skysight-inc/HackerNews huggingface dataset:
Hi, read the blog post. According to both the blog post and ISEC, you had a pathetically easy man-in-the-middle attack against all of your code, including deployed code in real world use, not just the "buggy" IOS client. Care to explain how that can be taken "out of context?" Even if the rest of the audit was a complete lie, that would still be "brutal."

From the ISEC REPORT:

"CryptoCat's OTR implementation on all platforms allows a chat peer to change their OTR key during a chat session without user notiﬁcation. An attacker performing a man-in-the-middle attack against the client's XMPP or HTTPS stream can inject their own OTR key in the discussion after a user has authenticated their peer's OTR ﬁngerprint. This permits the attacker to decrypt all messages that follow, and no user would have reason to suspect the compromise. Group multi-party discussions do not seem to suﬀer from the same vulnerability." (emphasis mine)

Your response in the blog:

"... This is a problem that can be exploited in some real-world scenarios and needs to be addressed with appropriate authentication warnings. Thanks to these audits, this issue was caught in Cryptocat for iPhone before it was released. Therefore, unlike the desktop version, Cryptocat for iPhone was never affected by this issue."
The public trial of Mozilla CEO Brendan Eich (interview)
This Infographic Is Just Wrong Enough To Sound Convincing (2013)
Tim Cook Turns Up the Heat
Rest assured of my utmost respect and support, Nadim.
None of the "problems" of which you speak are actually mainstream problems. It's perfectly possible to hose your network stack in any OS. Just don't do that and you'll be fine.

USB drivers, sound drivers, printer drivers, web cam drivers, etc etc, are all using user-mode drivers since Vista. They cannot crash your system. Similarly, graphics card drivers use a special model that means they can auto-restart if they were to crash; which as it happens is exceptionally rare and often resolved by upgrading the driver.

I've used Windows ever since it first got a Registry (95) and it's never corrupted on me, ever.

I lol'd at the "or improving the driver model?", as though there is ANY mainstream OS out there with a better more flexible and stable driver model than Windows has today.

You've basically dug up a load of non-issues, fictional issues and historical issues and portrayed them as relevant issues in the world of Windows today. They aren't.
Huh, this was apparently submitted by Alex Stamos, a co-founder of iSec partners (who did this audit). And he editorialized the title, "Brutal Professional Audit of CryptoCat Published."

Your former company did an audit for a customer, then you posted it to HN calling it "Brutal"? Really?
It never will, it is a design decision. Even Intel pushes for intrinsics.
Did you show cool visual stuff like in SICP where you could make images and move them around? Or animate a story of some kind?

I'm asking because my younger cousin definitely enjoyed looking and playing with a Mario-like game where we would loop-back and have fun within the REPL. However, I don't think she would have enjoyed mathematical additions or learning about while loop for the fun of learning-about-while-looping.
I don't know... but if I came across that without knowing the context, I would conclude it was written by a non-english-native speaker, most likely an Asian speaker.

Try an experiment, show the text to other people and ask them to guess the likely national/ethnic identity of the writer.
I don't think so. I'm under the impression that records are kept there indefinitely.
Are you saying that it's good news because it means that no actual users were exposed to the flaws? To the extent that those flaws apply only to the iOS version, I agree: that's good news.

Are you saying that it's good news because they tested something that you weren't ever going to release in that state? That's a tougher row to hoe, unless you're going to claim that your team inevitably would have found the same set of vulnerabilities that Scott, David, Alban, and Zooko's team found.

For a typical application --- yours isn't typical for any number of reasons --- prerelease or not, the state the application is in when a pentest team gets it is, from the perspective of security, the application customers would have received.
I thought similar things, but your answer is also a parody of engineers.

