skysight-inc/HackerNews huggingface dataset:
I must have expressed myself poorly.

My point was that people reading NH are advanced users and everybody on the thread (at that point) was unhappy with lack of options. Ie that phones just keep getting bigger without adequate options remaining below the current standard size.
Absolutely. Silk Road was a mostly (not completely) illicit marketplace and the characteristics of illicit markets is that money transfer has tons of friction. You can't use regular bank accounts, cash works but sending cash around the country or the world is problematic, risky, expensive, slow.

So bitcoin was a perfect solution to that problem. It naturally gravitated towards a market with very little competition and shitty alternatives. Of course it thrived.

Bitcoin could never have taken off if it had tried to become a currency in stores first. It needed a proof-of-concept. And the only market it could do that in, was a market with no competition.

So bitcoin blew up there, and now it's slowly making the transition into the mainstream where it faces much more elegant, entrenched, competitive players like debit/credit/ach/cash etc. Despite these being far from perfect, it's a big battle. But without Silk Road, bitcoin would never have had the momentum, the interest, userbase, hype or infrastructure to even think about competing for mainstream use.
Anything sent over HTTP(S), such as your credit card numbers and passwords, likely already passes through generic HTTP processing code which doesn't securely erase anything (for sure if you're using separate SSL termination). Anything processed in an interpreted or memory safe language puts secure erasure outside of your reach entirely.

Afaict there's no generic solution to these problems. 99.9% of what these code paths handle is just non-sensitive, so applying some kind of "secure tag" to them is just unworkable, and they're easily used without knowing it... it only takes one ancillary library to touch your data.
If you restrict yourself to super simple things like zeroing chunks of memory and the unused stack then it still might be acceptable.
I think the target audience is different.

For people really interested in crypto there's obiously HAC [1].

For people interested in something that is updated each year: LNCS from DIMVA and RAID are quite good for understanding the problems or future problems and their solutions.

And of course phrack?

[1] http://cacr.uwaterloo.ca/hac/
> if you imagine a smoothed curve then the levelling off between $4.99 and $6.99 and subsequent drop at $7.99 suggests that $6.99 may be the current sweet spot for SongSheet’s pricing.

At 4.99 and 6.99 the income was almost the same, with 6.99 having only a small edge. However at 4.99 more people are using your application, that may improve the long term growth. Also in general for about the same income, isn't it better to have more users benefitting from your work, and a cheaper to buy application?
what you need: A completely fresh Ubuntu 14.04 machine

Bummer. I already have a server running and don't plan on paying for an extra instance just for mail. Has anyone tried this with VirtualBox or some other virtualization? Should work if the correct ports are forwarded, no?
It's amusing that you read my statements exactly backwards, but think I'm the one misunderstanding you.

You're reciting all the standard arguments in favor of "responsible disclosure". You're literally saying nothing new. I've heard it all a thousand times. It's crap.

The longer vulnerabilities are hidden, the longer users are left at the mercy of black hats, unable to protect themselves, and the less incentive there is for developers to act.

You see it even here, where the developer "acted", but only after being exposed. You even acknowledge it, but fail to reach the logical conclusion.

This scenario has played out over and over again throughout history. Corporations will never act in the best interests of anyone but themselves. The people holding them to account are not the villains.
Nah, a business that's 100% bitcoin-based with no fiat on or off-ramps will still need a money transmitter license.

For example an exchange to trade one cryptocurrency for another (bitcoin to litecoin). So even a non-fiat company can indeed be a MSB.

It's completely true to say that the IRS deems it property, not currency, and Fincen deems it a money-like product or a money-substitute. It doesn't outright call it currency though, but the implication is there.
Assembly is not really portable and error prone. I don't consider it anywhere wizardry (or hard) but corner cases are hard in C and in assembly even harder.
I agree with this, but I always used scala as a OO language mixed with FP features. I prefer OO, but many in the scala community were adamantly on the FP side (7 years ago, not sure today).

