skysight-inc/HackerNews huggingface dataset:
Replacing black boxes is not a good idea. Black boxes work when everything else has broken. We trust them to report when unimaginable edge conditions are breached.

We should instead supplement our sturdy but silent black boxes with a chattier partner. The new device would not survive a catastrophic breakup. Nor would it receive the omniscient breadth of data trusted to a black box. Instead, it would (1) receive a subset of flight data (e.g. location, alerts, and pilot inputs) and (2) immediately send them to a ground-based datacentre. These data would back up air traffic controllers' radars in real time. They would also assist in locating fallen planes and their more comprehensive black boxes.
To those wondering, these questions were given by the cicada 3301 organisation to the few participants remaining after a long search for people "good" enough to join said organisation.

More Info: http://en.wikipedia.org/wiki/Cicada_3301
No. Results can be returned as plain text, images, Instant-APIs[1], WL-code and other.

[1] http://reference.wolfram.com/language/guide/CreatingAnInstan...

(Disclaimer: I work for Wolfram Research)
Next Keurig Will Probably Include A Form of DRM
Is Afghanistan really impossible to conquer?
Self-reply, as the edit window is out of order: don't forget mobile devices (the support of software IMEs for anything outside the alphanumeric range is spotty to say the best), and as you're talking about financial institutions, also think about ATMs and PoS terminals where the only thing you have worldwide available is a 0-9 keyboard.
How stable is the platform? Would you consider providing social login in future?

A couple of observations:
1) the double pop-up for posting a reply (right hand top) and Start a conversation is bad UX, IMHO.
2) the urls (of forums and conversations) aren't SEO friendly. Is it possible to change this?
Isn't anigbrowl suggesting supplementing the black boxes rather than replacing them?
It is good thing that Pompeo is concerned about SXSW's speaker's credentials. Because obviously that is why we have our government.
But I'm a little surprised to see that Pompeo doesn't think that Snowden can contribute to a thoughtful and informed discourse.
My hat tip to you. Nice find!
Definitely better than Beijing, but it used to be much better. There are no tech jobs in zhongdian.
Just as capital investment can lead to increased efficiency and drive growth and prosperity within a firm, public infrastructure can lead to the same type of net gains for society at large. Ultimately, it increases the rational real options available for further investment, and this creates potential future upside where none previously existed.
Ponzi Scheme || Tulips != Bitcoin

Poor article. Haven't these already been proven?
A Picture is Worth More Than One Word
Good ol' ping can also be used to send data. Some implementations support the -p flag which allows to send 16 bytes of user-defined data.
Awesome Dan, thanks for sharing. Very inspiring to see a one man show producing such fine products. Is there anything you outsource? You should write a book on the details of how you did it, I'd buy it in a heartbeat!
Well, yes that's true, but in the context of "monadic lifting" >>= refers to the monadic bind operator.
C++ braced initializers and type deduction
But honestly, i dont even see that as problem with China alone. Heck today it is hard to find ANY decent newspaper that are unbiased. ( In the Context of Chinese and English only ).

I dont think they are crazy ideas. Any country, be it US, UK, Japan or China have their own set of problems. Although I do generally agree that the Western World dont generally always understand the language and culture difference.
E-ink is fun, but I'm not sure it's the right thing to do for a watch. Doesn't it have exactly the wrong trade-offs?
Actually the problem with QR codes is that they are too ugly and not attractive. I have made a script to rectify this issue: http://codecanyon.net/item/advanced-custom-qr-code-generator... but this script does not have GeoLocation feature yet. Anyways have a look I hope you will find it great.
Oh, I'm not saying that I embrace the theory (I actually am against such policies - most of the times they are used to get people re-elected), but I was just mentioning it's still being regarded as a valid way of creating jobs and stimulating the Economy by numerous economists.
I still have to disagree. You don't have to look far (patio11's Bingo Card Creator) to find single-founder businesses that reached level of success without going viral. (I suppose this all depends on your definition of viral, too.)
1) The probability of someone producing the a different download with the same checksum is 1 / 2^80

2) Then why trust the truecrypt guys?