The client almost certainly does not want a multidimensional drawing with trick lighting. Just because you _can_ engineer anything doesn't necessarily mean that its the right solution. If the client is asking for something that seems crazy, it's probably because there is a communication or information gap somewhere, not because they want something crazy.
It still exists, unchanged.
He is not only the CEO. He is also the sole board member. He filed in US court asking the US court to recognize him as Mt Gox's "foreign representative" in the US.
The "that appears to be what they want" sentiment will, I suspect, be quite amusing to anyone who's ever bought tickets for a Wu-Tang gig only to find that (random number significantly less than the number of known Wu-Tang members) actually turns up on the night.
They're using it as an incentive to purchase PS+ - so I don't think this will be fixed with PS4. I find it distasteful being forced to pay to prevent being blocked by updates when all I want to do is watch a video.

http://manuals.playstation.net/document/en/ps3/current/setti...
Nothing in the description indicates driver was faking serious disability.Why did you assume that?
"That's a triangle."

Shut up, you fool, it's what the client's asking for. Get them to add a few more lines and then order coffee.
That's an awesome idea.

If the tether was attached to a winch then they could lower or raise the turbines depending on the optimal altitude for wind speed.

Maintenance could also be much easier because it can be lowered rather than sending people up a turbine.

If you add a turbine behind the main turbine, how much less efficient would it be?

Wouldn't the tether be the most difficult part of this? Why is that not discussed more in the article or even shown in the picture?
My first thought was that it looked very similar to Ninja Blocks: http://ninjablocks.com/products/ninja-blocks-kit
Why find your way in as a hobby? Are you a professional developer now? Do you like low-level code? Are you OK with jumping directly into the deep end of the pool and maybe drowning a little bit? Why not reach out and talk to us about working on a professional security team?

We have gotten very, very good at taking low-level devs and turning them into terrifying killing machines, and if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors, we'd be happy to do the same to you.

http://matasano.com/careers
Has anyone in the UK had this?

Our account is still showing a 7 day window.
> People can and do internalize messages

Thanks for this. That's why I said she could use some inspiration. And not all the messages come from men. Women and friends provide powerful messages as well.
They mean art in the sense of "high art"[0]

[0]http://en.wikipedia.org/wiki/High_culture#High_art
Wow, Amazed someone used ZigBee instead of Bluetooth Low Energy. There's just so many more BLE chips out there and Android and iOS phones are even compatible nowadays.
You can have as many perpendicular lines as you want on a Poincaré disk.

http://en.wikipedia.org/wiki/Poincar%C3%A9_disk_model

(credit goes to my coworker dmvaldman)
You are clearly too young to remember the rage people had back then.

WinXP was "Busy" compared to Win98. Those who wanted busier, more colorful schemes could always install a color pack or customize their windows as appropriately.

WinXP released with basically one colorpack, and removed the option of going back to the older "classier" gray look from Win98 / Win95.
For gaming, this would be an ideal place to have an OnLive client.
+1 for Plex - works perfectly from the browser/iPhone/iPad/Android phones and tablets. Great Chromecast integration.
Coding is a purely ancillary function to my day job; I am not a developer.
Uh, does that cartoon rendition of "Cortana" remind anyone else of the Corpse Bride?

http://whatculture.com/film/tim-burton-ranking-his-movies-fr...

Creepy...
That's the point, I think I launched the campaign too soon. I didn't had a good press coverage on the launch day. One week later, I got answers from Mashable and Techcrunch reporters, they seemed very interested by Notifon, until I sent them the campaign link (with only 3% of the financial goal reached).
"I hate coding" would be a problem for us, but "I ship software every day", not so much.
Web Components are on their "Watch List" at the end of their roadmap[1], but the language seems to be rather dismissive unfortunately.

[1]: https://github.com/winjs/winjs/wiki/Roadmap
Still rumor and I don't expect to see anything on that front for some time. Why buy the cow when the milk is free, not like Xamarin is flirting with enabling Java on iOS or something - they are sold out to C#/F# so Microsoft is reaping the benefit.

