skysight-inc/HackerNews huggingface dataset:
based on the region where this occurred, you can rest assured that one, if not several, state intelligence services knows exactly what happened to the plane and has near continuous knowledge of its position. the area of asia where this occurred would likely be of interest to US, CN and RU.

the fact that none of these countries gave information about the whereabouts of the plane in a timely fashion suggests to me that they have a vested interest in not sharing what they know.
JsDelivr API – From a Casual Experiment to Success
Joking aside, I'm surprised more isn't being made of Balmer's hand in this mess. Some of XP's staying power is surely due to it's being the first "good enough" Microsoft desktop OS (win2k notwithstanding), but the back-to-back failures or Longhorn and Vista had to have an enormous hand in a generation of users never upgrading. That eight year chasm is breathtaking.
> An anonymous market means that there's no legal recourse if someone cheats you or steals from you.

Which is why the protocol needs to financially discourage cheating.

Take the Bitcoin protocol, for example. It's not impossible to build a Bitcoin mining ASIC for $10M, get 30% of the network hashrate, and have a reasonable chance of reversing a 6-confirmation transaction. But unless you can find someone who is willing to accept a 6-confirmation $10M-equivalent Bitcoin transaction, it doesn't make financial sense for anyone to do so.

The same should apply for this hypothetical protocol. If you can see a merchant has spent 100 BTC to build up a reputation (eg. through proof-of-burn), he could try to scam you when you buy 0.5 BTC worth of goods from him, but he wouldn't profit from it financially.
Sometimes it is the tool that's to blame, you know.

Even the best master carpenter wouldn't be able to build something as simple as an end table if he were given a pickle to use as a hammer, and an onion to use as a saw.
No. "Recruiting" doesn't create any differentiation at all between the two modes: 1. Typical hiring processes and 2. Collusion among tech giants.
That's right, not enough information. But, however your attitude might be the right one, I'm a little bothered already, because I didn't expect that to happen so soon.

In fact, even the idea of "year of CPU time" doesn't sooth me much, because while most of your traffic might be "quickly-expiring" it's definitely not true for all of your traffic, and what's possible to do with a year of CPU time will be possible to do comparatively cheap very soon. And I guess we all remember stuff like Google collecting some wi-fi traffic anyway.

So, it sounds somewhat scary to me. We don't even have anything better than WPA2 now, do we?
I've requested the paper through my school's inter-library loan, I'll know in about 4 hours if the librarian can get me a copy. If you send me an email and I get a copy I can forward it on to you. (Though it wouldn't surprise me if someone else 'liberates' the paper for everyone before then.)
What they do is have proofs hosted by the user on different sites (e.g. Github, Twitter) that your client can use to verify that the key is valid. The Keybase server can't fake those without compromising those sites.

In one command, Keybase has acquired maria's public key, her keybase username, and her public identities, and confirmed they're all her, using GnuPG to review a signed tweet and gist she posted. (...) If you trust the client (our reference client is open source), then the server can't give you the wrong key for maria without getting caught or also compromising her twitter and github accounts.
Am I the only one who thinks that this post is not relevant to HN as it serves just as an advertisement for buying the paper, without providing any meaningful content?
"Olá" is "Hello" in portuguese, in Spanish it's "Hola"
HushMail, IIRC, proposed almost the same thing and in the end they had the keys to unlock your mailboxes.
Wow, that's pretty cool indeed. I completely did not understand that off their landing page though. Thanks for the clarification!
Firefox OS developer preview
You can do it right now, you just need to write your own updating function. With PL/Python or PL/V8 it would be quite simple.
Startup Product Launches Are A Terrible Idea
It's a step in the right direction.

