skysight-inc/HackerNews huggingface dataset:
You might as well be using cows as a currency, it'd be no different from bitcoins.

Characteristics are much more important than arbitrary definitions because what we want to call something is mostly subjective, characteristics aren't so much. i.e. a fork can be called a utensil or a weapon, but its characteristics are the same: sharp, pointy, rigid etc.

For example, you could say 'anything is a weapon', and thereby we're not allowed to bring clothing on to an airplane, because someone could use a tshirt to strangle a person. That would be completely true, and there certainly will have been people who've been strangled by a tshirt in the past 20 years. But that doesn't mean we should ban it and call it a weapon, because it doesn't have the characteristics or use of a weapon ordinarily and is barely a weapon.

Same for cows. Yes you could use it as a currency, but it doesn't have the characteristics of a currency (fungible? no, divisible? no, portable? no, long term store of value? no, precise unit of account? no) while bitcoins are divisible (up to 100 millionth of a bitcoin), portable (obviously), precise unit of account (yes), store of value (possibly, in my opinion probably but time will have to tell). So indeed cows are treated very differently for the right reasons, as it's not a good form of money and thereby isn't used as money generally. If cows had good characteristics as money, it'd be used a lot, and we'd see people try to use cows to launder money on a massive scale naturally (because any legal money will be used illegally too, and that must find its way back into the system at some point), and then you'd see money transmission laws include cows as a 'money-substitute' just like bitcoin. But they aren't, because they aren't actually a money-substitute, because cows suck as money.

Sure, but you can use anything a currency. And being able to avoid the laws just by using something that isn't officially recognized would be rather dumb.

I agree which is why US institutions have moved to officially recognize bitcoin as a certain thing, so the laws that apply to those things apply to bitcoin, too. For the IRS that's taxation law on property, for Fincen that's money-like products.
Nothing really is going on. The Typelevel "fork" of Scala would better be called an extension or an experimental playground. They have broadly the same goal as Odersky for Scala but want to get there faster. They intend to remain compatible with Typesafe's compiler and Typesafe intend to merge their changes back.

Paul's fork is him exploring some ideas and not intended for widespread use. To quote the README:

"It's still in development, in every imaginable sense. I would prefer not to publish code in this condition ... However since typelevel has also forked the scala compiler, publishing now and giving them an opportunity to exploit my work seems the lesser evil."
That's helpful but the argument will always be that you just need to pick one of those four or that Kauffman are bad pickers of funds and therefore exclude many of the best from their allocation.
Also, this is front-end only, why do we need ssl?

Not the author, but you still need secure transmission of the JS code, otherwise a MITM could send a modified version that sent your stored data to their servers.
That's odd. I wonder why the qemu on the other end is resetting the GDB connection.
I really like this theory. I guess it turns out that once you put into perspective what part of the world Microsoft affected, it really is fundamentally outweighed by the good the Gates Foundation is doing.
That's great, thanks. Unfortunately it doesn't have much post 2001 data on many big name VC funds like Sequoia/Accel/KPCB.

Reuters couldn't get these via Calpers after suing.

http://www.reuters.com/article/2013/12/20/us-funds-californi...
Google sheets. Use the templates.
It is not front-end only, the invoices are generated server side.

t.$.ajax({
url: o + "invoice/generate/",
type: "POST",
Agreed. Their lacking graphics hardware (and drivers) are probably the main reason why they focus on boutiques, bingo machines and other coin-ops.

No clue if they improved their graphics as well for this iteration.

They really should have acquired (or be acquired by) a vendor of decent embedded graphics (Imagination or Qualcomm?), but at this point there's very little chance of that still happening. They already sold S3 to the closely linked HTC I believe.
You can't look at SHA-1, SHA-2, and SHA-3 as successive "versions" of hash functions. They're distinct things. SHA-3 isn't so much "better" than SHA-2 as it is "different". It has some practical improvements, but those improvements aren't relevant to the certificate use case.

