bit of Snapchat's memory space if I want.

I can view all network traffic between the app and the servers. Either by MITMing the app or if the app has cert pinning nothing stops me from peaking at buffers(I did this with Square, it was actually not that painful).

With just that you can see it is not possible to stop me from saving a Snap. I don't even need to make my own API calls, I can simply intercept the traffic of the actual Snapchat client and pull the image out of there. Even if you had a magical way to make sure only the actual app was requesting the Snap it wont help, it is the legit client.

The more important take away though isn't that Snapchat is broken, because that's not super interesting.

What you should take away from Snapchat is that you cannot stop people from calling your remote APIs that your apps are using. All it takes is someone sufficiently bored to go dig through pcaps and decompiled code to map out the API.

So what do you do? Don't trust the damn client. Your service shouldn't be broken just because I am calling your API outside of the bounds of how your application will call them.

This isn't a new idea, but it seems like a lot of people never learned this lesson.
At first i was kinda pissed off, because to me, wearing a suit has no bearing on whether i can do a coders job or not. But afterwards i came to the realisation that if a company judges my suitability on whether or not i'm wearing a suit, its not a place i want to work in.

This, 1 million times. I had the same experience when asked "Where do you see yourself in 5 years" and my not replying with a pre-canned response of dreaming about middle management in a company I know almost nothing about.
It never meant anything new, but it does mean something (mutualising resources and having access from anywhere and the like).
MuscleTech NANO Vapor Review
I use spring in large scale Java projects but I rarely take advantage of the @Autowired feature because I find it very confusing as I define my pojos in XML configuration files. if I have autowired fields all over the place I have to look at source code AND XML files to understand what the heck is going on and from where a given field is autowired.

I suspect this introduces extra complexity. I have not yet had the chance to try Guice (https://code.google.com/p/google-guice/) so I wonder if it solves many of Spring's problems (one of the top issues is verbosity of configuration files).
I get that a lot of companies still rely on Windows, but aren't we slowly edging away from really needing it? Especially when more and more software is being written in platform-agnostic languages like Java?

I feel like a company willing to migrate to something like ReactOS could just as easily migrate over to some *nix variant. The only Windows-only thing that I can think of being essential would be Office (that might be the big one though).
I'd love to see an analysis of the other 9 they could not match to see what traits they share in common that make them difficult to analyze.
Internet Marketing Firm
"If people's skills no longer fit, then by definition you cannot repurpose their skills."

A-players cannot learn new skills?

Basically, they want specialists and not A players[1] and then they discard and hire new specialists. Its HR checklistism disguised as elitism.

1) A players can learn new skills and still be A players. If they cannot, then they weren't A players.
Nah, the JS is for codepen. Santa himself is CSS only.
Please note that the site and PDF describe two different, but related projects. DNSNMC, IMO, is actually the more significant of the two, while okTurtles is just one example of the type of app it makes possible. First draft of a complete DNSNMC specification and implementation is being worked on right now and will be pushed to https://github.com/okTurtles soon.

A rudimentary DNSNMC is very simple to implement in something like Nodejs. The version that will be pushed to github will be written in CoffeeScript and NodeJS. At some point my hope is to provide a version that installs easily on Linux via package managers and integrates nicely with PowerDNS.
That's so incredibly disrespectful!
Linear Algebra

Linear programming

Advanced calculus

Nonlinear programming

Probability

Stochastic processes

Time series analysis

Fourier theory

Basic mathematical statistics

Multivariate statistics

Analysis of variance and
experimental design

Analysis of categorical data
The best drone for hackers is the one they build themselves. There is absolutely no point in buying a factory drone - you can make them yourselves easily enough, and without much fuss - in fact RC drones is one of the longest-running subjects that has attracted hackers over the years. If you want innovation, learning, experimentation - check out the "DIY Foamies" section on http://rcgroups.com/ forums .. there are literally thousands of drone designs in there that the budding hacker can enjoy, learn from, and exploit for their needs.

