skysight-inc/HackerNews huggingface dataset:
Apple promises fix 'very soon' for Macs with failed encryption
The portion of the tax going to public education should have been $40 million plus a flat 5% of revenue to really scale if it's really that lucrative.
Blue sky law
also a sax player. do those practice bag thingies even work? i'd rather just use my ewi if its really a time of day making actual sound is not allowed.
Whoa. I've never seen that before. I play trombone. And I've never felt bad for sax players until now :-)
HN must really be on the decline :(
Sadly they use Jobvite. Its usability is about as bad as Lotus Notes.
I would expect memory corruption bugs to be harder to exploit, because their exploiting might require knowledge of some particulars of the environment (maybe we need to know the exact version of the buggy library used, so that we know the memory layout/location of some symbols; maybe we need to know some particulars of the interaction between library and application like how long are the buffers that the application passes to the library). Am I completely wrong or are such problems easy enough to overcome?
It amazes me that Facebook don't get sued more often, if our experience with their ad management is at all representative. The UI is terrible, and plenty of the statistics it shows appear to be broken in unfathomable ways.

Estimated audience sizes? Nonsense.

Suggested ranges for bids? Sometimes change by almost an order of magnitude between submitting the ad details and checking the dashboard a few minutes later.

Preview your ad as viewers will actually see it to make sure you've got the image size right? ::hilarious laughter::

Figures for click-through rates? I don't know why you'd only want to pay for actual clicks to your site and not other things like people clicking like on your ad or your page. After all, someone liking an ad that will be gone tomorrow is surely worth as much to you as someone actually visiting your site.

What times will your ad run? We'll assume you're in the US even though you explicitly told us you're in the UK. And then we'll also price everything in dollars, so you pay a conversion fee on every bill. And no, you can't change this once your account is set up.

Just set it up the same way as last time, we were satisfied with that? Sorry, the system has changed again and you have to start over.

Maybe we could use a third party ad manager to try to overcome some of these difficulties? Sure, but they're all going to work a bit differently, and the options they present won't match what you see on Facebook's own ad management pages.

All of this is based on various experiences as a small business advertiser, and in most of the cases I'm thinking of the real numbers still worked out favourable despite all the problems and the frustration of trying to get everything working so the campaigns went ahead. But if Facebook treats larger customers spending serious money the same way, it's not hard at all to see why we hear stories like this from time to time and why legal action can result.
This isn't a defense of Apple's choices, but:

Using public implementations for crypto code has been difficult until pretty recently. There didn't exist many high-quality, trustworthy, public implementations of the types of crypto that real-world systems have wanted to do.

Even now, the situation is pretty grim for anyone who wants to integrate crypto code into an existing large codebase. The canonical answer is "just use NaCl." However, I've had developers outright refuse to use NaCl because "it's so hard to compile." They were saying NaCl has some issues compiling on certain types of architectures, and issues compiling as a dynamic library. When libsodium was suggested in response, they retorted that libsodium was "NaCl but with modifications by people other than the ones you'd want making modifications to crypto code." In other words, libsodium purports to be "NaCl, but easy to integrate into your project," yet the reason it's easy to integrate is because someone other than recognized cryptography experts fiddled around with NaCl until it was easy to compile. So apparently it's an open question whether libsodium is as trustworthy as NaCl, and NaCl is a pain to integrate.

All of this implies that the current situation is still not very good as of 2014 for people who want to just do crypto safely and in some standard way. And rather than writing that code in 2014, Apple had to write it years ago, when the situation was far more painful than the present day's shortcomings.

To answer your question, yes, there are public implementations which could theoretically be used. But actually using them is... difficult. Not nearly as difficult or as error-prone as rolling your own, but perhaps difficult enough where someone who isn't an expert in cryptography might make the dire mistake of believing that rolling their own is less difficult.

I wish Matasano would publish an open-source crypto library. An "NaCl that's easy to use and that people actually trust." They have the resources and the credit to pull it off.