3) Then why trust the truecrypt guys?

The only way to achieve the level of security you're looking for is to download the truecrypt source code, audit it and then compile it and use that.
"Pizza-smelling thermal ink" is ink that smells pizza. Which didn't make sense to me until I watched the video and found they meant to say, "Pizza-scented thermal ink", which is ink that smells like pizza.
Strange. In Beijing its the opposite, the old malls dry up as soon as the new ones open. Jongrongjie is a good example.
That's pretty cool! I need to get one for me and my business partner!
Correct but in order for an operator to be overloadable in C++, it must have a meaning in standard C++ as well. The comment was pointing out that it's surprising that >>= is an operator in standard C++.
Swype's issues with spoofing date back to before they were a paid app (that only happened last year). At the time, there were only two ways to get Swype:

1. Your device manufacturer paid to include Swype in their default keyboard (no IMEIs requested or desired, AFAIK). That was where they made their money, at the time.

2. You signed up for Swype's beta program, to get a free version of Swype directly from them (which you sideloaded, possibly on multiple devices and/or ROMs). To me, whether or not they "really" needed IMEIs for their statistics is beside the point. Gathering those statistics was the only thing they were getting out of their beta program, so if you didn't like that deal you should just not participate - not spoil it for other people by giving false information.
> Domestic consumer market growth does have a chance to save us, that was what I thought the best way out when I was younger. But that would never happen, when you have some understanding how the nation's stakeholders operate. This is a topic that is too big to discuss here.

I understand you do not want to discuss it here, but can you briefly explain why this would never happen ? This is a very interesting point.
From http://api.criticker.com/

> Due to a security breach, the Criticker APIs have been taken off-line for an unspecified amount of time.

> We apologize for the inconvenience.
Your suggestions are good. But 21.00 would still work better for the vast majority of people than 4.30.
MondayNote: The Apple Game: New Categories vs. Ecosystems
No, I think people who work 80 hours a week making twice what someone who works 40 DOES bother some people.

And then there are people that worked for years to develop a capability and get paid for doing it for 20 minutes. Somehow that's supposed to be equal to 20 minutes of hamburger slinging.

People pay for value, not how long it took to produce it or whether it took years.

It is impossible for some authority to somehow do a better job of judging value than millions of people spending their own money on things they value. There many, many considerations and what others value is not ours to cast aside because we think particular deals don't make sense.

But that is the objective, to get government to somehow fix this "problem", as if all the interventions and subsidies and taxes towards that end don't even exist.
Oh my mistake, I actually use >>= and <<= frequently.
Abortion provider fined £200k over hacked website
Ask HN: Did pay-to-play games really ruin the gaming industry?
My question is why are the "exploitation" techniques employed by TCG of the past widely accepted while mobile games, such as clash of clans, cause an uproar in the community and have a bad rap? The general idea I get from reading articles about pay-to-play games is that they are the first to use this evil business model, but this is simply not true. Why has clash of clans angered the community to a near boycott while TCG remain as a nostalgic reminder of our younger years?
Based on the last pizza I got from Dominos, the DVD might taste better.
followup - I took a 'personality test' for a job at 18 years old. Someone came out from the office and looked around, then finally at me, and was a bit shocked to see me instead of someone else. "Did you take this yourself? Did anyone help you earlier? Your scores indicate you have the cynicism of a 35 year old." heh ;)
Reminds me of the kind of article I used to read in 2600. Nice post!
Using a standard library for authentication like oAuth or similar is generally a better idea than creating your own. It's also usually easier since you don't have to re-invent the wheel.

Aside from that, I don't see a reason for an API to be able to retrieve passwords. If passwords need to be reset then the API could maybe issue a pass reset request that would email a confirmation link.