About OO: subtyping leads to semi unification which really complicated type inference. I'm beginning to think it might not be a good idea to combine FP unified features with OO semi unified features.
Bravo. I have never thought of this, and I commend you on your insight. I just want to add one more thing.

Right now, police dogs are our "Fourth Amendment experts." Cops routinely allege that the dog "hit" on a person or vehicle, and courts uphold the notion that this is alone is sufficient cause for detainment and a search. Just wait until police are equipped with "scientific biometric sensors." If your eye so much as twitches or your voice cracks or your heart beat is not "steady," that will be sufficient. Science, don't you know!

In other words, there will be absolutely no more Fourth Amendment.
Using assembly won't preclude timing attacks vulnerability, esp on x64. Nowadays beating even the C compiler performance wise is exceeding difficult with hand written assembly.
Well imagine the police arrests you because it says drugs are illegal, but the courts say they're not. But you still go to jail, because the police says it's illegal. That would be pretty strange.

Similarly, it's strange for the IRS to say you need to pay X taxes because the IRS says it's not a currency, but the courts say it is. But you still need to pay the taxes.

There are reasons for why this might make sense, sure, but it's also easy to see why some people find it strange or confusing.
Why shouldn't the compiler be able to figure out that you sum a series of numbers that aren't used anywhere else, thus don't need to be spilled to RAM?
If that was a troll sir, it was a good one. I wonder how many HNers had to clean their kitchen today ;).
I don't think this can be a language feature. It's more a platform thing: Why is keeping key material around on a stack or in extra CPU registers a security risk? It's because someone has access to the hardware you're running on. (Note that the plain-text is just as leaky as the key material. Yike!)

So stop doing that. Have a low-level system service (e.g., a hypervisor with well-defined isolation) do your crypto operations. Physically isolate the machines that need to do this, and carefully control their communication to other machines (PCI requires this for credit card processing, btw). Do end-to-end encryption of things like card numbers, at the point of entry by the user, and use short lifetime keys in environments you don't control very well.

The problem is much, much wider than a compiler extension.
While they pay so little tax, their smaller competitors that do, effectively subsidise them.
> Isn't JVM and Java libraries (i.e. "batteries") the one of the main selling points of Clojure?

Yeah, but that only appeals to the people who are already committed to the JVM (or .NET), and that is a shrinking population. There's a whole layer of complexity to deal with managed code and OOP languages and there's a bit of a impedance mismatch between a Lisp and a Java-style library and the VM itself.

For people working with native code or otherwise not in the JVM ecosystem, Clojure is not really ideal.
Good question, one that I did consider at the time. I figured that the normal weekly variation at $4.99 actually made the total a little higher than it would otherwise. i.e. I went with my gut to a certain degree. You may be right about the more users thing at the lower price point giving better growth in the long term. The interesting thing (something I glossed over in the post) was that during the experiment, the total during the week it was at $4.99 was a lot higher than the baseline before the experiment (when it was also at $4.99).
Does it at least use StartTLS by default?
People with more money than time and hacking skills can also consider the purchase of something like a Leica M8 or M9 (the M8 is actually relatively quasi-affordable-ish when purchased used) and an old lens (right now I have my grandfather's 50mm/f1.4 LTM lens, which dates from the 1960s and fits with the simplest of adapters). It's a kinda cool combination. Not quite as cool as this hackery. But cool.
Clojure isn't forking...
> It is impossible to safely implement any cryptosystem providing forward secrecy in C

What about Rust?
Python is a dynamic language and a compiler can't do much in helping you move from 2 to 3. You really need good test coverage.
Can we stop with this 'middlebrow dismissal' crap? It's a meaningless phrase that is just brought out to bludgeon people you disagree with without having to actually address their arguments. The fact that it wasn't even true in this case just shows what a worthless concept it is.
Airlines don't want you to know
Last Wayback machine snapshot is from Sep 5 2014.
Wow, I really don't understand how this man has such a following. Everything I hear about him is so petty (not to mention that everything about his blog is written to somehow conclude that Apple is some sort of god, even when the source is completely the opposite)
Go to tech meetups and small business meetups. Find good people in tech, the job offers will come second.
I'm extremely troubled that CloudFlare is taking this short-sighted stance.

