skysight-inc/HackerNews huggingface dataset:
Indistinguishable from a PRF A good block cipher satisfied this property, otherwise it's not a PRF and insecure.

Hair-splitting, really. Actual OTP is an imaginary construction that requires an endless supply of truly random bits that have to be securely stored or somehow recreated during decryption. It shifts the hard part to that fn, and just XORs the result with the pt or ct block.
[private key disclosure or remote code execution] seems definitely achievable under some applications of FDE and some assumptions about the state of attacker's knowledge

It is? That's very interesting! May I ask, what are some of those applications of FDE / assumptions of the attacker's knowledge? This whole thing is quite fascinating.
CTR isn't an OTP in the classic sense of OTP, because you rely on the security of blockcipher. For example, if you used blockcipher=single DES, the attacker can break the cipher by breaking single DES by brute force.

Indeed, even if blockcipher=AES256, the attacker can still break CTR by merely guessing key in 2²⁵⁶ operations. (Likely only one such value of key will yield meaningful plaintext throughout the entire multi-block message.) That is contrary to the information-theoretic security property of OTP, where the attacker can't tell whether they've correctly guessed the key.

More to tptacek's point, if you're using the block offset as i, then if you write the same block 30 times, you used the same value blockcipher(key, nonce . i) each time. That isn't a one-time use of that part of the pad, it's a 30-time use of that part of the pad. It's extremely possible that an attacker who has observed all 30 ciphertexts can actually decrypt many of them in combination. In Boneh's Coursera class, we did it successfully with like 4 or 5 ciphertexts, and I've seen a paper that describes doing it automatically for the majority of the text with only two ciphertexts, assuming the plaintext is English written in ASCII.
If you want truly anonymous login, might I recommend https://launchkey.com

Obviously there's nothing truly anonymous about this service if Facebook knows everything about you...
WebKit bug 112840: LLVM as a backend for the fourth-tier JIT (aka the FTL JIT)
Hi, We will get these sorted. I was surprised that this got picked up so early as we were just starting to canvas feedback from developers, so it still a work in progress.

Multi-screen/Multi-device was the term we chose because mobile-first is a very very loaded and our goal is to target mobile as a base but ensure everyone builds up from that experience. But you are correct, it needs to be introduced.

[Edit] - adding bugs
https://github.com/google/WebFundamentals/issues/17
https://github.com/google/WebFundamentals/issues/18
Computer coding a growing trend in Canadian classrooms
Awesome job on the website, and it's great that you guys got such a good domain name.

A bit off-topic, but would it be possible for Pharo's windows to look native?
I work for an inter-governmental organisation in the environmental services sector; ~300 people, ~40 programmers (but many others - scientists - do some coding, too). Most people have private offices, there are also 2 or 3 persons offices. I enjoy my single office. I like to put my feet on the desk when I read a paper or a book or when I fancy a quick game on my mobile :)
Speed up your console
Yep, possible in Sublime Text. It's one of the harder things to get right, and Sublime also has (or had) weird behavior, but most of the time copying 20 items with 20 cursors and pasting them to 20 cursors works great.
You should probably just check out Sublime Text, that's the best (almost only) implementation I've seen.
Marissa Mayer’s Pay Tied to Another Company’s Performance
I trust you've run a funded start-up that failed because you could no longer meet payroll yourself? No? Ok, let me give you a bit of my history then and we'll see if you feel that it is humble enough.

When the .com crash hit we got within a hair of going down. Fortunately we did not have any investors that I could not have paid back from my private pocket (which I eventually did, I bought them all out). If not for a little bit of foresight and a 3 month warning something really bad was going to happen (24x7 missing a check payment) we'd have been absolute toast. And with 25 people on the payroll that would have been totally devastating.

At that time we'd spent a lot more on our ramp-up than Erica ever did. And blogging had not yet come into fashion, but I'm sure that if I had written about it at the time you'd have made it sound like I was callous or had too much ego because it was other people's money and trust that I was playing with.