So far as we know, there is no timeline for the deprecation of SHA-2. In fact, most people are better off right now using SHA-2 than SHA-3.
All research are "on average" and given a set of conditions.
So, shouting "anecdata!" is not a as strong as it sounds. There are many circumstances to consider.

[Disclaimer: I am person who regrets not "just doing it" while waiting for better times - and motivation for a particular project evaporates in years.]
how are you generating the pdf? client side as well?
This and the fact that there is a backend service that handles the work of generating the PDFs are the reasons why I wanted SSL (though I am looking into moving the PDF generation to be completely client-side).
Isn't there a major PRNG state issue with freezing and reusing snapshots?
Marc Newson Joining Apple
I like how Amazon does it, with stars and comments. That way you can look at the stars given and then add in the grain of salt by the quality of the associated comment.
Show HN: John Carmack News (Android App)
Hello everybody.

I've developed an Android application called "John Carmack News" [1] that aggregates news about John from different sources.

I've developed it because I couldn't find a similar application on Google Play.

Do you guys have any suggestions?

[1]: https://play.google.com/store/apps/details?id=com.vsoftgames.johncarmacknews
I built stats-tools for use in place of awk for basic statistics.

https://github.com/jweslley/stats-tools
"Stalkers typically use their own computer and do so through a variety of layers of deception".
In this specific case, the stalker is in Egypt and there is a very high chance he is using a "cybercafe" to access the internet rather than his personal PC/Internet connection.
It's not my project, let's hope the developer is a HN user so that he can anwer your as well as others' questions :)
> trusted keys

The problem with Web-of-Trust is that once you try to roll it out mainstream, most people will just click "accept" or "I trust this key" without thinking about it. Instead of "signature-rings from spammers" you would have spammers duping less-aware real people into trusting their keys.

That said, it would seem to be a longer feedback loop to get a number of actual people to open emails and trust their keys.
I wish I could, as the son of two public school teachers, the husband of a public school teacher, and the father of a 1 month old who is already trying to figure out how to keep my kid out of public schools and away from the Common Core, upvote this 1000 times.
There's a Scala-based backend service that generates the PDFs based on the data it receives from the client (I am planning on transitioning to something like[1] for this purpose in the future, however). The PDFs are garbage-collected within 10 minutes of when they are created.

1: http://parall.ax/products/jspdf
This. Most people don't understand the difference between the two. You can have all the bandwidth in the world, but if your latency is high, browsing around the interwebs will still feel pokey.
Likely but it doesn't take a trained compliance officer to not do the things Shrem did choose to do.

Look I'm not against drugs (born & raised in Amsterdam, never used but understanding of it) and Silk Road was mostly a voluntary marketplace without victims that reduced violence and crime involved with drugs being sold at night illegally on every streetcorner instead of anonymously online. It's a product of a system that ignores research and examples (like my country) that legalized markets provide more oversight, opportunity for regulation, for consumer safety, usage-limits, child-free zones etc, than a completely illegal unregulated market. And all Shrem did was enable people to participate in this market (which a priori is not illegal, as it traded baseball caps and hamburgers, too, Shrem was agnostic about what the bitcoins were used for, and did not even sell them to Silk Road users, but to someone who resold them to Silk Road users).

So I'm not against Shrem. BUT, he broke laws. And he did it knowingly and willingly. All the emails released by the court show he sent emails telling this guy of whom he knew was selling on the SR, to use different email addresses so that he wouldn't have to ban him (as his cofounder didn't like it), limit bank deposits to X amount per time (so that he wouldn't have to file a report to Fincen) etc etc. And then he didn't report anything even though in the emails he spoke of the need to do these reports, and told his cofounder of this responsibility. He literally instructed a customer how to avoid and evade the law over email secretly from his co-founder, and then chose not to do the due diligence he's legally required to do in terms of reporting large orders, despite communicating he was aware of this duty.

