skysight-inc/HackerNews huggingface dataset:
Github meets SoundCloud. When I create a piece of music (using something like Logic Pro) I go through many iterations and only end up with a mixdown piece and no idea of how it evolved to that point. so it would be nice to see the evolution of the piece.
But the best bit would be the remix potential. Someone else could fork it and create a remix!
IRS misses XP deadline, pays Microsoft millions for patches
print(x, end='')

Not quite as nice, but not exactly unusable.

https://docs.python.org/3.1/library/functions.html#print
Retro console gaming. A huge panel of old console games could come to mobile devices and look fine. After being convenient and stable, connectivity could be really cool.
I find this interesting. Calendars are fun, until you have to program them :P
Trust is often misplaced, and there are plenty of people who seem nice initially while working to screw you.
Those side-channel attacks are largely theoretical. OpenSSL and RSA in general are vulnerable to side channel attacks, because many of the fundamental operations are not constant-time. That can change eventually, but RSA is difficult to write in a constant-time manner. OpenSSL certainly has had its fair of lab-demonstrated side-channel attacks, but I don't think anyone has been able to demonstrate their use in virtualized hosting environments against arbitrary other tenants.

Side channel attacks once you've already got code running on the same operating system as the target are much easier. But if you can get arbitrary code to execute on the same machine running OpenSSL, you probably already have their keys.

So, I think the criticism to OpenSSL is valid. Why use it when it seems there are less bad alternatives? A lot of it comes down to network effects, inertia, and licensing. That's a much better answer than side-channel attack surface area, which all RSA implementations share :)
French: male mortality (1816-2006)
I don't like this proposal, simply because e-mail and SMS are not secure. Something like SQRL sounds much better to me, in contrast.

> What is the benefit over traditional usernames & passwords?

- There are no usernames or passwords to have compromised, lost or stolen.

- No keyboard interaction, great for using public computers that could log your keystrokes.

- You only need your Master Key, no lists of usernames and passwords to keep track of.

- There is NO WAY to link one person across sites based only on the site-specific public key, websites may ask for more infomation that could be tracked.

http://sqrl.pl/guide/

https://www.grc.com/sqrl/sqrl.htm
More like as of 15 years ago.
Tikona Bill Pay Demystified
The tor project is a great example of how open source software (OSS) projects can work with sponsors. Trying to find more information on Qualys and PSW Groups sponsorship of openssl is a nightmare compared to tor project sponsors.[^1][^2] Without the tor project's emphasis on transparency and professionalism I doubt they could post numbers like this:

Since meeting the revenue milestones of $1,253,241 in 2009,
$1,574,119 in 2010 and $1,681,101 in 2011, Tor has reached new
heights in 2012 with over $2 million in revenue (unaudited).[^3]

My comment should not be read as a criticism of OpenSSL, it should be interpreted as cause for optimism. The tor project has demonstrated that OSS projects can get sponsored to solve complicated security problems that are difficult to explain to the general public.

[^1]: List of sponsors/projects: https://trac.torproject.org/projects/tor/wiki/org/sponsors

[^2]: Example monthly report for SponsorF's project: https://lists.torproject.org/pipermail/tor-reports/2014-Marc...

[^3]: Tor Project Annual Report 2012, pg 8, https://www.torproject.org/about/findoc/2012-TorProject-Annu...
Two things.

First, resting a limit order on the book makes you a liquidity provider, but not a market maker. Market makers are consistently willing to buy or sell, regardless of where prices are; they are long-term neutral with respect to the instruments they trade. They're able to trade constantly without losing their shirts because (a) they deliberately avoid holding a long-term position in what they're trading and (b) they are constantly adjusting their prices to stay in the middle of the "true" bid-ask prices.

It's easy to see that entering a single limit order doesn't make you a market maker; you're willing to trade only if prices match your preferred valuation, which means you have a long-term long or short position for that instrument.

