skysight-inc/HackerNews huggingface dataset:
This is of course anecdotal:

I just so happen to have spoken with a practicing Italian banker (in English), practicing financial professionals from several other Anglophone nations, and from Germany as well. (these conversations were friendly and not professional in nature - I was not seeking their services, should any future Treasury/IRS folks be reading this!)

Never have I once - ever - heard a single one of them suggest even for a second that there is any financial/economic system as heavily regulated, asinine, filled through with bizarre rules, and just overall insane as that found in the US.
So you took a game that used to take a few dozen KB of memory and an 8-bit CPU running at less than 2MHz, and turned it into one requiring many orders of magnitude more memory and CPU speed? I'm impressively disturbed.
But they did have to close the site. And I guess that Nintendo could easily bring them to court and win (not that they will, it's a small non-profit target).

My comment was meant as a "funny" way to say that Nintendo is usually very unforgiven with clones of their games.
Oh, oops, I upvoted this because I thought there was a backdoor in the Linksys WRT54g (original title:	"Linksys wrt54g backdoor"). Instead it's just about developing custom firmware. I shall look before voting, next time...
Simple explanation is that the publicity increases use? Doesn't seem that weird to me.
MPI Gather with derived types
https://github.com/jimweirich/wyriki/commit/d28fac7f18aeacb0...
As a side note, I find the hyperbole of "killing trees" as a description for "writing checks" a little annoying and uneducated. Does one believe that the energy that makes the Internet possible is free?
I've been experimenting with x265 via ffmpeg, encoding some TV episodes in HEVC. My experience is that it takes 3.5-7 seconds of CPU time to encode 1 second of video. (These are things like 576x432 resolution at roughly 700 kbps, or 704x528 resolution at 530 kbps.)

As for decoding performance, VLC appears to use 30-50% CPU when playing these videos back. (Haven't tried one at uber-high resolution yet.) As far as I'm concerned, if it's fast enough to never stutter, then that's the biggest goal it needs to hit, and beyond that, reducing power consumption is desirable but not too important.
Any idea what the bounty was for this finding?
Seems way too complex for what I want. But now that I think of it, plugging it into a more complete XBMC setup could be the ticket.
Obviously, I trust you to know about these things, and you point to other bad examples which I'm not familiar with. In this context though, code execution isn't necessarily important (though I'm sure that's a dream scenario). The ability to snoop on assumed secure traffic is a pretty sweet starting point.
Parallel construction with the other items:

Desirable goal? Drudgery, drudgery, drudgery...

He's not trying to inspire so much as inform you of the entrance requirements for the various goals.
I suspect this article is what they say they do as opposed to what they actually do.

They may even say these things internally as part of the "official" plan, but as you point out, there's reason to be skeptical it's how they actually operate in practice.
Craigslist has been hacked
Consider this: it was only at the end of December when Appelbaum showed some documents about iPhones being hacked by the NSA, and it made a pretty big splash in the media. I think it even forced Apple to respond at the time. Especially if this was open sourced, and everyone could see they fixed it, they wouldn't immediately try to plug the bug/backdoor after that piece of news came out, especially with such a weird bug.
> (it's the TLS library for Firefox and Chrome)

The False Start bug in NSS that you are talking about (CVE-2013-1740) never affected a released version of Firefox; we found the bug during testing of False Start in preparation for enabling it in Firefox 26. We pushed back the enabling of False Start to Firefox 28 (which will be released next month) so that we could fix this bug first.
how? seems normal
Where does WhatsApp acquisition rank in history of tech deals? – latimes.com
You seem to be downplaying the seriousness of the bug to the point of making it seem trivial, and while I agree that there are many, much more serious types of bugs that 1. don't require active MITM, and 2. the press don't give proportionate attention, it is only "trivial" in the same way that Yahoo not using SSL for their webmail is "trivial," or the way a website leaking an authentication cookie over HTTP is. Only here it's not just Yahoo's email; it's (almost) all applications. (Not to mention that you can use these "secure" channels to deliver e.g. memory corruption exploits.)