My point is, had nothing to do with being under staffed or having too little money to hire competence. Every 15 year old could have not made these mistakes. (if that is even true, they raised quite a bit of money and generated significant revenues very quickly, too)

Still, got nothing against the guy. The whole case is rooted on a non-sense drug policy.
I don't have a family, and I wouldn't even dream of going indie with revenue like that, and my side revenue is about 3x+ that.

Until I'm clearing 10k/month, quitting isn't even a remote possibility. It would probably even need to be more with health insurance and self employment tax to consider.

Edit: I wish you the best of luck. Maybe I just lack the stomach for betting on something that isn't a sure bet.
A few examples:

"Remote Timing Attacks are Practical" https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf

"RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis" http://www.tau.ac.il/~tromer/acoustic/
Turns out there is already a class 1 SHA-2 intermediate! It's just buried on their site, but you can add it to your chain and it passes SSLLabs validation and otherwise looks totally fine. So this isn't as huge a problem as I had thought.

https://www.startssl.com/certs/class1/sha2/pem/sub.class1.se...
I'm doing an android port of my app right now. Very little code (aside from functional code) is re-usable. The view model is incredibly different.

In a few cases, it's a lot better. In most cases, it's significantly worse. It just seems to take longer to do everything.
1st Week of September
This is really good. With the boring, generic, exact-match domain you've given it I was expecting something spammy. Is your aim to go after the SEO benefits or would you consider renaming it to something a bit more characteristic?
I'm curious how the parent post has positive points, while this post has been downvoted.

The reality of "spot the vegetarian/vegan" complaints are usually due to disagreement with vegetarianism/veganism. This is much the same way that people that complain about gay people "announcing themselves" is due to either disagreeing with homosexuality, or just plain being uncomfortable with the idea that it exists.
One could conceivably provide a Redis backend for Riak, if one were so inclined.
Want to understand the secret of Vice’s success? Wait and watch
Depends what's the Beta of PE/VC vs the S&P 500 / FTSE 100.

And blindly tracking major indexs means you are highly invested in a smallish number of stocks in the same area in this example investing in the big indexes means you will have take all the losses with the bank crashes - instead of a share/fund that got out or banks when it looked to toppy.
May I ask what version of qemu are you using?
Thanks for pointing that out! I've updated it to use ₹ instead.
I sorta cleaned up the giant if tree there. It was on my todo list :)
interesting, thanks for the info. i just finished up a similar project and had tough time with jspdf, ended up using http://pdfmake.org/#/.
This makes perfect sense. When computers were a novelty, allowing them would make an establishment seem to be on the vanguard of fashion. Now that computers and tablets are ubiquitous, it's the other way around -- people probably appreciate a break from the devices that are everywhere else.
> terminate and persist executable

I believe those are called Terminate and Stay Resident programs (TSRs).

> The VNC server is a complete fudge though, however I could not figure out a easy way to hook the keyboard interrupt fromGDB

How about pushing events into the circular BIOS keyboard queue at 40:1A?
not like that:
Not exactly like that:
I didn't mean simple that way, more like hash alike. The 1st example is not optimal but shows the idea.

I disagree about "pointlessCopy". Of course it's permitted by the standard but it's not an optimization. Using such a broken compiler is beyond help.

-------
volatileVar *= random();
for (int i=0;i<len;i++){
volatileVar+=buf[random()%len]+0x61c88647;
buf[i]=volatileVar;
}
=====
static volatile uint volitileVar;

for (int i=0; i<len; i++){
sensitiveBuffer[i]=random();
}

for (int i=0; i<len; i++){
volitileVar+=sensitiveBuffer[volatileVar%len];
}
You like building things. Okay, I'll run with that, understanding that I don't know you well and will get the specifics wrong. Just trying to kick start your thinking.