Second, "most" retail investors do enter market orders (orders fulfilled immediately that cross the spread, buying at the best ask price or selling at the best bid price). But sophisticated investors do not do that. Market orders charge a premium for the liquidity they demand, and so sophisticated traders use different order types.
There has certainly not been a lack of work on porting, there was the neo branch as well, there is some interesting (for some values of interesting) discussion about the approaches to 2.x and 3.x compatibility:

https://github.com/boto/boto/issues/1127

and also the py3kport branch:

https://github.com/boto/boto/tree/py3kport/py3kport
In my experience it is the other way round. I run Linux 3.13 on Macbook pro (Early 2011). OSX takes 2~4 seconds, linux takes ~1 second.
Sensationalism at its best. It's "passwordless authentication" except for the fact that you still have to somehow login to your email account.
PolarSSL has been validated with FRAMA-C by a company. Unfortunately you have to pay to see the results, and they use blinding for bignum arithmetic, not constant-time. (But they do have a decent curve implementation). http://trust-in-soft.com/news/

To remove side channels and preserve validation, you need to be slightly clever. You validate that a C implementation of one of the functions does the same thing as a function in the validated package, then swap them in the build output. This can be done for miTLS. Your validation of the C part is much more limited in scope than the whole thing.
The difference is whether you pay middlemen 0.1% of the value of your trade of 2% of your trade.

If you can't get worked up over a 100+bp difference in cost of trading, you shouldn't be worked up over HFT, which is operating at much smaller price deltas.
A comparison to perf (specifically its use of tracepoints, ring-buffers, user-side scripted postprocessing) would be apropos.
The major reason is that when your website becomes popular, and becomes more of a target, you can swap out the software hsm daemon with a more sophisticated hardware solution, if implemented properly, by just changing a pkcs11: url[1] to point at the new HSM.

PKCS#11 has a few irritants, but it's a fairly sensible API. and it's already implemented by many things (browsers, gnome-keyring, ssh, ...). OpenSSL, GnuTLS at least both support it via one mechanism or another, my only real complaint from the webserver side is that the configuration knobs aren't really plumbed through.

[1]: http://tools.ietf.org/html/draft-pechanec-pkcs11uri
How would you respond to someone with an opposing point of view on an issue you're passionate about replying to one of your comments with a link like that?

It's an interesting idea, but I think the conceit is that other people would actually read your arguments at that link. In my experience, that's not true.
Jamendo radios, mostly rock and lounge. It helps that English is not my mother tongue and so just a random song is unlikely to grab my attention too much. Known songs might very well distract me so I avoid my personal music collection.
It would have to be time based, not boot based, unless you want to do key revocation for all the previous at-boot-time generated keys. But yeah, if you rotated keys once an hour or once a day, then if they got leaked the window for MITMing your customers would only be that long.
NPR's Planet Money has an excellent series on the role that money plays in politics- http://www.npr.org/tags/149649575/money-in-politics.

The short answer seems to be that in return for good committee assignments, congressmen are required by their party to meet certain fundraising goals. If congressmen do not meet these goals then they may get removed from choice committees and the lack of funds will put them at a competitive campaign disadvantage. It's to the point where congressmen may spend over 2/3 of their time soliciting funds and must regularly solicit lobbyists for money.

http://www.npr.org/blogs/money/2012/04/19/150904641/why-lobb...
Python3's treatment of integer literals in that case is bad. The first is the behavior that someone used to programming will expect by default, since those are integers. If you want non-integer operations you should have to use a decimal point in the 1 or 2.
You should back those arguments up with evidence. Which points in the review are refuted in the book?
I didn't mean to be rude. I'm sorry if it sounded that way. I think it's both shortsighted and irresponsible to force people to abandon libraries that work.

The parent poster wasn't concerned about learning the language. They were concerned about dependencies that work, which is what I was saying:

"I care about getting my python script working as soon as possible and for a foreseeable future - I couldn't care less for the Python language and it's future."

