skysight-inc/HackerNews huggingface dataset:
The thing I wonder about is their rainfall accumulation feature (I haven't tried it so don't know the details).

They say you don't have to go check rain gauges. That using government weather station data and some sort of calculations, it is possible to show how much rain fell on a field.

Now this may very well be possible. But if it is I wonder how it's done (yes, I know they explain it...but I still wonder). And I wonder how accurate it is. Maybe it's accurate enough. But I'd love to see some side by sides with actual rain gauges. Government weather stations are not that close together and rainfall can vary even hundreds of yards apart. It would really suck to claim X inches of rain fell on a field so no water is necessary, when in reality it didn't happen. It seems like this could cause claims of reduced crop yields for which the provider is responsible. But maybe this works exactly as claimed. I don't know. If it does work as claimed it's an amazing feature.

It's a cool project for sure. One downside I see is that they are basically asking farmers to hand over their budgetary and production data (to be fair, Farmlogs says this data won't be sold). Having known some farmers, I see this being an issue with many and there will be a significant portion that will never use the product for this reason. On the other hand, many apparently will, so good for Farmlogs.
For examples of real implementations of timing attacks, try this: http://www.contextis.com/documents/2/Browser_Timing_Attacks....

Some of those are fixed now, but the history stealing link redrawing one is still an issue as far as I know (or at least, this bug is still open https://bugzilla.mozilla.org/show_bug.cgi?id=884270 ).
ATLAS Doesn't Walk Too Softly, but He Carries a Big Stick (well Truss Actually)
Avoid _Applied Cryptography_. You probably won't get too much value from _Introduction to Modern Cryptography_, either.

The only cryptography book I can recommend is _Cryptography Engineering_ (nee _Practical Cryptography_, which is virtually identical).

You would be surprised how few professional security people know anything about cryptography. It certainly isn't a qualifier.

I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_.
Yeah, this was written fairly quickly. I was considering making a terminate and persist executable, however that would mean it would work less with other non MS-DOS systems.

The VNC server is a complete fudge though, however I could not figure out a easy way to hook the keyboard interrupt fromGDB
thank you. So you would need to be running DOS under windows, it wouldn't work on bare metal.
The problem is that any of those fields is very complex.

Taking iOS as example, one can specialize on the UI frameworks, audio, networking, HTTP, 2D, 3D (OpenGL, SceneKit, ...), layouts, UNIX layer ...

It is almost impossible to master the whole OS stack.

Now multiply this for all fields you might target.

This is why code written by many consultants, tend to be "just to get stuff done", as there is so much one can learn when jumping from field to field.

If one decides to specialize, it can be a good when in high demand, but also a problem to switch field when the demand is gone.
You're right, of course. Developers still hold a lot more of the cards, and power, than investors would like.

But you're also missing the irony here: when software foundations consolidate, so will everything else in software. Instead of a thousand crazy 'apps' like SnapChat, you'll have user-derived variations, fulfilling the long tail, leaving little need for VC and the silly valuations they inspire.
A must have mac app for iOS developer!
Your Services Are No Longer Required – The Coming “Great Idleness”
That looks very good. How do you plan to manage spammers ?
Out to "get" you exactly how?
You really like to insult everyone who disagrees with you, don't you?
Show HN: 12perks – Reach your target audience on Twitter
I can't imagine there was anything between the FBI and site that established a context for them to be attempting to access a user on the system that they had not created. So I hope they are relying on some investigative authority and not some hairsplitting definition of unauthorized.

edit: I guess they could have been providing incorrect passwords for an account that they created. I agree that is easier to call unwanted.
Or maybe he just happens to believe what he says? Maybe he believes that the sensitive information that Snowden released is damaging the security of the US?

I personally think Snowden was a traitor. He released way more information than was necessary to accomplish his goal; The information he released has almost certainly put lives in jeopardy; AND he fled to Russia which is essentially a totalitarian state where his presence, if not aiding in a material way, is aiding Russia in a PR capacity. If you haven't noticed, Russia is turning out to be, if not a geopolitical foe, and outright enemy of the United States.