But the big factor that counters that is that if it is a success you get to own it, if it is a failure you own it even more. For Erica to come out about this publicly takes a lot guts, probably more than I would have if I would fail making payroll. That's brave, it is the absolute opposite of ego, the fact that others trusted her and gave her money would have made them part of the success, inevitably, if it goes wrong then they are also part of the failure.

Start-ups are risky, everybody in this game should know that by now. So embrace the failure, learn from it what you can and move on, and by all means, don't sit down and mope. That would really be a loss.
An airbag for your password
The project is given a life silently!
Facebook Platform Upgrade Guide
Thanks for that link. I too find the orthodoxy of infinity today a bit hard to take.
It truly is an interesting move. Last night my housemate was telling me about MS's moves in the office365 space, I was gobsmacked by what they're up to these days. I actually commented "time to buy some MS shares", pigs were flying. And now this..

It does make sense though. Developers only really want a way to verify the user exists and isn't some spammy bot. Verification like facebook login is the easiest way to go. The problem has always been - far too many people avoid signing up with facebook as it shares "god only knows what" with the site. This works around both issues and really is the only way they can become the single signon entity. Which is what they've been aiming for.

As for "not bothering to implement" (aap), if you already need to handle facebook connect login, its going to be minor to add anon login facebook handles all the identity stuff leaving your app clean of yet another verification loop which annoys the hell out of users.

Sure there is the "apps need that data to make money" situation, but as a matter of fact, the people signing on anonymously were a) going to create a fake facebook or b) signup manually and give you a mailinator address.
CS Disco Inc. (www.csdisco.com) for all engineers and most other employees.
This thing is a beast!
Speaking of Cryptonomicon, haven't many historians concluded that the ULTRA program (Anglo-American breaking of Germany's Enigma cyphers) was also a significant factor in the decline in U-boat effectiveness?

This is not addressed or even mentioned in the article.
Docker is pretty over-hyped.
Team Dynamics Check-up Lately? Announcing the Innovation Estimator
Also, remember that evolution, in life, markets, or software, has a very hard time making discontinuous leaps.

Life finds a way. Unless a meteor falls from the sky and blots out the sun, in which case it apparently doesn't.
The One Line of Code That Generates Nearly $4 Million a Year
Apple has them
All of these arguments seem like they are overly prescriptive. Individuals should use what works best for their needs. TDD may work wonders for me today on one project, and then it could be horrible tomorrow on the next project. My co-worker might have the inverse.

Stop arguing over how other people create software; Ship Code instead.
That was a different type of u-boat [1].

[1] http://en.wikipedia.org/wiki/German_Type_XVII_submarine
Combinatris
Simplifying continuous integration for StockTwits
Couple responses:

You scare-quote "unclear security goals", but that's not my objection, that's Phil Rogaway's objection. And his argument (and Ferguson's argument, and Liskov's argument) isn't hard to understand: by adopting disk sectors as the setting for your encryption, you trade transparency (the ability to use encryption on any filesystem) for a whole mess of constraints, which the article you're commenting on lays out in detail. The worst of these constraints is that you lose any real authentication, but the fact that XTS is basically XEX-ECB is another problem.

You've also taken the "two keys" issue out of context. The issue isn't that it unnecessarily uses two keys. The issue is that it's hard to derive clean security proofs for XTS, because of all its complications. The way Rogaway puts it: there are three constructions involved in XTS --- the XTS wide-to-narrow block adapter, the "XEX2" two-key XEX construction for full narrow blocks, and the "XEX3" two-key construction for partial narrow blocks.

I believe you're also wrong about the Evil Maid scenario. Perhaps you're getting hung up on a detail that I wasn't implicating (for instance, booting from the drive). The issue is that in a normal FDE setting, attackers don't get repeated use-tamper-use cycles. But in a cloud-backed FDE setting, they easily do get that, so more sophisticated versions of the same attack scenario are possible. Think "Evil Maid" here in the same sense as Kenny Patterson used the "BEAST" attack scenario to build a plausible attack on RC4.

