skysight-inc/HackerNews huggingface dataset:
I am not an expert on the subject, but isn't it just finding enough solutions to cycle through? As the bacteria become resistant use another solution that works and let the resistant bacteria die out as there becomes no reason to have the resistant traits anymore, thus making them vulnerable to the drug again, or maybe I am just completely wrong.
> Individuals should use what works best for their needs

Maybe rather: teams should use what works best for their needs ?

EDIT: whee, downvotes. Apparently HN'ers work on teams that ship software and where a developer uses kanban, another TDD, another waterfall, another scrum, and another only commits code when the 8 planets are aligned.
Sure, but I don't think it really qualifies as "see, science solves every problem". And what if there are houses everywhere? There will be time slots for rooftops. After a certain size of the houses, there will not be enough rooftops for everyone to get sunshine.
Neat, I was just wondering about this. I'm using the same idea with core.async channels in ClojureScript to parse the BitTorrent peer protocol[0], but I wasn't sure how to describe it.

[0] https://github.com/happy4crazy/ittybit/blob/master/src/ittyb...
"What am I, chopped liver?" - every bacterium and virus, everywhere
True, some industries like it more than others. But given that tech is one of the most heavily recruited industries right now you'd think that LinkedIn would want to keep a good image around the HN crowd.
History is littered with examples of superior forces failing to achieve victory due to mismanagement or deception. Anyone who's tried to seriously play competitive games will say the same thing: it's not over until it's literally impossible to win.

You're correct that the Germans had a supply problem. But that might not have been as decisive as Hitler's decision to sacrifice the entirety of the 6th Army at Stalingrad for mere prestige, for example.

It was a stroke of luck that Hitler was so stupid as to not listen to his commanders and make so many blunders. Some have called Hitler our best ally in the war, since his mismanagement was responsible for so many strategic mistakes.

If a different type of person had been in charge in 1943, there is a sizable chance the war could've been won. The production problems were hard, but not decisive to the point of making victory vanishingly unlikely.
I'm flagging the TDD he-said-she-said banter submissions. I'm not sure if this is kosher or not, but they feel a little trite no?
> Unless a meteor falls from the sky and blots out the sun, in which case it apparently doesn't.

Deep water hydrothermal vent ecosystems beg to differ :)
There's a ton of ways Hollywood can get paid but it may not be as easy or profitable.

Although it wouldn't be popular I could imagine Hollywood relying more on product placement. I've noticed TV shows targeted at young people having increasing amounts of brands in them.

Plus there's Kickstarter style. People pay for the movie they want to get made. Veronica Mars was funded this way.
A Terrible Deal for Clients
Parts of Microsoft are moving towards open offices. For instance -

http://www.geekwire.com/2014/microsoft-developer-division/
So how come cancer isn't eliminated yet? Many people still die.
No, rekeying does not solve that problem, not to mention which you've just handwaved a hard problem (varying the key over different sectors). That's doable (though it again doesn't fix the problem with your proposal), but the resulting mode isn't CTR.
No. What you've done here is redefined "OTP" to mean "any stream cipher". No.
You can flag whatever you'd like, but

> If you flag something, please don't also comment that you did.

http://ycombinator.com/newsguidelines.html
The best coffee maker ever?
Author here. The display library has recently been updated -- try updating and running again, it should make a bit more sense.

Also, refer to this post: http://lesswrong.com/r/discussion/lw/k5u/exploring_botworld/ for both an explanation of what we find Botworld useful for and some documentation for how to write Botworld programs and interpret displayed Botworld grids.
The trivial malleability of CTR is apparently why NIST rejected it, but it's important to remember that most unauthenticated block cipher modes are malleable, including XTS.
Fast tests are awesome, but hard to achieve - at least for me. TDD advocates: prove DHH wrong with easy to adopt frameworks and working software, not blog posts or books.
Agreed.

Any time you see a financial graph that isn't logarithmic you can immediately ignore it as garbage.
Why User Testing Services are Useless
The site I logged into was with WP Engine (not a site I operate; just one I help maintain). It's fast, but there's still a perceivable lag when clicking around the admin area.

I'm not sure if you've played with Ghost much, but I recommend signing up for a free demo account at http://ghost.org if you're at all curious. Create a few posts, click between them on the contents tab, dive into the (currently very bare!) settings page, and try editing and saving a post – everything feels almost instantaneous. I don't get that feeling with WP, even on WP Engine or WP.com.
Oh bless us, it's the Hoax again. :( Set out to prove something reasonably obvious and straightforward (could you publish any old guff in Social Text at the time, even straightforward mathematical/scientific howlers? I'd bet my trousers on it), make a complete bags of doing so (if there's one time the editors of a social-science journal should feel reasonably happy accepting the physics content of an overview paper at face value it's when the author is a physics professor at a top-40 college publishing under his own name!), get praised and adulated forever after; for if Science teaches us anything, it is that it doesn't matter if your method is rubbish so long as you get the answer everyone wants and expects.
Yes it does, and it's still CTR.

