skysight-inc/HackerNews huggingface dataset:
Inherently, adding more systems creates more risk vectors. When an application is installed on an operating system, both the OS and application now have to be protected. An example would be Flash ontop of an OS. You have to defend, patch, and architect based on whether your systems have Flash or not.

With virtualization you have the hypervisor that has applications running along with it (ie: ssh, a cli, syslog, bash etc) and then you install a guest in a VM on top of the hypervisor. The OS on the VM is another vector which has applications on it (DB, web, ftp, etc).

If I have a bare metal server with just an OS installed on it and its applications on top of that, I only have to worry about that set of OS and applications and their associated risk vectors.

If I have a bare metal server with a hypervisor and then the above OS and set of applications, I have increased the number of risk vectors by however many applications are running along with the hypervisor.

“but do people actually believe that it makes it less secure?”

Just bringing a hypervisor into an environment does not of itself immediately make it less secure. I agree with you, I don’t think it makes it less secure. It does increase the risk of the environment and appropriate architecture and action must be taken to prevent your statement from being true. A large number of environments do not architect and manage properly.

Another very realistic, and happening today, example:
Bare metal server with Windows OS installed.
Bare metal server with a hypervisor which just happens to have bash on it (or is susceptible to this memory issue). The same Windows OS is installed as a VM.
In the second instance with the hypervisor I would have, indirectly and out of my immediate control, made my environment less secure.

An increase in complexity or increase in components will increase the risk of an environment.
It's an interesting idea, but currently quite impractical as there's no infrastructure for it.

The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor.

Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary services, expose only Tor's proxy to the second NIC.

Create the other VM with 1 NIC in the virtual network with the Second NIC on the other VM.

This enforces Tor-only access for the second VM. Any activity must go over Tor or it may not access the internet.

Snapshot the VMs. Always restore the snapshots when beginning a new session.

Setting this up takes some time, but nearly guarantees an exploit cannot escape.

I also recommend disabling unnecessary services which may expose the host to attack (ie: file sharing and video and mouse acceleration) through the second VM. It may be more secure to use a low-level emulation (QEmu, VirtualBox or VMWare with hardware acceleration disabled) rather than a hypervisor-based VM solution for this.
LivingSocial (http://www.livingsocial.com) -- Washington, DC. Boulder, CO. Portland, OR. Remote

===== About Us =====

LivingSocial is revolutionizing local ecommerce. With millions of consumers and merchants using our web and mobile tools, we're constantly improving our suite of products. Using data to drive decisions, our engineers are solving hard problems at the heart of our business.

===== Who Are We Looking For? =====

We’re looking for hungry, creative, and pragmatic engineers to help us continue innovating. If you have the skills, we offer the opportunity to work remotely (or in the office).

===== Open Positions =====

We are currently looking for:

- Front End Engineers
- Ruby on Rails Engineers
- Clojure Engineers
- Data Scientists and more

Check out all of our openings here: http://corporate.livingsocial.com/careers/browse-all-jobs/
ok thank you. I actually mostly know russian, but that word made no sense to me.
Flicker. Anything less than 120Hz can give severe eye strain and headaches over long (30-60 min) work sessions.

As to the LCD replacements, the anti-aliasing is just not as smooth (yes, I'm being subjective) as on the CRTs. Perhaps, a "retina" level resolution display with 100+Hz refresh-rate will be a real solution. But those are probably still at the R&D stage and will be ridiculously expensive at launch! And the graphics cards to drive them as well!
just that the GPL is meant for code and CC isn't so it has special considerations in it that aren't in CC. CC is meant for media like images, video and text.

RavenDB is a company that offers a dual license commercial and AGPL. http://ravendb.net/docs/appendixes/licensing You may be able to glean some information on how they do it.
There's been some backlash against Lean Startup and Minimum Viable Products as of late. The implication is that it forces you to release crappy products. In the post I outline how we apply MVP thinking to our product development process. It's by no means as "minimum" as possible, but it's working for us.

I'd love to know how other teams apply this thinking (or not) in their development process?
So you're going to fork the web?
Seems that it was banned because of this commit about suicide https://github.com/amdf/objidlib/commit/e9c31e97c0ca7863516f...