The plain text password is something that's beyond the API design, but a one way hash is generally better with an algorithm that is recognized as being secure (not MD5).

Basically, to repeat, simply not designing your own security but using recognized libraries will typically be a better idea.
Introducing Chaos Mode
> There were many problems with the plane, including the physical one of the pitot tubes freezing up

Not many, a single problem actually. Plus, the plane was not crashing after the issue occurred and the autopilot was off. The crew misinterpreted the signals and did not pay attention the Stall alarms repeatedly. The plane was flying fine even without the autopilot, it's a case where the crew actually crashed the plane by themselves.
Can you please share how you marketed the app? What worked and what didn't?

Everyone: When sharing information about your app, I would request people to share marketing approaches as well. It would greatly help people who are just getting started.
Holy crap, that guy's an amazingly witty writer.
You're absolutely right about the hash constructors. I was trying to make it clear what's happening conceptually, but that's why I included the note to choose a cryptographically secure hashing function. HMAC is generally a good hash constructor pattern to use.

EDIT: Just realized it'd probably be clearer to replace the pluses with commas in my examples, to avoid implying the relation between the parameters of the hash_function.

hash_function( secret_key, api_function_name, datetime )
This sounds like most video game Kickstarters. Unfortunately backers often have different expectations of how much a game should cost than developers. There have been many Kickstarter projects where, if you realistically look at team size and development time you can figure out that the project doesn't have enough money to pay all team members a living wage, even if you're assuming they can live on minimum wage. I guess in those cases most of the team isn't getting paid or is working as part time contractors, and the people that are taking money are using it for subsistence. This is common with indie game projects.
I was thinking the same thing, and concluded the ink changes color or something in the presence of pizza. Not that far fetched actually and would have been a lot cooler.
Yes a good point.
> It's pretty fucking simple for a computer to monitor the altitude of a plane and say "one of your planes has significantly deviated from it's target altitude".

Look, read the AF447 case again and the reports of what happened in the cockpit! The pilots were not EVEN listening to the different alarms being triggered in the cockpit and did not realize that they were in danger no matter how many instruments they had indicating major issues in front of them. In such situations what would make you think they would give a shit at what an automated message coming from a land operation would tell them ?
regular-expressions.info has been a good reference site for me. Another useful tool is an online regex checker. Out of a handful or so options, I find this the best : http://regex101.com/?
>whom he described as lacking the credentials to authoritatively speak on issues pertaining to "privacy, surveillance, and online monitoring."

That's a good thing, given that all the people with credentials giving "authoritative answers" have been bullshiting us.
Grandstanding attention whore accuses SXSW speaker of being a grandstanding attention whore.
I just realized it might not be that easy to find my contact info. I added it to the website, but it is my username here, no caps, at gmail.com
You will learn about regular expressions in 55 minutes. To learn how to use regular expressions, in as long as it might take you, it might be better to:

Read the wikipedia page which has a great description of what regular expressions are and why you would use them: https://en.wikipedia.org/wiki/Regular_expression

Read the JS docs: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guid...

Test your regexes: http://regexpal.com/

Visualize your regexes: http://www.regexper.com/

Try some challenges: http://callumacrae.github.io/regex-tuesday/

And remember, writing regular expressions can be very difficult, reasoning about your regular expressions can be even more so, defining your problem can be the most difficult of all. Think before you regex.
> Pompeo, R-Kan., said he was "deeply troubled" by the scheduled video appearance of Snowden, whom he described as lacking the credentials to authoritatively speak on issues pertaining to "privacy, surveillance, and online monitoring." Snowden's "only apparent qualification," Pompeo wrote, "is his willingness to steal from his own government and then flee to that beacon of First Amendment freedoms, the Russia of Vladimir Putin."