Further, every solution is going to have other machinery solving specific concerns.

You don't call XTS something else because you've used scrypt or PBKDF2 as the PBKDF.

Work is work.
This comports quite well with my personal experience. In late 1999 I happened to pick up XP Explained and set about to try this testing thing. At the time, there wasn't any "Unit Tests == Fast Tests" thing. What we did on our project was have two different types of tests: "Fast" tests and "SlowAndExpensive" tests, that we ran separately. But there wasn't much some fundamental distinction between them. That came a lot later.
My mother has a degree in Archaeology and considers Jared Diamond fairly suspect (Guns, Germs and Steel in particular). Apparently he cites some articles/books that have various problems (methodology, factual errors, etc.) These problems were well known at the time that he was writing.

I would encourage anyone who reads it to also read reviews/critiques by qualified people.
At Campaign Monitor - http://www.campaignmonitor.com/careers most employees have their own office, including programmers. There are also a few small team rooms and it's generally an awesome place to be a developer.
No, malleability is not beyond the scope of which "mode" you encrypt something with. That's like saying that security is beyond the scope of which "mode" you encrypt with. People used to believe you could divorce confidentiality from integrity, back in the 1990s, but that turned out not to me true, due to adaptive chosen ciphertext attacks.
I wonder if this is actually the minor decision about patents that the Supreme Court will take this year. It seems they are quite aggressive against companies who abuse patents, which could mean they may not favor patents in that other trial that's supposed to decide the fate of software patents, too.
If I had fully appreciated that there was a significant risk of my purchase completely vanishing overnight, I wouldn't have made the purchase. I had planned for "What if the price falls to 1/3rd of its current value?" At least I'd still have 1/3rd of the money. But zero is a much lonelier number.

Bitcoin is speculation. Not only is it speculation, but it's the kind of speculation where you can fail for reasons beyond your control and which no one knew existed. (See transaction malleability, which hit the reincarnation of Silk Road pretty hard.)

Losing your coins to theft or third party loss is simply spirit shattering, and unless people are truly okay with their coins literally vanishing, I would hold off on converting a sizable portion of your wealth into coin. It's easy to say that you'd be okay with losing it all, but the reality of it is much harder to deal with.
The example that I'm thinking of is if the FDE doesn't provide authentication and the attacker can flip bits of plaintext by flipping bits of ciphertext, and the disk is used to store software, and attacker knows what block a particular binary will be stored in. (The last assumption actually seems plausible if you an OS installer is sufficiently deterministic. Maybe the OS installers from hosting providers like Linode, AWS, and DigitalOcean are that deterministic, even if some desktop OS installers aren't?)

Then you could flip bits inside of the binaries to convert them into backdoored ones. I have an example in a current presentation that I've been giving where a fencepost error in the OpenSSH server in 2002 (that resulted in a potential privilege escalation attack) was fixed by changing > to >=, which the compiler compiled as JL instead of JLE, which turned a single byte 0x7E into 0x7C. (That is literally the entire effect of the patch!)

If you can find where on the disk that byte is stored and manage to flip that single bit back, you can re-introduce a particular security hole that the user believes was fixed back in 2002. There are probably thousands of such bit-flips that would produce exploitable bugs, typically by modifying or inverting the sense of conditional branches, but maybe in other ways too. (In cracking DRM in Apple II games, people used to replace tests or conditional branches with NOP, and that would still work to affect how security policies are enforced.)

Not all encryption modes will let you do this attack, but I think that relates to tptacek's point originally that encryption software implementers need to be very careful about their selection of cipher modes and understand what kinds of attacks they defend against.

Elsewhere in this thread sdevlin was thinking about how in a non-tweak mode you can copy ciphertext from one block to another, which means if you could cause a particular file to exist on the drive, and then you can modify the ciphertext, you can cause one file to be overwritten by another (if you know the offsets where both are stored, which you might be able to learn if you know exactly when both were created and could monitor the ciphertext sufficiently often). So for example, if you could send somebody an e-mail attachment that they would save to disk, you could later overwrite some other file (like one of their OS binaries?) with the contents of that attachment by copying the ciphertext block that represents the attachment over the ciphertext block that represents the other binary.

This is one of the main reasons that tweak modes exist, specifically to prevent an attacker from recognizing or copying ciphertext blocks between different locations within the overall ciphertext.