If you don't have authenticity, the "secure" channel isn't worth very much.
Yay, a car company is choosing between two closed-source, almost certainly compromised, podunk OSes.

It's not that either is particularly bad (even though at least one is); it's that there is a free, as-good-or-better option. It's a much more secure, much more trustable option, and it's obviously to use Linux, *BSD or even Android instead.

I'd rather not have the speakers in my car turned into roving wiretaps, thanks. My conversations might not be relevant to national security, but their privacy -- even hypothetical privacy -- is relevant to _me_.
Unless I'm misunderstanding exactly what PRISM is, this bug seems like it would only be useful for OTHER nsa data collection programs, not PRISM.

Unless, of course, we are now using the term PRISM to refer to all NSA activities that we don't agree with.

Gruber should know better.
Zach Holman on all Things Github [video]
Considering that WhatsApp used port 443 but sent messages in plaintext... I think Telegram actually did better. Also since in the end, nobody actually turned out to be able to decrypt messages.
The code already has that condition variable ('err'), the goto is to avoid execution of code that should not be executed. It's not about avoiding additional stack -- that was probably the last thing on the programmer's mind. The idiom is about error handling.
You have an odd definition of "less exploitable". On what planet is compromise of all trusted communications "less exploitable" just because it doesn't immediately lead to code execution?

Once you are MITM'ing, you get passwords. You get personal details. You get everything you need to do far, far more than run code on someone's phone.

All the vulnerabilities you list are bad. Sometimes I wonder if you post your consistently contrarian posts on HN just to stay visible.
It's gaudier than I could have ever imagined.
Does kraken allow BTC / USD trading by customers located in CA? I didn't think they did.

Edit: Their FAQ even says their approval in CA and most other US states is pending and customers aren't allowed to trade until it is approved

https://www.kraken.com/help/faq#verification-tiers
I had no trouble transferring from Checkout to Fiber, and Fiber is a pretty cool project. I also know people on my team that transferred to Glass.

Anything is possible, you just have to do it. Nobody is going to come up to you and say, "hey, I read your mind and I think you want to transfer to Android. Follow me." Just do it!
> two data points a pattern does not make, however WhatsApp is having a big outage days after Microsoft bought them.

Um .... Whatsapp were bought by Facebook.
October 2013: http://www.ncbi.nlm.nih.gov/pubmed/23846283

> "In summary, the accumulated weight of evidence implies far lower risks for pulmonary complications of even regular heavy use of marijuana compared to the grave pulmonary consequences of tobacco."

Yeah, I think mostly this comes down to the above discussion of "greatly" -- marijuana seems to have some correlation with lung disease and cancer, but it seems to be less than tobacco.
Another explanation is that it was an act of vandalism / code graffiti by a script kiddy or perhaps a real hacker with more skill than maturity.
Try during sleep.

No, seriously, it seems to be blowing up just in Europe and it's 01:27 AM in GMT+1 right now (western Europe). I was able to get my CLI client activated on Linux something like an hour ago.

Edit 01:30: And activated web client too.
TLS validation bypass + automatic software update using TLS as authentication mechanism = RCE

I'm not sure why this is being classed differently.
Art Festival Shuts Down NSA Imitators
I'm pretty sure you care more about this than Nintendo ever will. Get off your high horse. As someone who has never used PyGame, this is really cool to look into and learn from.
... and thats why americans have troubles to open bank account abroad.
most of the commits are done on the last days... some of them are just some line changes... (https://github.com/justinmeister/Mario-Level-1/commit/586b96...) I code on my free time too, On the night I turn on my laptop and code for a couple hours, I am a bussiness owner, most of my day is related with other activities, and I just want to think in another thing and relax. Coding it's the perfect choice, but you need a project to feel motivated, something not related with your day work and something easy enough to be accomplished in a couple days (so you can fell your progress and feel proud). I see he completed level 1, my intuition says he won't go more far away to another level, because he just got the satisfaction he needed. Probably now he will choose another project and develop it.
You're arguing that memory corruption is a worse vulnerability, which is true, but doesn't contradict the claim that the NSA could exploit this vulnerability to intercept traffic and add Apple devices to PRISM. So ultimately you fail to demonstrate that Gruber's post is "silly".
Is there a reason the todos list is a list of text inputs? It makes sorting them awkward because there's so little area that's draggable.
One of the main reasons I stick with Google Voice for my primary number is so I can send and receive SMS messages from a computer with a keyboard. There's a Windows 8 app so I can use it on my desktop and Surface natively, and it works well enough on my iPhone too, so it's everywhere for me.