The faustian choice will soon be between having no security on any platform and supporting ancient platforms. This could come at any time. It could already be too late.

Like it or not, you are a security company. You should act like it. This is not acting like it.
Once a rename register is garbage collected, it's flagged as "not ready" which is a state in which any instruction attempting to read it will block. They can only be scheduled once it's been written to.
How could you run a popular website via the upload pipe supplied by a public wifi? There's no way that's practical.
pretty handy, here's a jsonip.com clone

http://jsonip.webscript.io/
Sure, but you can use anything a currency. And being able to avoid the laws just by using something that isn't officially recognized would be rather dumb.

You might as well be using cows as a currency, it'd be no different from bitcoins.
> I always used scala as a OO language mixed with FP features

Good point! Must admit that I did not write a lot of Scala, but I always approached it from the FP side :)
Some additional books are also mentioned at this StackExchange question - https://security.stackexchange.com/questions/2013/books-abou...
If in doubt, order everything on the menu.
This is also why dedicated cryptoprocessors exist, with special features for attack resistance; I'm not completely certain about this, but I'd think the software running on those does not have to zero memory containing keys, because the whole environment that said software runs in has been secured from the outside already, and if it's possible to read any memory or run untrusted code from outside on those without being detected, then there are far bigger problems to worry about...
> the burden should be on the prosecution to prove that the NSA et al. were not involved

You can't prove a negative.
iRedMail also provides a simple web interface for user and domain management, the 400$ option is for buying the advanced UI.
Was that "Parallel construction" from the FBI to hide it's NSA source (intelligence laundering)?

https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
How is this different from intercom.io or customer.io
Its serving me the usual page with articles and all. May be its a DNS glitch during the updation process - whois records say that the domain was updated today.
Ask HN: What is the best rating system?
Bonjournal is a journaling app that helps you document and share your travels.

https://bonjourn.al

We are thinking of adding a rating system so that users can rate the places they visit. Think journaling meets Yelp / Foursquare.

Obviously no rating system is going to be perfect. Yelp uses the five star system. Foursquare uses a 10 point scale. We are leaning toward letter grades.

Why I like letter grades:

1) Precision: A, A-, A-/B+, B+
2) Less ambiguous: I have a strong understanding of what a B vs a B+ means...not so much with 6.5 vs 7 or 3.5 stars vs 4. Perhaps that is just me.
3) Widely adopted: http://en.wikipedia.org/wiki/Grading_systems_by_country

However, we're not 100% sold, and wanted to ask the HN community.

* What rating system do you prefer and why? *

Some references:

http://techcrunch.com/2009/09/22/youtube-comes-to-a-5-star-realization-its-…
http://www.quora.com/Is-there-a-better-alternative-to-the-5-star-rating-sys…
https://www.quora.com/How-reliable-is-the-100-point-scoring-system-for-choo…
> Is this a safe experiment to do at home? Is there a chance of sparking?

Even if, so what? In the very unlikely worst case scenario, you'll have to shell out $50 for a new microwave. Just stay frosty and keep your finger on the "Cancel" button :).
Unfortunately this SEO justified change has permeated the community and now people call the language "golang" instead of "Go".
Aren't we talking about giving the average high-schooler freedom to pursue a broader range of educational opportunities - sure, don't let them choose dope smoking per se as a school subject but letting them choose to engineer a bong shouldn't necessarily be frowned on provided they pursue educational aspects (production skills, design skills, engineering aspects, science aspects, etc.) and their parents sign off on it (negotiation skills right there!).

If they want to draw dickbutts then let them, but they have to use blender and do a stop-motion including some entirely virtual elements, or program a laser cutter, or write a paper on what compels adolescents towards such things, the history of dickbutt, interview a famed dickbutt drawer, etc., etc..