Alternatively, I wish we could gather funds to have them audit libsodium.

Also, all of this is based on the assumption that NaCl or libsodium actually meet the needs of what Apple was trying to do with this crypto code. It probably doesn't, because NaCl / libsodium provides a complete replacement to the entire crypto stack of an application. To take a wild guess, I'm thinking that Apple needs to implement / interact with some other kinds of crypto than what NaCl/libsodium provide. For example, certificate validation. So then you'd suggest "use cryptlib!" but this is hampered by the fact that in addition to all the previous considerations, cryptlib also isn't free.
It may be a bug on my phone, because the option is there.
Which is a good ranking.
Great persistence.
OOSafeErase 7 Server x64
Right, and what if I don't feel like working, but I do feel like eating?
I hope this gets traction, I really do want the facebook stock to drop.
Thanks! Is it surprising that they open source it? That gives their adversaries opportunity to look for weaknesses in their code. And as for benefit for apple, ... it seems to be exposing the fact that they have a mixture of tabs and spaces and have let someone edit an absolutely critical file with no code review or testing.
Why evil yandex?
Never pay market value. Always pay above or below.
Being able to buy a rPi at any time from a vending machine located in one of the worlds greatest hackerspaces means that - at any time - a kid can learn new things, for cheap.
Ugh, don't read the comments, people arguing Mac vs Windows. It would be better for the universe if the BBC just disallowed commenting and all the discussion takes place on 3rd party sites like HN.
Why you consider Yandex evil?
I don't know about those books, but in the case of these koans, it's intended to be entertaining. It's a joke. I think it's also intended to be irreverent.
Silicon Valley is No Model for America
I chortled at the Google Finance quip.
What you say is true. But security through obscurity doesn't work, because people are very good at reverse engineering and decompiling. So your choices are either: open source your crypto code and suffer some embarrassments which people will forget and forgive, or have closed source crypto code that either doesn't work or can be exploited in subtle ways. Pick your poison. :)
Except this bug is passively exploitable at scale.
Drug legalization isn't the problem, corruption is. When the cartels can buy any officer and government official in Mexico, legalization will only give them more power.

"4) In a competitive, legal market, the successful firms will be the ones which offer the best product - the firms with the best drugs, the highest standards of quality and ethics, the nicest stores, and the best customer service. Why buy from dodgy drug-dealers when you can walk into a beautiful store and get great customer service?"

Really? So Walmart and Amazon have the highest standard of quality and customer service..really??????

"Why buy from dodgy drug-dealers when you can walk into a beautiful store and get great customer service"

Because money talks. The government will tax and regulate drugs. Many users will not want to pay a higher price for a lower quality product (quality might be THC levels, etc).

Why go to dodgy virus-laden websites to download software and music when you can go into a beautiful store with great customer service?

I'm all for the legalization of MJ, but I feel like common sense goes out the window in any of these discussions.

If the community is all about stopping the violence, why not boycott all cartel grown drugs?
Some people do not have such a luxury. I cannot arbitrarily decide to ignore my daily duties simply because I don't feel like working. I'd be fired. The same goes if you are a business owner in charge of your working hours. You cannot arbitrarily decide that your client portal outage doesn't matter because you don't feel like working. Your client is going to fire you.
> If you feel like working, then work. If you don't, then don't work