Yes, I didn't mean "nobody" literally. I should have said "few."
Open: An Autobiography (Andre Agassi)
http://www.amazon.com/Open-An-Autobiography-Andre-Agassi/dp/...
> On both OSX and many Linux distros, Py 2 comes pre-installed but Py 3 does not.

Because python 3 was not the most stable at the time of distribution of that operating system. Why would I the developer of said operating system release anything but the most stable versions of the language? This would in turn make my operating system at times less stable.
My initial thought is to sell them for a high price to things like nursing homes to save on labor costs and increase health for patients.
I created something similar to #1: http://millisay.com

It hasn't really taken off, but I also haven't put much effort into promoting it. It still lacks a few features (I've been busy with other projects), but I really like the clean, simple design and a few people have posted some interesting stuff.
Actually if you look at the documents of the new exchange in question, IEX, they don't propose to do anything about HFT at all.

They are still a price-time priority matching exchange, they still allow colocation (well not directly, but they are themselves in data centers that have colocation), they still offer exotic order types, and their much hyped added latency amounts to 350 micro seconds. They aren't trying to remove HFT from the markets, they are trying to disadvantage one class of HFT in favor of another.

I personally don't have any problem with their goal, but they aren't being honest about it and that seems problematic.
Does the code you write reduce the costs or increase revenue of the business? Get those numbers together and compare them to the rest of development. If they compare favorably, share them with the CTO. If not, find a way to increase them.
I appreciate your contrarian position, but I don't think you've thought this out. The problem with "just getting new keys" is that there is no guarantee of detection of a key breach. So you might desperately need to get new keys, but not know it for months. Meanwhile, bad people have access to that all-important content.

Protecting content involves protecting keys. So to prioritize protecting content, you have to prioritize protecting keys.
While it's mathematically conventional and maybe event elegant to represent integers that way, isn't it ridiculously inefficient to actually implement it that way? I guess there is going to be something in the compiler that recognizes and special-cases this pattern, but still...

Also, I really wonder why there is no language with "nice"/"conventional"/C/ALGOL/... syntax for dependent types. Right now my dream language would be something like Spec# (which is C# with contracts), but it would try to prove its contracts (within the bounds of possibility of course, wrt. the halting problem and so on).
Oculus Pr0n
The Meteor universe – a list of Meteor JS resources
Nope: you can exploit the timing attacks from across a network link in AES. DJB did this long, long ago. Furthermore, I believe OpenSSL has constant-time RSA, but you can always use ECDSA for which constant time implementations in C exist. (I wrote one, but I still need to switch the hash function to SHA256 and add the unnecessary encoding steps to the output, so consider it a PoC).
If you use hibernate won't the keys be stored on the swap partition?
Is the ‘point’ of solar about to change?
This sounds less convenient, harder to implement, and no more secure than OpenID, and even that failed to gain traction.
Open my mind – programming topics
I like Debian as well. I wish they were more popular than "that other distro" that copies their work without contributing much back. I think the move to systemd is a good idea.
Wouldn't it will be simpler to have replaceable faceplate with different connectors (a cradle) in each room? Basically, idea is similar to having power buttons/plug/ethernet connector on the wall. Instead you have horizontally mounted faceplate in a cabinet, bed headrest, or any horizontal surface with appropriate connector where device can sit and be charged. There are not too many USB charging devices that will be used in a mental hospital by patients. And depending on the type of device swap out the faceplate with appropriate one.

The best way to avoid ligature and self harm risk is to not have any cable or sharp objects around. Also, this solution will avoid the privacy risk when patient device is taken away for charging by staff members.
And since this is HN, it runs Linux as well: http://arstechnica.com/information-technology/2013/10/the-na...
This is the idea behind http://fireballed.org/. Nice idea though.
gorgeous website. Note that most colleges in the world are like that: Most people just want to get the degree and get out. Do it for yourself not for others.
That was my first thought too.