Want to shoot hoops in the yard all day, well OK but you have to teach this group of younger kids how to do it; write a paper on the best 3 point scorers in history including what you consider to be the things that made them great, include a review of their career earnings expressed as an expected lifetime per annum gross.

You give them freedom to decide the arena and tools to educate themselves but limit them on the details that ensure it's an educational experience. Problem with this - resources, teachers who know enough to support the particular interests of the child.
> Your argument would be far more persuasive if Google were really biting the bullet and dropping support for SHA1 even when an old browser connects.

That's certainly the plan. What did I say that suggests otherwise?
An asteroid will just miss Earth tomorrow. We won't always be so lucky
Pangrammatic performance (IO/CPU optimization)
A former Oracle employee was more direct saying Oracle’s
products were seemingly configured “by a kindergartner.”

&

An internal assessment estimated that the “Oracle Solution” was 40% custom code

Anyone know who the kindergartners were ? I believe Oracle are now in the business of sending their software development to far away sweatshops.

I'm pleased that action is being taken here - software now seems to be seen as a commodity by far too many - the craftsmanships is gone and the salesman have taken over.
It is retina as in at-least-pixel-per-arcsec.
Why don't you give 15-30 day trials?
What about a backup SMTP server?

I ran my own mail server for a year and found it incredibly stressful. Switched to runbox.com and I couldn't be much happier atm.
I'm not sure this is the scenario we're fighting. The problem is when your program (which handles sensitive data) has a flaw in it: for example, it might be possible to trick it into leaking uninitialized data (possibly out of bounds) over the wire. Another potential issue is core dumps (and maybe swapping, but that's a little different). You don't want sensitive data to be written on the disk.

Malicious programs running with your program's privileges are a different scenario altogether, and usually they can do a lot of damage. Want sensitive information out of another process? Try gdb.

But yes, it is trivial for the kernel to zero a page before handing it out.
1 screenplay, 2 directors
SEEKING WORK (remote, located in Connecticut)

Developer and designer (4+ years), work out of my own shop, HetaThemes. Our flagship theme is MidLaw, a WordPress theme for small to mid-sized law firms.

Primarily develop, design, and customize WordPress themes, or convert PSD designs or HTML/CSS/jQuery to WordPress. I'm also building an app and run my own server as a hobby.

I've worked on complex sites for digital agencies (30+ templates, 25+ plugins), as well as on smaller sites for small businesses/individuals (10 templates, 10 plugins). References available.

Technologies I use: PHP, HTML, CSS/LESS, jQuery, CodeIgniter, WordPress, mySQL, ZURB Foundation (3/4/5), Bootstrap, SVN or Git for version control, Fogbugz or Sifter for issue tracking, HipChat to keep in touch with clients. Self-taught and resourceful.

Reach out to me at: hn [at] heta [dot] co (not com). I can send you links to live sites I've designed and developed, sites I've converted to WP, etc.

Thanks for your consideration.
Rust was originally written in OCaml, and then ported to Rust once things were working well enough.
For AESNI, you probably are already using some sort of assembly to call the instructions. In the same assembly, you could wipe the key and plaintext as the last step.

For the stack, if you can guess how large the function's stack allocation can be (shouldn't be too hard for most functions), you could after returning from it call a separate assembly function which allocates a larger stack frame and wipes it (don't forget about the redzone too!). IIRC, openssl tries to do that, using an horrible-looking piece of voodoo code.

For the registers, the same stack-wiping function could also zero all the ones the ABI says a called function can overwrite. The others, if used at all by the cryptographic function, have already been restored before returning to the caller.

Yes, it's not completely portable due to the tiny amount of assembly; but the usefulness of portable code comes not from it being 100% portable, but from reducing the amount of machine- and compiler-specific code to a minimum. Write one stack- and register-wipe function in assembly, one "memset and I mean it" function using either inline assembly or a separate assembly file, and the rest of your code doesn't have to change at all when porting to a new system.
Thanks for the runbox.com mention. That looks like just what I need for my server.
The very nature of the S&P 500 would exclude it from such a comparison. VC funds are targeting startups not established entities. To make the S&P 500 list you have already achieved a significant balance sheet through years of tweaking /improving.

