skysight-inc/HackerNews huggingface dataset:
What I learned from that: the easiest way to detect undercover cops is to ask them to--or really, entrap them into--committing an unrelated crime, e.g. hurting someone.

Imagine "rewarding" the new member of your drug ring by giving them a hired escort who has been paid to resist all acts upon them, and then locking the new member and the escort in a room together with some extremely brutal S&M "toys." You'll get lots of false positives--people who don't actually get their jollies from harming others--but it's the false negatives that are important here, so maybe populating your organization with sociopaths is a low price to pay.

On the other hand: is the boss committing a crime just by setting up this "reward?" They wouldn't mention anything about having to harm the escort, it'd just be implicit in the setup that if you're that type of person, the situation is easy to take advantage of.
Yup. And that very reason is why many people don't have social networking accounts. You can control what you share, but you can't control what your friends share.
If you're burned out, try to find some tasks that are really easy for you and are relatively short in duration and well defined.

For instance: setting up google apps for small companies.
Facebook is more likely to stay than email IMO.
Yes (I am not expert in neural nets, but that appears to be exactly what this is saying). If you look at what goes into a neural net and compare it to what goes into a Fourier transform, it should be obvious that neural nets have even more than they actually need to do this task.
Very addictive and a neat way to see what is going on out there with a quick browse.

I'd suggest more modern look and feel for the top bar, maybe something like a black bkgd with opacity? Currently it pulls the feel of the site down a bit.
You still haven't explained why we should be "caretakers" for dying species. You argument now sounds like "we can, so we should".
Opternative - http://www.opternative.com/careers/ - Chicago, IL

Front End Developer (http://www.opternative.com/careers/)

Back End Developer (http://www.opternative.com/careers/)

Mobile Developer(iOS or Android) - email Eric@Opternative.com for more details
Show HN: Speed up rspec tests by removing only inserted models
I'd really be thinking hard about my cloud policies

A lot of social engineering attacks involve things like security question password reset, lost second factor reset, lost access to backup e-mail/phone, and things like that.

Don't most enterprise cloud offerings dispense with things like that, because users can visit a helpdesk in person?
lastpass on android has the ability to insert your passwords into app login forms (via a custom keyboard / accessibility API, I think). I don't know if the same is true on iOS
Interesting thought. If McCarthy could have subpoena'd Google, he'd have been able to prove that they were all commies and then people wouldn't be unfairly smearing his name today.
Coming Out of the Black Nerd Closet: A Meditation (2011)
Copyright takes a lot longer to expire than a patent.
I dislike Agora. The site is rarely up and when I do manage to login most of my requests time out.

What I'm interested in is how much money the major sites are making. The much smaller Cannabis Road was recently hacked and robbed of $130k in bitcoin from various escrow and user wallets. I can only imagine what the major players are making.
UberPool San Francisco
'Dropping' sounds like they're reducing it ... can I suggest a rename to 'eliminating'?
> Password reset is answering the date of birth and security question challenges (often easy to break using publicly available data – birthdays and favorite sports teams, etc. are often not secrets)

I really dislike this trend of "personal questions" to reset your password. The first car I owned or where I'd like to retire is easily obtained information. When are websites going to stop doing this?

I answer these questions using passwords generated from 1Password. So basically I have 4+ passwords per sites that use these questions. Very annoying.
If you visited the specialist, your health insurance would already know because they'd be paying the bill. Now, I'm not an expert on medical billing, but I can't imagine how "being on the same floor" as a specialist could result in any sort of invoice. I'm not sure what you mean by "extra attention". Why would the insurance company use that information? Surely any given specialist is around hundreds of people every day he or she isn't treating, so that particular data point has no use in predicting who is going to receive care from that specialist.

Standing near someone - same argument as above.

In the rare case that you are actively involved in overthrowing a corrupt government, then yes, it is important to keep yourself hidden from that government. But privacy in general does nothing to prevent the corrupt government from coming to power in the first place. If anything we need less privacy - for the government.

People don't "just like" things for no reason. I think it's worth examining why we like privacy and what needs it fulfills, and what other ways we might be able to fulfill those needs. It seems to me that digital information is just too easy to distribute for us to have any hope of containing it. We are better off assuming any available information is going to be made public and finding the best way to proceed from there.
you have clearly never used Uber.
Nothing stops a threat from just lying and waiting for you to expose a large number of passwords. Having one stolen doesn't raise red flags in itself.

I don't think signed addresses will be particularly effective. With the sort of key stores we have now, it seems pretty plausible that a bad actor to get a certificate that would pass on the Trezor device. It raises the barrier of entry a little though.
Choice quote:

To reiterate what the main bugs are that are being exploited here, roughly in order of popularity / effectiveness:

Password reset (secret questions / answers)

Phishing email

Password recovery (email account hacked)

Social engineering / RAT install / authentication keys

Note: Not weak passwords.
Seems crazy that sites need to individually opt in to anti-Clickjacking with CSP, instead of modern browsers disabling it by default.

