skysight-inc/HackerNews huggingface dataset:
>>illegally crossing a border will get you detained or fired at in almost any place now and ever,

Leaving a border will generally not make soldiers shoot at you from the country you leave.

Being that locked in only happens to slaves and other prisoners.

And I think you know that.

>>Regarding renowned Wikipedia researchers

(I already noted that you learn differently in your schools, like most all other countries with recent atrocities in their history.)

Sorry, if you argue against wikipedia without even looking at research references I can't take you seriously.

I didn't read the rest.
Ask HN: What are the odds for shellshock exploits in 3G radio networks via RF?
assuming (actually I know) lot of the radio network controllers (RNC) and 4G eNodeB which receive the signal from the tower using bash, so what are the odds of injecting code into the network leading to remote execution with shellshock?
Sure, but how many people genuinely have data that big?
Well... He probably has the crappiest job on the planet...
A 6 letter alphanumeric password, do they think people use old laptops to generate the possible passwords?! It should be at least 128 or 256 if they're being serious about security and preferably much much longer than that.
> Breaking the code, according to an Apple technical guide, could take “more than 5 1/2 years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.” (Computer security experts question that figure, because Apple does not fully realize how quickly the N.S.A. supercomputers can crack codes.)

Uh, what? Surely the journalist has missed an important technical detail here, right?

https://www.grc.com/haystack.htm
... but that usually doesn't mean you have to have your full data set in memory, only the hot parts. And even if so, one or two ~10 ms seeks during a query aren't that terrible.
Any word on if/when Linode may schedule reboots?
Just as an additional data point: I've heard something in that vein attributed to Durkheim, multiple times. Unfortunately, I do not know the source, and a cursory search doesn't turn anything up.
So here is a fun fact about professor performance. When I was a grad student, various calculus classes had a shared final. We had some professors with great evaluations who devoted their life to teaching. We had some Germans and Chinese who students perceived to barely speak English [1] and hated. Student evals were fairly predictable - hard exams would reduce scores, jokes and sympathy would increase them.

Everyone's students followed the exact same normal curve.

I've been told that the only way one can make an observable difference in group final scores is to schedule a class at the same time as sports practice or remedial education. You need better students, not a better teacher.

[1] I've noticed that either students are unable/unwilling to listen to a foreign accent, or perhaps I am unable to notice them. Recently a friend of mine said my secretary had a heavy accent - I barely notice it.
So how many programming languages besides LISP are powerful enough to support turning Protocol Buffers into code during compilation? And is this the ultimate must have?
Firefox@Ubuntu14. I think it works as intended by the designer it just irritates me that some images will stand still while scrolling.
Only if it enhances the poetic value.
This makes me extraordinarily happy, perhaps this is the first major step in the struggle against government spying on innocent citizens?

On another note, is anyone disturbed by how even the idea of people being able to store their private data securely being seen as inherently criminal by high level officials? What does that say about these people in power, they literally view your right to privacy as dangerous. Sickening.
«Michael Jacobson, executive director for the Center for Science in the Public Interest, says that while Hari sometimes “hyperventilates” about small risks in food, she is helpful on balance.

‘Populist Voice’

“Going after food dyes is worth doing and she brings a populist voice to the table,” he said. Internet-savvy food activists “do nudge companies to change their practices, often for the better.”»

In any industry, many of the experts are inherently bought off, and it's helpful to have everyday individuals develop an interest in diverse topics that affect them.
Ask HN: What do you use for BDD in Python?
Python has several solutions for Behavior Driven Development such as Lettuce, Behave, Pytest-BDD, PyVows, Freshen, and probably others I haven't heard of yet.

What are you using, what are your testing with it, and what makes it better for that purpose than the alternatives?
Sure, you could. But CouchDB just makes that very easy to do while it is very hard and hacky in PG. On the flip side, the use case did not require the guarantees that PG has to offer, so why go through the pain for no gain :)
I don't have any data on this, but anecdotal evidence suggests that the average knowledge worker works 4 hours per days. So even if you're right, they're still doing 2x. When I have a programming/computer task a typical day for me is 8:30 am - 10:30 during weekdays. I work from home so there is no commute time and I usually quickly eat at my desk. If I have meetings and a lot of multi-tasking then that eats into my productivity because there's always task switching inertia.
Big banks still use it.
Current experience indicates however that such end-product testing gives you no real advantage to finding out where the problem is occurring, since yeah, you can only test the whole thing at once.

I’m not so sure. I’ve worked on some projects with that kind of test strategy and been impressed by how well it can work in practice.

This is partly because introducing a bug rarely breaks only one test. Usually, it breaks a set of related tests all at once, and often you can quickly identify the common factor.

The results don’t conveniently point you to the exact function that is broken, which is a disadvantage over lower level unit tests. However, I found that was not as significant a problem in reality as it might appear to be, for two reasons.