Why have we got to jump to questioning people's motivations every time they stray from the party line? ...As if there is only one acceptable opinion to hold on everything.

Sheesh
> So when it comes to FP, I like it pure-and-typed (a la Haskell), or untyped (like the Lisps), but not mixed-paradigm.
You overrate pure programming.
Thank you for SA. I do not share the experience that it is outsmarted, I still achieve > 98% accuracy just as I did ten years ago. That is really a testament to all the hard work of its developers.
I don't have a full gigabit connection yet, 700 megabits down and up right now, but piracy was easy on a normal broadband connection. The killer app I want from my connection is no buffering on YouTube, Netflix, and other streaming services. There is no excuse why my connection isn't good enough for these services, yet I still get and hear complaints in my household about the internet being slow or unresponsive. I do a speedtest from said device at that time, a mobile phone, 150 up and down. So is isn't me anymore, it is them.
This is pretty nice and very easy to use, good job!

One point: I would normally expect to see a breakdown of how much tax (VAT in my case) has been added, rather than just a percentage - I know you just subtract the subtotal from the total, but having the amount of tax shown as a separate line is actually a requirement for a VAT invoice in the UK [0] and may well be in other countries.

When I'm working with new subcontractors who may not necessarily have an invoice system set up already, I normally point them at http://invoiceomatic.io/, which was built by the geniuses at FreeAgent (which I use myself). [1]

[0]: http://www.hmrc.gov.uk/vat/managing/charging/vat-invoices.ht...
[1]: http://freeagent.com/
Virtual reality and more immersive multiplayer games.

In fact, both speed and low lag make a great multiplayer experience.
Nice work! Maybe add a way to export/import all invoices (say I want to switch machines). A data table to see all invoices and a reporting tool will be useful. Also, this is front-end only, why do we need ssl?
Thanks, that's pretty awesome. However, I was talking about attacks relying on non-constant time memory copy or math function that is used to somehow defeat a server or cryptography.
How do you run this? I tried with qemu and a DOS 6.22 floppy image, but it crashed.

qemu-system-i386 -fda Dos6.22.img -boot a -vnc :0 -s
QEMU: Terminated via GDBstub

2014/09/06 16:49:59 Starting GDB client
2014/09/06 16:49:59 Starting VNC client
2014/09/06 16:49:59 Starting SSH server
2014/09/06 16:49:59 Waiting for TCP conns on 0.0.0.0:2222
2014/09/06 16:50:00 Sent FB out
2014/09/06 16:50:01 write tcp 127.0.0.1:1234: connection reset by peer
Cloud print from Google Chrome integrates with FedEx kinkos
poorly.

now i just buy aaa bonds and sp500. lost too much gamblin' alreafy.
Does Gruber's license hold any weight here?

They're not using his perl code. They aren't bound by any license on it. There was never even a markdown spec to license, just a blog post (and Gruber knows he can't claim any binding license over this spec, because he's not complaining about that, but just the name).

Gruber had an implicit trademark on the name Markdown, but holding a trademark requires that a) you actively exploit it and b) protect it. As for a), he completely abandoned Markdown in 2007, never going anywhere with it after a few years of bad stewardship. And regarding b), since he allowed other implementations of the spec to pop up and use the name 'Markdown' liberally before this one, it has become a common item and no one really has any claim over it.

For all the chest beating, Gruber has no business telling anyone what they can do with Markdown anymore, unless they're directly using Markdown.pl or taking code from it. Which no one is going to do ever again, specially not after this project sails away.
Even if the proposed feature is added to C and implemented, there is still the (practical) problem of OS-level task switching: when your process is interrupted by the scheduler, its registers are dumped into memory, from where they might even go into swap space.