In other cases, the default is to not let a page mix origins:
http://en.wikipedia.org/wiki/Same-origin_policy#Cross-Origin...
Who teaches functional programming?
Sure, but it'll stop rayiner from gmailing passwords to himself.
> Preventing the oracles from colluding to prematurely release the keys, or not release the keys at all, is a harder problem.

No, the harder problem is knowing the "encrypted" data is something other than a directory of the sellers favorite goat-porn. A cut and choose proof could be used, but non-interactive ones require a lot of samples to have good security... and revealing a lot of sample images is something the seller doesn't want to do here.

To put that in concrete terms: Say I claim have a million nudes of Elmo which you'd like to purchase. I give you an encrypted copy of them. You pick some number at random, and I reveal the keys. You decrypt and get find all of them to be fine examples of the promised images of Elmo in all Elmo's glory. You are now convinced that it is likely that the rest of the images are similar— since your selection was uniform you can use simple combinitorics to how likely I would have been to get away with various levels of fraud. "That tickles"

To make this protocol non-interactive with a fiat-shamir transform— I hash the encrypted pictures and use the hash to select which ones I reveal. This requires many more examples to achieve security because I could have been secretly grinding one of the images until the hash picked the few passing examples I had. (There are, however, ways too boost the security by inserting an expensive process— like giving away Bitcoins— into the inner loop).

It's likely not reasonable for a collection of just a few dozen images, even with strengthening, however.

For machine decidable things— say a DRM master key— other approaches are possible (https://en.bitcoin.it/wiki/Zero_Knowledge_Contingent_Payment) but since no one is likely to turn up a program that decides nudes of one celebrity vs another, about the best you could do is a non-interactive cut and choose selective reveal over _pixels_, and use compressed sensing techniques to build low res images to decide if the rest of the pixels are worth paying for. If you're happy with that, then at least theoretically, the ZKCP approach lets you pay for the keys for the rest of the pixels with no risk of being stood up and no third parties.
Looking for Beta Users Who Use SalesForce
We are in late beta stage of a software that automatically logs email and phone activities into Salesforce.com We want honest feedback and are looking for some more users. www.onit.io
Check out this short youtube video for an overview
http://www.youtube.com/watch?v=8dbGkUbolmo
Thanks
Yep, time for each game too, and which end they play best at for the superstitious amongst us. Tons of stats we'll probably never use, but just in case!
The differentiation is knowledge & intent. Nobody types in random photo GUIDs after the imgur url to find content, just like nobody generates SHA-1 hashes hoping to find valid magnet links. Users follow a route of links through search engines and content aggregators to find what they're looking for. Look, I know it's easy to take this whole issue to ridiculous logical extremes[0], but the argument that you don't have culpability by hosting links is really, really weak.

To head off the probable route this discussion will take, linking to Google or Reddit as a whole does not incur the same culpability as those sites do by linking directly to the material, as finding the offending link requires additional knowledge. If you linked to Reddit along with instructions like "go to <subreddit> and click the third-highest link for the week" then it would incur culpability as it's functionally identical to linking to the content directly.

[0] http://en.wikipedia.org/wiki/Illegal_number
Check out PasswordPilot on jailbroken devices :)
> Structural recursion (folds) is to general recursion (let rec) as the "for" loop is to the "while" loop.

So, they are strictly equivalent?
</Clanguage>
I'm looking forward to the Django Dash, and hope to make time to put together a small project using 1.7. I can't wait to try out the integrated migrations.

Thank you to everyone involved in getting this release out the door!
"and when it’s time to switch servers (every multiple of 5 points). […] Once one player reaches the final score of 21 with 2 points clear, the system automatically ends the game"

It amazes me how long it takes for rule changes to propagate throughout the world.

Table-tennis has been using 11-point games for over a decade, with serve rotation after every two points (http://en.m.wikipedia.org/wiki/Table_tennis#Rule_changes), but I rarely meet recreational players who are aware of that, and that includes people who played it first after those rule changes were made.
One of the first things I install on all my phones is Andie Graph. It provides very good emulation of all the Z80 based TI calcs.

https://play.google.com/store/apps/details?id=net.supware.ti...
1Password is not a cloud service.
It was cool to be at djangocon while this was announced in the hallway track.
I got screwed by a password manager that got deleted during upgrading a hard drive. Never again
This supposes that burglars work by picking out a person, then waiting until they're not home to go rob their house. Instead, burglars search through a neighborhood to find houses where nobody is home, then break in and steal things. It's the other way around.