Right. If history has shown us anything, it's that a guy on the House intelligence committee has no idea at all what's going on in the NSA.
I agree there's no excuse not to use (and force) HTTPS, but the parent did say:

> hash your secret key together along with other data unique to your HTTP request, in particular the headers and the datetime

So that isn't a straight hash and you can't just trivially replay. It does require you store the secret in the clear (or at least reversibly) on the server, but I see a lot of APIs do that...
Google's Sundar Pichai on wearable tech: 'We're just scratching the surface'
I wonder how much visibility on HN it requires for the switch from "not a bug" to "definitely, for sure a bug" to happen?
#1 is a fairly standard security concept used by protocols like oAuth or JWT. It requires an API key pair (public and secret key).

The secret key is only used for signing and is never passed in the request. Used in combination with nonces and time stamps you can make a secure API that isn't susceptible to replay attacks.
China warns of risks in plan to retire Windows XP
> A program looking at all incoming data and picking out extraordinary data (in AF 447's case, for instance the stall warnings) to flag for a human operator to inspect would help greatly.

Look at what happened in flight AF447. Everything occurred in a matter of minutes. Even if what you mentioned were to be in place, there would be virtually no time for an operator to do anything about it. And probably such operators would have to go through textbook questions because such regulations would be imposed on them by the FAA.

That's why we have several pilots in every aircraft, to mitigate the risk of human failure. Having more operators outside of the plane are not going to help much. If you want to put more engineering power, it's more software in the plane that is the right way to go for safety, as demonstrated so many times before.
>there's nothing "libertarian" about making money from avoiding a sovereign power's taxes while sabotaging their communications infrastructure.

The "no true libertarian" defense?
You're judging something without facts based on pure politics. And you blame the show for being influenced by politics.

You're doing exactly what you're against of, and you don't even notice it.

If that's not obvious I don't know what else is.
The only modernization needed is elimination of human pilot all together out of the loop. Then there is no training, union, or endless testing, as the robot is fail safe just like there have always been more than one engine in commercial airplane.

Purposefully staying behind the technology curve is not a "safe" strategy, aviation is not alone in this obsolete thinking bias, the same is seen in utility, automobile industry too.
I believe the Chinese currency is non convertible and free floating, if their "debts" are denominated in their own currency, the basis for this story is flawed. The producer should take 10 minutes for a little education from Bill Mitchell: http://goo.gl/zMlB1X I wish U.S. policy makers understood our monetary system.

It does sound like China has problem with inequality which hopefully they will address.
>The African governments effective and non-corrupt enough to provide basic 21st century amenities like internet access are, practically by definition, not the African governments that we are talking about. What need do those countries have with drone-internet if they already have widespread uncensored internet access?

You know, you can have a government that's not corruct and still don't have "basic 21st century amenities like internet access". Actually your own people might not even care about such "basic amenities".

Sometimes the corruption comes from people outside pushing such amenities down your throat.
I'd say if Google can send this much traffic automated it is most certainly a bug. They should engineer some sort of upper limit to the amount of traffic sent to a single ip so as not to perform denial of service attacks on it.
Even kiddies like me can DDoS now... Where shall I begin... ;)
Ack, you're right. Subliminal marketing takes hold again :/

My intention was to push back on the references to hipchat, campfire and so on.
SEEKING WORK - Remote, or on location in Canada.

EMAIL: aaron.d.daub+hn@gmail.com

Hi! I'm an iOS consultant based out of beautiful British Columbia. I've been working with iOS since 3.0. I have niche experience with AVFoundation, and am ideally looking for a long term (several month) project.

If you'd like links to some of my apps in the store, shoot me an email!
I'd love to do this for coding, except the onboard wifi is unusable. I tend to prefer Amtrak to any airline in basically every area except wifi, which is bizarre considering how recent a development in-flight wifi is.
That's pretty clever, good find! I wonder if you can do the same stuff in Office 365, etc.?
Nice catch!

I don't think removing the parameters would be ideal, though, since some sites might legitimately serve up different images based on different parameters.

