skysight-inc/HackerNews huggingface dataset:
Every time I see these sorts of vulnerabilities I think that these devices are becoming far too complex for their own good --- in this hacking series I've already seen mention of:

- HNAP -> SOAP -> XML

- HTTP

- Linux

The first 2 items above are protocols that are primarily text-based and have no easy way to determine things like lengths. This is bad because it often causes whoever is writing the code to use an arbitrary length that "will probably be big enough", and IMHO that is never a good thing, for various reasons including security.

Making it controlled by a simple, fixed-length (or length-delimited where absolutely required) binary protocol would've reduced or even eliminated many of these overflows, because such protocols are far easier to write correct code for. E.g., if a command is always 8 bytes, then you are always going to use a buffer of 8 bytes and read 8 bytes. Those that need variable-length data can prefix the data bytes with a length, and that must always be read first and acted on, since reading too much or too little just won't work. No need to parse text lines of arbitrary length, (un)escaping, etc. Each additional layer of complexity, each step that needs to be done, is an opportunity for bugs to be introduced.

Also, this is a device that absolutely does not need to be running Linux; its functionality would probably be achievable with an 8-bit microcontroller and WiFi module, running none or maybe a minimal realtime OS. Instead of over 4MB of firmware, a few tens of K would be sufficient. I've seen some very nice and robust embedded devices, and some that seem more like the developers just took a standard Linux devboard, put some code on it that looks like it works, then shipped it. This device is very much one of the latter.
Joke: A Roman walks into a bar, sticks 2 fingers up and says, "five beers please".
Do it for online poker and take over the (poker) world.
resolving deadlocks, other locks: log on via mysql, show processlist and kill the few long standing queries. It's an ugly solution and should not be used freely, yet a lot better than database restart.
No. Do you believe that by paying money your privacy is guaranteed? Even Fastmail's privacy is doubtful regarding its non-US clients -which would be my case if i used it.
As someone who has been a paying rider in the Stockholm mass transit system for decades, this doesn't really bother me. I'd rather have a small group of people freeload than have the fines jacked up or HEET turnstiles installed. I don't think having 100% paying riders in the transit system is a goal worth pursuing.

The measures that some here advocate have downsides.
Here's a distribution of Elo scores in the data set: http://www.randalolson.com/wp-content/uploads/chess-elo-scor...

This data set is from chess tournaments, so it's predominantly games with skilled players.
Some cities subsidize low income peoples' passes.
You can disable Hangouts (chat), the top tabs and G+ from the standard interface too. I'm using this with Mail Notifr app along with two Gmail accounts. I get instant notifications and the web interface loads in an instant for each email inbox. This way I avoid crappy email clients.
Why public transport is paid is beyond me. Why would city spend significant resources to discourage usage of public transport by putting price on it? Do they really prefer for the people to buy cars and stand in traffic for hours on overcrowded streets and subsequently be disgruntled and pressure local governments for more roads?

Why only public traffic commuters pay if all benefit from the fact that they are not on the street crawling in 1.5 tonne of steel each?
>The data doesn't support the conclusion that chess is becoming more defensive.

That's a good point. I weakened the wording to make it clear that I'm speculating.
Some people seem to feel that there is something wrong with marketing that makes you want a product or service.

As many people with an expensive luxury brand can tell you (whether it's a handbag or a car) nice things are often nice way beyond what they really are or what they tangibly provide. (And there is nothing wrong about that..)

Let's call it "the mother test". In other words if you gave a luxury car to your mother and she didn't know it was a Porsche Panamera Turbo how much pleasure would she derive out of it over a Toyota Avalon or a Cadillac CTS (relative to the price differential)?

Put another way if a woman gets a kick out of a Coach handbag how would she feel if the handbag was a very good (licensed) replica of the Coach instead of the real thing?

How many people with expensive Chef's kitchens derive pleasure out of them and actually don't even cook that much? And would rather have a kick ass Chef's oven rather than a GE oven? Just because the marketing has convinced them of value?

My point is simply they are happy spending the money and getting what they are getting and there is nothing wrong or deceptive about that practice.
Vancouver, the New Tech Hub
True, I did discount the jailbreaking community. They're a great bunch, but it's such an uphill struggle to break new versions and new chips. I don't see how that's sustainable.
Speaking of fare-evasion, try viewing the article in private-browsing/incognito mode.
Sometimes I wonder how Vienna's metro works. The year long ticket is 360 EUR which is not a lot and there are no gates anywhere, just manual enforcement.