Regardless, if you're an average adult in the US, "weekdays between 9 and 5" is a fairly reasonable assumption of when you won't be home. No giant database needed.
So if I'm understanding this from a technical perspective, the real story is that this is/has been going on for quite some time, and there's an entire ecosystem devoted to it. The general public rarely ever sees behind the curtain, but somebody got greedy in this case and we ended up in a race to the bottom.

If true, interesting that such a layered economic structure can exist without much press or public comment -- until something like this happens.

Fascinating. Makes you wonder what percent of the total activity these 100+ celebrity invasions represent.
What about just using a basic cipher for your questions? It is what I do. So if the question is "What was your first car?"

Answer could be: Ford

Instead it is Enqc or droF or Gpse
Is this similar to the Anomos program that died 6 years ago?

https://anomos.info/

Anomos would have required a tracker, like torrent, but had onion routing for downloads, I believe.
Yes, I have a few clipper cards tied to travel bank accounts. Unfortunately, Clipper cannot be integrated into third-party vendors / apps and is prone to 24 hour account locks if transactions are declined. Adding money ad-hoc is troublesome as well.. use a POTS terminal, go to an approved retailer (Walgreens, etc), online ('available within 3-5 days').

Their commerce system is not mobile friendly and is a pain for mobile users. It could be much more efficient.
Constant Geological Events == Man Goes Extinct?
I wouldn't be so sure that Clear Channel knows those numbers. You'd be surprised how little data big companies know. Do you have a github or blog post on your experiment?
The bar is not quite that high. I recall hearing about a case where the cops suspected someone so they sent a fair amount of advertisements for an illegal product to their house. The defense basically said, they did not bite the first time or the second, but after a while curiosity got the best of them. The important thing to note is they passed up several opportunity's before trying to commit the crime.

In this case, as long as the cops don't actively advertise people probably can't use the entrapment defense. But, if they setup a large ad-words account then in theory that's a problem.

However, If the jury finds that the defendant was predisposed to commit the crime that he committed, the defendant will not be allowed to use the entrapment defense, no matter how extensive police participation was in inducing the defendant to commit the crime on this particular occasion. So, if the prosecution demonstrates someone is a habitual drug user then the cops can advertise freely. But, if they cops advertise and someone that's been clean for a few months/years calls them up that's a gray area that depends on the jury's interpretation.
AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed.

Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technical solution to a social engineering attack, so it's a clever way out as an excuse to avoid doing something difficult. You are not the first person to try it on me. You also sound like you're making the case for social engineering control of their machine, at which point what does the password manager matter? You have physical. Game over.

I have this conversation regarding self-signed certificates and MD5 hashing as well. "But they don't authenticate," or "but MD5 is insecure!" Yep, I know. Do you understand the threat vector for my usage of either? You sure?

Just use one. Seriously.
I find myself suggesting this to people often, but I'm excited about the Mooltipass[0], an offline password keeper crowd developed on Hackaday. Hope to get one when they've ironed out the bugs and finally move to random passwords.

[0] http://hackaday.io/project/86-Mooltipass
The Celebrity Photo Hacks Couldn’t Have Come at a Worse Time for Apple
1Password lets you store your (encrypted) password keychain on Dropbox to sync across devices.

You didn't get screwed by a password manager, you got screwed by a bad backup policy..

Sorry to be pedantic - and I feel your pain for losing your data - but there you go..
> Developers don’t have the best hand eye co-ordination

1. "hand-eye coordination"

2. Generalizations should at least be supported by references

3. Pretty awesome hack
Fastmail still has hardware inside the US; not a viable alternative to Google, privacy-wise.

(have just checked out MyKolab, they seem pretty awesome, although alas too expensive for me right now.)
I can't say how much I love Django. Back in the day when it was first coming out, I was coming out of the Microsoft/ASP.NET world and was being introduced to the wonder of Rails. But a small project I had contributed some mind-share to had been rebuilt in Django. When I asked which I should learn, Rails or Django, a wise developer friend advised I play with Ruby and Python. Figure out which language spoke to me, and use the best framework available.

I chose python, and despite the niceties of Rails, found Django an absolute pleasure. Add in a sprinkle of Johnny-cache, Jinja2, and South (because you could in Django) and it was a powerhouse.

I haven't written any Django code in a couple years now - my work is now mostly backend/API code for which Flask was much lighter weight (and Go is mostly replacing), but all my Django sites are still running.

Congrats to the team on continuing to push forward a brilliant framework, the best documentation in the business, finally getting DB migrations in the core, and more and more and more.