I wouldn't even consider replacing that with WhatsApp, specifically because they don't have/allow clients on desktop/laptop devices. As in, I thought about checking WhatsApp out, searched for info on desktop clients, a Trillian plugin, or something, and immediately ruled out using it at all based on the lack of those things.
Everyone flying should write SSSS on their boarding passes on a predetermined day, too.

While you're at it, retransmit bitcoin transactions that have been slightly altered but that still have valid signatures.
I think there were two major technical issues stopping the overwhelming adoption of mobile XMPP/Jabber:

1) Apple push notifications were the only method of reliably delivering on demand messages to iOS devices, so to provide expected (app in background) behavior on iOS, someone had to provide an always on proxy between XMPP and iOS push notifications, and that proxy had to have your credentials. This required ongoing expense on the server side combined with a client side app.

2) XMPP is connection oriented and doesn't handle the disruption of disconnections and changing IPs/networks when a mobile device roams or transitions from wifi to cellular data.

On the political side, I think GTalk had, by far, the largest network of XMPP users. As I understand it, they've tried to solve some of these problems with proprietary protocol changes which resulted in the Hangouts app and the subsequent dropping of full XMPP support by google: https://www.eff.org/deeplinks/2013/05/google-abandons-open-s...
Tptacek, it is scary because of exactly that -- it is so simple. How could such a secure platform built by such a massively large cap tech company do something so incredibly stupid in its most critical security stack.

If this trivial bug can happen and pushed into production .. Good lord, anything can happen.

The foundation of our mobile economy has just been proven to be on very very shaky legs.
Bitcoin suffers from no such idiotic and arbitrary denial-of-service attacks by intermediaries.
I somewhat enjoy interviewing, and I thought about writing up my narrative of the best interview I ever had (it was very exceptional), and at the same time I thought about writing about the strangest interview I ever had, a distinction that belongs to Google. I decided not to because I didn't want to be unfair to them based on my experience which may well be out of the ordinary (I could recount it solely for this crowd if someone is interested).

I didn't get far in that interview (I excused myself), but the entire process was downright Kafkaesque and I get the same eerie feeling reading this article.

> Traditional leadership is, were you president of the chess club? Were you vice president of sales? How quickly did you get there? We don’t care. What we care about is, when faced with a problem and you’re a member of a team, do you, at the appropriate time, step in and lead.

I'm sorry, what? This definition doesn't actually describe anything. It's more useful as an example of begging the question[1] than it is of describing what they mean by leadership. And how do they go about deciding if you step up to the plate at the right time in an interview, anyway?

It seems like their "leadership" criteria wouldn't actually select for people with good leadership skills, it would just select for people with good storytelling. Par for the course for interviews, but let's not kid ourselves.

[1] This phrase is commonly used to mean raising the question but I mean it here in the traditional sense, like the comical observation: "If such actions were not illegal, then they would not be prohibited by the law."
That's a pretty good idea. You could probably even do it for less, or in a way that guarantees usage over time - pay $1 per month they are active on the service and adding friends, over a year.
Subsonic is good:
http://www.subsonic.org/pages/index.jsp

Honestly though I'd just use Google Music.
>If it’s a technical role, we assess your coding ability, and half the roles in the company are technical roles.

