skysight-inc/HackerNews huggingface dataset:
What Comes After Antibiotics? Alternatives to Stop Superbugs (2013)
So a more than doubling of performance is unethical because the internet is being used for its intended purpose? Can you elaborate on this criticism? I'm assuming your threshold for "ethical" is perhaps 10x?
I figured that's what you meant, but I'm having trouble imagining how one would modify a truecrypt volume in a way that would give an adversary any advantage: http://www.truecrypt.org/docs/encryption-scheme

It seems like if an attacker wants to compromise (not merely corrupt) a truecrypt volume, they'd need to exploit the target machine itself, not just the data being read by it... unless Truecrypt has an implementation flaw like a buffer overflow, and you're suggesting modifying the volume to take advantage of it?

Storing a Truecrypt volume in Dropbox would completely invalidate your plausible deniability about whether there's a hidden volume on the drive / whether you have access to it, since an attacker can watch changes in the ciphertext and infer whether you're using a hidden volume. But I thought it was impossible for attackers to generate new ciphertext that decrypts to valid plaintext unless they had the keys, at which point they've already won. So it seems like there's no way to modify the truecrypt volume except to corrupt it. Hrm, I'm out of ideas.

Sorry, I just like to learn as much as possible, and what you suggested sounded very interesting. Don't worry about explaining it unless you want to... I imagine my questions are kind of annoying. I'll research it more.
Veritasium. Pyro Board: 2D Rubens' Tube
OK? There's nothing here that isn't covered by the free usage license. Check out http://tufts.doublemap.com/map/ for instance. Looking through the code, it's all pretty standard stuff.
How we integrated Cortana with our music app
This is a good question. Here are some reasons:

* If you're working with 512 byte sectors, the cost of individual MAC tags gets high.

* No matter what your sector size, reserving space for the MAC tag gets you odd-sized sectors.

* Most importantly, what does it mean to have a sector with a bad MAC? How does that get reported back to the filesystem? Filesystems aren't designed to cooperate with the disk to track cryptographic attacks.

By the time you solve that last problem, you've already gotten yourself pretty far down the track of just providing crypto in the filesystem layer. Which, because the filesystem layer is format-aware, you might as well just keep going and make a proper cryptographic filesystem.
>> it will only take 5ms

This is true in the scenario of a linear chain, e.g. `.then(foo).then(bar)`, but the spec also requires that the following should work (for interop purposes, among a few other scenarios):

.then(function() {return someOtherpromise.then(doSomething)})

So you might incur other harder-to-track-down penalties if you're doing interop between libraries somewhere, or if the promise chain has dependencies on the data provided by upstream resolvers.
Why not shield your store instead of blasting more radio waves?
That was my reasoning for not getting into Bitcoin in a big way during the hype cycle. It's incorrect, though. The best case for Bitcoin is that it becomes the global reserve currency, in which case your dollars are worthless and it makes sense to exchange any number of dollars for Bitcoins now before the dollars become worthless.

IMHO this scenario is pretty unlikely, but it shows the difficulty of doing fundamental analysis on currencies. Currencies are based entirely on confidence; they are, by design, intrinsically worthless. (Gresham's Law dictates that any currencies with intrinsic value tend to get driven out of circulation and cease to become usable currencies.) So the only facts that matter when evaluating them are the attitudes of the population towards them. This is why ForEx speculation is usually likened towards gambling; it's pretty much impossible to make a sane rational analysis of their value.
CTR is not a one-time pad. Read the article: it discusses using CTR for disk encryption.
Have you ever seen a room full of 2nd graders try to log into something?
We have, and it isn’t pretty. Imagine 30 arms wriggling in the air, and one crazed teacher running around the computer lab to troubleshoot. That’s what a typical day visiting our users looks like.

This is why at Clever (https://clever.com - YC S12), we’ve set out to build a better underlying platform. Step 1 is Facebook Connect for education: one identity to tie together all of a student’s learning applications into a cohesive experience.