And by the way, thanks - I owe a bit (lot) of my success to everyone who contributed to Django and the larger community. I hope my meager contributions a few years back were at least a bit of repayment on a much larger bill.
may i also humbly suggest the two vol. series called "parallel distributed processing" (rumelhart et al) which provides an excellent overview of early NN research.
There are already C/C++ implementations of most of this, and Matlab implementations, if you go hunting around.

If there’s something specific you need, some of the algorithms have some fiddly parts, but there’s not too much that’s fundamentally difficult to implement in any of them. Any particular part should only take a day or two to build for some one-off use case.
Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board).

Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.
Doesn't the TREZOR show you the address you're sending from/to as well as the amounts? That would be pretty easy to double-check.
Find a github repo of an interesting project an read CONTRIB file at the root (ex. https://github.com/TryGhost/Ghost/blob/master/CONTRIBUTING.m...).
OTOH, if you're a celebrity at a party, and you "do shit" and someone takes a picture of it, the horse has pretty much already left the barn as to whether that picture is going to show up on reddit and it's just a question of when...
One thing I'm mildly surprised hasn't shown up more in these types of markets is "pirated" or outright stolen clinical pharmaceuticals. Drugs like Humira or Etanercept are expensive and need to be taken for years ( usually for the rest of your life if you really need them ) and are heavily advertised.

Selling Humira at $200 USD / dose would be profitable if you were using stock diverted from Abbott Labs, and selling a similar product using a black market supply-chain would still be effective; even if the trust in the product would be less than most sensible people would accept.

Of course it would get not just the regular regulators on your tail, but the full panoply of intellectual property and medical enforcement.

From a customers point of view it's pretty easy to justify paying a tenth of the "list price" for a drug that keeps you alive and functional; so the demand is there.
Super excited about having migrations built into Django finally!

Great work to everyone involved, and thanks for making an amazing product that makes going to work fun
I'm a naming expert and I've actually written a book on 'how to name your startup'. Currently working on a Kindle version.

As a part of the book, I interviewed Sahil Laviniga, the founder of Gumroad. He invests a little on the side, and he told me that a bad name is a bad sign. From the transcript:

I think a name is actually quite representative of the long-term commitments of the founders/ founding team. A name that sounds ridiculous or uses an uncommon TLD may seem throwaway and imply a lack of product sense. Founders should be picking a name with a long-term potential.

Fred Wilson also wrote about domain names at http://avc.com/2011/04/finding-and-buying-a-domain-name/

I believe that a good domain name is an important success factor in building and launching consumer web services. It's not in my top ten but it could be. It's certainly something we think about a lot when making investments and working with companies post investment.

So for at least two investors, the name definitely matters.

If you're looking for specific examples, look into Wesabe (lost to Mint) an Fukime (no longer exists). In general, a good name won't make you successful, but a bad name will hold you back.

More reading on Mint vs. Wesabe:
http://kcovia.com/why-mint-beat-wesabe/
3 Observations on Why Hackers Should Embrace Analytics
I cannot speak for the OP, but we are more likely to make "bad" decisions when the situation appears desperate.
Any suggestions on packages you're using for your Go toolchain?

I'm a django developer that's somewhat fed up with python's slowness. I love django but I'm looking to diversify. I've worked through a bunch of Go tutorials, but I don't have a good feel at all for the go ecosystem.
Worth noting that spotify did in fact do exactly this, and as far as I know recently discontinued the P2P element of its streaming service.
Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG..

"this is a really dumb password" is probably actually a really good password. ;-)

And also, your "problem" is simply your decision to trade security for convenience.

You need to weigh the risks vs. reward and make the choice for yourself. If something goes wrong, at least you'll know why.
Why all the hoopla then? Just go ahead and do it. Why make a public stand and generate so much drama?
Double check it against what information source? The malicious software has altered the one shown on both devices. They will of course match, but not with the one you're actually meant to be paying to.[0][1]

[0]: http://www.reddit.com/r/Bitcoin/comments/23sjle/chrome_exten....

[1]: http://www.reddit.com/r/Bitcoin/comments/1vrium/a_google_chr...
Isn't DDG in the upcoming iOS release though?
Just to give OP a heads up: the article's font is rendering terribly in Windows Chrome.
Counter examples
Egcs
xorg
Oderskys Java compiler
On frequentism and fried chicken
Are you serious about your remark about spelling? I must say it caught my attention, but why would it be silly?
I have never seen the term normal distribution used in connection with anything but the Gaussian normal distribution. Especially not in connection with normal numbers. Can you point to some examples of people using this sense?
Yes, the immune system would probably be culled from our genome eventually if there were no pathogens left.

It would be tremendously risky as a species, and also very unfeasible considering how important microbes are to life, but you are correct in expecting an unused "feature" would likely be removed, as every "feature" has a cost. Much like cave fish that live in total darkness all their lives- their eyes disappear...
Why Pascal is Not My Favorite Programming Language (1981)