The fine is also low at 103 EUR.
The idea of privacy with email is, unfortunately, very ephemeral. As seen in other articles also submitted to hn in the past, even if you stop using Gmail, Google will still have a very huge chunk of your data to track simply because the vast majority of the people you communicate with have a Gmail account. There is no easy/apparent way out.
Ok, but why would anyone set up and run an extremely privacy-hardened service for you, for free?
It actually looks pretty interesting and potentially fun. Only criticism would be to improve the site design and functionality. It could use a cleaner look and a more fun atmosphere.
Is agnosticism actually a consequence of Bayesianism?
So ClojureScript will get TCO before Clojure? (JavaScript would get this before Java) Interesting times we live in.
You probably couldn't resist intrusion if you were under an active investigation, but hosting your own mail server would certainly help to partially mitigate the mass surveillance dragnets that are logging all traffic en masse from popular mail providers.
> "Keeps work and personal accounts very separate."

Does it? I don't know either way, but if I were google I would link the two accounts (just takes one more cookie at most!) so that if me@work-acct searches for a car, then me@home-acct can be served a car ad....
Well this is just depressing (although it looks like these have been fixed by now in most of the frameworks mentioned,) as "just use a framework" has been my go to response to people starting new PHP projects because I had assumed they had SQL injection taken care of.

This isn't a PHP specific problem of course but I do wonder if it is a sign that frameworks in general shouldn't come with their own ORMs. Although, having seen PHP running in the wild that doesn't even bother escaping strings into SQL, I have to think that at the very least using a framework makes things safer if not safe, and makes fixing this crap easier.
I have used this now for years.

It's a fucking godsend, every computer I have has 3 different Chrome accounts on it, all short cuts on my tool bar.

On windows at least it is trivial, extremely trivial, to switch between them. You will generally be in one of the modes, for me these are "their company", "my company", "personal".

Whichever one you used last will be the one that receives the "open internet" command. So if you are in "their work" mode, reading your emails in their email client it will open the google doc in the right context.

For you your workflow is somehow broken, for me that's exactly what I want. If I'm in "their work" mode, I want all browsers to open in that context. I'm not expecting them to be psychic. That means 95% of the time it just works because you are already in the right context. The other 5% you get used to very quickly. If I open up my personal email account, I want any next links clicked to be opened in that context.

Added bonus, it's great for every SASS not just just google accounts.
Same here. I've been with them since 2007 and they've made huge strides, especially with the recent interface overhaul.
Just FYI, they don't have the main feature I am using GMail for: priority inbox. Or at least I didn't find it in their feature lists.
> If we are talking about the flight control software, the airplane must have the keys to boot clearly.

Not necessarily. It could boot into a bootstrap state with a premaster secret, where it waits for a premaster-secret-encrypted drive-decryption key to be wired to it from its base-station before booting up. Kind of a very secure version of PXE.
[Replying to my own post, since I can no longer edit for clarification.]

A lot of commenters have let their imaginations run wild and turned "travel/camping trip" into some kind of "survival of the fittest/Navy SEALs/I WILL BREAK YOU" type endurance test. This was not the case at all.

An example of what I'm talking about... The next time you're traveling, watch how the other travelers react if things don't go exactly according to plan, like an unexpected delay. You'll see all kinds of reactions, from calm and taking it in stride to completely loosing it. It's incredible how some people will let even the tiniest inconvenience throw them off of their game completely. That type of person is not someone who will be an ideal cofounder, because nothing about a startup is going to go exactly as planned.

Also watch what happens when things get boring. Once the initial excitement of starting a company has passed, there will be many, many days that just aren't that exciting. Disney World is exciting, but driving from LA to Orlando in the shortest time possible can either be a blast or drudgery depending on who you're with.

Some commenters are also reacting negatively to the idea of "testing" someone. Let's be clear here: Every question you ask your potential cofounder is a "test" of some sort, since too many wrong answers will result in their rejection.

Loosing a cofounder is so traumatic to a startup that you really should put good effort into learning whether your potential cofounder is just "talking the talk" and will jump ship at the first sign of trouble, or if they can actually "walk the walk", and stay committed to the venture for the long haul.
I'd suggest hiding upvotes count in /newest page.

After submitting a bunch of links, some of them making a front page, I noticed that there is a fairly strong effect of social proof.

People check /newest, see that some post already has 1 or 2 upvotes, check it instead of some without any upvotes (someone upvoted, might be good!). The upvoted one gets even more upvotes (because more people are reading it), and it's on the homepage.

A bunch of my submissions made the homepage and from what I've noticed, the threshold is about 7-10 upvotes in the first hour. So can we fairly say that a dozen of people decide what's on the homepage? Maybe.

While the sample size is really really small, 8 of 9 links I submitted and got more than 4 upvotes, made the front page. But I guess with a greater sample size, the general assumption would still hold true.

