skysight-inc/HackerNews huggingface dataset:
It's awful because for the first time in human history there will actually be a race of people who are superior to the rest. Hasn't exactly played out great even when it's just in their imagination.

Put yourself in the mind set of a super rich and powerful immortal human being. The stakes are hard to imagine, you are trying to preserve your existence for an infinite future. People who stand in the way are not even going to have a chance, an immortal can't afford such a risk.
What about the super common: "I don't want to work because there's a much more immediate source of dopamine release right here on this page of interesting internet links..."
What about: I am having so much fun doing other things that I don't care enough about what I should be doing? (or replace 'should' with 'know that would make me happier in the long run and also be better for my family')
Or, the company hides the "unsubscribe" link in a tiny font at the bottom of the email, and it's just much simpler to hit Gmail's big "spam" button at the top.
Here's my personal algorithm for handling commercial email that appears in my inbox:

1. If I'm highly confident it's spam, mark it as spam. (Very rare necessity singe gmail catches spam pretty well).

2. Otherwise it's something I have subscribed for, perhaps without noticing (opt-in by default from some service I have used). Look for the Unsubscribe link, click it.

2.1. If the Unsubscribe link IMMEDIATELY unsubscribes me (landing in a page that just confirms I'm already unsubscribed), ok, then just delete the email.

2.2. But if ANY additional interaction is required--choosing a reason for unsubscription, having to click another button--after finishing this, I will also punish the sender by going back to gmail and mark the email as spam.
> Isn't our willingness to take risks connected with our inevitable, eventual, death?

Is it? Does anybody who takes risks really do any kind of mental calculations involving expected lifespan?

I might be too young, but having 60+ years in front of me feels almost like being immortal, and I have to constantly remind myself my time is short. But personally, I have never ever had the issues of death and short lifespan crossing my mind when thinking about taking risks or doing something creative.
Which is fine, but in my experience flaws like this are often introduced via automated merges that could as easily have resulted in:

if (...) {
goto fail;
}
if (...) {
goto fail;
}
goto fail;
if (...) {
goto fail;
}

which produces the same bug. (Everyone's been shouting about "braces in single statement if clauses" as though they're an absolute fix; they're not, although they're a good idea in general. And yes, code review, better merge tools, yada yada.)
Capsicum is much more intuitive so I think it would be a lot less work to set up without tooling.
A day or two for an important security update is too long.

I heard about this thing yesterday on HN and did the update manually. My dad and sister's iOS devices hadn't notified them yet when I told them about it today, more than 24 hours later.
On his site he claims "One way or another, I have a couple meg of code and documentation in the core toolset of every general-purpose Linux and BSD distribution in existence." Assuming that is true, would your opinion about 'owing him a living' be different? I'm not suggesting that it should change your opinion, but it's an interesting concept (to me anyway) to consider if one's unpaid past work that benefits many others is a legacy worthy of some compensation.
IMO Hashing on the client side is a terrible idea. There is now no way for the application to check the complexity of the password on the server side. Relying on client side controls to do the same is almost useless.
Yup. If google can clear you promotions tab out of stuff you don't care about, it makes the ads they place there more valuable.

Many people, it seems, haven't noticed that google is now placing ads in your "promotions" tab that look just like email: http://www.thewire.com/technology/2013/07/theres-easy-way-es...
"worlds greatest hackerspaces"

To which I would point out any child that makes it to a hackerspace probably has parents of tech interest. If it isn't available at Target, Best Buy, or Wal-Mart in the US (not sure EU equivalent) then it isn't going to train many new programmers.
I think one of the challenges of hosting a "sub-HN" is that the hosting costs are hard to justify.