So please, stay away from the factory drones, folks.
sometimes I'll look up a product passively (someone mentions it on a site and I google it), but don't really look at the page long enough to think about whether to buy or not buy it (a specific instance of the more general "tabbed browsing has made me open tabs I don't look at")

these ads are probably targeting behaviors such as this, more than "decided not to buy"
So what are the implications for application DESIGN? None. It was just a mistake in not using SSL. Next.
Really? I though it was funny.
I disagree. Even if you're fallaciously occasioned to "check your privilege", it's still a useful exercise. And doesn't writing off all such invocations make you guilty of the same kind of prejudicial dismissal you're arguing against, anyway?
From the whitepaper http://okturtles.com/other/dnsnmc_okturtles_overview.pdf

"The magic doesn’t stop there. DNSNMC isn’t just DNS + NMC, it’s also an HTTP server. DNSNMC provides its clients with secure access to the Namecoin blockchain
itself through a RESTful API."

They're planning on shipping this browser extension with a hardcoded list of DNSNMC server IP addresses. Isn't that a central point of failure? (E.g. If an adversary mounts a DDoS against all servers in that list.) Adversaries wouldn't need to render the service unreachable, just slow it down to painfully-slow speeds for average users. Regular DNS is resilient to this because of its hierarchical design, but the paper seems to be proposing a flat list of DNSNMC servers that will be shipped with the extension by default. Since almost all users will stick with the defaults, subverting those servers would disrupt DNSNMC for most users.

Also, it's unclear to me how users or website owners use DNSNMC's REST API to update their blockchain identity entry. Is it password-based? Like, when a user first creates a blockchain entry, do they set a password they must remember? If so, then what happens when they inevitably forget their password or someone steals it via a key logger? It needs to be changeable in case the old password is compromised, but that causes a whole bunch of problem scenarios, like an attacker steals a password then changes it, then modifies the user's blockchain entry. How does a user recover his stolen blockchain identity?

Overall the whitepaper is a comprehensive survey of the current public key infrastructure landscape and embodies some interesting ideas for the future. While there are some very dubious ideas (like tackling all problems with JavaScript crypto) I'm cautiously optimistic about the overall direction this whitepaper is proposing, because something similar to this is a necessity: a distributed DNS system that doesn't rely on certificate authorities, and lets users distribute their public keys in a public way that can't be easily MITM'd. There are unsolved problems, like how users can recover a stolen identity, but this whitepaper takes care to be extremely clear that it's a work in progress, and that it's being made available to get early feedback on the design / to solicit ideas from the community. They don't pretend that they've thought of everything, which is nice.

They're working on an important problem (a future in which CAs are unnecessary + giving everyone a way to distribute encryption keys tied to your public identity) so this kind of research is sorely needed, and I look forward to seeing what their next step is.
because it counts people not value them.
> If people's skills no longer fit, then by definition you cannot repurpose their skills.

Many companies at least try by way of retraining.

Netflix is saying they're not willing to offer courses/training to already employed people in order to keep them. Consider what this means in terms of dollars. They are choosing to spend more money on recruiting and hiring overhead than on training.

Maybe they've done the math and this hiring overhead is cheaper than retraining -- but they've ignored the long game of goodwill towards the company. Or maybe they just don't care.
Aaron Rodgers will know playing status by Thursday
The worst is the UPS to USPS handoff where the USPS driver just leaves a note in your mailbox saying that your package will be at the Post Office waiting for you. Why did I wait 3 days to go pick up a package from a place with a horribly long line? I can't imagine what the line is going to be like on the day after Christmas, damnit Amazon.
I know the listing is quite useless. But I wanted to hear people's opinions on which language to use for data analysis in 2014.

I'm quite fluent in R. I love some parts of the language, the breadth of packages available, and ggplot. But it's really slow and not general purpose, so I always preprocess data in Ruby.

Clojure is a fantastic language, but it's data analysis story is thin. The matrix libraries are still being worked out. Incanter, which contains most basic stats routines, seems abandoned. Yet, some people like the Flightcaster guys use it, so there might be ways to work around this.