Which means that the other half are not technical roles.
You can hire on these things once in the interview process, and I think most companies probably like to think they do the same thing. But they aren't interviewing everyone we can assume. So how do you pick people for interviews? This is where all the GPA and good schools stuff comes in usually, or something unique about the candidate. Perhaps certain experience that serves as an indicator that the person will have the required attributes.

I'd have been more interested in hearing how they select for interviews and not how they hire. If someone from an average school with a below average GPA, he/she could impress and get hired on these attributes (which the candidate certainly can possess), but the real trick for these candidate types is getting in the door.
Of course I meant software engineers (SWE). There is no job title 'Programmer' at Google.
To everyone claiming "it looks like a merge gone bad": That's a bit hard to believe. There's no other changes around the extra goto, so it's pretty weird for a duplicate line to appear like that out of nowhere. It's also incredibly visible in any diff viewer, so how such a checkin could have gone in without being noticed is just unfathomable.
Tinder style app for entrepreneurs networking and meeting
@gkoberger thanks! I'll be reaching out to folks later this weekend. I'm definitely planning on writing a post-mortem as well if people are interested.
STAR WARS EPISODE 7 LEAKED FOOTAGE
Check out the new star wars trailer! Loads of vfx
Unless you're their superior, I don't see how telling someone "you probably shouldn't browse reddit at work" is likely to result in any positive change.
Because Tom Friedman is a cluster of bad ideas masquerading as a newspaper columnist.
Upptalk is up :)
Not being able to verify the source code destroys the purpose of using TextSecure.
And you are... ?

Grab your ego and shove it up your ass dude ;D
Yep. The enrollment process is laborious, but it's worthwhile for those of us that deal with quarterly estimated tax payments. https://www.eftps.gov/
Exactly. You do it for the same reason why people try to paint famous works of art. You get to really see many of the pain points that the original artist went through and connect with something on a different level unlike any casual observer.

In this case, the medium that is being used for the implementation is different, but you still get to solve many of the same problems.
Keep programming and researching. Then use your skills to make cool things. Then show them to potential employers. You'll do great.

Try and get to uni anyway. But take the pressure of yourself. If you're making cool things and learning loads you're ahead of the pack.
It would be nice if massive meant "more secure," but the real relationship is not between an organization's size and its security, rather it's about how much that organization tries to minimize, or displace, risk. Very large organizations tend to not specifically care that something is provably secure so much as they want contractor X to be liable if something bad happens because of it.

Some organizations--and even though it's easy to mock Apple here, I do believe they're one of them--sufficiently appreciate that improving security minimizes risk, and so spend a decent amount of money on it. You could argue they failed here, but even Adam Langley who essentially "is SSL" at Google admits he's not sure they have a test that simulates an attack on a possible similar implementation error in their own code (though he does argue that such an error would have been caught in Google's code review process.)

In any case, an attention to security is certainly not something that is borne out of an organization's revenue or number of employees.
This is not ad hominem but I should note that anyone reading this article should take care more that it is written by Thomas Friedman and maybe one should take care before wasting too much time reading it.
What Running a Business With Depression Really Looks Like
I use Astyle to enforce both braces and indentation automatically.

http://astyle.sourceforge.net/
I'm impressed! The code is well structured and you're using Python and PyGame, which is awesome! Well done!

For anyone wanting to learn Python and PyGame I'll just leave this here: http://pluralsight.com/training/Courses/TableOfContents/game...
How do headlines like this get noticed? It boggles the mind.
I drove about 500 miles in Ford C-Max Hybrid rental car last summer, and really liked it. But was horrified that I had to pull off the freeway and reboot because the nav/radio/console had frozen. I would never buy a Ford with Microsoft software, so I hope this switch works out better for them.
No need for backdoors, with WhatsApp's security measures sending a message is like broadcasting a tweet.