The obvious disadvantage of hiding score is that it's harder to tell what is worth attention (especially during peak hours when there is a new submission every minute), but maybe it would help to bring more good content to the front page (as opposed to content that a dozen of people thought is good).
> The problem is that old media (or at least the people at the top) don't understand how to solve this problem because it involves a heavy dose of technology

There's a relatively new and successful digital-only publication in Holland called 'De Correspondent' that has been innovative in many ways. One of their goals, for example, is to allow subscribers to participate more in the news process.

And yet their comment section is the most primitive kind imaginable. It frustrates me because they do so many things right, and they have some high-profile commenters.

I toyed with the idea of trying to spice up their comment section (within the limitations of what a client-side plugin can do), but I put this off because I heard they've been 'working on it'.

I think a good commenting system or some reddit-style section would really fit in their vision, but I suspect part of the problem they face is that the site is built and maintained by a design-centric agency that isn't heavy on the technical innovation.

Another example, they touted their iPad-optimized version and yet the infinite-loading didn't (and possibly still doesn't) work on Google Chrome for iPad.

I know quite a few journalists, and one thing most of them seem to have in common is border-line illiteracy when it comes to computers. Most of them never heard of Reddit, for example, which is baffling to me for someone in a profession like journalism...

(that said, I applaud much of what De Correspondent does; they're on the right track and I hope to see similar initiatives in other countries)
"reasoning that scofflaws might graduate to more serious crimes if left alone." Really, is there any evidence of that? Or do they think that people will get bored with it, and start on harder crimes

In New York in the 1970s, subways were dirty, unpleasant and unsafe. The panhandlers, thieves, graffiti artists and public
defecators tended also to be fare-beaters. I don't think that the fare-beating caused the harder crimes, though.

If someone graduates from fare-beating to shoplifting, it doesn't really affect me as a rider. However, if it's true that the criminal or dangerous riders are likely also be fare-beaters, then I'd support a crackdown on the fare-beaters to have a cleaner and safer ride.

I doubt that Swedish high school students who beat the fares ($120 per month is a lot of money for a teenager) are going to turn into hardened criminals, though. Sweden doesn't have the deep socioeconomic problems that produce crime to the extent that the U.S. does.
Done! Thanks for your comment :)
It's funny how people are scared about Google this and Google that, yet are okay with credit bureaus and credit card companies selling one's information to third parties. Very funny, I say.
NYC (and hence the NYT) is quite familiar with the Broken Windows Theory, which was used to drive law enforcement changes intended to reduce crime in the 90s under Giuliani, if I recall correctly.

http://en.wikipedia.org/wiki/Broken_windows_theory
Whether I live in my imagination or in an external reality moderated by my senses, it would appear the same to me, and part of that appearing the same is that it seems to follow rules beyond my conscious will that I can guess at based on past experience.

I don't see how the fact that it might all be a dream makes the experience of pain any less painful or the experience of pleasure any easier to come by. I experience it all the same.
Stopping advertising companies sniffing around is easy. Hushmail will do that.

Stopping a government is different. Are you preventing just the slurping of data? (Just because they have your emails in their cache doesn't mean they're grepping for you); or might you be targeted? In which case you're going to have to carefully use operating procedures and software. And make sure the people sending you email do the same. Also, you'll need better locks, and no windows on the ground floor and etc.
Reddit Enhancement Suite, a ubiquitous browser extension, shows the link karma, comment karma, and account age of any username that you hover over.

So, it's totally possible that, like others have said, people deciding which request to fulfill take karma/account age into consideration to avoid gaming the system with multiple accounts.
And the ability to minimize the awful chat in the bottom right that's blocking most of the interesting statistics I'd like to see.
This is not a good argument for using or staying with Gmail.

In fact, writing this another way potentially identifies a more compelling reason to leave:

By using Gmail, you are incrementally harming the privacy of everyone you communicate with.
Five predictions about the future of reproduction
You're right. All casinos should be shut down. All games of chance should be illegal. Carrying dice should be punishable with 5 years in jail. A pack of cards is instant life sentence. Betting money on anything for any reason is a death sentence. Betting for fun is a gateway drug, and will be treated as if money were bet.

That is the only way to rid society of the ill of gambling.
Increase fines and capture rates until the expected benefits of fare-dodging are negative.

Nobody needs to run to catch the evaders. Periodically, ticket inspectors need to check everyone on a carriage / vehicle, covering all exits.

$180 isn't much of a fine, especially since it can be covered by 50% of a $15/month membership charge. That implies a catch chance of about 4.2% per person per month. If an unlimited ticket is $120, then the fine should be closer to $3000, if there is no increase in catch rates.

A $3000 fine would be unjust for people who make genuine mistakes, however.

So a different strategy should be followed: crack down on individual routes, greatly increasing the catch rate, combined with a modest increase in the fine; focus on changing behaviour, one route at a time.