I'm a coder yet I don't understand much about encryption and certificates and signing. Keybase makes it more accessible to me. If you assume that there's many people like me (I bet there are: non-security obsessed coders, geeks, whatnot), then the existence of Keybase makes these concepts accessible to a larger crowd than before. That's a win.
IOS 7.1 Jailbreak Revealed, But There’s a Catch
I've never really believed in a recipe book for millionares. If the books like this really worked, every second person would be a millionare. I strongly believe that a millionare is the person who follows his/her own way and does it well, keeps on doing it when the whole world says: You suck, dude! You don't have to write or read a book about it. It's simpler -do whatever you want and if you do it right, you'll make it through.
Because in software development industry "Because it works!" is considered an acceptable answer, that's why.
He hasn't explained because it is a ridiculous comparison. Husband and wife relationships are long term loving partnerships. Employer-employee relationships are business transactions.

A good husband/wife shares rewards fairly equally. An employer rarely distributes profit equally.

A good husband/wife team both have a large degree of autonomy and decision making power. In an employee-employer relationship this power predominantly resides with the employer.

A good husband/wife stands by their partner in times of trouble. An employer will happily jettison under-performing employees.

A good husband/wife will sacrifice some level of material comfort in order to help their partner improve themselves. Employers will not provide training etc unless it is in their best short term interests.

Etc etc etc. Fact is jobs are nothing like marriage.

Likewise it is not about advertising in unwelcome places. Google is not advertising to Apple; they are advertising to individuals who happen to work at Apple. The party, Apple, that considers it unwelcome is a third party to the advertising. It is frankly none of their business. It is unwelcome to Apple because it stops them from underpaying their staff.

And finally there is a big difference between actions that enhance the market and allow it to operate efficiently and negative market actions. If you are worth $200,000 to Apple but only $100,000 to Google then it is a better allocation of capital for you to work at Apple. If you are worth that money to Google then they can easily counter offer. This aids market efficiency which is the driver of all our economic growth.

This is completely different from trying to steal key players simply to harm your competition. But stopping this key player theft is actually easy via legal and ethical market mechanisms (e.g. vesting options, bonuses on successful completion of key deliverables, fully funded non-competes, actually paying market wages etc).
Link is down for me.

Archive.org link: https://web.archive.org/web/20130623133054/http://leoexplor....
Pay fixing and chomski
We're not reinventing any cryptography here - the goal is a simple way to look up and trust keys, based on known public identities. from keybase.io
Do you have a source for that forex claim? I remember reading in one of his books that he was never able to consistently profit from fx trading.
Looks a bit spammy to me. I recommend this one every chance I get as a practical book about how to do your own small business as a developer:

http://www.amazon.com/Start-Small-Stay-Developers-Launching-...

One of the things I like about it is that it is not a "get rich quick" book. Indeed, one of the quotes I highlighted is "strive to build a startup that generates $500 per month in profit". That really resonated with me, because it sounded like something that I could aim for, rather than "YOU TOO CAN MAKE BAZILLIONS!!!". Even if you want to make bazillions, you've got to pass $500 a month at some point!
"It is funny to see the construction of Europe, which is arguably the first time in human history that different groups of people willingly tend towards a common political entity" - how about India?
The Millionaire Fastlane: write a book with this title, and have a lot of clueless people buy it. It's proven to work.
The thought expressed in the post reminds me of Norman Kerth's Retrospective Prime Directive [1], [2]:

"Regardless of what we discover, we understand and truly believe that everyone did the best job they could, given what they knew at the time, their skills and abilities, the resources available, and the situation at hand.
At the end of a project everyone knows so much more. Naturally we will discover decisions and actions we wish we could do over. This is wisdom to be celebrated, not judgement used to embarrass."

[1] 'Project Retrospectives: A Handbook for Team Reviews', Norman Kerth

[2] http://www.retrospectives.com/pages/retroPrimeDirective.html
Show HN: Official WordPress Plugin for Kraken.io Image Optimizer
Real-time Django notifications with Node.js, socket.io and Redis
> Keybase.io is very much rolling their own system.

It's a store (much like github) for standard PGP/GPG keys. And it provides a convenient CLI for basic tasks.

As far as I can see, it does no more rolling of its own system than Github.
I'll offer my own input here, goaljobs[1]. (By the way I don't recommend people to use goaljobs unless you're prepared for a lot of assembling and are interested in understanding what it does -- it's not easy to use at all).