Julia looks great, but I'm worried by the lack of emphasis in functional programming. Having a multi-paradigm language is great. Some things are difficult to implement outside an imperative mindset e.g., a Gibbs sampler. But functional should be the preferred option if possible. Maybe this is a wrong impression of mine.

Python has all the libraries, but I've never really liked the language, and it's still quite slow.
The page doesn't provide any info about how 0ad uses ECS.
I have to say that looks a weird and potentially very harmful way of thinking. Why by default pit yourself against your job? Why you have to work on some "personal project" which seems to be completely isolated from, even contrary to your job? I guess it has to do with some "unsuccessful intern experiences" by the author, but I don't believe it's the correct perceptions of things. The ideal scenario, obviously, is to blend personal interest/fun together with the job you are doing. And I believe a lot of, even the majority, of top people in their field do things by such principle, and are living a happy + productive life, not only satisfying their own intellectual appetite, but also benefiting the company, and more broadly the world as a whole.
>>We awarded the person who discovered the bug

How much did you award them?
> I looked at a product and either decided to get it or not. Why are you still showing it to me? I'm done with that product.

Especially annoying when I bought the product, and I still get ads for it.
Wow, your tests must be easy.
How Google Earth Killed Santa (2006)
I'd just be happy having a job where someone paid me to learn after showing some basic competency. In return, I would stick my neck out for the company and stay 10 hour days trying to solve problems and not ditch at the first whiff of a higher paycheck.
I recently got an interview with Google (didn't get it), I'd kill to work with them. Even if they pay a bit less than what I'm currently getting, if it means I'll work on something less boring than what I'm doing now (typical business corporate bs where I'm working pretty much by myself).
Upvoted for a great read. (I'm squarely on the "fan" side when it comes to Abba, but I can really appreciate your well-written post.)
Any time I start looking through the source code of one of these games, I wonder how I get paid in the same realm (sometimes even more) as a meager UI developer than these guys doing "real" engineering. Makes me feel dumb, but also intrigued and intellectually stimulated. I'd like to become a better programmer someday, so I could understand this code.
Snapchat - GibSec Full Disclosure
Blizzard Engineer With Cancer Needs Your Help For Christmas
I am part of the system, and it is the only immediate access I have.
3rd-party copies of the video[1][2][3] are "unavailable in this country" on Youtube UK, but this may just be exceptionally fast copyright filters - the content was apparently broadcast on Channel 4 and also 4oD (their internet TV-on-demand service).

[1] https://www.youtube.com/watch?v=eWLFwif-BrY
[2] http://www.youtube.com/watch?v=siy8RP2Vo4A
[3] https://www.youtube.com/watch?v=MjOACWG0oW8
How the F* is it possible that your app's reason of existence depends on proper security and you miss usage of HTTP where only HTTPS should be used? A vulnerability like that could be found with a proper grep on the source code. But even that seems to be too much effort.
I'm not a cryptographer, I'm a potential user. If I was up for reading white papers on this, I wouldn't be interested in having buttons shaped like turtles.

What I'm asking for is a summary of what this thing actually does from a semi-literate layman's perspective...
I wonder what he did at Atari if he didn't code? He wasn't a force multiplier there, he actually ended up on a shift by himself because everyone hated working with him.

I always assumed that he could code at a very basic level, perhaps I was wrong.
Well, whether its derived from sports or not, I still find the terminology to be quite discriminatory. What justifies this, I wonder?

Its possible that everyone in the world is an A-player, given the right chance. But with rampant discrimination going on, I doubt the chance is ever granted in a company that uses this terminology to manage itself ..
They're planning on shipping this browser extension with a hardcoded list of DNSNMC server IP addresses. Isn't that a central point of failure? (E.g. If an adversary mounts a DDoS against all servers in that list.) Adversaries wouldn't need to render the service unreachable, just slow it down to painfully-slow speeds for average users. Regular DNS is resilient to this because of its hierarchical design, but the paper seems to be proposing a flat list of DNSNMC servers that will be shipped with the extension by default. Since almost all users will stick with the defaults, subverting those servers would disrupt DNSNMC for most users.