First, there is product design. That is not just 'make this font look pretty', it is doing things like figuring out sane workflows for your user, watching them use the product and figuring out elegant solutions to the points where they get stuck or frustrated. It's conversations with the engineers - your design might eat batteries, or render poorly on device X, or.... There is coming up with the product idea, presenting it to investors (who could just be the VP in the company you work for, there is plenty of chances for creativity w/o starting your own company). There is product management, project management. There is the whole personnel side of things. It's not just 'fill out this form for the yearly review' - a good manager has a mental model of their employees, and guides them through constant improvement. She also makes it possible for that employee to do their job by removing everything extraneous to that job.

I'm just saying HN can give you a skewed perspective. I have solely invented a few different products while working for large companies and had my companies decide to adopt them. The only two things missing was the payoff at the end, and the stress filled nights (am I going to make payroll? John just bought a new house). For me that is a great tradeoff. For others, I can't say.

And I'll say this. People like Jony Ive didn't become great by running off and doing their own things alone. It's a path to do that, to be sure. But he spent years grinding at a growing company. His story is different than yours, I'm not trying to say there is an equivalence. But you have to work really, really hard, for years, for your ideas and designs to be worthy of the world, to be better than the competition. He became great by years of grinding, and his work was made sellable by daily, relentless meetings where every decision was torn apart by other brilliant people (say what you want about Jobs, he knew how to get great work out of designers).
Crowdfunding 101: Kickstarter vs. Indiegogo (infographic)
This is beautiful and exciting. Do you plan to share the source code in github ? I would love to contribute.
That's bullshit.

DMVs printing RealIDs right now use high-end Fargos or Zebras, all under <$5000. The main detail these offer is multi-sided dye-sublimation and the ability to use a UV ribbon. "Microprinting" is a joke when you, as a consumer, can buy the exact same equipment that governments use.

The most difficult security feature they utilize at the moment is a multi-spectrum visible hologram, something you cannot actually produce in a small-scale.

Fortunately, you may order RealID state multi-spectrum holograms for around ~30 states from China and India on the cheap (~$1/ea shipped), and they're not visibly different under a loop.
You are argue that php is better then than using ruby or javascript. Now I could perhaps weight in on that somewhat dubious claim but I'd much rather ask why are you restricting the pool to php, ruby, and javascript?

Why not Python, or Go, or even Haskell? There are many languages other than the three you mention which have much better reputations for secure web programming.

You likely got downvoted because you presented a false choice to back up your argument.
Thanks!

My goal with the domain name was to have it be extremely easy to remember (and descriptive!).
I made one as well [0] for my own invoices as a contractor in the UK which I made to try out Typescript.

I just went the way of using the print to pdf feature of the browser rather than generating the PDF myself (and no need for any server side things this way!), works well enough for my case.

Code is on github: https://github.com/Keats/invoicer

[0]: http://vincent.is/working-on/invoicing/
That's what I mean actually getting it consistent is hard as the performance is really hard to predict and may change even with CPU stepping. Even then it requires very solid planning as well.
“For a programmer, the cost of attending a meeting is always higher.”

I would have extended this sentence to include just about all aspects of IT that require intense concentration and research. I don't do as much programming anymore but it's been replaced with a lot of work in sql server.

Meetings for me, are the bane of my existence. People very rarely adhere to the agreed upon time and even if they do, there is prep required for each meeting (if a meeting agenda goes out) and some followup (A/Rs).
Doesn't actually seem true. OK, running the decrypt leaves the key and data in SSE registers that are rarely used where it might be looked up later by attackers. There isn't any portable way to explicitly clear the registers. Then why not just run the decrypt again with nonsense inputs when you are done to leave junk in there instead? Yes, inefficient, but a clear counter example. You could then work on just doing enough of the nonsense step to overwrite the registers.
The problem with these american HC documentaries is that they are employ certain stylistic means which make them impossible to watch for me.
Yes but no. All you would have had was a captcha image, you have no way of knowing it was the Silk Road captcha image. If you scan the internet, you will find millions of captcha images.

The FBI went the other way: they had the SR login page with an an unknown non-TOR IP address and asked "what is at this IP address?" Since it was a captcha image, and captcha images have to be sourced by the web site that is doing the captcha verification, it strongly implied the IP address was the SR server. As it turned out, it was.