More evidence, Xamarin announced their Evolve conference dates, times and prices and when it goes on sale - if Microsoft were buying them they would hold off on letting several thousand people spend thousands of dollars for a dev conference that would later be tantamount to a bait and switch.
Exactly. It's not new. It's just well done. Spotlight, Quicksilver, and Unity Lenses all had that functionality too.
Whether something is or is not "production-ready" is subjective. Different projects can handle different levels of (un)reliability; "production-ready" really just means "not a significant contributor to your service's downtime, relative to the quality of your own code."

A more useful-and-objective piece of information, I think, would be the average/maximum number-of-nines of reliablity reported by current users of the project. Then you could just look at your own project's current reliability, and allow yourself to depend on anything more reliable than you are.
"The point Dijkstra was trying to make is that humans are inherently incapable of dealing with that kind of detailed complexity, and still reliably make useful programs. That's why he proposed that goto should be excluded from all higher-level programming languages."

There is a very simple isomorphism between each of the typical control structures (sequencing, choice, and iteration) and its implementation with gotos. It's an easy mechanical translation, in either direction. I don't think Dijkstra was making any claim that spelling these control structures with goto radically increased the difficulty of programming. The important thing was using reasonable control structures (and only reasonable control structures) in the design of your program. Obviously, having the language do it for you is preferred much like any other mechanical translation - but that's not the key point.

"It should free the programmer of considering those alternative ways of controlling program flow. Presence of goto statement points to a flaw in the language design."

I don't disagree with any of that.

"Because the basic language I'm referring to, was on my TI84-plus calculator, and it only had an if-statement (no if-else!)."

That's still an example of using goto to implement missing control structures, not using goto when the control structure you want is present.
But he asked "Can you describe, what the end result should look like?"
main() is the entry point function in newer OS X versions. Why ship crt0 in everything when you can put it in dyld?
I have recently switched to crunch. So far so good. Setup is pretty painless if you wait until a new financial year. Only downside I see so far is that the accountant is more like 3rd line support. The online software is pretty straight forward though and it displays your current tax liabilities in real time. I recommend signing up for a free demo.
Just to add to your response, I think absurd questions are totally OK. It's a fact of a life that non-experts will need to talk to experts, and when that inevitably happens it's best if (a) the non-experts aren't scared of asking potentially absurd questions and (b) the experts can translate their thinking into non-expert language. Both (a) and (b) are necessary for great communication.
Junior sales will say yes to whatever the client says they want; Junior engineer will try to implement whatever the client says they want, say no if it's impossible.

Senior sales will try to figure out the real reason of a client's request, and sell them a solution that solves their real problem; Senior engineer will try to figure out the real reason of a client's request, and propose a solution that solves their real problem.

A sales person and an engineer may start from opposite directions, but really good ones think the same.
The only portable GUI code that I've ever seen work somewhat reliably is HTML/CSS.

Everything else either implements a 3rd GUI, Swing, et al, or looks weird on a few of the platforms, GTK.

Oddly enough the best cross-platform lib I've seen, Qt, is written in C++.

C certainly isn't the be all and end all, however, it's far more portable, reusable, and linkable than C#.
http://en.wikiquote.org/wiki/Charles_Babbage

On two occasions [Charles Babbage] had been asked, — "Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?"

To which he replied:

"I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question."

(I usually remember it as "I cannot rightly comprehend the confusion that would engender such a question"; either gets the point across.)
Except they are now selling a razor that "works best" with their own blades.
@secalex Dumb post man. Way to de-contextualise something, cause a drama and damage reputations needlessly.
Those don't do the same thing.
...so what wrongdoing did the banks do, exactly? Told another way, a failing company was headed towards bankruptcy, until the banks stepped in and saved the day by recapitalizing the company, saving thousands of jobs and a good brand in the process.
I can't tell if you actually don't know who commissioned it or if this is your way of suggesting that the parent comment is a lie. It seems like information you would have access to, considering your connection with iSEC, no? (I'm not trying to stir up shit, just genuinely curious.)
There are some strange people our here in the valley. I thought maybe he was one. Either way, the thought crossed my mind and I posted it here because there's also some strange people on HN that I thought could relate.
> The browser code is distributed as an extension, which does not have the properties you describe.