Who knows where 3.x will be in 6 years, but now a huge number of people will continue to develop in the 2.x series with no worries. Six years feels like a long time when you're at the beginning of them. By the end, maybe it will be easier to just tweak the Python 2.x codebase than switch everything to 3.x.
Which leads me to that thread, thanks :)
I believe Splice is working on this? https://splice.com/
And here I thought this was going to be clever.
And so, XP support still lives on. Actually, at $200 per computer per year, it has the potential to be quite a lucrative support, so it'll continue as long as there's demand.
My MBP (Late 2009) takes less than a second both on Ubuntu and OS X (Mavericks) to password prompt.
Only the black hole part. As speed increases, mass increases too - and mass is energy. (Which is also why we can't have (anywhere) near speed light space travel, there's not enough energy anywhere to maintain accelerating the increasing mass)
If I was running a bank, I'd hopefully use a proper HSM. You ask it to generate a private key, you then ask it for the public key, get it signed into a cert, and use that. The HSM promises to never give out the private key to anyone (including the administrator), usually in a tamper evident way (if someone did manage to extract the key, you'd notice). Even if you have root on a machine that has an HSM plugged into it, you can't get the private keys out.

However, my personal webserver isn't a bank. Not everyone can justify spending this much money on a HSM to get this level of assurance. What I'm proposing is a simpler solution that isn't robust against sophisticated attacks (eg when the attacker manages to get root), but is far more robust to some classes of the common attacks we see today (where the attacker can read any memory/file that the webserver has permissions to see).
Sacha, this is a really good overview of some common JS syntax I've been struggling with as I've been learning Meteor. Thanks for posting!
Is everyone falling into the trap of over-securing last week's security problem? Isn't this just like banning water bottles on planes after a failed liquid bomb attack?

Be careful that in our haste to secure the private keys, we ignore easier attacks. The article seems to gloss over an attacker hacking the web server, when in fact that gives them such powers that going on to grab the private key might not even be attempted.
Interesting. I was thinking about a very similar calendar API last night. Mostly from a scheduling standpoint. But the webhooks part is a cool addition. Is something similar now possible with zapier?
Did they recorded for every talks in https://us.pycon.org/2014/schedule/talks/ ?

If yes, It's will really awesome, can't wait for the rest.
CircleCI is a Clojure company from day one, so there was no need to force it on people. We've found a lot of advantages from this, not just on the code side but also from recruiting.

One problem we've had is that our frontend isn't clojure/clojurescript (its coffeescript+haml+knockout). In theory that means its easier to find frontend developers and designers. In practice it has meant creating a frontend/backend division where the backenders in particular don't like to work on the frontend. We testing out whether a move to clojurescript (and hence being a truly one-language company) will solve that.
That would be an argument for supporting both. I fear that otherwise what you will end up with is that a minority of security conscious people will have HSM (actual hardware or software) and most others will just configure their Apache/nginx software as quickly as possible and get on with it. Having the basic config be more secure by spawning the soft-hsm itself sounds like a win.
The good thing is that you can get that behavior if you really intend it, just use the // operator. I'm really in favor of this change.
> The parent poster wasn't concerned about learning the language. They were concerned about dependencies that work

No, read more of the thread - to quote the OP:

> I rarely write anything high language besides small scripts.

OK, so you could argue that their scripts probably remain small because they call into tons of third-party code, but honestly I get the impression that it's a case of working with the included batteries and not being overly concerned with dependencies. If it was solely about deps availability, they probably wouldn't have talked about "learning Python 3" as their sticking point.
Speaking of Go, the official go.crypto repository comes with NaCl port:

https://godoc.org/code.google.com/p/go.crypto/nacl
Cool about psdash, the commit didn't exist when I started to write the comment :)

Twisted and Scrapy are getting ported, and the community is moving forward. But this is not happening because of a miracle - people are making it happen. My point was not that Python 3.x is bad (I think it is good), it was that community still needs help, that writing alternative software is not the best way to do it, and that there are still reasons why writing new Python 2.x code is easier.