Based on the previous experience if github reacts in any way this will probably get resolved sometime in the future.
'Great big poo balls' What it's like making a Kano
[Tutorial] Build the Next Whatsapp Using 3rd Party SDKs (Sinch and Parse)
How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
Your Website, your Design
For small contracts, I usually ask for half up-front and half at delivery. Medium-size might be in thirds with the second payment invoiced when they get the prototype. For large contracts I tend to do monthly payments with a little bit of front-loading (ex: for a 100k project over 6 mos, 20k x 2 months and then 15k x 4 months).

Your hourly rate is entirely dependent on the project, skillset, and experience. A small PHP-only developer cannot command the same rate that a full-stack backend, frontend, and iOS developer might. Delivery timelines also play in - if they want it next week there's a premium.

I'd avoid that agreement, it's overly broad. I try to make mine assign on full payment / completion of project and cover only the work performed for the contract. If I can swing it, I try a non-exclusive license instead of full assignment as well, which allows me to reuse code.
As of now that project doesn't appear to exist.
This is not completely accurate. The guy went to the hospital on the 26th, was misdiagnosed and sent home on antibiotics. Then he was taken to a different hospital by ambulance 2 days later when he obviously got worse instead of better.
The project seems to have been removed.
A bit of anecdata: I spent a lot of hours on a Vectrex and didn't get any eye damage :-)
The question I want to know is who has already?
Clicking on the upper left logo (I was trying to return home) opens a new browser tab--not cool at all.

Other than that and a few other trivial issues, the site looks great. Can't wait to try it out.
Lever (YC S12) raises $10M to make hiring awesome
Don't suppose you have a mirror of what was posted? I'm kinda intrigued...
"dont panic" is ironic. Panic not because access was lost but because the conditions for loss were so trivial.
If the same event was held there every 4 years, they could reuse much of the hard infrastructure and generate more return on not much more investment.

That said, it will never happen because the IOC is effectively a PR firm at this point, they'll make much more money from a new country every 4 years than they will from Greece repeatedly.
Banning USB hubs isn't really workable either. Any keyboard which has USB slots would be blocked, for instance.
Screenshot for the curious
http://habrahabr.ru/post/239021/#comment_8027431
Comments and tickets on github are github only.
I think "decision maker" means they are acting on some sort of a complaint/request. Rospotrebnadzor ("Ros" - Russia, "Potreb" - Consumer or Consumption, "Nadzor" - Oversight) is simply the government org whose responsibilities include blacklisting. There is no way to tell from that website what led to this decision as far as I can tell.
For unix interoperability and palandromic satisfaction, we can now offer you X Windows for Windows X.

Discounts for straight-edgers (xWWx for sXe!)
> Does WebRTC strike anyone as too many things in one package?

It does too many things. I want to use WebRTC data channels for a multiplayer game, but the current implementation libraries tie-in all the media components. It would be nice if there was a WebRTC implementation that provided data channels without having the media functionality.
From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.
It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic explanation.
What stops evil devices from simply waiting for a period of time and springing the dialog at a later time or when the user is likely AFK? (Can it detect idleness by looking at voltages?)
This was released July 31st. 2 months ago.
The purpose of that is to allow students to attend the event without having to skip class for it.
Review of:New treatments show promise in prolonging human lifespan
I read the article at http://nextbigfuture.com/2014/10/more-evidence-emerging-that-rapamycin.html, that gives a reasonably thorough review of drugs that are currently believed to slow or reverse aging. It could could be improved by links to the original documents or studies, and by reviewing contrary evidence as well. There is an academic bias against printing negative studies that makes it difficult to know how rebust a result really is.
Agreed regarding the usage of parallel construction-- I am sure that somewhere in the government's internal guidelines on when to use parallel construction there is a catchall clause providing exemption for "exigent circumstances" which allows it to be abused domestically for any purpose.

This case now reeks of heavy NSA involvement merely passed to the FBI for the actual enforcement side of things.

I'm not sure if there's actually an angle here, but it would be extremely interesting if the defendants were able to impeach the FBI's evidence to such a degree so as to force an admittance of parallel construction. It's a no brainer that something fishy happened here.
In the worst-case scenario, why not use connect/disconnect events themselves as a form of user input?

https://news.ycombinator.com/item?id=8401924
It was removed from blacklist few minutes ago.
Since a warrant would otherwise involve violating the rights of the person being investigated you typically need to have some evidence that a crime is being committed. The ends do not justify the means in a court of law.
We have positions for both. See the full-stack/generalist bullet above.
OpenVPN servers can be vulnerable to Shellshock Bash vulnerability
Route leak incident on October 2, 2014
Here are a couple other posts:

http://robots.thoughtbot.com/introducing-hound

http://robots.thoughtbot.com/hound-reviews-coffeescript-for-...
Not OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.
Do you have any examples of things mistakenly blocked?
Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted.