We're a small, highly technical team with deep experience in education. In under two years, 1 in 7 schools in America has begun using our APIs, meaning that Clever moves data for eight million students every day.

And while we have all the startup perks (a beautiful loft office in SoMa, free lunch, unlimited Amazon credits for learning..) – hands down the best part of the job are the calls and emails from schools describing how much Clever helps them.

As an education company, we’re all about learning personally too – it’s practically a prerequisite to work here. In the past few weeks we’ve done tech talks on things like exoplanets, set theory, and kitesurfing. (We also love a good round of bughouse chess – just ask Magnus Carlsen http://screencast.com/t/xD7umWfo)

We’re looking for full-stack engineers who can hack in Node, Go, and Python (or are willing to learn), but more importantly, we’re looking for people who share our passion for improving education. If you’re interested, we’d love to hear from you.

https://clever.com/about/jobs
Everyone (who doesn’t have ulterior motives) can agree that any kind of sign up process for something that will likely always stay on one device should at least be optional. That much should be blindingly obvious. But nice that we talked about it.

Using Facebook (or any kind of login) to solve that would be a bad idea (but many might be tempted to do it).

However, in those cases when the task is more complex than that (I just checked, that applies to eleven† of all 23 third party apps I have installed on my iPhone) that’s not a solution. I – the user – want to be able to access the data from anywhere and do actually use that functionality regularly.

Honestly, I personally would have no issue if each of those apps gave me a choice of signing up with either Google or Facebook. That would massively simplify things for me and I wouldn’t have to lug so many accounts around. I can understand the privacy concerns, so I do see the need for alternatives, but for me personally it’s not an issue.

—

† Reeder, Twitter, FB Messenger, iBooks, Pages, Keynote, Numbers, YouTube, Twitch, Vine and Dropbox; Apps that already don’t force me to log in, most because it’s just not necessary: Castro, arte, Star Guide, six game apps; Apps that force me to log in for some functionality and I’m not sure how I feel about them: iPhoto, iMovie, Remote.
Sony develops tape technology with the world's highest density: 148 Gb/in²
I agree. There was some concern around 2005-2009 about whether the attacks which broke earlier hashes could be extended to SHA256, but at this point it looks like those fears aren't coming to pass.
> Patents afford exactly zero benefits to a low-resource party in all cases except acquisition

In many (most?) acquisitions, patents are incorporated in the valuation of companies that are to be acquired, even when the purchaser is a giant entity that could probably beat the target in a patent litigation by countersuing for something else.
Is it really that unusual to have two vendors competing for a single very large customer?
I think his first sentence is a strawman. What I'm tired of from the TDD crowd is that they insist that people are doing it wrong if they don't do to the extreme demand of others.

A great example of this is Bob Martin saying that you are absolutely doing it wrong if you don't write your tests before your code and if you don't restrict your writing of app code to the pure case of making a failing test which you wrote first pass. This is an extremist ideology, and many of us are tired of having this thrown in our face over and over again.

Here is Bob saying this: https://www.youtube.com/watch?v=WpkDN78P884&feature=youtu.be...

No one said, "testability is a meaningless goal", and it's dishonest to say that. We're saying that the extreme to which the TDD crowd takes this good general guideline is bad, and their insistence that anyone who doesn't do it that way is doing it wrong is growing very tired and someone has to speak up against it.
> The worst case is coastal flooding, some people have to move inland, and some plant and animal species go extinct. Perhaps some areas become desert (but people live in incredibly hot areas now, so those places will still be habitable).

The distinction between "best case" and "worst case" is meaningful and I'm not sure you understand it.

What you're describing is a credible best case scenario - basically a very gentle extrapolation of what's happening right now into the future - and not the worst case.

Something like the clathrate gun effect playing out in one of the very bad ways that's hypothesized (or one of the many other hypothesized killers which we believe we've observed in the fossil records, in the earth's crust, in ice, and so on - there's too much to discuss here), and the subsequent effects of that on our environment and later on our politics as the bottom falls out of everything, represents a worst case.