This raises the question: How does YC justify hosting costs? My completely-off-the-cuff-assumption-take-this-with-a-huge-grain-of-salt is that YC benefits by having a huge audience to make announcements to, like job postings at YC funded companies, various pg essays, or just investing in overall goodwill from the HN audience. Probably the most likely reason is to increase deal-flow to YCombinator itself, though.
Why is the mailer asking you why you're unsubscribing a punishable offense? Mailchimp does this by default on any of their unsubscribe pages (which come after you've been unsubscribed).
Browsers don't support SRP, which means that if you want to use it, you'll need to deliver it via Javascript. SRP is particularly tricky to get right; a substantial fraction of the SRP implementations we've looked at have bugs that cough up authentication bypass. SRP verifiers are easier to crack than bcrypt hashes (though harder than trivial salted hashes). And finally, it's not much of a win; you get the same or better protections simply by running your login over HTTPS.
Sure. We have founders from I believe 22 different countries in the current batch.
This is not about spam. This is about newsletters that users subscribed to, e.g. because they were interested in a product.

Now, such newsletters are very viable: often you subscribe to them when purchasing a product or getting a freebie. For many users (i.e. my parents) it is very hard to find out how to unsubscribe from them.

Currently, such newsletters are very effective. Sending them doesn't cost you much (from MailChimp to DIY) and you retain a lot of users, since they find it hard to unsubscribe (or don't bother). It doesn't really matter that Google adds advertisements besides such e-mail, because if I had a list, I have already slipped my advertisement into a user's mailbox for free.

Making it easy to unsubscribe from such mailings makes them less effective: it will become harder to retain a communication channel to potential customers, since more of them will unsubscribe. So, Google Ads become more attractive as an advertisement tool, evenmore because users cannot unsubscribe them (short of using an ad blocker).
ASPIRING MODEL
Exactly what do you mean by this?
ESR seems to like to take over maintainership of projects. There's nothing wrong with that, but I know plenty of people who maintain lots of low-profile projects who don't make a point of listing just how many projects they're responsible for.

He also has a long history of turning whatever one-off tool he built for a particular project into its own project (that nobody but him uses or develops) and citing that as well.

He's done some decent work but that doesn't seem to satisfy him. He has to be a leading light and a visionary, and he doesn't seem to know or care that describing oneself as such is off-putting.
4. The guy's also famously wealthy
Not really. If you buy 10 tickets, you're buying an extra dose of thrill because you think "I bought ten, I got a better chance of winning".
> once the leader has seen the light be on a sufficient number of times he can definitively say that they have all been in the room.

Ah, but what's a sufficient number of times? The unknown initial state is what tripped me for a bit. :)
It seems relevant to recall Raymond's VA Linux windfall post from back in the day, if for no other reason than it illuminates his position on wealth.

https://lwn.net/1999/1216/a/esr-rich.html
The part about having to use HMAC for keyed hashing is (hopefully) going to be obsolete soon. SHA-3 is explicitly designed to be safe under the H(key+message) usage.
Incidentally Bcrypt does have a 56 byte limit

This is incorrect; bcrypt has a 72-character limit. Try this in python:

import bcrypt, sys

salt = "$2a$10$2TmO7iAhRfimvNwvpBn.7e"
print bcrypt.hashpw(sys.argv[1], salt)

Nearly identical 56 and 57-char inputs produce different hashes:

$ python pass.py 12345678901234567890123456789012345678901234567890123456
$2a$10$2TmO7iAhRfimvNwvpBn.7e701F3mp2Z7fpuY/4lu6vUUkrlMEmMou
$ python pass.py 123456789012345678901234567890123456789012345678901234567
$2a$10$2TmO7iAhRfimvNwvpBn.7ejJV9jpN0Ahp2RmNAdUGaRxRZndRAs9y

Nearly identical 72 and 73-char inputs produce identical hashes:

$ python pass.py 123456789012345678901234567890123456789012345678901234567890123456789012
$2a$10$2TmO7iAhRfimvNwvpBn.7e9w2f6/fKQ2QBu1eaIXp4A1WheruxtGK
$ python pass.py 1234567890123456789012345678901234567890123456789012345678901234567890123
$2a$10$2TmO7iAhRfimvNwvpBn.7e9w2f6/fKQ2QBu1eaIXp4A1WheruxtGK

you can use longer bcrypt passwords by doing a SHA256 pass

True, but: Beware! Imagine you're doing bcrypt in C, and the first sha256 output byte is a 0-byte. bcrypt() sees the NUL / empty password and produces a hash trivially breakable by anyone aware of this issue. :-)

So I'd recommend doing Base64 on the sha256 hash, if you're using C and you want such long passwords with bcrypt. But plain bcrypt will give the best results.