The problem with XTS is that there are better modes you can use, even for sector-level encryption, if you shake off the constraint that you're working with physical disk geometry. Which, in the real world, a lot of FDE users can in fact do, because they're not working with real disks but rather virtual disks stored on cloud filesystems.

If you don't need to comply with physical disk geometry, it is probably feasible to get block-level encryption with strong authentication guarantees, and with a native wide-block PRP that will get rid of the ECB data leak in XTS.

Finally, don't use XTS for anything but FDE, even if you know what you're doing. That's a bit of a tautological statement for me to make, because if you know XTS, you also know that it's only meant for FDE --- but I've been getting comments from people who have seen XTS used in application-layer crypto. Bad. Ick.
The Three Basic Tools of Systems Engineering (2010)
> I'm not a lawyer, but as I understand the situation it's illegal to take certain types of information into account when making hiring decisions (e.g. race, gender, religion I think, sexuality in some states, etc.).

I'm appalled that you are somebody that hires for a living and you don't know the basic legalities of your profession.
Ask HN: Review my startup name.
I'm trying to start a startup and have thought of a name - Zenode (Zen - Node) What do you think?
From the site, it looks like the FB login page you get after clicking the button is all black, and then you get sent back to the app. The regular one would be in the normal colors. Although I suppose they could popup a fake anon one on their own site, but they wouldn't have the right URL. On Android the app allows login without entering a password as well, so I'd immediately know because login through FB doesn't require my password but the app's fake version would.
I've been using OSM with first Cloudmade and then Mapquest for an internal project at work and my experience is mixed.

The most notable difference in terms of quality that I have personally noticed is that the geocoding on the OSM side of things is of wildly variable. The Cloudmade v1 Geocoding API was simpler and returned better results that the Cloudmade v2 API, but the data returned in v1 had less detail that the data returned in v2.

Mapquest offer a licensed data geocode and an open data geocode. The licensed data geocode, as you would expect, returns better results than the open data geocode but still fell short of both the ease of use and accuracy of the v1 Cloudmade geocode.

The kicker in all of this is that Cloudmade recently changed the way they choose to do business. That meant that my internal application wouldn't generate enough hits to the the Cloudmade servers to continue to keep the account open. We were literally in a situation of wanting to throw a small chunk of money at Cloudmade but because we couldn't meet a seemingly arbitrary lower limit we couldn't, abandoned Cloudmade and moved everything across to Mapquest.

Also I'd just like to call out that Leaflet.js is a fantastic library to use and allows us to do everything we want to do to the maps with an absolute minimum of fuss. We are looking at adding internal floor plans to some of the maps and I managed to throw together a PoC in leaflet.js that is looking like it would easily support this with a minimum of fuss.
That's not going to happen. The gov't will change the regulatory and reimbursement environment but the heavy lifting will be done by academic and pharmaceutical researchers.
Alright, but in more complicated cases you have to bust out macros, and they're just plain harder since they don't give visual feedback.

Take an example like the following:

def foo():
// do stuff

def bar():
// do stuff

Now I want to change my comment to say:

// The function foo does stuff

With multiple cursors, I select both def's, copy the following word, then go down and change the comment.

Again, I'm not saying this can't be done in vim. But it's just plain easier to do with multiple cursors. And if you don't believe me, well, that's your right of course. But having used both, extensively, I'm telling you - please, at least give it a try. For many daily use cases, it's just so much easier. And I don't get anything out of selling you on multiple cursors except for the warm fuzzy feeling of maybe helping a fellow developer learn something that will help them.
Judges in Texas are elected. (Which is pretty ridiculous considering prosecutors, defenders, and litigants can contribute to judicial campaigns... during the course of a trial.)

I'm surprised no one has run as a Judge in East Texas while soliciting campaign contributions from tech companies.
Nope, all large commercial systems being designed now are expected to take account of omnichannel
That seems to jive with my memory. Thanks!
The ocean’s hidden waves show their power
Should an engineer go deeper or broader?
Generally speaking, should an engineer try to go deeper (like Ilya Grigorik knowing details behind browsers and computer networks) in a particular field(s)
or broader (like Steve Yegge knowing like a dozen programming languages) in many different fields?