Firstly, the next thing you’re going to do is probably to use source control to check what changed recently in the area you’ve identified. Surprisingly often that immediately reveals the exact code that introduced a regression.

Secondly, but not unrelated in practice, high level functional testing doesn’t require you to adapt your coding style to accommodate testing as much as low level unit testing does. When your code is organised around doing its job and you aren’t forced to keep everything very loosely coupled just to support testing, it can be easier to walk through it (possibly in a debugger running a test that you know fails) to explore the problem.
Since the phrase "big data" appeared.
Not until 9.5 at the earliest.

http://www.postgresql.org/message-id/534C4225.6020600@agliod...
Then how for they stop free riders?
To be clear, 2 litres per day is the amount of water you are supposed to consume, including all the water in your food. Obviously anyone working out is going to need more to compensate for sweating.

Anyone drinking 2 or more litres of soft drink per day is going to need a lot of dentistry, for starters.
Buffer app metrics
I propose we create a new convention, "humans.txt", which states in a plain, simple manner what parts of a system one can access and how. This is placed in the web root alongside robots.txt .

This would be a closed-by-default system; it says you can use the shopping cart functionality for yourself. Thus, if you use CSRF to use the shopping cart functionality "for" someone else, you are breaking the law unambiguously.
Usually the wife cashes the husbands pay check and gives the him an allowance, while she manages the household budget.
> There's an obvious bias here.

It's good that this was posted to a programming community, then. So that it can balance that bias out with its own "less languages are good because it is more immediately practical, who needs multiple languages anyway?"-bias.
Notice, Cuba is top on geo scale of interest in Javascript, Php and Python. Can we attribute this to Eric Schmidts meddling in that region?
https://forum.linode.com/viewtopic.php?p=64914#p64914
Your proposed test for bias would be reasonable for a traditional school, but although the linked post focuses on how Hacker School has fared in regard to gender diversity, Hacker School stands out more for its diversity of programming skills and skill levels, from near-beginners to CS PhDs, as part of the goal of maximizing how much the students can learn from each other. You're overlooking this important part: "We accept every person who applies who we believe we’re a good fit for and who would benefit from and contribute to Hacker School." This is of course ultimately a subjective standard, and any serious attempt to evaluate their success in meeting it is bound to be highly subjective as well. You might think that focusing less on raw programming ability would be an excuse for bias, but from what I saw in the batch I attended last year they achieved a very healthy balance along those dimensions for both men and women. It's to the facilitators' credit that if you removed either all the men or all the women from my batch, it would still be the most well-rounded group of programmers I've ever worked with, which again is admittedly subjective, but even as a white male as prone to statistical nitpicking as you are, I can't think of a better way to judge that they really do admit men and women, as individuals, in a way that aligns with their more holistic objectives for HS as a community of individuals.
Well one thing we store is HTML content and "MS Word" like document data. We also store hundreds of revisions for all of those documents. I wouldn't want to use an RDMBS for this because (a) its not relational, but also (b) backup/replication/load distribution would be too painful. A system like CouchDB can be spread out over n-machines, any of them write-capable.
Links to the Python BDD packages I am aware of, if you want to check them out:

* Lettuce: http://lettuce.it/

* Behave: https://pythonhosted.org/behave/

* Pytest-BDD: https://github.com/olegpidsadnyi/pytest-bdd

* PyVows: http://heynemann.github.io/pyvows/

* Freshen: https://github.com/rlisagor/freshen
Still relevant in terms of comparison between languages. Surprisingly Perl and Ruby are missing. These terms along with "Python" and "Java" are also words with other significant meanings though. But adding Golang and Haskell shows that one should not put too much into this.
> California, America's "salad bowl", is facing a drought that threatens to turn it into a dust bowl.

Then how about it stops trying to grow rice in semi-deserts? That's probably much more of a problem in that regard than some already-produced food being thrown away.
Hi. "Worth" should be "worse".
My grand parents lived through the second world war and food shortage was a big issue during and after the war. That's why my parents and grand parents always taught my siblings and I to respect food and avoid any waste.

I believe that's very common among people my age (40) in Europe. I wonder if that's just less true of Americans and younger Europeans because hard times are further away from them.
Sure, I couldn't get away with that in a AAA game. But you can still have separation of physics, game logic, networking, and drawing. Honestly my previous attempts at fancy architecture encouraged more intermingling of those than my simpler approaches (which is not to say that there aren't strategies that get the best of both, just that they're either hard to design or hard to use correctly for a beginner/amateur).
Where in the CGI spec does it say anybody has to eval anything?
This is great, as it really lowers the barrier of entering Julia.