I know this is HN, but please don't over-parse the headline. Telling your boss or customers that you just don't feel like working today is a luxury that almost no one has.
In a similar vein, I'd recommend http://www.hackernewsletter.com/. I subscribed a few weeks ago and have enjoyed it quite a bit. An example of their latest newsletter: http://us1.campaign-archive2.com/?u=faa8eb4ef3a111cef92c4f3d...
Are you sure? I have over 60k karma and still can't downvote links.
Network Hacking with Mike Macedonio
Why HStore2/jsonb is the most important patch of PostgreSQL 9.4
Whatsapp Outage: Intense coverage on digital Media may be the reason
and GEMA hits .. Can not watch this in Germany because of SME-music content.
Sounds Interesting..
I have found the Pomodoro Technique (http://en.wikipedia.org/wiki/Pomodoro_Technique) to be helpful. I can't do it for a whole day, but a short sprint to grind through something is a near, achievable goal. For extended, head-banging frustrations, it's helpful to step away, think about it without the distraction of the screen, and coming back at it with fresh eyes. The time AFK is not to be underestimated: http://www.paulgraham.com/top.html
It's blocking by user agent and source ip. You should be able to port the list easily for Nginx. I'd even say you can write a simple awk script in a few minutes to convert from Apache's format to Nginx's.
If you get fired, then what? Even if you don't find a new source of income, you're not going to starve. Only a few hundred people starve per year in the U.S. What's the big deal? It's all just psychological issues in your brain. Either way is actually fine.
Core Intuition Jobs
The post was on a blog, not a news article and nonsensical titles are commonplace. And the submitter followed the HN guidelines of using the same title of the post.
The ease with which a bug can be exploited has everything to do with its impact. Exploiting buffer overflows is messy, requires a lot of effort, and it's detectable. Thus, you are more likely to use it for something special.

Apple's TLS handshake bug was trivially easy to exploit, entirely silently, in a fully automated fashion and with zero chance of detection and without leaving a trace. That's why it's a big deal.

If you are in the business of collecting massive amounts of data, this is exactly the type of bug that you would be using. SSL clients leak a large amount of data in the handshake (supported protocol versions, cipher suites, extensions, etc), allowing you to fingerprint them and detect the vulnerable ones on per connection basis. You then attack, safe in knowing that you won't be detected.

Once you get the victim's password (e.g., if you attack their email client), you can suck out all the data you want. Because you are the MITM, you can do it from their own IP address, too. All fully automated.
https://www.kickstarter.com/projects/tanttle/emotiv-insight-...
A VB script file on windows does the same thing easily: CreateObject("SAPI.SpVoice").Speak"text"
There's a well known and clearly visible trend that more institutional (i.e. not friends and family) investment is moving later stage for "normal" software businesses.

The reasons are well known: the cost of developing software (at least the initial prototype) have dropped far enough that a great many people can afford to build a prototype themselves.

Further, the cost of market validation has also dropped enough such that a great many companies can achieve some market validation without outside capital.

Put together, it's a reasonable expectation that a dedicated entrepreneur will put in both the minimal time and money to both build a prototype and prove that real customers exist who view the solution as valuable.

However, the cost of building a big business is still high. Specifically, ramping up development, hosting, marketing (team and spend), sales, etc. still costs enough money that outside capital helps.

This last point is key and answers the question of "why would I raise capital if I did all of the work of building a prototype and getting my initial customers?".

Lastly, the ultimate goal is to succeed. There are a number of different paths to success, but one of the worst failures is not outright failure of a company.

If you think about the possible outcomes of a business, there are basically 3:

1. Complete failure...business shuts down

2. Moderate success...$2 million, $5 million up to maybe $25 million

3. Success... $25 million plus with the ultimate goal of doing 9 or 10 figures a year

#1 sucks. Maybe more without venture capital as its your money you lost, but it's good in no way.

#3 is great whether or not you get venture financing. Depending on your financing, you'll walk away with $5 million or more personally.

#2 can either be a wonderful success, or the worst failure (worse than #1). #2 is great if you bootstrapped. If you bootstrapped, you'll walk away with $5 million or more in your pocket. If you grow to $10M+ in revenue, then you're financially free.

However, #2 sucks if you raised significant capital. Most likely, you hate the company because you'll walk away will nothing even though the company has had some success. Investors will hate the company because the investment is sucking up time, focus and will never be a winner.

In this light, waiting to raise capital until a company is a little bit more mature is a boon for entrepreneurs. If you have a #1 then kill it and move onto the next opportunity. If you have a #3, then go raise (or don't).