Actually, browser extensions have the exact same properties except for being code signed. That's not enough: http://arstechnica.com/security/2014/01/malware-vendors-buy-...

> I don't think CryptoCat has been distributed as a traditional web app for at least a year (probably more).

That they ever shipped in-browser crypto demonstrates that they shouldn't be shipping crypto.
You realize that all nations you listed but China are pretty much "one and the same" as the US when it comes to NSA spying? You only underlined how disproportionally powerful that intelligence alliance is.
The key is to get notifications when you're away. BLE don't have a good range (about 10 meters). ZigBee is more like Wifi (about 50/100 meters).
In Monte Carlo, there is something called "stratified" or "biased" sampling. It's used to overcome the problem that if you are trying to sample a highly nonuniform probability distribution, a "fair" sampling based on the frequency distribution won't tell you about the tails unless you use a lot of samples.

Suppose that we are trying to sample a distribution that is, say, 90% male and 10% female. If we do that with a fair sampling, and take 5 samples, chances are that we will end up with no females in the sample. Someone observing the sampled distribution would draw the conclusion that there are no women in the population from which the samples are drawn.

The solution is to not sample fairly, because to do so results in oversampling the common cases and undersampling the rare cases. Instead, you construct your sample such that it samples the rare cases with an artificially higher probability. You of course needs to take this into account when interpreting the samples, but that's fine.

So for the topic at hand: if you want to expose someone to the widest possible range of viewpoints, sampling fairly is an inefficient thing to do. Instead, you need to split the samples into several strata, be they gender, cultural background, wealth, anything you can think of, and then make sure that all parts of those distributions are represented in your sample. Otherwise, with a limited number of samples, you'll never encounter the rare instances.

In other words, you need to "carefully structure inequality in", as you say.
Are the Matasano crypto challenges currently stuck in some way, like with a grading backlog? I signed up some months ago, sent my first set of answers just after the new year, and have never heard back about the second challenge set.
> The far more interesting possibility is that the data suggested that they do what they did, but that the data was wrong.

Agreed, you can even see good UI ideals behind several controversial decisions... large buttons on the start screen (just like enlarged buttons on the ribbon) suggest someone read Fitt's Law. Searching is a task that takes your focus while you type, it seems to deserve a little more screen real estate than the tiny eighth of a screen 7 offers.

Maybe MS designs are evaluated in usability studies by charitable or willing users, but are sort of foisted on the public once shipped, and evaluated much more critically.

Or maybe MS is lumping all of its users into one profile, when there are really so many Windows users, you almost have to break them into clusters of users.

I had a VM running Blue for a while. It was a jarring experience at first, I got used to it, but I didn't immediately run out and buy it. I mostly type to launch, so I never clicked on anything on the start page, but didn't really notice a dive in my workflow, since search was a little better. It was neither as good as its proponents claimed, nor as bad as its detractors made it out to be for me. But maybe that's just my workflow.

Windows is designed for so many audiences, they should really disaggregate their UI from their core. Something that makes Linux incredibly confusing might actually be really necessary for good UI design for this many people.
So, if there is a large amount of money that is searching for risky investments to the extent that investors are willing to finance an obviously failing business, how come more of it doesn't end up in risky ventures that might actually go somewhere?