This is a good point. Two things: (1) you stopped a bit short in your quote. Here's a bit more from the paper on that:

"To avoid falling into the same trap that web browsers enjoy today with Certificate Authorities, okTurtles will encourage the user to use their own DNSNMC server, whether it’s one that they have setup themselves, or one that belongs to someone they trust. Defaults are provided to encourage adoption and to make the software function immediately upon install."

(2) That paper is the first public introduction of DNSNMC, and I expect (and really appreciate) everyone who reviews (and has reviewed) it, and pointed out issues like this.

That said, this problem could be solved by something like a DHT [1]. Or, it might be a non-issue and not really need something that complicated. Just a live-updating list of trustworthy IP/fingerprint pairs (with bootstrap servers, protected by something like cloudflare), might be all that is necessary for the defaults (which again, the extension would encourage switching off of).

Also, it's unclear to me how users or website owners use DNSNMC's REST API to update their blockchain identity entry.

Yes, that API is being worked on right now, so your comments are definitely helpful, and you're also very much welcome to provide any and all other feedback. Here's another great place to do it: http://dot-bit.org/forum/viewtopic.php?f=5&t=1423

Thanks again for your fantastic feedback! (What a wonderful Xmas present! :)

[1] https://github.com/feross/webtorrent
Something tells me a few folks are happy to let you skip Christmas, Grinch.
Global products
It's a remote Windows desktop, running on a remote server and provided as SaaS.

While I agree that cloud is overused in general, it seems appropriate in this case.
>Edit: I realise this is unclear. He needs his private key and the public key of the recipient to encrypt the message. Then only the recipient can decrypt the message. To do this, the recipient needs his private key and the encryptor's public key. Hope that helps.

Incorrect. To encrypt a message, you only need the intended recipient's public key. You don't need your own private key.

Likewise, for the recipient to decrypt, they only need their private key. No need for the encryptor's public key.

You can send messages to other PGP users without ever creating your own keypair. It's only to receive encrypted messages that you need a keypair.

Now, if you want to sign a message that you're sending, you need a keypair.
So what? A privileged person can be correct, and an unprivileged one can be wrong. What do you gain by checking your privilege over checking your reasoning/facts?
Exploitable PHP Functions (2010)
I used to think this was the case, but I use chrome in incognito mode ( and only for fb!) and I'm starting to get retargeted ads. I suspect they are using some sort of 3rd party on the backend. Moreover, it's not only ads now ... I'm also seeing suggested groups that seem eerily creepy ...
What exactly are Greenwald & Omidyar doing?
I'm a programmer. I learned programming over the past 10 years. Take the best lawyer, doctor, or chemist, and I doubt that they can learn to be A player relatively soon (i.e. in 2-5 years). Even if they could learn programming, they would probably not be as good at it as they are at their own original skill. I'm sure it goes the other way round as well.

And after all, why would an A player want to learn a new skill, if they can make a very good living using their present skillset (albeit in a different company)?
Show HN: HTML5 cover flow audio player in 150 lines of Pythonium for Firefox 26+
I always find such logic incomprehensible. Is a job that suits your interest, contributes to others in a meaningful way, and makes your life rewarding while at the same time keeps you a decent living ever so hard to find? I don't really think so. Why do people have to think like "it's I against the world, the job I do is the enemy of my personal enjoyment"? It's weird and potentially harmful.

In fact quite some people who I see getting into finance jobs with the "getting-enough-money" mentality often end up miserably. Without any love for their jobs, then no wonder.
Ask HN: Do you think the Subscription model will be the future pricing model?
Exactly++
You might want to think about redesigning the cover, the title isn't legible.

Looks interesting though, I'll be reading it later this week. Congrats on writing a book.