Just limiting the amount of traffic to a single server, or outbound from a single spreadsheet, seems like a good solution, though.
Nice catch. I'm not so sure about:

A simple fix will be just crawling the links without the request parameters so that we don’t have to suffer.

Many links would fail/have different content if the request parameters were removed from the URL. Perhaps the crawler could use some kind of reverse bloom filter [1] to be more careful/back off if it receives the same content from multiple URLs. However nothing is simple at Google scale so there are probably issues with this approach too.

[1]: http://www.somethingsimilar.com/2012/05/21/the-opposite-of-a...
This is about two years old: http://www.behind-the-enemy-lines.com/2012/04/google-attack-...

I would hope that Google is able to detect abuse of their infrastructure for (D)DOS.
Doesn't Facebook do something similar for preview links in chat and/or wall posts? You're probably limited by the number of messages/posts, but I wonder if that could be exploited with n number of fb accounts.
I'm not surprised at Google's response, since this looks to me along the same lines as putting lots of images in your signature in a popular forum; although in that case it is really is a DDoS.

Maybe Google should consider putting a bandwidth limiter of some sort on that (or even better: use hashes to avoid duplicates), but I think screaming "security! vulnerability!" is not a good action to take here...
This sort of abuse of protocols is pretty well used. A number of interesting port knockers are written using ping (ICMP echo). One of the more interesting to me was using the TTL value to pass hex nybbles. Implementation was up the ttl until your ping got through, then send your 'value' as ttl + value to your destination. It was limited mostly because you don't get that many hops generally. It is also negatively effected by path randomization but if you're willing to commit bits to forward error correction you can still get a message through.

A lot of ping traffic through, shows up like most of these ideas in any shop with regular network monitoring.
Indeed, I've quoted that article. But it doesn't talk about random parameters which makes it so easy to attack any website not just your own where you know what the urls are.
This is a very nice overview, but, knowing the rules of chess doesn't make you a chess master.
One dimension you can look into is the percentage the county's administrators get from average people's income and their consumption. I don't know if there is anything public in English. But I can tell you it's very very high. And the social safe net is not reliable in the long run. That's why people need savings in the bank.

Another key dimension is to have some knowledge about the party that rules China. As an organization, it is quite efficient in some straightforward tasks. However, sometimes there are tasks that require more advanced way to organize people. Any organization has its limitation. And most organizations have very limited capability to adapt/evolve. The way to form the organization is the biggest obstacle. Once this is understood, everything becomes clear.

Sorry that I have not given a clear answer but some clues. The tools I recommend are some basic understanding of concepts in organization behavior, complex system(such as complexity theory), Austrian school economics and, of course, some history of the party, how it operated economically from its early days.

No need to get deep in the tools I listed, just have some ideas of how they perceive the world. These tools are not perfect. But with them, we may have a better view of the thing we want to know.
Hope this helps.
Wow this is an awesome idea. Every business has this problem with multiple people trying to modify the same excel file.
Useful One-Line Scripts for Sed
Yes of course. But then do those dynamic images serve any purpose on a spreadsheet ? If a user needs a dynamic image he can download it to his own machine and upload it. Of course if he need many dynamic images, then that's another question.
I found http://regexcrossword.com/ to be a good learning tool.

Here's one if you really want to test your skills: http://i.imgur.com/qLh2gcK.jpg
I've seen this bug floated around a few times, with the request parameters and all. Interestingly enough, you do not have to use an image either, and can link to any document on the server. In addition, it will work with nondeterministic values. So you can do (for example):

=image(CONCATINATE("http://example.com/?", RAND()))

If you add this to a spreadsheet and fill a few thousand rows with it. Each time the spreadsheet is loaded, google will hit the server a few thousand times.
How could Google use hashes to avoid duplication? They'd have to download each link before they could hash the contents thereof, so the damage would still be done.