skysight-inc/HackerNews huggingface dataset:
Though many's the HN'er who will groan when I tell you this, I'm saying it because it's true: if the security of your email is a big concern, you are better off keeping it at Google Mail. Google maintains an extraordinarily capable staff of security researchers and developers, including key developers of the NSS TLS stack on which both Chrome and Firefox depend, and several of the world's best-regarded vulnerability researchers. Google's "complicity" with the NSA is more folkloric than factual, and in any case implicates any other email provider in the US... or, worse, hosted in venues that lack even the US's protections, which (surprisingly) include many European countries.

The security track record of boutique email providers isn't great. The privacy track record of those providers isn't much better.

If you want to get your mail off Google because you find their ad-tech and data mining objectionable, that's totally reasonable. Just be aware of the tradeoff you're making when you do that: you are unlikely to improve the actual security of your email by migrating elsewhere (though you may improve your peace of mind).
Cold War is over; US vs. Russia isn’t zero-sum
This is a developer tool. FOR DEVELOPERS.

If the tools solve useful problems, who cares if they break later? We'll fix them.

I would very strongly caution against Apple continuing to provide such a boneheaded IDE.
>If someone told me that, I'd feel absolutely terrible inside. And that is the definition of an insult.

So if someone calls you and tells you a loved one has died, they just insulted you? Man, I better never let anyone know anything that will make them feel bad. That would be insulting. /s
Seems the founder thinks he can suppress speech through tweeting: https://twitter.com/NinjaLikesCheez/status/44064551256879513...
This needs to be a part of ThatHigh.com :)

Except, you know, not sketchy.
It's funny, as a kid I can remember thinking: "Right, everything has to go in the main function unless absolutely necessary, it will just be easier to read that way."

Nowadays, it's the exact opposite!
The kid did nothing wrong (unless he stole the phone, obviously). Even in the article it says "the person who will be held accountable will ostensibly be the party who signed an NDA to get the handset, not Jamkatel himself", which is exactly the way it should be handled. It's not clear that the kid is in trouble at all.
Change the official Presidential anthem to Santana ft. Rob Thomas' "Smooth"
Beats Music sends C&D in 3...2...
Reading his responses, the entire app feels like a bad attempt at trolling.

In any case, nice write up. I enjoyed reading it.
It is a neat attack, I agree. Do you have any idea which browsers are vulnerable to it? Technically, the protocol handles this case, by distinguishing between an authenticated connection close message and an RST?
When I read blogs like this I think "Dear Penthouse..." The original humble-brag medium.
Not sure why this was posted, when the pre-built version doesn't work on 10.9.1. It doesn't properly detect that command line tools are installed.
>The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. //

Most laws seem to have these SoS exclusion clauses. In this particular case, S.251(1)¹ says

"The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient—

So it's by regulations², ie "rules". Whilst they don't need a new law to be passed they're still a statutory instrument, it's not like this section allows the SoS to just decide by himself.

See for example S.252(2); and S.251(7), quoted here:

"Regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c 29)."

---

1 - http://www.legislation.gov.uk/ukpga/2006/41/part/13/crosshea...

2 - http://www.legislation.gov.uk/uksi/2002/1438/pdfs/uksi_20021..., http://www.hra.nhs.uk/documents/2014/02/cag-frequently-asked...
Music is way too important in my life to temporarily rent it from some company that may or may not be around or even have the same content available in a few years.
We had the problem you're describing for awhile, but have since figured out how to avoid processes going down and interrupting other reqs. Essentially, you attach a global domain, and when that domain catches an error you stop accepting new connections (obviously you have to be load-balancing between procs) and start a countdown. Some reasonable amount of time later (I think we wait 30 seconds?) you assume that any in-progress request is done and restart the process. We've found this to be very successful.
Hmm, did you just post this "disclosure" on your blog before informing the company? Well, now everyone is at risk if your claims are true. Poor form.

Proper course is to disclose to company first, then disclose after fix is in place in reasonable amount of time. Why risk everyone for your benefit?
Part of the reason for having started mopidy was that we wanted something MPD like, but with Spotify support, which at the time was not reasonable to integrate directly.

Now we've evolved quite a bit since then and are now at a stage where we are modular music server, where the MPD frontend is just one of many possible ways of talking to our server. Additionally everything is an extension, so we don't end up like some other systems I've seen where plugins end being second class citizens.

Edit: Other things to note is that at the time we started, 2009, we were not aware of Tomahawk, and more importantly, we wanted a server, not a GUI app.
Access to guys?

I'm not sure that's what you meant, if it is then can you expand?
They could stick a hardware encryption chip into their products and with a proper crypto system could enable secure encryption even against an active attacker with control of the OS. Even a password hash using a decent hash like bcrypt would be secure against an attacker with only user privileges.