You can break down complex tasks like "Has my software been delivered through the app store" down to goals that have to be fulfilled by carrying out (recursively) many layers of rules, like "did it pass human evaluation?".

It's a generalization of make / build systems.

[1] http://people.redhat.com/~rjones/goaljobs/
My thoughts exactly. They always look a bit #desperate #tryingtoohard #inauthentic PLEASE RT!!!
I can't imagine the hassle of having to charge five battery pack.

The bigger battery pack I found on amazon with decent reviews was 32000mAh for $119.99 (http://www.amazon.com/dp/B00DN0KBXU).

The trontium still cost more than two of those but the difference is shrinking.
> For one thing this is the book venture capitalists don't want you to read.

That sounds like 100% marketing schtick.
> Made in California

Perhaps it means something positive in California itself, but outside of it it more or less means "expensive, pompous, behind schedule" :)
Where's the money stream, will they disappear or be aqui-hired?
Okaaaaaaay, and how to you connect a wire from that USB port to your magsafe port on your macbook?
ShowHN: IntroJS v0.8.0 – Introductions without focusing on elements
Works for me tremendously well, and that's why few years ago I bought a waterproof notepad and take it with me to the shower. I do that often when I'm confused or out of ideas how to continue something. Actually, the best public talks I gave were all designed in the shower ;).
Where are the calls for boycotting Google for doing something blatantly "evil" and illegal?

Kudos for Facebook for doing the right thing here.

I'm just curious what ramifications this has, if any.
Chances are you are the type of person I complain about every day. Using Excel for things it should not be used for....

There are true data analysis tools on the market, Excel is not one of them
I believe it's a licensing issue, could be completely wrong though.
That's been tried before. It's theoretically possible, but unless you have a ton of computing power and example problems to work on, it'd probably just overfit to the specific problems you train it on.

And as the other comment pointed out, genetic programming is far too weak to achieve anything this complex. You need to simplify the problem tremendously by hand and then have the computer optimize the last few bits. Though seeding existing metaheuristics to start with might work.
generic grumbling about academic paywalls

I'm sure we'll see an analysis written up by Securosis or someone along those lines soon. I'm tempted to buy it myself, but given the synopsis, I'm a little skeptical.

"The researchers have now shown that a brute force attack on the WPA2 password is possible and that it can be exploited, although the time taken to break into a system rises with longer and longer passwords."

A brute force attack is possible on any symmetric encryption system. Difficulty is increased with the size of the keyspace. These are truisms. No offence to the authors, but this isn't really a discovery, unless they've discovered a way to reduce the key space.

"As part of their purported security protocols routers using WPA2 must reconnect and re-authenticate devices periodically and share a new key each time. The team points out that the de-authentication step essentially leaves a backdoor unlocked albeit temporarily. "

This isn't really a backdoor. If there was an actual fault that would allow you to authenticate without passing a key, that would be one thing. But you still have to pass a key by the way they describe it. To perform a brute force attack on the authentication step, you need to capture the handshake. You can wait for that to happen, or try and force one yourself. Here's an aircrack tutorial on how to do this:

http://www.aircrack-ng.org/doku.php?id=cracking_wpa&DokuWiki...

Note though, that while this gets you the packets needed to perform your attack on (as opposed to waiting for the Client/AP to periodically reauthenticate), and potentially saved you a couple of hours, you still have to break the key.