(Edit: sdevlin, not rdl.)
Can I suggest you reread the article? I felt bad that I spent so much time on the mechanics of tweakable ciphers because people didn't really need to understand them to see why not to use XTS, but here you've vindicated all those paragraphs by stating the exact problem they solve, and did it be presenting an unsafe alternative to them.
Self-awareness vs success
No, I can't stand design which say "you read our heading, great! Now scroll a bit to read the next 5 words" either.
I worked at Oracle up until last year. At Oracle HQ in Redwood City, yes, many developers have private offices. But our office and the other offices I visited elsewhere that had been built-out more recently were open-plan environments.
This is an incredible post. It takes a high level of strength to weather a terrible storm like this, but an even higher one to be as candid as Erica has been with the world at large. I'm infinitely more appreciative of something like this than what you'd find at http://ourincrediblejourney.tumblr.com/ or a faceless shutdown page.

In a weird, abstracted way, I'm reminded of the fantastic game Glitch's shutdown:

http://www.glitchthegame.com/closing/

I don't know Erica in real life (though I've read her blog for a while), and I've gained even more respect for her. I can only hope she finds the success befitting her passion and integrity that the folks at Tiny Speck did.
My account was suspended years ago with around $300 in my account. No clear reason for the ban was given and even though I gave them the logs the ban was never lifted. Needless to say that I closed my website.
Well, we're talking about antibiotics so you want something that kills bacteria without killing the cells of the person in which the bacteria are.

If what you're looking for is harmless for human cells, it's just a matter of time until bacteria find a way to resist it.
I agree with this article, but think that by singling out social sciences it fails to reveal the bigger picture: that all scientific fields are subject to these same mistakes.

I just started working in a research lab at a hospital that creates finite element cardiac models based on data taken during heart surgeries on sheep along with MRI images taken at various intervals pre and post surgery. Although I'm still new to this position, it seems that our own methods are subject to just as much deception. We basically want our models to coordinate with the actual heartbeat at only two exact moments, during the beginning of contraction and relaxation. If I've understood what's been done before, modeling these two brief periods during a single heart beat are all that are needed for publication.

I bring this up not to criticize my lab, obviously our work is meant to be a progression towards getting more and more accurate models. I just think that it shows that even something that is considered hard science is subject to many of the same faults as anything else. There are so many parameters and considerations to take into account that I don't think the end goal is to build a comprehensive theory that explains computational modeling of physiological function in a similar way to how Newton's laws predict the motions of the planets. The goal is simply to create a model that works for the purposes of helping diagnose and treat people more accurately.

It seems that a crisis is imminent in the coming age of computational, statistical, and mathematical applications to all fields where researchers are not properly taught to distinguish between data science and building actual theories. Just as there is a humungous gap between using a computer and actually coding, there is an equivalent difference between being able to collect & analyse data with a computer, and able to actually build a substantial theory that can describe a vast number of phenomena and result.
My homage to BASIC
bingo. It can succeed the way beanie babies did, which were never used as a unit of account or medium of exchange. /s
TDD advocates: prove DHH wrong with easy to adopt frameworks and working software, not blog posts or books.

Gary Bernhardt's about as credible on this as one can be, as he's literally recorded hours of himself building working software with TDD.

From the article:

These tests are fast enough that I can hit enter (my test-running keystroke) and have a response before I have time to think. It means that the flow of my thoughts never breaks. If you've watched Destroy All Software screencasts, you know that I'll sometimes run tests ten times per minute. All of my screencasts are recorded live after doing many takes to smooth the presentation out, so you're seeing my actual speed, not the result of editing.

I understand disagreeing, but responding to this post with "show, not tell" just makes it look like you haven't read the article.
Is it me, or there are other people who feel stomach ache when reading this sort of stuff? Why don't just learn algorithms and other computer science "direct" approach by analysing problem and solving it in most officiant way? 100 lines of tests for 50 lines of code for a _catalog_? Really? I'm sorry just reading this brings bad feelings, like those which traders describe when they feel something's wrong with the market...
> LinkedIn isn't my main presence on the internet, I agree that would be a sad state of affairs for a tech-savvy person.

Why would it be a sad state? Not all of us are interested in social technology, not all of us want to write content for a blog or website, and not all of us want to share the details of our lives with others online.
The elephant in the room here is the bugs that crop up in the interfaces between units. Depending on your problem domain, it may be easier or harder to create interfaces between all these TDD'd, isolated modules. There's certainly value in a spec as isolated component documentation, but I'd argue there's more value in specs for regressions, particularly when refactoring. This is especially the case in dynamic languages like Ruby which require tests to avoid the most basic runtime errors.

The answer to this conundrum is often: that's the job of the integration tests. Okay, but integration tests are slow, so you'll never test all the permutations of the interactions of the components.

DHH said during the keynote, "it's easy to make your tests fast when they don't test anything". Of course that's hyperbole, but there's a kernel of truth to be investigated there. When working with something as complex as an ORM like ActiveRecord, isolating the business logic and using the ORM strictly for persistence may allow for fast tests, but you still run the risk of bugs creeping in on the interface because of some assumption about or change in the way ActiveRecord works between versions or whatever.