Alternatively, fines could escalate for repeat offences.

All assuming anyone is interested in decreasing fraud, of course. It may be a socially acceptable loss for more complex reasons.
Apart from being needlessly punitive, it also changes the economics of the group not a jot - they just triple the membership rate, which is still far cheaper than paying the correct fares.
Deciphering The Economics Of Venture Capital
Paying for it allows them to spend time researching better systems and gives them some buffer in the dace of legal attack. See also anon.pennet http://en.wikipedia.org/wiki/Penet_remailer
You wouldn't want someone who lost all of their games and someone who drew all of their games to have the same number of points in a tournament, for an example of why draws are 1/2. Not that it matters for who wins more often, as you say.
> The iOS push notifications are what has been causing me to move my email over to GMail.

Don't rely on Gmail for push: they discontinued Exchange-support recently, though they grandfathered in old users. What's irritating to me is that when I set up my new phone I lost it, and am now back to using fetch-only Gmail unless I want to use one of Google's proprietary apps (unless they've changed this recently).

Agreed that I'd like Fastmail to have push. Every time they come up on HN, I mention it, because I'm a paying Fastmail customer and would like to stay one because they're really perfect in every other way, but the lack of push email is just very disappointing.

> I'm sure solutions exist for push notifications. Has anyone had success with any of them?

On iOS there are options like Boxcar and the like, but they're usually sub-optimal and rely on passing your login credentials to a third party.
Yeah, that was my point with basic income. With something like that, people without jobs wouldn't need to be homeless - the idea would be to give them enough to get by.

You're right, automation will tend to put people out of work. If they can find more skilled work that hasn't been automated yet, they're fine, but if not... we'll start to have a problem. Unless, of course, we rethink the idea that people need to work to survive.

Because honestly, if we don't need everyone to work for society to function, I don't see the value in forcing them to do so.

(And maybe, in the long run, capitalism isn't the best choice for how we ultimately run our society. That kind of change isn't happening anytime soon, however. A basic income, on the other hand, might just have a chance.)
The monospace version of the font has too much vertical spacing to be used for programming. Everything looks double spaced.
I felt.. sad, reading this part:

"Then there’s the Intelligence Community, who call themselves the IC. We might like it if they stopped spying on everyone all the time, while they would like us to stop whining about it.

After spending some time with them, I am pretty sure I understand why they don’t care about the complaining. The IC are some of the most surveilled humans in history. They know everything they do is gone over with a fine-toothed comb — by their peers, their bosses, their lawyers, other agencies, the president, and sometimes Congress. They live watched, and they don’t complain about it."
It seems rather dishonest to imply that Google is giving (or selling) your data to marketing companies.
It's actually explainable, I think!

Assume stars are distributed roughly evenly in space. This is not true about the overall universe, they're clumped in galaxies, but fine for the dataset we're explaining, which maxes out at 3000 light-years from Earth.

Approximate the galaxy as a flat plane. This isn't a bad approximation since it's much flatter than it is wide.

Which stars are at a given distance D from earth? Those that lie on a circle of radius D centered at earth. But that count is just going to be proportional to the radius (circumference = 2pi times radius). So the count of stars does follow a power-law distribution, and that power is 1. There are KD stars at distance D, where K is a constant proportional to the overall density of stars in our neighborhood.

(I'm glossing over the fact that a circle is infinitely thin and stars are finite in number and so any given circle will probably have 0 stars on it.)

If you instead model the galaxy as a sphere, you get the same sort of result: count(stars) at distance D is proportional to the surface area of a sphere of radius D, 4pi*D^2. Still a power law. (The galaxy is about 1000 ly thick though, according to Wikipedia, and the data go out to 3000ly. So a sphere is probably not great here.)

So why do power law distributions tend to obey Benford's law? I'll punt on that: https://en.wikipedia.org/wiki/Benford%27s_law#Explanations
How? Fastmail is...another mail provider.

Paying for email service might be a good idea for a lot of reasons, but people have an extremely absurd sense that they're "fighting the man". You know - by paying in US dollars, to a US company, using US banks....

EDIT: Something I did just see is that Fastmail gives you sieve scripting. Since going from hosting my own inbound email to Gmail, I've really missed having a good email sorting language.
What do you mean? Why were they evading the fare in the first place?

Tripling the fine may decrease the number of people that pay it, but it would also essentially shutdown the group that encourages people to skip fares.
I don't know if "great" is the right word. Sparse maybe.

Also someone didn't set up their GA ID properly! Someone's going to be missing out on a lot of traffic stats.
The termination problem is the major issue. You cannot generate a selectively decryptable signal from inside the encrypted code. In other words, being able to generate a halt signal to mark the end of the program flow immediately invalidates the security of the entire container.
Probably because i am not the only one who would use it.