If you just go ahead and decide all those hypothesis are bullshit, well, ok. In that case the notion of a worst case doesn't have a lot of meaning.
Redesigned meal tray saves Virgin millions
+1 I would like to know the answer to that question also.

BTW, does the fed reserve/government only create $1 trillion/year out of nothing? I thought it was more. I just finished reading "What has the Government Done with Our Money" (http://www.amazon.com/What-Government-Money-Percent-Dollar-e...) - a good read, but nothing new for anyone leaning towards Austrian Economics instead of fiat money.
There are errors in this.
The facebook hate on this site has reached levels of absurdity.
OK, I've pushed fixes for the DOIs, and the first two DOIs you listed here are working now.
I'm a native spanish speaker from Venezuela and I can tell you that where I'm from "Mosquito" is not seen as a diminutive of "Mosca", since, like you say, the correct form to say "little fly" would be "Mosquita". So, you're right.
Sites that want their content linked, reused and cited should use some sort of permalinking strategy. I don't think we should have a unverifiable citation because a publication does not follow sound link generation strategies. Provenance of the information is what we seek, citing a journal who doesn't provide a time proof way to access the resource should not be cited.
Your comment was clear, but logically problematic.

> When you have a routine infection that can't be cured with antibiotics, the hospital bills will be far more then the few dollars you saved. Eat less meat.

It is like saying don't drive a car, because in the long run it will cause you to die of global warming.
I think a little disclosure should go along with your opinion. Are you, or have you been, a practicing attorney?
I'm trying to think of a single service that I log into that I don't access from multiple devices. There is one internal work application I have only used from my work computer, but even that should really be accessible from other devices.

Everything else I use from multiple devices.
DynamoDB? SQS? SNS?

What can't you do given access to a key-value store, object storage, and some message-passing mechanisms? Keep in mind, IAM policy is fine-grained enough to restrict access to specific keys and attributes in DDB, etc.
When you say bitcoin doesn't have them, you just mean bitcoin is currently making it possible for you to commit tax fraud, right?

Bitcoin hasn't magically changed the laws of the world, it's not freeing anyone from restrictions. If you're using it in a manner to avoid taxes, launder money, fund terrorists or whatever, that's still just as illegal as if you were doing it with a briefcase of cash or gold.
Exactly this. For a site that supposedly caters to entrepreneurs, the vast majority of people here seem so out of touch I sometimes wonder how they're capable of navigating the real world.
A valid concern. From what I've heard though most mutations that cause antibiotics resistance are selected against in the absence of antibiotics.
Eek. Can you let me know where and I will get them fixed as soon as possible.
The MathWorks, I believe.
I primarily like XTS because it's very fast and can be efficiently pipelined on x86 platforms with AESNI. I can get 215 Gbps throughput on 8 cores of a modern Intel CPU.

Also, if XTS is used in a length-preserving fashion, it can encrypt standard block devices without significant changes.

However, length-preserving means that it's either not going to be authenticated or you need to keep authentication material elsewhere. In the latter case, I'd rather use GCM.
I just logged into an account I managed with one of the big WP hosts, and it's a huge improvement over how it feels with shared hosting

I'm curious, which one were you using?
Uh, yeah, except not a cryptographic hash function, first of all :-)

Secondly, CTR has serious issues too. It is trivial to bit-fiddle. The naive implementation you're suggesting leaks the keystream in one CCA query.

Just because CTR in and of itself is easy to get right doesn't mean that any system composed using CTR is easy to get right.
That isn't facebook's problem to solve, its your problem. You are fully equipped to solve it yourself (i.e. don't use facebook).
Please notice Valerie, she is absolutely brilliant.

http://valerieaurora.org/

This is my personal favorite: http://valerieaurora.org/tcpip.html
The icons are broken in firefox because you used a webfont wich is hosted on another domain.