It would be consequential (but utterly impractical) to add another C-level primitive to prevent OS-level task suspension during critical code paths. Good luck getting that into a kernel without opening a huge DoS surface :)
That is a really fun poster to have!

I hope of course that people realize you should not rely on this as an educational tool but merely as a quick reference. Please, don't use any of these commands without knowing what they do!
curious, why would someone need jsonip.com ?
Show HN: Triangles for iOS
It looks great, I just tested it out and enjoyed the simple layout. Its refreshing to see a service focus on UI over flashy tricks and gimmicks filled with marketing jargon.

Also congrats on the URL choice, really easy to remember and should score you some SEO points.
And less automatic transmissions?
Why on L4? Is Mill somehow tied to it, architecture-wise? Or is it just that L4 has a smaller footprint and is easier to port?
I find Clojure to be one of the most scannable languages. The s-expression syntax gives you a visual representation of the relations between different pieces of code. When you see one expression nested inside another, you know they're related. You can tell what branching and relations are there by a quickly scanning the code and looking at the indentation. Having a bit more syntax than traditional Lisps helps break the code up visually as well. For example, things like bindings jump out immediately.
> for me, the main strength is having persistent data structures at its base for everything.

Agreed, but also:

- The ISeq abstraction

- Software Transactional Memory for state management

- Structure-sharing of the persistent structures, for added efficiency/performance

And of course, all the nice reader macros that make things so much easier to read.

This project is cool, but what I'd rather see is Clojure becoming parasitic, living on all the host VMs it can. We've got the CLR version, and ClojureScript for V8/JS, but we could also have it properly on top of Python, Ruby[1], Lua, Erlang, and LLVM.

[1]: I know Rouge exists, but I'm not sure how well it's progressing.
Pricing theory: how to price your product
> I generally have a hard time with any book list for security people that includes, for instance, _Design Patterns_.

Would you please elaborate on this point? I am not familar with that book and so do not know why its inclusion reflects poorly on the list (or the list author's assessments).
But spammers would just send "pokes" as well. The system would have nothing to go on besides the reputation of the sender when a poke is initiated, so this is no different then just sending encrypted text to begin with.
Launched: Zoho Mail App for iOS and Android Phones
Intellectual Ventures Stops Suing and Starts Making
Employment documents that require you to violate company policy
I've done it several times:

http://www.entrelife.com/2012/05/how-i-went-from-0-to-50k-on...

http://www.entrelife.com/2013/01/my-first-year-on-my-own-in-...

http://www.entrelife.com/2014/01/my-app-business-2013-year-i...
INR shows up wrong - টকা
The problem with the 15% number is how many are actually using it to manage their farm versus just on checking it out or using the weather/markets features? The guys (dozen or so) I've spoken to about it are just using it for weather/markets.

A second problem is web-/app-based farm management solutions place at loggerheads two qualities of good farmers: 1) progressive use of technology to increase profitability; and 2)the natural resistance to tell anyone what they've paid for inputs (land, machinery, seed, fertilizer) and what they're being paid for outputs.

Farming is a business, and by giving out too much information, farmers risk being out-maneuvered by their competition. Whether the competition be another farmer discovering what's being paid for cash rent and offering $5/acre more, or a hedge-fund gathering up real-time planting and yield information to play the CBOT/CME.

On a personal note, I've been involved in farming for 45+ years. My dad 80+ years. When explaining taking the information about the farm and crops and giving it to a company, my dad--who's never used a computer in his life--just stopped me and said: "That information is a new commodity they'd be getting for free to take and sell, and we'll never see a penny of it. "

Something for farmers to consider.
There should be a section for git filter-branch.

:>
Example of somebody prosecuted strictly for fiddling?