But, if you have a #2 then you know you can get rich by bootstrapping, which will prevent you from making the mistake of raising capital for a non-venture fundable business.
You are correct, most people would not starve; however, losing one's job is not something to be taken lightly. I imagine the following would be a very difficult conversation with your family: "Well, I just didn't quite feel like working today. As a result, I lost my job. You may have to go without many of the things I have previously worked so hard to get for this family, but at least everyone won't starve."

EDIT: Also, the issue of hunger in the United States is much more serious than you think.

http://feedingamerica.org/hunger-in-america/hunger-facts/hun...
Happy Birthday Tom
The Programming Language Consensus
Google is what you get when you hire essentially random people, all of whom believe or are led to believe that the process that led to them being hired is infallible.
Could a trumpet be adapted to have an extra valve after the mouthpiece but before all of the other parts, that diverted a certain amount of the airflow, and thus would make the playing experience more similar, or do I not understand the physics of brass instruments ;-) ?
Judgment vs. Understanding
The escape sequences to set 256 colors were previously hardcoded into tmux, instead of detected from terminfo. That works fine, until you use a program that uses different escape sequences.

I suspect terminals don't set 256 colors by default for backward compatibility reasons. tmux itself didn't assume, you needed something in your config file or a command line option. Now though, I believe it can detect it based on your term.
Yandex's documentation about implemented robots.txt features:

http://help.yandex.com/webmaster/controlling-robot/robots-tx...

Yandex's online tool to check specific URL on allowness in robots.txt:

http://webmaster.yandex.com/robots.xml
I frequently wonder - is Facebook allowed to say, "bing, you can crawl us. NewCompetitor, you cannot."

I feel like once a company allows public access by posting stuff on the web, they can specify terms, but not include/exclude groups specifically. (In a legal sense; I understand blocking systems that hammer servers but will respect robots.txt. IME bing is the worst offender -- they hammer my sites, send no traffic, but will stop if I specify in robots.txt.)

Does anyone have an opinion about "once public, I can crawl"?
Are there companies other than Google that do this? I haven't heard of any, but that doesn't necessarily mean anything. I always thought the practice was unique to them.
At last! This release is a significant milestone for us as it is the first
release we consider to be production ready.
>Unless your website is written in Russian or Chinese, you probably don't get any traffic from them. They mostly just waste bandwidth and consume resources.

THIS is evil. You could use this argument for banning any new search engine.
While you're correct, the fact that someone can define an IQ test as the test that most strongly correlates with the g-factor (itself merely a composite factor from a number of different measures) doesn't mean that IQ, or the g-factor, or "general cognitive ability", corresponds to any physical causative factor: http://vserver1.cscs.lsa.umich.edu/~crshalizi/weblog/523.htm...
I was going to upvote you until I saw your edit about downvoting. I believe you should state your mind without concern for arbitrary internet points. If you express concern over these points, it weakens your perspective, in my opinion, and I am much less likely to award you those useless points.
If you fear breaking it, why not replace / revolutionize instead. See GCC vs LLVM, X vs Wayland, C++ vs Go.
I'm not sure of your point. Cocaine does have legal uses, especially with ENT doctors/surgeons, who use it as an effective anaesthetic.

But the profit margins in the illegal drug market is largely because of the risk involved. Facing legal competition, which does not have to include that risk in its price, is effectively creating a market where legitimized producers have an extreme advantage.
Buying a lottery ticket is rational if the cost of the ticket is offset by the relative increase in your pleasure that comes from dreaming of winning.

For example, if you gain >$price of a Powerball ticket worth's of entertainment from musing about how you'd spend the prize, it's a rational purchase.

On the other hand, buying two tickets isn't rational. You get no extra dreaming, and your expectation of winning hasn't moved essentially at all.
Pomodoro saved my butt during my senior year of college. I put off a book report until the last minute and found myself needing to read 5 chapters about medieval Italian republics in 3 hours. I allocated 1 Pomodoro to each chapter, and said that if I hadn't finished the chapter before the end, I would skip to the next one. This forced me to speed read and skip confusing parts (instead of re-reading them 10 times). The report wasn't one of my best, but I wouldn't have finished it at all without the structure I got from Pomodoro.