Is the problem a lack of information, the lack of better investments, or that investors don't care about their money?
How was this a "pre-release prototype" audit of Cryptocat if the app was for iOS was rejected from the Apple app store in December.... and the audit took place after that in mid January? Seems dubious to say it was all about some extra debug logging when there are some serious flaws here found weeks after it almost was approved on the Apple store.

http://www.theverge.com/2013/12/27/5249402/encrypted-chat-se...
folklore.org is amazing, but it’s been around for 10 years now. I kinda want to amend to the title: “(2004) (1982)”. Heh.
Tsunami Waves Animation: Northern Chile, 1 April 2014
I was kidding.. I never needed to use anything but Postgres.
Show HN: my new Android app to better your Russian
I just go to the desktop (win+d)and hit alt+f4
There's an even faster way than sjwright's answer.

Type the windows key, then 'cmd', then press enter.

I really wish Windows 8 did a better job of teaching users, especially the quick ways to launch programs from the keyboard.
What surprises me with all this detailed record keeping is the sheer cost of all this -manual- security apparatus. Sure, not every resident was a 'dissident' to be monitored, but it sounds like this family had a team of ten people working their case, round the clock.

I suppose a lot of the informants and plants were not paid, but forced to participate through threats, but it still seems like a staggering amount of organization at incredible cost.
Weirdly: yes, I do. It's handy, and those experiments show what I've done to tackle a problem. Numerous times those experiements that I've left in the repo somewhere have come in handy.

Hell, we keep our feature branches around here. *shrugs
95 was pretty groundbreaking. Vista was nice tho. But XP felt a bit fisher-price even at launch :p

The Win8 colors look like someone ate a color palette and then barfed it all over the wireframes. It's horrible
Whoah! I'm not saying anyone is being dishonest. I know approximately as much as anyone who can read the linked PDF knows, modulo that I also know a bit about how OTF works because I worked with Matthew Green on coordinating the Truecrypt audit.

I was asking for clarification, but my writing style is dry and blunt, so I'm not surprised if I managed to convey something different. I apologize in advance if so.

More than anything else, I wrote the comment as a (hopefully mild) F-U to the sentiment that the USG is hellbent on destroying privacy on the Internet. Big parts of it are, sure, but there are good people working inside of it too. :)
"I recommend that you refuse to buy as much as a guitar pick from any company currently owned by a private equity firm, or any financial entity that does not come from the music industry itself."

The problem is that any boycott initiative needs both a datasource and a UX that integrates into our buy habits. Something like a "PQ" - a parasitic quotient.
I have no idea what you're saying, so I'll just add to my point. Did authority originate as 'the people' purposefully vesting some of their power into one or more leaders, in order to organize society more effectively? Or is that how we post-rationalize the state we're born into?
If you bought it, you bought it and its yours. Don't pay millions unless you own the rights.
There's a Sufjan Stevens song that can only be heard by attending private listening parties in Brooklyn. It's free to attend, but no recording equipment is allowed.

http://online.wsj.com/news/articles/SB124475230719107485
Buy two and give your friend one?
One thing that isn't clear at all is if it is necessary to use Visual Studio to build a WinJS app. Can I develop and test the app on a MacBook or Linux laptop in a web browser, and only involve Visual Studio when I need to package the app for the store? Or is VS required to even get started?
I didn't downvote you, but I can only speak from personal experience that I haven't found the start screen to be any slower vs. the start menu.

None of the negatives you mention apply to my usecase (I don't typically rename shortcuts, nor did I ever use the recent files functionality etc.)

But what I do find is that the start screen is faster for opening the application I'm looking for: I'm either searching for a particular name as with the start menu, where the speed is about the same, or I'm browsing around looking for something whose name I can't remember, for which I find my groupings of smart tiles far easier to parse in a quick glance than I ever found navigating a directory structure in the start menu.

A directory tree to open applications still seems a bit like a holdover from the filesystem design, rather than an interface that's been designed for the purpose of finding the right application fastest.
That's actually completely different though.

I'm always trying to get my internal stakeholders to NOT describe what they think the end result should look like, but to describe WHY they want it, what they want to accomplish, and let me help figure out what the end result should look like to accomplish that.

I'm not saying it's easy.