And that's what it all comes down to. Breaking a weak password is easy. Breaking a lengthy key is hard. The only vulnerability that exists as described so far is insufficiently long keys. That's a key management/user problem, not so much a technological one.
I like the LED status lights, but I don't like the skeumorphic cylindrical battery shape. Batteries get away with it because you put them into something. This thing will just continue to fall down or roll around.
It looks like they just de-authenticated a client and then performed a dictionary attack:

"At the beginning, the area was scanned-sniffed with ‘Airodump’ and then a deauthentication attack was made with ‘Aireplay’," according to the paper. "Through that, an instance of the PSK was caught. Finally, ‘Aircrack’ was attempting to reveal the secret password by using the instance of the PSK and matching it with every record of the dictionary. For these experiments we used a very big dictionary that consisted of 666,696 standard printable ASCII character records of various lengths. ‘Airodump’ and ‘Aireplay’ are commands of the ‘Aircrack’ suite, responsible for sniffing and deauthentication respectively." [1]

[1]http://www.securityweek.com/researchers-outline-how-crack-wp...
Backup Awareness Week
same issue in google.
> We need to eliminate the H1B visa program and expand our green card program. I want these developers to be paid a fair wage, and I want them to remain in the US after the duration of their visa.

This.

The H1B program is essentially indentured labor.
sell foraging gear to gold foragers
I know many of you will not like this book, but I personally think it's exactly what the doctor ordered for a ton of people who feel they need to break free from the "golden handcuffs" of their salaries / day jobs.

It's everything I wish I had read at age 20. Except it didn't come out until I was about 28 or 29. At that point, I'd just spent the last half dozen years learning all of those lessons myself.

Behind the marketing fluff and silly title (which has been quite successful for him), MJ absolutely nails it. People either "get it" or they don't.

For some of you, it might seem like common sense:

* Separate your time from your income stream. *

Build a flexible, scalable business that you control that has a hard path to entry, yet can scale beyond its own man-hours.

Don't be too put off by the title. There's a ton of people, myself included, who would benefit from reading it.
As other pointed out, there is just not enough information available. Hopefully soon somebody can make the paper available to the rest of us?

What bothers me most however is what the authors seem to recommend as additional security measures (per http://www.securityweek.com/researchers-outline-how-crack-wp...): MAC ACLs and Hidden SSIDs. I don't think I need to point out here how ridiculous these 'security' measures are, especially in light of the nature of the alleged weakness and how one would need to exploit it.

That doesn't really lend a lot of credibility to the paper's / this link's title.

Also, it looks like that without rainbow tables, the PSK cannot be cracked in a meaningful timespan? They compared the 'captured' hash (?) against a dictionary to determine their success, but again, I might be extrapolating too much from too little information.
Further technical details and quotes from the paper are available at:
http://www.securityweek.com/researchers-outline-how-crack-wp...

The methodology appears to be as naive as a brute force attack against the Pre-Shared Key (PSK):

"At the beginning, the area was scanned-sniffed with ‘Airodump’ and then a deauthentication attack was made with ‘Aireplay’," according to the paper. "Through that, an instance of the PSK was caught. Finally, ‘Aircrack’ was attempting to reveal the secret password by using the instance of the PSK and matching it with every record of the dictionary. For these experiments we used a very big dictionary that consisted of 666,696 standard printable ASCII character records of various lengths. ‘Airodump’ and ‘Aireplay’ are commands of the ‘Aircrack’ suite, responsible for sniffing and deauthentication respectively."

Which part of this paper is new or novel?
Could you adjust your CSS (I believe)?

http://i.imgur.com/pCSbgwm.png Firefox 28.0.1 Windows 7 x86_64
My favorite item from the Q&A [1]:

What’s to prevent a Reactor from rolling off a table?

We will be offering an octagonal silicone sleeve that will prevent a Reactor from rolling off surfaces and also protect it from bumps.

So....your base product actually will roll off the table, but you can buy an optional extra to prevent it?

I know nothing about USB power delivery, but I presume that's the value proposition (since as others have noted, there are already a plethora of external USB batteries) although it seems nothing currently supports it.

[1] https://trontium.com/answers/
Part of the problem is that one-off scripts are different than applications. One off scripts don't need to be big or particularly maintainable, but the problem is people get in the habit of writing Perl that way.

So it's complicated.

Also keep in mind that a lot of CPAN modules out there began back in the 1990's and are still being developed today. I know. I am now a maintainer of several, and the code isn't often that pretty.

But this is the benefit of being encouraged to think about elegance of code: one improves.