Hopefully the above illustrates the general wisdom of avoiding DIY crypto of any kind.

edit: code formatting
layers of containers wont give you much. the main issue is the shared kernel, any bug there, any shared resource from there, and all containers have the same risk, no matter how many levels of nesting you have.

layers of vm's, lxc containers, zerovms, etc, will probably make the attacks harder, but also the management, and speed, will suffer, and the security/useability trade off will probably not be adequate (given how fast vm's start anyway, if you want more isolation, you could just use a VM then)

Zerovm is nice, but it requires porting, and of course, is not a silver bullet either.
"login to unsubscribe" is worse, especially for cases where I'm not sure off the top of my head what my login details were. I just want to decrease my mental overhead and now it increased by making me think of that.
> Chip manufacturing is now mature

Yes, but while we're hitting the limit of our current solutions, AFAIR there's a lot more room to explore with 3D chips and optoelectronics. We might yet squeeze some more progress out of it.

> Biotechnology is an infant, like computers at the 50s. Why should we not expect huge progress from it?

We should, and in this case we have a good reason to believe it - every living thing on this planet, and every little bit of what we discover about them, is an evidence that nanotechnology is possible, works, and can do amazing things. The challenge in front of us is to understand, take control and re-purpose.
I get the same problem, and I use my calendar as a weapon against it. If you have three things you need to do, pick one and block a time off on the calendar to focus on it and ignore the other two. After that it's the calendar telling you what to do, not your own self doubting brain.
It's actually a CSS rule:

animation: draw 10s linear infinite;

That's in the .path class, which most of the elements in the SVG are classed as. Works really well!
This is because everyone in developer's community is asking for tips and donations even if they can afford a standard living without it.
I remember reading an article which conveyed, ask for tips and donations only if your livelihood depends on it and it sounds very reasonable.
>Yes, that's why we require political leaders to step down from office eventually. But the civilized way of requiring leaders to step down from office does not involve killing them.

I'm talking more in line of philosophical movements. Political leaders are not that important (although it sure seems that way to us).

In my opinion, we as a species, need to have that failsafe of time perspective on ideologies. We risk lurching in a wrong direction with no possibility of coming back on track otherwise.

No single generation should decide to faith of humanity as a whole.
OPEC Data Visualisation Portal
median = size % 2 == 0 ? (homework[mid] + homework[mid-1]) / 2 : homework[mid];

In my opinion the ternary operator is misused here when an if/else would have been clearer.
What a fun puzzle! The "ah-ha" moment is realizing that the brains of the prisoners can be be used to store the state, and not just the panel of switches. My initial reaction was to think about the storage capacity of the switch panel, and immediately hit a wall because clearly you can't store 26 bits in 2 switches. So you have to go hunting for another place to maintain state - and of course in the head of one of the prisoners is a great place!
My thesis was split in multiple files.
I mean Facebook should put a web bug on the target page.
Platform flame, FYI.
I think it's implying that services which you intentionally (or accidentally) subscribed to usually have a setting when you log into their service in which you can enable/disable their marketing emails.

Conversely, emails you get in which you can only subscribe through a link in the email or elsewhere is almost always some shit you never signed up to, thus, spam.
I completely agree. I'm just explaining why it might show up more quickly on some devices, purely due to chance.
Yann Lecun defends AI
> Easily, by not making PR announcements before you succeed.

Oftentimes it's the PR that is the difference between success and failure.
The worst ones require one to log in to unsubscribe. I wish there was a harsher punishment than just gmail's spam button.
Simple and free currency JSON API
A large pot of general taxation, yes. That is how it works in the UK. Arguably NI should be a wholly separate system that only funds the NHS and state pensions, and be run as a real insurance system, but it's not and converting it is next to impossible.