Edit: Just saw that you already know about this: https://github.com/google/WebFundamentals/issues/13

---
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://web-central.appspot.com/web/essentials/icons/icons.w.... This can be fixed by moving the resource to the same domain or enabling CORS.
It's explained pretty well in the article. Basically with CTR using the block # as the nonce you break the security assumptions of a nonce (use only once). If the cryptofunc is static, and you are editing a document in place, an attacker can see exactly which bytes changed and do other statistical attacks.

Think about a file that you preallocate with NULLs. If you get an image of the disk before you write to the file and then an image once you write to the file, you can simply XOR the before and after to get the ciphertext.

e.g.

using block 100
cipherblock_before = cryptofunc(100) ^ 0x00 = cryptofunc(100)
cipherblock_after = cryptofunc(100) ^ data
cipherblock_after ^ cipherblock_before = data
I've always thought that the deletion fee for <3 month old data was a way to limit "misuse of the service" - call it a detergent if you will - more than actually a way to recuperating costs. Because I guess the costs will be there no matter when you delete data
Other than burying the cite (2 links to his own blog) to why "cost of provisioning a single watt of power is more expensive than 10 years of power consumption," the author's canonical source is eventually a 404:

http://static.googleusercontent.com/media/labs.google.com/en...

The data is also > 7 years old.

EDIT: working link:

http://static.googleusercontent.com/media/research.google.co...
Yeah; there are technical limitations with Bitcoin that are well-known. I was referring more to virtual currencies in general; Bitcoin is unlikely to be the final evolution of virtual currency. My comment was more about how Bitcoin raises the promise, but I do know it's unlikely to be able to fulfill it.
a) How is one supposed to know what is clickable on that webpage?

b) Why are the circles not valid click targets?

c) If you say this -> "To deliver the best user experience, we must deliver content as quickly as possible (<1 second)" then why does your section on Critical Rendering Path show the optimized page load in 1.5 seconds?
"bolso pequeño" is "bolsito", not "bolsillo"
There have been several studies showing that, while this might generally be the case, there are strains of CA-MRSA that show no strong selective disadvantage compared to their wild-type, susceptible brethren.
It's from http://www.pnas.org/content/early/2014/04/24/1324197111, which I found via PubMed (search for "immunology", page 2).

The only two services I've found that accept it are http://hdl.handle.net/ and http://dx.doi.org/, and I think they're querying the same database.
The FBI and the Bombing at the Boston Marathon in 2013
This is some of the most awful writing I've seen on the HN front page in a while. I'm sure if you're well-versed in the issues surrounding revocation the discussion makes a great deal of sense.

For the rest of us, it's a forrest of technical jargon, which is stunning to me given that the concepts at play here aren't insanely complicated.

>So I think the claim is that doing blocking OCSP lookups is a good idea because, if you use CAPI on Windows, then you might cache 50 OCSP responses for a given CA certificate. Then you'll download and cache a CRL for a while and then, depending on whether the CA splits their CRLs, you might have some revocations cached for a site that you visit.
200 million, really? And how many Directors or Vice Presidents make the purchasing decisions for those 200 million? A lot less, you say? Very good! The folks who got this PR Hit for Windows 8 Tablets can focus on those agents who make the decisions that the 200 million have to suffer with.
What meaningful information can a service glean from that when probably 90% of the western internet using world has one?
My understanding of why this isn't often the case in the Social Sciences is that data is usually extremely expensive to collect. The researchers usually spend many, many hours writing proposals, revising it, resubmitting it, until they finally have the funding to collect the data their interested in. Then they actually have to get people into a laboratory, or send someone out to do field work (sometimes halfway across the world), or any number of expensive procedures.

And then, after data is collected, they begin analyzing it and seeing what are the interesting patterns in the data. And this takes a lot of time, and often you just want to show one thing at a time. In the current environment of publish-or-perish, and grant providers asking what you've done with their money, you might want to take that data you worked so hard to obtain, and milk quite a few publications out of it. If you openly release the data, then others can easily find interesting patterns in your data before you can, beating you to publication, and diminishing your track record for future grants, tenure, etc.