As a co-worker said, "When you live in an egg shell, small cracks are deadly."
Newfound Asteroid Will Come 10x Closer to Our Planet Than the Moon on Sunday
>> discussing what OO pattern should be used

If there are teams sitting around discussing patterns then they aren't focused on what they should be in the first place. They should be focusing incessantly on implementing the requirements to meet the needs of the business and ultimately the customers.

5 decades of code was written and a lot of it still in production before the GoF (Gang of Four) got together to write down their musings.

Most of the patterns I've studied are so abstract as to be completely useless in applying to the art of implementing the requirements to meet the needs of the business and ultimately the customers.
Pet peeve: for ambiguous currency signs, the currency code must always be clearly mentioned on the invoice.

I hate it when I buy from companies in the US and they just write their prices as $.

Then my accountant doesn't know if that invoice was in USD or HKD. There are dozens of countries that use the $ as their currency symbol.

At least mention the currency code somewhere, please.
Neat! Didn't know about the 40:1A location. I'll add that in and hopefully get rid of the VNC server need (that way I can also use gPXE's GDB server and make this SSH'ize real boxes
"Compared to Perl 6, the Python 3 development process was perfection."

Comparing to a series of "Apocalypses" (the term used early in perl6 development to refer to radical breaking changes) is not great evidence that python3 is non-disasterous.

Do you really think python3 being 6 years in limbo (and counting) is a good thing? Probably not fatal, but I don't see how it's good.
This is excellent: opinionated and correct.

Guess what happens if you try to git revert a merge? Yeah. Don’t do that.

You can, but you really need to understand what happens when you do so, so that you're not confused by future merges from the same branch. Straight from the horse's mouth:

https://www.kernel.org/pub/software/scm/git/docs/howto/rever...
That's just a workaround though. It still does not invalidate the basic thrust "I can't write code to handle keys in C and be sure I have not left copies anywhere"

The proposal seems goods
Any other long-term experience with runbox.com?
> Then why not just run the decrypt again with nonsense inputs when you are done to leave junk in there instead?

Because the compiler is perfectly within its rights to optimize that out!
I wrote a little about the guts of the Rust compiler earlier this year. Shouldn't be too out of date, should get you pointed in the right direction if you're interested in the details:

http://tomlee.co/2014/04/03/a-more-detailed-tour-of-the-rust...

At the time of writing, Rust would use LLVM to generate object files from LLVM IR, then link 'em together using the system's C compiler.
The preferred way is to use Tails on a dvd since the entire point of a privacy live dvd is not to leave local evidence and run it in memory only.

A separate $40 ARM box, running some kind of open firewall software (openbsd, m0n0wall, pfsense) that blocks all outgoing traffic that isn't tor is also preferred than trusting say, Virtualbox NAT, which likely leaks host IP to the guest and your VM state to the host.

A bonus to having a dedicated system for whatever secret squirrel things you're doing is it's a physical barrier protecting you from yourself, like when Sabu accidentally logged into IRC in the clear. It's also a good idea to build your own Tails source and hardcode a gigantic password into the startup scripts. This is the "I'm too drunk to be doing this" protection should you ever be faced off your ass and think it's a great idea to go on IRC and taunt the feds or check your sales PMs for the booters and carberp mods you're peddling on not_legaL_hax4sale.ru forums. After 10 tries and failing you'll either pass out or hulk smash the box either way you will not wake up in jail.
Is it possible to specify both a RSA-SHA1 cert and a RSA-SHA256 cert that way, or would it have to be RSA-SHA1 and ECDH-SHA256?

Apache/OpenSSL would have to assume that pre-TLSv1.2 clients support only SHA1 because there's no signature_algorithms extension, but for TLSv1.2 clients can Apache/OpenSSL choose between a RSA-SHA1 cert and a RSA-SHA256 cert?

The reason I ask is because ECDH certs seem to be even harder to come by than RSA-SHA256 certs right now.