EDIT: This is what I'm talking about http://arstechnica.com/security/2014/02/crypto-weaknesses-in...
Get rid of the menu bars altogether. They made sense in 1984 when people who had never seen a mouse needed to discover how to use things. How often do you use a menu in an app today? Anything commonly done has a keyboard shortcut. Anything graphical has palettes. Menus are often contextual or being hidden behind three bar buttons these days.
Firing and contracting out are the type of actions someone at many companies would take faced with equity requirements. The type of organizations that actually put equity requirements in place by choice are not going to do those things (any sensible auditor would not allow "contractors" to fake follow the rules).

When rules on equity are put in place for political reasons (say to pretend bailout for too-big-to-fail banking executives) then all sorts of not actually following the rules will be done. Those organizations normally have no interest in equity they are run by kleptocrats and the kleptocrats will just do things you suggest and act like those things matter (pretend that if the job is done by a contractor that means the job doesn't count...).

I don't actually think 10 times the lowest pay makes much sense. But the choice of this of being run by the kleptocrats in control of most treasuries today I would accept this 10 times rule. It isn't that I think it is a good rule, I just feel it would be less horrible than the kleptocracy mentality in place now.
Not free, but I would suspect that paying electronically is at least a magnitude less impactful on the environment. That checkbook had to be produced, shipped to the bank, mailed to you, and then the individual check has to get moved around as well.
I take it you're familiar with threat trees? Any vulnerability is serious. It's just another vector that either realises a threat, or brings the attacker closer to realising a threat.
Whew, I have been working on a next gen voxel engine for over a year now. Its amazing what you can do with it, but due to the level of interaction, complexity keeps raising.
Those documents were about NSA bein able to plant a malware on a iPhone (1st generation) when given physical access. I would say it has nothing to do with this TLS bug
Yup normal here as well
Using Google Music is probably the least effort way of going about it. I need to figure out if there's a simple way to batch import from Linux.
Symfony has similar generators as well.
Because I can revoke Application-specific passwords and they are more limited in that there are a set of settings that they can't change (can't change my email address, change my password, setup forwarding, add more application-specific passwords, etc).
WhatsApp didn't go on about their security and mock security expert's opinions, either. Telegram intentionally built their own encryption, did a poor job, summarily dismissed expert criticism, and set up a shame contest. That kind of behaviour is far worse than an "SMS-replacement" service not really putting much effort into security.
Who gives a shit about shaky legal ground? How will a CnD shutter his side project? Could just take it offline and continue to build it. I doubt Nintendo are going to go through the lengths to force him to destroy a .py file or two...

It's as if every line of code written needs to be useful. I'm seeing this more and more. Many cool projects are criticised based on how useful they are rather than how cool they are. Maybe if a project was positioned as useful/sellable, then perhaps such criticism is justified, but when something is obviously not meant for sell and has obviously been built for all except seriousness, it just comes across as daft.

Just the other day I saw a comment about an embedded PHP interpreter. "How will this EVER be useful?" Who gives a shit? It looks fun to write, so it was written.

I personally enjoy programming. Most code I have written has made me 0 money, has been seen by 0 eyes and has provided me hours of fun and pleasure in writing it. I'm sure many programmers are the same.
> The foundation of our economy has just been proven to be on very very shaky legs.

Exactly. That sums up my feelings about it better than I could. Something so critical, something trivially easy to catch in a code review was not caught. And, the only scenario in which a code review might not have caught it: no code review. That's no code review for libssl.

If this is incompetence and not malice, it's incompetence of monumental proportions.
Er, I take back about the Flash and playing music thing. No flash = no music.
The limits of Friedman's understanding should come as a surprise to no man.
You can have the service fallback to sending SMS but with an ad for the service before the actual message.
Except Whatsapp has a very strong network effect that's difficult to replicate (the other person must also have the app). That's why we designed Upptalk to interoperate with standard telephony services like SMS and SIP.
You could achive a full MITM and much more with the abillity to run arbitary code on a device. It is categoricly more exploitable.
They don't have a vision, they just copy random crap. Thankfully there are alternative options.