To answer my own question, I guess you could say weev, but I think his troubles really began when he made the pivot from fiddling to mass scraping. I think it's harder to argue the FBI's access was unauthorized when what they were looking at was the "access is denied" page.
If anyone has any feedback please don't hesitate to comment.
> For encryption operations these aren't catastrophic things to leak — the final block of output is ciphertext, and the final AES round key, while theoretically dangerous, is not enough on its own to permit an attack on AES

This is incorrect. The AES key schedule is bijective, which makes recovering the last round key as dangerous as recovering the first.
_Design Patterns_ is one of those books that nerds of a certain vintage all have on their bookshelves. The lucky ones --- most of them! --- haven't read it carefully. It's a book about software architecture, and, more specifically, about turning C++ into Smalltalk.

It has absolutely no relevance to software security, even in terms of background material about computer science. (It's actually of dubious relevance to programmers in general). It's one of a couple books on this list that give it the flavor of "I just typed up my bookshelf".

It doesn't help that the summary is "Required reading for any serious programmer".
Funny, when I read the headline, I thought this was referring to Paul Phillips saying that "Scala is unfixable" [1] in the other thread. He's also a Scala founder and he's also saying the language needs a fundamental rethink.

Interesting how the interpretation can vary.

[1] https://news.ycombinator.com/item?id=8277626
Vermont cafe finds a ban on laptops and tablets earns better business
I had a folding keyboard for my Handspring 13 years ago. i used it to take notes in classes.
A major advantage of typeclass polymorphism vs dynamic polymorphism is that typeclasses enable parameteric polymorphism, and parameteric polymorphism enables reasoning that is lost if types can "pretend" to be a supertype.

For instance, in Haskell you can prove a functor instance has at most one implementation (if we disallow diverging values), uniquely given by fmap id === id. GHC can automatically derive it for you. If you have dynamic polymorphism this is lost because now you can have "nonuniform" functor instances that behave differently for different types while still satisfying the functor laws.

More generally, parameteric polymorphism eliminates a large number of "behavior surprises" that can lurk in OO code. And with existential types I never find myself missing dynamic polymorphism. Similarly, in Clojure, if I find myself using dynamic behavior, it's either to interact with Java or as a hacky version of parameteric behavior.
Can you make the code available on GitHub? What would be really cool is to add API so that it can be accessible programmatically by other accounting systems.
The hypothesis is that immunity is conferred by the presence of ebola antibodies developed after very-low-dose exposure from eating fruits visited by infected bats.

> His teams took 4,349 blood samples in 220 randomly selected villages. They found that 15 percent of Gabon’s population had antibodies. But it varied widely: near the coast, only 3 percent did; in some jungle villages near the Congo border, up to 34 percent did.

>Also, their antibody levels varied widely, and what level is protective is roughly known for lab monkeys, but not for humans.
And they will. The trial isn't over. Somebody will get on the stand, be sworn in, and then explain the actions he took to reveal the server's IP.
Simple, you don't go 55mph into blind curves because you aren't an idiot. Also you would have to drive quite a beast of a car to be able to even make a blind curve at 55mph. That's some rather impressive grip.
Thanks! That's a great point about VAT, I'll be sure to add that in an update.

Invoice-o-matic looks freaking sweet, I wish I'd known about it sooner. :D
Setting up my own mail server a couple years ago i had this problem. The "best" solution seemed to be routing through a service like gmail, which defeated the purpose.
Very informative and amusing post. My favorite statistic was the 18% of entrepreneurs succeed the first time, and only 20% succeed the second time.

> The sort of person who jumps in and gives advice to the masses without doing a lot of research first generally believes that you should jump in and do things without doing a lot of research first.

Like most good polemics, this one probably overstates the case. It seems to me that if you want to pursue an idea when you're young and inexperienced then go for it; but don't go for "it" because doing so is intrinsically better than getting a job.