But my point stands: I'm not including the NHS budget in mine, for this.
We tell the alumni explicitly that they're obliged not to disclose what they see in applications, and that if they see an application that competes with them they should click on the "skip" button provided for this purpose. We can't watch over their shoulder as they do it, but we're careful about which alumni we pick as reviewers, and there has never been any problem so far.
Adobe releases emergency Flash update amid new zero-day drive-by attacks
>Your Salt should ALWAYS include a feature you have to store anyway about the user that would be unique to your service.

What is your rationale for this? Is your concern is that a random salt will accidentally collide? With a 128 bit salt, there is a one in a million chance of a collision occurring in a set of 26 quadrillion.

>UserName + PassWord + User ID + CreationDate + <Numerals from a Base64 encode of the users first and last name>

That is just incredibly low entropy compared to a random string of bits. If you do this and use (as you suggest is just fine further down) MD5 or SHA1, you are begging for disaster if your site is worth attacking.

>MD5 and Sha1 are only bad because there are rainbows for them

Wrong. MD5 and SHA-1 both have significant vulnerabilities.

>bcrypt is ... not any more secure if you did the other things above

Insanely, completely, ridiculously wrong. MD5 and SHA-1 are stupid fast. A GPU-based cracker can try 5.6 billion MD5 hashes per second, and 2.3 billion SHA-1 hashes per second. If you're using a long random salt, you might hold out for a while after a data breach before all of your passwords are cracked. If you derive a low-entropy salt the way you explained above, you'll be completely boned.
But if browser makers decided not to support the hashes, the website owners would have to upgrade. Why allow them to continue to use weak hashes?
If a service puts me on a subscription list without asking me, and then at the unsubscription page throws a questionnaire at me as to why I am unsubscribing, I take that as dishonest behavior.

Obviously I am unsubscribing because I never subscribed in the first place!

Depending on how completely unrelated the subscription is to whatever I signed up for (say I signed up for online image hosting, and they start sending me emails about their fantastic paid backup service) then I mark it as spam even if the unsubscribe button is easy and single-click.
I don't disagree with any of this. We're now litigating a thought experiment I proposed upthread. In particular: I agree that straight up browser bugs are more common, more exploitable, and more appealing than NSS parsing bugs; I just liked the symmetry of comparing a TLS logic flaw to a different TLS parsing bug in a codebase people weren't as familiar with.
I obviously didn't proofread that first one. I am in general against centralized power unless it does more good than harm. Healthcare, for example, holds power, but I'm surely convinced that the decentralized power that health insurance companies have is superior to government-managed health care that is done right (I'm in Norway now, and from what I can observe, works for the user's health benefit)

Asked to work? Most of us Have to. At the bottom rungs, keep your mouth shut, dress like the accepted average, and fit in with the company's culture. No creativity or input actually needed. And no questions trying to learn things. You don't need to know what the management knows. This isn't pressure? How many 32 year olds working in fast food views their job as useful or productive?

Using the 32 year old with the fast food as an example... do they feel they are valued? Likely not. Fake job, but it is a job. I somehow doubt this would change much.
A post by him from after the deal was signed: http://www.flyertalk.com/forum/22387891-post72.html
> So your entire impression of San Francisco's history...

My comment was quite clearly addressed at SF's current population, not previous ones.

In fact, that's one of my major gripes with them: they benefited by riding a previous wave of change, but now that they're the status quo, they want to stop the next one.

It's the classic, "I got mine, now slam the door" mentality.
Exploring an alternative to git-subtree
Elysium is fascinatingly weird film - so they had all those ships packed with wonderful medical technologies and robots standing by on minute's notice and still refused to spare any of it because of pure spite, despite not even needing them at all, as they all have the same things in their homes, so only reason why they also had all those ships with medical robots would be to heal Earth people - but they never did, so why they built those medical ships in the first place? Just to taunt poor earthlings?