The return comparison is unequal.

A better barometer would be cash on cash returns but with vc funds that may be difficult to track.
Fair enough. I am somewhat curious as to what "it" you plan on making better. Also curious as to why this fork "isn't the kind of fork that hopes eventually to be folded back into the original." That, specifically, just reads bitterly.

Also, sadly, at the moment none of this is any real input to any utility I control. I have used Scala in the past. I tried setting my plans with Lift, but that didn't go over well with my coworkers. So, as of now, I am merely on the sidelines. And, do note that I am not trying to demand you not do this. Just saying from my vantage point, I'm not at all clear on what this is improving.
Modern Operating Systems - The classic dinosaur book from Tanenbaum.

Wrong.

The dinosaur book is written by Silberschatz, Galvin and Gagne and is called "Operating System Concepts"
You're assuming that weev actually ended up in prison for CFAA violations instead of acting like a dick in court.
Many modern high-level languages use some kind of VM (most notably Clojure and V8). This is a means to provide a JIT, do runtime optimizations, and garbage collection. AOT means that you don't have a chance to do anything about the generated code at runtime. That said, the startup time of a monster like JVM is definitely problematic; the approach I'm taking is a thin VM.
Multi language site with 2 Jekyll plugins
Sure you are. When speaking internally people set up a "mirror" of themselves, speaking as if to another person (despite any internal pronoun use like "I").

If someone yells something in the forest, they are speaking to, variously, a personification of nature, the world, a god, themselves (as described above), or perhaps more literally an imagined companion.

Expression is not about the effect but the intent, even if it's subconscious.
Why would users need to store all old mail on server? You can auto archive it or simply delete about 95% of mail which you won't ever need later again.
The Motherhood Penalty vs. The Fatherhood Bonus
> Does anyone have an opinion on this? I'm a firm believer people can change and while this might not be Bill Gates changing, it might simply be him "atoning for his sins" so to speak, not that I'm religious, nor that he is either I think.

My candidate explanation, Melinda.
You should've said:

> I find your lack of trust disturbing.
A lengthy hardening effort and well-known flaws to compensate for does not sound at all like a secure platform to me.
The neural architectures change so a set of parameters for one network won't run on another. Image size changes too which changes the nn behind it.
There is not much work on mapping one set of parameters onto another. Transfer learning might have a little applicability. But unlikely at the needing edge of vision research.

Worth noting a neural network IS a general purpose function encoding.
Job One for a Startup CEO: Personally Welcome New Customers
I was looking for this sentiment before I made my own post.

There is absolutely no reason to think the FBI did their work the difficult-but-legal way when they already get rich feeds from NSA. This is parallel construction all the way. I hope the defense figures out how to make a giant stink about that.
I always valued HN over reddit. Obviously I'm wrong.
Yeah... well summarised. I kind of enjoyed the article, but while reading it I kept thinking, "This isn't really the reason..."
If I wanted to read CPU registers from the outside, there's an easy way: JTAG. You should be able to halt the CPU, read (and modify!) the registers, and resume the CPU.

That should be possible even on x86, though on x86 the relevant documentation is probably hard to find. For some ARM processors, it should be as easy as installing openocd.

Of course, JTAG requires physical access to plug the debugging cable, which puts it in a different category of attack.
aside: I was going to refer the goodfilms blog post[1] but decided to check quora first (I've stopped using it because of their login/read only first answer) and there it was! (and it appears that quora has removed the gating)

Also, can you make your references clickable?

[1] http://goodfil.ms/blog/posts/2011/10/07/a-better-way-to-rate...
Posts like this make me just more convinced about that C combines the worst of "portability" and "assembly" into "portable assembly".
REVIEW: Google Domains – Good Bye GoDaddy, Good Riddance
They should be obligated to testify to the truth under oath. It's not proof but gets their position into court records.
Please elaborate or link to more on this. I haven't heard this perspective before.
Ask HN: How do you invest?