Single byte XOR is just child's play, even if the "key" was only used once. They may as well have used ROT-13.
Code Complete 2 [1] was one of the first coding books I've read. As with anything else, it's good to look around (HN is a good place) for people who have problems with the book. I think I learn as much reading the commentary people make about books like that as I do from the book itself.

I think I've listened to every podcast on software engineering radio a few times [2]. The older ones are especially nice because they usually pick a specific topic and cover the high points. I liked that I could listen to it while I was driving, or otherwise not in front of a computer.

It's specific, but Javascript: The Good Parts is probably the most used book I have on my shelf. It has such a perfect amount of usable information in it. It's pretty great. Again, it's definitely worth looking up critiques and counterpoints.

I've also got Introduction to Algorithms, which I use as a reference, sometimes. I switched over to The Algorithm Design Manual [5] after I saw it referenced in an older Steve Yegge post [6]. I read through the intro and it seemed like a book that would be more appropriate from an autodidactic standpoint. I really have no idea if that's going to pan out, since I'm not that far into it, but we'll see, for sure. Doesn't kill me to have an extra algorithms book laying about, though, and I've always got intro to algorithms for cross reference. I've found that I really need to have as many sources available as possible when I'm learning alone. Usually I don't get something until the fifth person describes it from the tenth different angle.

That's most of what I can think of off hand. I really enjoyed The Joy of Clojure [7], though haven't checked out the newer version. Programming Collective Intelligence [8] is a fun book, and is what made me want to go back down the maths route to get more into machine learning.

And of course habitually reading hacker news for an hour or three every night :)

So that's my totally inexpert list of random stuff that I enjoy

[1] http://www.amazon.com/Code-Complete-Practical-Handbook-Const...
[2] http://www.se-radio.net/
[3] http://www.amazon.com/JavaScript-Good-Parts-Douglas-Crockfor...
[4] http://www.amazon.com/Introduction-Algorithms-Thomas-H-Corme...
[5] http://www.amazon.com/Algorithm-Design-Manual-Steven-Skiena/...
[6] http://steve-yegge.blogspot.com/2008/03/get-that-job-at-goog...
[7] http://www.amazon.com/Joy-Clojure-Michael-Fogus/dp/161729141...
[8] http://www.amazon.com/Programming-Collective-Intelligence-Bu...
From India's northern backwaters, a new business elite rises - Yahoo News
Normally you would have one machine hooked up to your speakers and then use clients on the other ones to control the central music server.

In the longer run I keep wanting to get https://github.com/mopidy/mopidy/issues/408 solved, basically having a main server and then audio only servers for true multiroom.
Can you think of any apps that need OSS? That is not snark, I am genuinely curious what applications require OSS.
The tradition was there, and it sucked.

Hunting the Internet to track down random dependencies, watching freshmeat.net every day for new releases, and fighting with all of the different build systems was what I did every day ca. 1997.
Ahh I see, fishing for compliments is definitely a bad use case that's hard to circumvent. Any ideas? I attempt to subtly discourage narcissistic submissions in the prompts but people will probably still do it.
Terrible response by the Puffchat guy: https://twitter.com/MikeSuppo (Google Play's dev listing goes to the Puffchat blogspot site, which links to this Twitter account.)

"This is a friendly message to advise that you remove all web based content about Puffchat"
"Please remove within 1 hour."
"Puffchat will be fixed in due course. Every piece of content with the original author's name attached to it after GMT scheduled will only provide evidence that can be used against him."

Edit: Actually, this could just be a publicity stunt. Do something boneheaded like this, get some exposure. Take flak from users that don't necessarily matter, and hope to score a lot more users. If you're not getting the growth you hoped for, what do you have to lose?
I think that labelling the use of POROs as an "advanced technique" is simply wrong. How could it be? In fact it's simpler than implementing an AR callback (with more complexity behind the scenes than anything!)

You are using app/services and POROs in your own app? So are we. But I guarantee they don't look like yours because there is no endorsed convention.

Why not? Because Rails is still clinging to such an outdated idea as MVC? Pure MVC at a large scale is bullshit.

"Size of the application is rarely a factor". I don't agree. Size of the application is always a factor. A big factor.

What I'd like to see is the community embrace conventions outside the fabled "MVC" paradise. Rails is "convention over configuration", and is content to hold your hand for your first thousand lines of code... but then what?
> But even with agile, you have to have some kind of idea how long an overall project might take, otherwise how do you even decide if a project is worth starting?

If each iteration is producing sufficient independent business value (e.g., not dependent on subsequent iterations), then you don't have to estimate the size of the "overall project" to determine if it is worth starting. That's actually a key part of the risk mitigation provided by agile/lean methods.
It's also a meme, of which you may not be aware. It comes from Ralph Wiggum, the caricature of the special needs child on The Simpsons, when he says, "Me fail English? That's unpossible!"