I am amazed by both types of engineers' extraordinary abilities. If you had to choose one path, which route would you go? Or how would you weigh the importance of the two?
If your internet connection is slow but your computer is modestly fast the CrowdProcess approach is demolished.

Internet capped at 100KB/s:
http://i.imgur.com/NhOiWCz.png
I don't think I make all that many assumptions. I am seeing what would happen if we imagined it is adopted as "the" Internet currency. On the Internet, especially in a situation like this where it takes 10-100 minutes to move away from holding bitcoin, it is quite difficult to play "second fiddle" to another curency. So we should look primarily at what happens if it becomes "the" Internet currency, and I think $7 trillion is a good cap to look at that under.

If you see my other comment to someone on the differences between Gold and bitcoin (https://news.ycombinator.com/item?id=7676732) you will see that it is incredibly easy to move away from and has no lock-in.

So we have to look at the macro process as BTC gains adoption as a currency, and we have to look at what would happen if it succeeded.

Bear in mind that unlike Gold, which has a poorer cousin in silver, every cousin of BTC has the exact same technical properties.

The only difference is the level of usage and acceptance. And that is dictated by what is the de facto crypto currency, and the amount of currency that is needed. If people tire of bitcoins, they can move away from them overnight.
EncFS is a FUSE filesystem. There is no reason for it to use sector-level encryption. It's format-aware. It can do fully randomized encryption and provide strong authentication. However, someone involved in EncFS did propose switching to XTS. Which is actually what prompted me to write this article.
No, I'm saying we're not all equal if such "special privileges" are granted to some special few individuals for one reason or another. Overall, it was a reference to the Animal Farm book.

But if you want to know if I think it's wrong for us to have inequality in the form of non-universal applications of morality or "law", then I'll answer with Yes.
> "Second, that sentence is false. Isolation from the database, or anything else, is generally done with mocks, but mocks didn't even exist when TDD was rediscovered by Kent Beck in 1994-1995."

See, that's not how I remember it. Stubs implementing the Interfaces you wrote (because Composition over Inheritance) was the common solution. AR's idea of a Unit Test has always been wrong to my mind. They aren't Unit tests. They're Integration tests.

This only really became an issue with the rise of Rails and the fact that you couldn't really write Unit tests for an ActiveRecord.

At least that's how I remember it.
Maybe it isn't that unreasonable. But personally I do like guarantees, and in a stateful language I especially like guarantees about execution order.

If these guarantees can be offloaded to a library then thats really great, as I don't have to keep them in mind anymore, freeing my brain to think about the specific problem I'm trying to solve. One less thing to check for when debugging too.

There is also the bonus feature that stack overflows wont happen, which enables liberal use of recursive promise functions. (On the other hand, memory usage might still explode, so its not quite that easy... :D)
Indeed. War is about producing weapons in quantity as well as quality.
That's trivial to add on, outside of CTR.

You have a system of keys derived from a master key. Too many bytes encrypted with one key? Use a new key for subsequent writes.

(And for god's sake use a PBKDF to derive a master key from a password, don't memcpy() it directly.)
This banter is really getting old and hogging a lot of space.

If you don't like TDD, don't do it. If your employer or organization forces you to do it, leave.

If you do like it and think it matters, do it.

It's really that simple.
In case you're wondering, I downvoted you for (a) getting needlessly personal and (b) more importantly, wildly overstating the very minor role of cats in spreading toxoplasma, relative to unwashed vegetables and undercooked meat. See http://en.wikipedia.org/wiki/Toxoplasma_gondii#Risk_factors_...: "Numerous studies have shown living in a household with a cat is not a significant risk factor for T. gondii infection, though living with several kittens has some significance."

It's fine if you don't like cats, but don't try to turn it into a moral crusade.