It also offers a level of exploration (with the in-place results), which is a neat thing for students – I've found that interactive environments generate interesting solutions to otherwise boring problems. I'm currently trying to replace Matlab as the language I use in our university's Probability class and Juno adds to "why use Julia" argument :)

Thanks!
Is it possible to brute force this? Using quantum computers?
Yes. Don't use shell for data transmission. Use a socket. Apache had that choice, knew bash was insecure (as everyone did in the 90s, that's why across can't be setuid), and didn't exercise the right option.
Great product. Nice to see Howie start another startup (Remember Etacts?)
I hadn't realized hardware division was that slow, yow.

I suppose that part of this is that we now have 64-bit operations everywhere - the length of the critical path for a 64-bit divide is absurd.
Access is great as a personal, single-user database, but how much software has been written to expand it past that limitation in small businesses? Also, Access isn't available for Mac. And Access doesn't run on your iPhone/iPad. I don't entirely disagree with your comment, but I do think there's room and demand in the market for something like AirTable.

I've personally been dabbling with similar idea for years. Guess I should have invested my time and money in getting it to market.
Why does it have to involve people who don't have money? How about not producing the food in the first place through better logistic? That could potentially be a huge saving for rich people.
How is this any different from SQL injection? Input from the world must be sanitized. All we're doing is increasing the scope of the word input - ALL input from the world must be sanitized.
Nowhere. Apache should have used a socket rather than the shell (which effectively evaluates data as instructions). People knew shell was insecure in the 90s, and there were malicious users back then too.

I think environment variables were used either due to naivity or an ultimately mistaken concept of simplicity.

Sunning up the entire thread: Apache should have used a socket, and should have known they needed to.
Environment variables are not supposed to be "evaling options in transit". They are a decent method for passing small amount of data to a program you start.
Spokane considers testing sewage to gather data on residents' marijuana use
Prediksi-skor-fc-koln-vs-bayern-munchen
Given the wait and see approach taken by Go maintainers on generics/templates I think there may be an opportunity for a template based pre-processor scheme (not using go generate since that works on go files). This approach would be the C++ approach - i.e., templates not generics.

The template could be in, say for Vectors, a Vector.got file.
In your go code (also a .got file - say my.got for example) you reference Vector<SomeType>. Some build system+pre-processor parses .got files and creates a Vector_SomeType.go file. A corresponding my.go file is also generated from my.got with all template references flattened to real types.

All *.go files are compiled using the regular go build chain to create the final application. Any missing types would be identified by the go compiler.

make could be used to drive the process, but the got2go translator application is the missing piece. Is it better than generics inside the language - no. It is very loose in terms of type safety as we are just performing text substitutions but it could save a lot of typing. We could also come to rely on a semi official/community approved repository of core collection .got files. The C++ STL implementations may serve as an inspiration for the API of core template code.
There's also PeerLibrary.

What would be most interesting out of all this is a viable open annotation protocol, and an infinite number of federated sites that use it.
There could be truth in that number depending on what encryption algorithms are used. Some take significantly longer than others to apply.

On a tangent, I trust Apple's competence but I have seen no information on the technicalities of this feature. I would like to hear specifics so we can estimate how secure the design is based on facts.
A shell certainly is not supposed to evaluate random environment variables.
Locking out intrusion is a huge value proposal for cellular manufacturers. I wonder why encrypted conversations are not already norm.
What I meant was a data-size that was too large for a machine. Adding arbitrarily large JSON to your table could expand the data-size to be too big for one machine, or even too big for block storage. Plus you might not want it all in block storage. My point is that an RDBMS can be better served storing the relational data alone with a separate DB Engine for the potentially massive JSON data.
It's not. It's the "calling out" part that is wrong.

You should never call out to anything by passing untrusted user input directly. Any information that came from the outside must be explicitly passed as data through proper serialization mechanisms.

For instance, you don't piece your SQL queries by concatenating strings. You use an abstraction layers, in which you code the query structure and you pass user input as data. There is this extra step of saying "this is data, not code" that strips the external input from executability.

(for the same reasons, if your templating engine is just concatenating strings and not building the page out of trees, you're doing it wrong, but it's a topic for another day)

It's a problem you get when you believe in "the Unix way" a bit too much. Yes, everything is text, but no, not everything has the same semantics.
I've never had cider or the old nrepl.el crash or freeze on me, they've always worked fine. I develop on Mac OSX and Linux, what platform are you on? And what Emacs version? I tend to be on the latest GNU releases. Are you using a GNU Emacs or something else? If you're on Mac, I highly recommend this distribution [1]

[1] -- http://emacsformacosx.com
I don't think you need quantum computers to bruteforce a 6-letter password.
Re: "I have seen no information on the technicalities of this feature."

https://www.apple.com/privacy/docs/iOS_Security_Guide_Sept_2...
mongodb recommends that your working set lives in memory, not your entire database - it's generally much cheaper to add more RAM than code in any case.

a few seeks aren't terrible for small/medium applications, but when you're asking for thousands of queries a second any disk access is bad news.
Depends on whether the decoding can be done offline, or requires the actual iPhone that the data is encrypted on.
Using technology to protect constitutionally guaranteed liberties is hardly "holding themselves beyond the law".
You guys should check out www.realm.io, it will be a great way to handle this type of stuff quickly. I am an iOS engineer there
The Go community are out building solutions productively and fruitfully, often finding the lack of generics an edge nuisance, but something that is by no means a showstopper.