Praising 3.x won't make users switch if they need some unported package, and bashing 3.x won't make other people's lives easier either. So let's help twisted, scrapy and other modules to become 3.x compatible.

Scrapy reached an important milestone recently - its test runner can now run tests under Python 3.x; test runner was the main reason why porting haven't really started before. If anybody wants to help then ping me kmike84 at gmail.com, or check https://github.com/scrapy/scrapy/pull/682, or go to ScrapingHub booth at PyCon and talk to people there.
Totally agree, except for the fact that email is a secure medium. Phone would be much better.
Doesn't IronWorker do all of that, and well, already?
This is a neat idea, getting real time data from a busy place like Twitter is something that rivals current search engines when it comes to get the latest news.
I believe commonkey is working on something to handle pw rotations in a team environment.
Google Inc.'s Android TV Could Fail
> If we had infrastructure that let us renew our TLS keys every 24 hours or so

The sad thing is... we do. 24 hours is a bit much, but why not have a different certificate for each server? The whole point of a certificate chain is to give us the flexibility to issue and revoke certificates from lower down in the tree... of course most of us serfs don't get the privilege of using our own intermediates.

Oh... and we're repeating some of the same mistakes in DNSSEC. Looking at deploying DNSSEC I kept reading that the general idea of the KSK was to function as a long-term key, and the ZSK as a short term key, but I have yet to see a method of managing things with the KSK offline that isn't like pulling teeth. The latest BIND requires that both the KSK and ZSK private keys be resident on your primary nameserver when you switch on the "auto-dnssec" magic.

Still, at least setting up DNSSEC is free.
The Free City of Danzig Timeline
One of the things I have been kicking around is a charity hub.

It seems like the tools for discovering and rating charities are well developed, but the tools for allowing them to collaborate and provide help are non existent. This causes a lot of duplication of effort. Someone who needs help should be able to fill out a survey detailing their needs, and then their profile would be available to any charity.

This would allow a more holistic approach to giving; A single parent who gets tuition assistance might also benefit from free babysitting or help with meals, which are probably provided by two different groups. Social workers would be able to assemble a variety of different forms of help for each recipient, and the program could automatically suggest donor/recipient matches.
How about Practical Cryptography (http://www.amazon.com/Practical-Cryptography-Niels-Ferguson/...) as a quick-guide over the more verbose Applied Cryptography which is much older than the former?
I've been looking into JWT tokens (claim that this device is authorized to do something). If there is a breach on server side, you simply replace public and private keys. Each user can also have a different public key.

Registration on User side:

1. Enter email

2. Welcome email with token

3. Save token (password manger, mobile phone, print it...)

4. Use app

If someone steals your token, you simply request new token and old gets immediately invalidated.

It's like Mozilla Persona, but there is no middle man.
> can't use print x anymore

Yes, its a function not a statement, so its now print(x).

> which also gets rid of "print x,", which printed something without making a newline, for one thing.

Sure, you have to do:
print(x,end=' ')

if you want to space separate things printed on separate code lines on the same output line.

Of course, if the extra keystrokes bother you, its really not much one-time cost to toss together a library that provides a function that gets rid of them, while keeping the rest of the power of the print function:

def p(*args, **kwargs):
kwargs = {'end': ' '}.update(kwargs)
print(*args,**kwargs)

Though if I was going to bother to do that, I'd probably do it with the same separator for multiple items on the same line as for items on different lines:

def p(*args, **kwargs):
kwargs = {'sep': ' ', 'end': ' '}.update(kwargs)
print(*args,**kwargs)

or, further leveraging print-is-a-function:

import functools

p = functools.partial(print, sep=' ',end=' ')