Oh, yeah: the research that suggests a connection between toxoplasma and feelings about cats shows that it makes men like cats more and women like them less. Your "crazy cat lady" thing has no basis in fact.
Show HN: Targeted.io – Email your users based on their interest in your app
Yup. Like the decision to send the engineers and technicians working on jet engines to join the infantry in late 1940, because they'd be needed for the war against the Soviet Union and jet engines wouldn't be required in the short term anyway(!) -- a costly mistake which set them until the surviving skilled technicians could be hastily recalled. Or Hitler's demand for a jet bomber which forced Messerschmitt to hang bomb racks on the Me-262, delaying their first operational jet fighter for 18-24 months.

And some of the stuff they did pursue was absolutely barking. Like the Landkreuzer P. 1000 Ratte:

http://en.wikipedia.org/wiki/Landkreuzer_P._1000_Ratte

TL:DR; the popular belief in the Nazi regime's inherent technological brilliance is a little misplaced.
Cool, I didn't realize CrossRef had an API. That will be helpful in troubleshooting DOIs that fail to resolve for me. Thanks for your offer. I'll definitely reach out once I've accumulated some more questions for you.
The /proc/... command mentioned above uses the old binary to attach to the old session, though.
Programmers, you need an assistant
Unlimited Public WiFi with Batshit
The Economist – Is big data bullshit?
You said it better than me. No reason to get religious over it. When I'm the architect on a project, I do it in some cases, and other times I don't. I'm not over concerned what everyone else is doing in this regard.
I haven't read any books specifically on this topic, but it's a fairly common thing in non-academic (and sometimes academic) discussions of history. There's a subreddit, http://reddit.com/r/badhistory, that spends a lot of time picking apart bad historical arguments from around the web. Just as often as not, I'd say, the issue with the history is just as much trying to apply modern morality and societal norms to a culture completely removed from the modern day as it is factual inaccuracies.

It's not exactly a rigorous explanation of the phenomenon, but it is a good set of case studies.

Also, it should be noted that using modern concepts in a historical setting is not always "wrong" or "bad history". It's pretty clear the author of this article chose to describe Grosseteste the way they did to simplify his work for a broader audience.
I had a private office pretty much the entire time I did coding for Schlumberger, though this can vary widely based on location. At the new company, it's mostly cubes.

I think the nature of office space is one of the problems with this. Most commercial office space seems to be set up in the open office/cube farm setup. If you wanted private offices, you'd have to pay to construct them yourself, and then wonder if it will cause trouble if you ever leave the space when whoever takes it next doesn't want it. It's much tougher to get private offices until you're big enough to be actually constructing your own buildings, or at least willing to spend money on a pricey build-out of existing office space.
Maybe I should say worst realistic case?

Otherwise things like: Atmospheric expansion from heat could increase the drag on the moon causing it to fall on us, could be considered worst case scenario too.

People really really love thinking of all possible things that could go wrong - the more disastrous the better (see: Hollywood; black holes from the super collider; or the atmosphere igniting from nuclear tests). But the earth is rather large, it's rather resilient, it's been through a lot and it's still here and working.
red meat is high in iron and anemia is not nice.
of course there are other sources of iron, i'm just saying that stopping eating meat should go with balancing diet.
Considering Gary provides citations for his timeline, I'm inclined to believe his over your memory.

That said, I think you're confusing _unit_ tests and _TDD_. Unit tests imply that you test a single isolation, TDD implies that you write your tests before you write your implementation. You can TDD unit tests, but you don't have to, and you can do all-acceptance TDD if you want.
The AES-NI properties that XTS exploit can also be exploited by better wide-block-narrow-block constructions; Rogaway for instance suggests that XTS could have cleaned up the CTS construction by using a better understood Feistel construction.

Even better would be a "native" wide-block tweakable cipher, one that created a strong PRP out of the entire sector, rather than chunking the sector into narrow blocks and then ECB'ing those narrow blocks. However you did that, it would also probably involve invocations of the AES block transform, and thus benefit from AES-NI.

But you're right: XTS has a convenience advantage for encryption in the standard hardware block device setting. What's sad about that is that simulated hardware block encryption is actually not a particularly strong protection for users.