The people who have no knowledge or skill in Go, on the other hand, fill the message boards, railing rabidly about how absolutely critical generics are, and don't these people (who almost universally have extensive experience across a number of languages) know what they're missing?
Militant Clashes Broke Out in the City Alley
But the problem with Shellshock isn't random environment variables. It's random environment variable VALUES in well-defined environment variable names. It's pretty well-known that there are certain dangerous environment variables (like PATH, LD_PRELOAD) that should not be blindly set. But CGI only sets CGI environment variables like PATH_INFO, as well as HTTP_. That even these can be dangerous because bash executes code on any* environment variable, is completely unexpected.
Or is it a plot to fool users into thinking their secrets are safe on a phone now?
I had the same thought. If we allow upper, lower, and digits, that's 26+26+10 = 62 possible characters per space. With six spaces, that gives 62^6 = 56,800,235,584 possible passwords.

Now if we take their figure of 5.5 years to crack a phone's files and divide, we get 327 seconds (more than 5 minutes) per password they check.

Something is off, though perhaps it's my math so please do double check it for me.

Edit: Argggg. Good corrections. My main problem is that I did my final division in the wrong direction. Fix that by taking a reciprocal: 1/327 = 0.003 seconds. And then correct that by a factor of 2 to assume they get each password in half possible time: 0.003 * 2 = 0.006 or roughly 6 milliseconds. Thanks for the quick check folks.
FTA:

At a news conference on Thursday devoted largely to
combating terror threats from the Islamic State,
Mr. Comey said, “What concerns me about this is companies
marketing something expressly to allow people to hold
themselves beyond the law.”

The state and the law are separate entities, Mr. Comey. It concerns me that, in your mind, you have conflated the power of the state with the normativity of the law.

In the twentieth century, the modern state gained the power to destroy all life on Earth. In the twenty-first century, the modern state and the modern citizen gained the power of private machine-assisted telepathy, memory, and computation. The state and its avatars must recognize that it cannot and must not have the ability to exercise absolute power over citizen's thoughts, computations, and communications if it wishes to foster a healthy and free society.
Really? Have you seen or heard of ANY other phone that bends THIS easily?

https://www.youtube.com/watch?v=gJ3Ds6uf0Yg&feature=youtu.be
Incidentally the problem is much smaller than in a statically typed language with containers.

Compare the difference between a Java list prior to generics and afterwards. Using it in Java was an orgy of object casts. This is not the case for dynamically typed languages.

In fact, the common approaches to containers valid in a statically typed language is largely wrong in a dynamic language.
Move semantics banned until revision.
"I'd hate to have people look at me and say, 'Well how come you can't save this kid?' 'How come you can't do this thing?'" said Mr Comey in a briefing. [1]

A separate article on the same sort of thing. But, I can't help but laugh at how the instant canned response from the FBI was "WON'T SOMEONE THINK OF THE CHILDREN".

It's pathetic, even more so because it keeps working.

[1] http://www.bbc.co.uk/news/technology-29378172
This is what Borland C++ had in the mid-90s before they added support for template on their MS-DOS compiler.

Way back when STL had just been announced as being integrated into the C++ standardisation effort and C++ compiler vendors were using preprocessor tricks to generate type specific generic data structures and algorithms.
I am running Ubuntu 10.10 but patch is not installed. Can someone explain the commands needed to download, build, and install patch as mentioned above. Thanks for any help.
There have been many lengthy disucssions about generics on the Go mailing list. Haven't checked them in a while but the essence used to be that generics are difficult. C++ has really powerful generics but unfortunately C++ templates are in many respects a nightmare. Java templates on the other hand are not really powerful. The idea was to wait until someone would come up with a powerful generics concept that is nice for the developer.
This is exactly what SharePoint does on top of boring, battle tested SQL Server.
It sounds like he/she is referring the the investigators who are saying that the only way to unlock the phones is to beat the hell out of the person who knows the password.
> Locking out intrusion is a huge value proposal for cellular manufacturers.

Is it though? The implementation can be tricky to get right, building it in takes resources, and (perhaps until recently) most consumers do not seem to value that kind of safeguard for their communications. Enabling encryptoed encrypted increases the cost to the manufacturer, all for something that most people did not think was important (before there was strong evidence that there was a lot of warrantless wiretapping going on).