In my thirties I left a pretty promising career to pursue the dream of designing games and running a games company. I failed (in the ways I cared about -- we didn't lose money or go broke). I think I learned a lot. One thing I learned is that sometimes there are advantages to being young, and poor, and hungry (in the "stay hungry" sense) and sometimes there are advantages to being older, comfortably well-off, and experienced.
The point isn't to be faster, it is to be consistent.
Three years is a very short timespan from which to make claims about asset classes. In most cases, seven years is considered the minimum for a true sampling of baseline performance; ten years is better, and more than ten is better still. Obviously a16z hasn't been around for ten years, so metrics like three-year IRR are the best we have. That said, it's silly to take a three-year IRR and benchmark that confidently against something like the S&P 500.

On the other hand, I would strongly suspect that the top VC firms massively outperform the VC industry as a whole, due to any number of factors, including deal access, ability to secure favorable terms, ability to make new rounds or exits happen, etc. In time, a16z's longitudinal performance may well beat the market. But it's way too early to call the ball.

I agree that you can't really look at the aggregate performance of the entire VC industry. It's probably a highly skewed distribution, with almost all the big returns going to a handful of funds.
Earnings are profits, profits are retained in the company. A simple look at the P/E ratio tells you very little without understanding the broader context.
> Each new release of Delphi attempts to keep as much backwards compatibility as possible to allow developers to continue to use existing code without incompatibility of interfaces or functionality.

https://en.wikipedia.org/wiki/Delphi_(programming_language)
The obvious fix is to address "might go into swap space". However, the real problem is that the process can be interrupted at any time and examined, not that the registers might go to swap.

If someone has the root privs to peek at your memory, they can also stop your process at any time and examine all the registers, whether they were swapped out to disk or not.

Moving the crypto code into the kernel and running with disabled interrupts doesn't help because the attacker is already assumed to have super-user privileges (they can peek at arbitrary RAM, after all). There are also non-maskable interrupts.

You basically cannot hide the machine state from someone who controls the machine: not without splitting the machine itself into additional privilege levels, such that there is a security level that is not accessible even to the OS kernel. The sensitive crypto routines run in that level. The manufacturer of the SoC provides these as firmware, and the regular kernel has no visibility to the internals.

ARM has a security model that supports this.

There is also something even more paranoid called TrustZone: http://en.wikipedia.org/wiki/ARM_architecture#Security_exten...
Because one type may use more than one field. Vectors and strings use the nr field additionally, and functions use the vector/fenv field additionally. Instead of creating a hierarchy, I figured a flat structure would be easier to understand.
I found that starting a startup taught me quickly what I didn't know. In my case, it led me to search for a place where I could learn what I needed.

It's hard to know what to look for, what to learn, when you have not ran against any walls. Starting a startup forces you to find solutions you don't have, for problems you weren't aware off. You might have many solutions when employed, but you're unaware whether those will help you with your startup and what problems you might encounter.
I have another problem.. my ISP blocks incoming traffic on smtp. For no good reason. I'd have to upgrade to a business class connection ($$$). Unfiltered end to end connectivity would be nice. Preferrably on a symmetric line. I'd call that Internet access.
Ross Ulbricht was an economist who knew some PHP, not a super-hacker.
The point is a Skype-type no-shop deal is unlikely to be replicated.
the difference might not be that big at these price points, but if you go to the extreme I'd say no because of support costs. if you can make a similar amount on free with ads and at 9.99 your support costs will be lower at 9.99. Also, your lifetime value of a user is much much higher. If all those people who would get it at free actually need it, perhaps over time you'll be able to convince some of them to actually pay the 9.99. The value of your total addressable market is higher at the higher price point. Also, I've found on the app store the biggest hurdle you have to get over is that free -> not free jump. Once you convince someone it's worth paying for, getting them to pay another dollar or two isn't that hard.
It doesn't, it applies to the entire cert chain (minus the root). DigiCert's non-EV intermediate cert (DigiCert Secure Server CA) is SHA1, so until they fix that, all DigiCert users are still going to be affected.
to accurately determine the current machine's external IP address, as the one reported by the operating system may be inaccurate (doesn't take into account NAT, proxies, firewalls etc)