So your point is extremely valid. But the counter point of why open data isn't feasible is, if a researcher does all the hard legwork necessary to get to the interesting analysis stage, why shouldn't they reap the rewards of their hard work (namely, publications and recognition).

A few things have been proposed: verification projects (one particular other research group gains access to your data and verifies your results, but is not allowed to use the data otherwise), and grace periods (you have to release your data 3 years after a study or something, giving you time to milk out publications, but still allowing for general verification later).

Generally speaking, true scientific verification should also involve the complete recollection of the data. But when data collection is extremely expensive, this is typically infeasible.

[I work in a field that's almost all open access, and research data is almost always available upon request. So I agree with you. But data is typically incredibly cheap in my field, so the problem above doesn't really apply.]
The Future Of Work
If someOtherpromise is an already resolved promise from your own library, then it will still take just 5ms - the neat hack here is that asap will simply push another callback at the end of the queue (which is still being processed by the for loop) and the loop will simply get one more iteration straight in the middle of its execution.

If its from another library, then that other library may be using its own scheduler and you will loose those 5ms either way...
See also the Wikipedia article about the movie "Freaks":

http://en.wikipedia.org/wiki/Freaks
I would be surprised. Anyway, why would they pay for scrubbing if the data is less than 3 months old and do it for free if not? If they do scrub, I don't think those are related
Easy and quick way to add search to a site with Denote
“irrational faith in technology to prevail in operationally or strategically complex and desperate situations.”

Technology does win wars, but it isn't magic. If Hitler had followed Karl Doernitz' recommendations and had 300 submarines on hand before going to war, Britain would have fallen to commerce losses to submarines. It was a series of top level decisions to defer the development of revolutionary weapons on the part of the Germans combined with a concerted pursuit of advanced technology by the allies, like RADAR aboard anti submarine airplanes, that decided the war.

If it weren't for such decisions, the V2 and Type 21 would have appeared sooner.
Inmos Transputer Emulator
What you say is not always true either.

I do Python mostly. Django? Fine. It has an excellent auth system out of the box. But that kind of auth system isn't very flexible either. Now I barely do Django development today so please excuse me behind any insane changes.

Flask and Pyramid world? Custom auth to me. They both have community modules for auth stuff, but do I really like them? I am not the kind of guy just pip install random "useful" package these days. Let's give another example. A year or two ago I tried to do social auth in some of my django and flask apps. Maybe I was dumb but using that social-auth library took me a while to get some of login working. Plus, the code was messy and buggy. In the end, I said screw that and implemented all of the custom login myself, just reading the official doc from twitter and facebook. That also took me a while but I knew the whole implementation inside-out. If I don't trust my own implement because it is insecure, then I must spend the same amount of time inspecting other people's custom modules.

The truth is, generic auth system is hard and is not flexible. In fact, too flexible can be a bad thing: http://plope.com/pyramid_auth_design_api_postmortem

I like customized auth system based on the api provided by the framework - that' what makes Pyramid powerful to me. Sometimes your community auth module can have limitation that you probably have to hack around.
Then don't use facebook login? How is this an interesting point to make at all on this topic?
IEEE references would be fantastic!

I don't think the ISBN lookup works correctly. Typing in 9781405347587 or 978-1405347587 returns a book with ISBN 0-9690745-2-2

I'd be looking forward to upgraded version with IEEE but I just graduated, ha!
TDD, Straw Men, and Rhetoric
All remote companies have this, in a sense.
having FB login as an option increases your conversion rate. The more ways someone can get an account, the more likely they'll find one they like (to a point).
I'm amazed Wikipedia doesn't have a first-party tool for this. I can look into it. I'm trying to keep SpeedCite as simple as possible. If there is demand, I could maybe build a stand-alone app for this?
What is the energy / calc-power reality?

Your own workstation and a dedicated server farm both waste power if they're under-utilized. So for server farms, we've consolidated with "clouds." Unfortunately your workstation still sits idle most of the time, so now this is just a really large cloud to schedule that capacity as well.