I used the focus booster app for OS X, I highly recommend it: http://www.focusboosterapp.com/
> A world in which a healthy adult has the reasonable expectation of earning a decent living while working full-time at a market wage is absolutely a world in which the dignity of work is a useful social value to cultivate. In a world in which that is not a reasonable expectation, the dignity of work can be a harmful concept.

Interesting times ahead. It's going to be painful getting there, if we get there at all, but the idea of a Universal Basic Income seems to be getting more popular. (It wasn't so long ago it was pretty much pure sci-fi.) Particularly I guess as it begins to look like modern capitalism may not actually be good at providing jobs for everyone who needs one.

Potentially UBIs could be very good for the world, freeing people to work on things they personally desire and value, and in some ways redistributing the 'means of production' back to the little guy.
Two thoughts:

1. Your objection applies to all sales tax.
2. Why do I think you would be equally outraged for staggeringly high laws on pollution-generating industries or firearms, which do have negative effects on other people.
If you're big enough, doesn't this just make sense? Why waste time maintaining a robots.txt policy when it must represent a tiny fraction of your traffic, which your servers can surely handle? And the really 'bad' guys are going to ignore it anyway. And if you really care, you'll have some much more sophisticated bandwidth throttling in place.

For the smaller guys, sure it makes sense to have some kind of simple robots.txt policy.
I second this. Usually I get distracted anyways, so I program 8 hours and get it done in 12 or so. It's harder to use when you have a lot of outside constraints in scheduling (you can't really walk out of class for 5 minutes every 30 minutes), but I use it on weekends and when I have a free-ish schedule.
Ford electronics were a good part of the reason I'm a 2013 VW GTI owner.
موعد مباراة يانغ أفريكانز svالأهلي دورى ابطال افريقيا 2014
Because of the idea of ultimate goals vs. proximate goals. Greedy algorithms are poor ways of finding happiness.

I know that I find work fulfilling. However, I don't like starting work. If I took your advice, my life would be far less pleasant (and not only materially).
curl -s https://raw.github.com/bluedragonz/bad-bot-blocker/master/.h... | awk -F\" '/SetEnvIfNoCase/ {pattern = pattern $2 "|"} END {print "if ($http_user_agent ~ (" substr(pattern, 0, length(pattern)-1) ")) { return 403; }"}'

Not tested. :)
Why doesn't FB to implement restriction/ACL for accessing uploaded photo?
Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos.<p>http://i.stack.imgur.com/673Bu.jpg<p>But it appears that this security is only in effect for the page where the photo is hosted. One can use the "Copy image URL" or the equivalent in one's browser, and you can forward this URL to anyone, who will be able to see it without even logging in to Facebook.<p>This looks weird, because I've seen companies without a superstar IT security team be able to restrict their images/resources with LDAP or something similar. Why can't Facebook do this?
That's if you're looking just at compensation. However, a exec can make one decision that can save / make a company millions or billions of dollars. In that perspective, a few million dollar salary seems like a bargain.

A secretary is not often in the same position.

It's just like selling a product. If you base it off "cost" - you set yourself in a hole to start with. But, if you base it off the value you can create / save, then you have leverage to make more money.
My GUESS - They choose not to. It's a 12 year old OS. That's old.
https://github.com/justinmeister/Mario-Level-1/blob/master/d...

Why on Earth would you create the level like this instead of using something like Tiled[1]? Pretty much everything you can make a game with has support for TMX tilemaps, and if not making basic support yourself shouldn't be too hard either, and ultimately way less effort.

[1] http://www.mapeditor.org/
Exactly. My MacBook is now for sale. Back to my Lenovo T400.

Trust = gone.

Apple's policy of silence and denial don't cut it any more. At least Microsoft use proper threat modelling, disclosure and mitigation processes, documented KB articles and have literally tonnes of QA and test capacity. Not joking but they have tens of thousands of machines in their test labs.