In common use, it's generally taken to mean exactly what the GP poster intended: a mock expression of surprise at a thing that is, in fact, assumed to be the case.
"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
The Germans actually lost the air war by themselves despite a huge technological advantage over the Allies. The Germans developed something of a love affair with the dive bomber. They were effective early in the war, but once Allied dog fighters caught up with their German counterparts, dive bombers became obsolete. The Germans continued pumping out dive bombers at the expense of producing more relevant fighters. It ended up costing them the air war.
I'm the OP. I meant I'd never had something downvoted 30 seconds after I posted it.
Cursorily seemed fine on my IOS7, but I did not optimize for mobile. What are you using?
At the bottom of the post it does state:

In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data.
Krnl - Totally disposable collaboration
Really?

http://globalassets.starbucks.com/assets/bbbb918e28fa404b836...

I much prefer that machine to the crappy k-cup machines.
Wearable robotic suit can lift 100Kg
Puffchat put people at risk.
Many people, especially older ones and people with bad or old monitors don't even realize they are ads. There's purposefully no border and a light background is used to confuse people into clicking ads.

http://blog.dynamoo.com/2013/10/google-ads-and-fff7ed-whats-...
Specialization is probably the most common way to get significantly higher compensation as a grunt. Make yourself an expert in some hot area of technology. Higher demand and lower supply = higher compensation.

Just imagine being the guy trying to hire a kernel developer vs hiring a PHP developer familiar with Wordpress. You're going to have to pay more, a lot more.
Totally love this!
If optimizing 57 seconds of your day makes such a drastic difference, you are doing a vast number of things wrong.
If they don't, then the boilerplate verbiage that appears in pretty much every contract I've ever seen, which voids any provisions of said contract that are illegal or unenforceable without prejudice to any other terms of the contract, does.

That is to say: any contract which includes such a clause can't bind you to do something illegal, just because you signed it.

It's generally illegal to lie to a court, particularly when under oath.
Everyone was already at risk, but they didn't know it. They were already downloading this content to devices everywhere.

He also says that he tried to contact the developer but got no response.

The dev would have been much better off apologizing, pushing a fix, and asking for a temporary embargo while the fix is put into place.
As a kid I wrote a few games using QBasic. I apparently didn't have a firm grasp on control flow because every call to a sub routine ended with a call to another subroutine; sometimes to a sub routine that was already called earlier in the stack. You win the game by beating it before crashing with a stack overflow.
Thanks! I've bookmarked this and will try it in the future.

But: as an experiment, I just turned off ABP and Google'd (heh) "yahoo support". One of the ads at the top was for http://www.aurasupport.com/email_service; at a quick glance, I see a website template from http://pixel-industry.com/website/, lots of broken English, and a domain that was registered just last Summer to a house address in a suburban development in Texas. Not exactly a smoking gun, but also probably not what somebody's looking for when they search for "Yahoo support"...

And, farther down the first page of the actual search results is http://www.yahoosupport.org/, which has a toll-free phone number in the title, 1-888-551-2881. Googling that phone number takes you down a rabbit hole of lots of dirty SEO (e.g. https://www.youtube.com/watch?v=AEO5-2RpYvo), no actual customer reviews anywhere, and offers for support for lots of services -- including, uhm, Gmail (http://www.password-recovery.us/contact-us, look at the page title).

So, I'll be happy to use the link you gave, but this seems to be a fairly serious problem, and I'm a little surprised that Google doesn't have a better handle on this.
They will if this person represents a significant portion of their revenue - just like any action taken by a large company.

At least Chris put his opinions out there in public. All too often people complain about a company in every single medium except for one that may actually make it to a relevant recipient.

..Which is also why I hope he also has sent this directly to HTC. I know Hacker News is read by quite a few [important] people in tech, but unless he also directs it to the proper avenues this rant will have as much effectiveness as someone complaining at a bar.
There are a lot of brilliant developers giving talks at every RubyConf advocating these very techniques...
Justice Department Backs Broadcasters in Aereo Dispute
FTA:

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
Some people like to hear "I don't know".

Lots of people do not like to hear "I don't know".
There are bigger problems in that Putin is not acting like he is in touch with reality:

http://www.telegraph.co.uk/news/worldnews/europe/ukraine/106...

3500 troops and tanks on the Polish border is kinda scary.
Well when the people who are about to seek legal action against tweet in public "It's going to be bad week for you :-(" because they're going to make it one, then yeah it kinda sounds like a threat.
As you can read in the article, he did try to contact the developer.