They have the technology to reassemble human body on molecular level and they still need millions of humans to work in degrading conditions to build those robots - because those molecular-precision technologies somehow not applicable to building robots? And yet despite their dire need of those workers - they not only dispose of them without second's hesitation but also allow their robots to mutilate them for no reason, thus degrading their productivity significantly.
This movie really doesn't led itself to any thinking - it just falls apart like wet toilet paper if you start to think about it.
There is No Ghost in the Shell: GITS Movie Analysis (2013)[video]
That PBKDF2 has been more extensively studied, but it has lower memory requirements. So the chances of a surprising vulnerability being found in bcrypt are higher, but failing that, it is the better option.
Don't forget to divulge when you can.
You can always use Tomoyo instead of AppArmor (also available in ubuntu). It allows you to configure specific rules for each domain, where a domain can be "this app" just as well as "this app started by that script", so you can differentiate between them hopefully.
Thanks man, that's generous of you!
Vultr: DigitalOcean Clone
Agreed. That and blank lines between the if blocks to visually separate the code blocks as well.
Sometimes the answers that are the simplest appear most profound. Like yours, in this case.
I just came out of a project using AngularJS with a Spring backend, so they also use new stuff, not just everything that is the flavour of the month.
This was a fun problem. On the other hand, I felt cheated when Vidit Drolia of Yammer gave this problem and expected it to be common knowledge enough to be solved in 3 minutes. Don't think it's quite that much of a valid interview problem.
The cracking community, unlike the bulk of the mainstream programming community, has not lost the art of disassembling executable code. Hiding source code provides negligible additional security.
>One way or another, I have a couple meg of code and documentation in the core toolset of every general-purpose Linux and BSD distribution in existence

Is this true though? Wikipedia only lists CML2 (the rejected new config system for the kernel). Grepping through Ubuntu's /usr/share/doc doesn't turn up much either (libpng, libgif and some minor stuff).
"For the past two months, I’ve been living in the world of keystroke tax."
Presh Talwalkar posts weekly logic puzzles[1]. His blog is a good source of interesting applications of economics and game theory to the real world.

[1] http://mindyourdecisions.com/blog/
LinkedIn has a few features that irate existing users. Letting other LinkedIn users anonymously check your profile comes to mind. Some feel it's like virtual stalking. My stance is that this a is a free platform and you can voice your concerns and issues with it but at the end LinkedIn has a final say on what goes. The same goes for Facebook and its privacy issues.
It was somewhat of a rhetorical question, but yeah, this is what I assumed as well.

In trying to find Google's policy and handling, I came across this interesting (2006) analysis[1]. Apparently they do pursue this on a case by case basis.

[1] http://static.googleusercontent.com/media/www.google.com/en/...
Mesa was followed by Cedar, which used reference counting with GC for collecting cycles.

Not to mention the Interlisp systems as well.
You can use a SecureRandom implementation that uses the underlying entropy pool for every call, or you can use an ordinary implementation of SecureRandom and call getSeed(numBits) instead of next(numBits), or as you mentioned, you can call random.setSeed(random.getSeed(NUM_BITS) every once in a while. Finally, if you are on linux the default SecureRandom provider will mix urandom with the prng output on every call to nextBytes, so there's no need to reseed at all.

Anyway you look at it, there's no good reason to instantiate use a fresh SecureRandom instance every call.
What we need here isn't regulation -- the cell business at least in the U.S. has all kinds of regulation. What we need is the ability of the consumer to sue these companies if any of their data gets released.

Regulation puts all the risk in one bucket, the regulator. If the company can deal with the regulator, they're good to go. And we've seen how good government oversight of privacy is going to be.

Open things up for civil suits, on the other hand, changes the economics drastically. Companies don't have to worry about making one agency happy. Instead, they have to worry about each and every customer. That's exactly the kind of care we expect from these bozos in the first place.
Because this has really bad unintended consequences written all over it. When the people controlling a significant percentage of the world's wealth are more importantly concerned with their immortality than the well being of the rest of us, it will come out in many, many ways, and a lot of them won't be good for the rest of us.