But one can write amazingly beautiful, clear, and elegant Perl or one can write rubbish (after all good Perl doesn't take much work to maintain). Most of my work is either maintaining rubbish or (I hope) writing nice, maintainable code.
According to some discussions on http://www.hackforums.net/printthread.php?tid=4129070 they "discovered" this attack:
http://www.aircrack-ng.org/doku.php?id=deauthentication
I like the way securityweek portrays their findings a lot more than the paper states. "cypher/system cracked" carries very specific meaning the the security community, meaning that a specific mechanism has been broken. SW sounds more like an advisory, warning to make sure your keys are strong. Kudos to them.
Keybase seems to rely on existing systems for trust anchoring (Twitter, Github...) as well as using existing cryptosystems for doing the heaving lifting (OpenPGP). If Github didn't reinvent the wheel because it's all Git, how did keybase.io reinvent the wheel by being all OpenPGP?
I didn't see that documented anywhere.
I'm confused. They downloaded aircrack-ng and wrote a paper about it? How is this news?
I think the target userbase for Keybase is nerds who found GPG too horribly unintuitive to figure out how to use it for themselves. I know I was like that for a while.

The other target userbase is people who want to verify GPG keys that don't have a web of trust. This is useful for, say, me - I'm not part of the Debian dev team or anything, so I don't have many people around who can sign my GPG key. It's nice to be able to publish a link to Keybase on my website and have people be able to be pretty sure it's me.
Wouldn't it be easier just to pay the $10 per flight and transmit your GPS coordinates to the satellite? That can be done today.
Just to put this in some context, if we're talking about 1 core-year (I hope this unit becomes popular) what it really means is just over 500$ will give you the same result in one year / possible parallelisation. If the process ends with brute-forcing independent branches to look for an answer, that may be effectively an hour or less for each case. Not much of protection really...
The summary/abstract/whatever isn't really saying anything new. We've known we can make a brute force attack on WPA2 by temporarily de-authenticating a client for years, and yes, obviously it takes longer the longer the password is. I know they want to sell the article, but did they really need to keep the detail of what exactly do they improve upon also in secret? Are they really mentioning de-auth, spoofing and brute forcing as if they were anything new?
Would someone that bought/knows someone who bought the article be kind enough to clarify on whether or not these guys actually came up with someone new or not, and if whatever they came up with is actually an important improvement from previous techniques?
Thank god it's cylindrical, because I'm sure it's cheaper to make it cylindrical, there's a nice big cylindrical space in every backpack, it's easier to source cylindrical stuff to stick in it, and as a bonus it rolls off tables.
Also annoying - the H1B has the absurd requirement of having a degree, or some ridiculous number of years of full-time employment.

Surely if a company says they want to employ a specific person, and that person is the best for the job, that should be enough?
Do you have any link for the paid support?
s/poaching/poaching or hiring former employees, if that's the case
> There is no one solution fits all. Especially if the problem is imaginary.

Yeah, but there are solutions that actually solve the problem.
The Failure Fetish in Silicon Valley
What would be really cool is if I could use wanelo as a search engine for something I'd like to buy but I don't know where. Like I want to buy a pair of striped shoes with butterflies on for a kid. I put the description somewhere -and I get pictures of the products available. Is it something you are planning to add?
I'd suggest this for their logo ☢
As some others pointed out, the title is very alarming and misleading. "cracked", to us, means "has a flaw, i.e. broken." If it were true, it would be very big news.

Fortunately, this is far from the case.
Not even that really. You might get a single difficulty 1 share or two, worth literally less than the maximum precision BTC allows.
The Basque Mondragon Corporation [0] is actually very impressive:

It is the seventh-largest Spanish company in terms of asset
turnover and the leading business group in the Basque
Country. At the end of 2012, it employed 80,321 people in
289 companies and organizations in four areas of activity:
finance, industry, retail and knowledge.

[0] http://en.wikipedia.org/wiki/Mondragon_Corporation
Wow cool!

Would really like to see related tags, built in the usual big data algorithms / search UX way.