That's why, as ugly and slow as Rails unit tests are, they are a simplifying compromise that strikes a balance between the theoretical ideal of a unit test and an integration test. ActiveRecord itself is this way too, in that often times the business logic just isn't complex enough to warrant the complexity of separating persistence from domain logic. As much as DHH may be talking out his ass without really having ever grokked TDD, I don't think his complaints are completely without merit.
California livestock antibiotics bill shelved
Details are at docker.io/governance
That site also provides a place to submit comments on the proposal itself and nominations for the board.
Things I Learned Writing a JIT in Go
Todd,
I signed up with BSA today after seeing your comment here. You do not use HTTPS for publishers to log in. This does not inspire confidence in the company.
Yes, well, I'm pretty sure those advertisements were back from when Bill Gates was running things, or not long after and well before very slow clock cycle things like real estate could have changed.

Since then, no particular bit of insanity from Microsoft would surprise us....
> Stop arguing over how other people create software; Ship Code instead.

Electrical engineering, mechanical engineering, architectural design and the medical profession, to name a few, have bodies of knowledge they are required to use.

Is it really a good idea for software developers to say "stop arguing over how other people create software; Ship Code instead" considering we don't have any industry standard bodies of knowledge?
Moveline Packs Up $3 Million Series A From ffVC
Its ok for them to not like things, just don't be a jerk about it.

When I was a vegan, I would typically mention that fact, and then also add, "but I don't mind if you eat meat and I won't criticize you for it". Lots of people didn't believe me at first, having been on the business end of a lot of criticism from "well meaning" vegans and vegetarians.
Unsafe for what, how? You're making all sorts of claims and now an accusation without backing them up with a shred of evidence.

XTS is only useful for FDE, everything else should look for simpler constructions.

Maybe you need to read:

http://cactus.eas.asu.edu/partha/Teaching/539-CommonFiles/Cr...

Would really appreciated if you would know you're talking about and provide evidence before saying "it's wrong" or "it's bad advice."
Avinash Kaushik Made Data, Metrics And Analytics Sexy (Again)
> You can flag whatever you'd like, but

No, you can't. If you flag articles just because you are tired to see some topic in the front page your flagging habilities will be removed (happened to me).
Yes, this discussion of industry approaches to our craft is taking up room for far more important things, like the discussion of real estate prices in San Francisco.
Whoa. We've shifted from the (simpler) continuation-passing style with callbacks to this. Is this really worth it? Honestly, I don't think I like the whole idea of promises. What do we gain from this besides technical debt?
Yes, definitely! Drupal (like Wordpress and others) stores all the "content" of your site in a database so there could be all manner of nastiness hidden in your pages.

And then, obviously, the attacker could have added an admin user account or, less obviously, altered settings stored in the database to make the site insecure.

My advice would be to restore completely from backup, if possible.
Https://www.Facebook.com is down right now.
> Malaria kills people, not mosquitos

You know, when people say "falling isn't dangerous, it's the sudden stop at the end," it's supposed to be a joke, not a serious proposal.
10 million++ page views per month for them to seriously consider partnering with you.
Packet reassembly, causing crashes since the days of WinNuke.
Facebook's competitors need to pay you more to refine your text.
Isn't this just a reflexive and ignorant response? Have you actually looked at any of the code he's shipped? I mean certainly people should be allowed to write about their experiences without having to face accusations that they've never actually done anything but write.
Exactly. I think most of the TDD probably come to some tutorials which test addition a+b of that sort and demonstrate how to test "ah there's logical error! how incredible TDD helps us to identify error early on!". I do some TDD from time to time, but outside of my textbook algorithm, writing pure unit test which involves using mocks is really tough and time-consuming (unless someone has built a test driver for you to use throughout the whole development).

In any, if you ever do curl http://localhost:port/mynewapp/page1 that's already testing and is doing functional testing. If you write that down before you start writing a piece of code, you are doing TDD to test whether your app will return 200 or not.
Meteor 0.8.1 Released
This is a sequence of non-sequiturs, none of which respond to my comment. I'll make it easier for you:

Propose a scheme whereby you use AES-CTR to encrypt a 100 megabyte disk of 512-byte sectors, whereby the scheme "rekeys" every "few sectors". Be specific.
I just said you could, I didn't say it was a good idea.
> "I want my feedback to be so fast that I can't think before it shows up. If I can think, then I'll sometimes lose attention, and I don't want to lose attention."

Don't you want to think while programming? I feel like that's practically all I do -- I spend most of my time thinking about a problem and very little actually writing code.
The great thing about state machines is that they are easy to debug. Once you have co-routines firing off co-routines, you're in co-routine spaghetti. In fact, I'll coin the term now:

co-routines = "asynchronous gotos".