That aside, though, when the issues are this egregious I'm honestly not sure what the right approach is. With flaws this bad it's hard to imagine that they're even capable of fixing the problems, let alone responding appropriately to the disclosure.
You can control mopidy remotely, but not yet stream to remote clients.
The point is that all of this funding scarcity is artificial. its all agame to make you run like a hamster on a wheel. there is no capex needs for liberal arts, only modest opex. but no matter, none of those guys are "funded" either. they all are pitching projects for grants just like the STEM counterparts. Its basically a sociology experiment at this stage.
You appear to have a different definition of definition than I do.
Putting on the conference was a great idea and was well executed, and I think is an important contribution towards improving the odds for female founders. To Jessica and the rest of the YC crew, thanks from the community. Please don't be discouraged by negative comments from the minority.
I would argue that the 'blub programmer' concept so beloved on HN indicates that HN is populated by participating narcissists.
Thanks for the link! I thought I was taking crazy pills.
U.S. suspends trade and investment talks with Russia
TFA states precisely this:

"In the interest of responsible disclosure I did try and contact the dev multiple ways, I was either ignored or not replied to and I feel users deserve to know what’s happening with their data."
There is no value in hiding salary this days. Everybody knows what the market is, so why hide it? For me this is a very good sign if a company post the salary range.
There are indeed Jaden Smiths in academia. I personally know people who did their first degree in (humanities subject) and got a PhD position in (top 5 world school) doing (in-demand science subject) and followed by a postdoc in a great institution based entirely on their father being very important in the subject.

These people got funded graduate spots in the best departments in the world, beating out others who obtained first-class degrees (4.0 for the North Americans) and worked their entire lives towards this dream.

How does this happen? Do you want to be the guy who refused to supervise the daughter of the nth most important person in your field? A man who has given you important references in the past and may do so again? When this relationship could get you even closer to the Will Smith of your field? This is good old fashioned corrupt nepotism for all the good old fashioned reasons.

Now, these people are both genetically and environmentally predisposed to be much better than average at this work. Sometimes it works out well. It is possible that this is a good outcome for science. But is it fair? It is not.

(Written as a working prof who had no academic connection advantages. I acknowledge that being white, male and having English as a first language was not a a bad place to start from).
And it is all over the internet:

Blog’s going offline while we bump the specs so we can deal with all the traffic, bear with.

I expect to see some articles tomorrow.

First one: http://www.tuaw.com/2014/03/03/snapchat-competitor-puffchat-...
> It was easier for me to understand the fundamental theorem of calculus than it was for me to do long division in my head. I don't think I'm alone.

You're not. I had the same experience. I have severe problems with mundane arithmetic, my mind just locks up when faced with concrete numbers and even simple numerical calculations. OTOH, no problem whatsoever with geometry, (abstract) algebra, calculus etc. I remember when I first got calculus in high school, how natural and easy it felt, how it simply made sense and how all around pleasant and interesting it was, and it struck me how different this experience was to the other more "basic and mundane" areas I struggled with during school. A few years ago I was amused when I saw an interview with an astrophysics PhD who struggled with doing basic arithmetic. It's a source of amusement for her now, but you can imagine the dread she had to endure in "school". So, no, we're not alone.

What the article says when it compares what children face in school under the label of "mathematics" to torture akin to digging a trench with a spoon sounds very true to me.
If deleting/modifying a file at one location results in deletion/modification of a file on the "backup", then it's not a backup.
My code changed in a similar way, however I recently devolved.

I've mostly worked with higher level languages, and recently delved back into C. I had forgotten what a complete pain in the ass it is to pass complex data structures around between functions.

I'm a bit ashamed to admit my functions got pretty damn beefy real quick.
Checking the Claim: This Device Would Allow Dogs to Talk Like Humans
Yeah... Even crazier, right?
Ultimate Streisand effect - I have literally never heard of this app that seems geared towards drug users; and yet I learn about it from it's incompetance.

How do people release public API's without THE MOST BASIC OF SECURITY CHECKS. Really? You can add a friend without any checks and even send messages as someone else? Christ.

A) Who funds these guys?

B) How can I get a piece of that seemingly-easy-as-hell-to-get pie?
What Goes Up Must Come Down: Introducing Surge Drop
I don't know how exhaustive the database is, but it looks like it just phones home to MS: http://news.softpedia.com/news/Windows-8-Secrets-the-Built-i... (second screenshot). Might do the same "bloom filter plus server check for false positives" that browser malware filters use.

Checking with a valid but extremely uncommon downloaded binary shows the same red banner (as well as a Chrome warning).
I think Russians will blow up in a rebellion in the next few years. It's hard to explain why, but younger people get more and more furious with Putin. They see through his shit. They get older, replacing made-in-USSR elders. Putin's power grabs become more blatant. Social and economic problems keep mounting. The stability that he promised is evaporating to corruption. Rich people are also becoming sick of corruption as they increasingly face the other end of it.
The Philosophy of ‘Her’