EDIT: I guess the biggest problem here is that the people responsible for actually perpetrating the crimes (e.g. the police officers lying in court) will most likely not be held responsible.
Anyone who pays attention to international affairs knows that the US has been seeking a rapprochement with India; Prime Minister Modi just had his first meeting with President Obama the other day. Meanwhile, the US has been at odds with China over its ballooning territorial claims in the South China Sea, to the point of possibly terminating the ban on arms sales to Viet Nam. I don't think the GP needs to provide citations for such easily acquired current affairs knowledge.
Same on OSX, Chrome.
Just because the Reddit office in in SF, doesn't mean you have to live in SF. So all those people talking about how SF is shit and expensive and horrible for raising a family must not realize that you can find better/cheaper/bigger places to live by going a short distance out side of SF proper. I have a family and spent over 4 years working in SF and never once lived there.
Would be interested to hear about the work you do. I read your profile, but do you have a blog or such where you discuss these sorts of technical problems?
Real-time Analytics at Massive Scale with Pinot Engineering
You're switching to working for the client on your current project? If that's a "buy-out", your employer is presumably getting big $$ when you leave. They won't care if it's written into their contract with the client.

Regarding taking coworkers with you, many workplaces have non-solicitation clauses in their employment contact. However, your new employer can buy them out also. Ask your new employer.
And Windows 8, Chrome.
If the investigation is not performed in a forensically valid way, then there will always be a suspicion of evidence tampering. The law is like that for a reason. You have to prove that you captured the evidence exactly as it was, and not only you, but everyone who touched it made sure of that fact too. If you can't prove that, the evidence could be tampered with. Planting evidence, or even changing the circumstances under which existing evidence is seen can have a major impact on a trial.
Wikipedia, Reddit, Imgur, et al.

They often are only blocked for hours at a time but it is still heavily disruptive.
US Diversity Immigrant Visa Program 2016 is now open (50K spots)
Loving it!
Using it in our project keeps the code base clean and styled. Integrating JS now, looking forward to more good things from the hound team
Okay, I misunderstood you then. I haven't found any words ending with "io" that are still available.
Toronto, ON, Canada

theScore.com

Job: Front-end Javascript & Ruby developer

theScore Inc. is seeking a talented and passionate front-end javascript and ruby developer to help build and extend one of the best sports web-apps on the market. The ideal candidate will possess at least two years of experience building web applications.

You will be working with a team of smart, friendly, and dedicated developers in one of Toronto’s top Javascript (Ember) & Ruby dev shops. As part of the development team, you will work along side a team of expert developers from other platforms to deliver a seamless sports app experience across desktop, tablet and mobile clients. We use the latest Web technologies. We’re not concerned with being IE 6 compatible.
Skills & Requirements

Full posting and links to apply here: http://careers.stackoverflow.com/jobs/68956/front-end-ember-...
Yep, indeed - http://eais.rkn.gov.ru/en/#form no longer shows it.
The Manhattan Engineering District HQ was, for some time, on the 67th floor of the Empire State Building. Or so says "Oppenheimer and the Manhattan Project", Cynthia C. Kelly, ed. But that's a 2006 book, and the remark lacks a footnote. An earlier source is needed.
Spotify on their Engineering Culture
The suicide methods listed in this commit include "stick pencils in your nose and hit the table". Clearly we as citizens shouldn't know that.

http://i.imgur.com/OLDgdiX.png
That's a cool idea, but it comes with a lot of overhead. Javascript files are one of the most heavily-cached on the web, and by signing them with PGP, you cripple your caching ability.

Or am I missing something?
I don't have specific recommendations, since most of my history reading, sadly, was in the twentieth century, and I don't remember titles that had a strong foreign policy element. However, one suggestion would be to go through college course listings, such as http://ocw.mit.edu/courses/history/ , and drill down to the readings for a strong list of books.
Because you can't get a warrant without probable cause. That's why it's illegal for the police to just arbitrarily decide to get a warrant and search your house for drugs because you look like the kind of guy who might have drugs.

And the police can't say "Well, we didn't have a warrant, but we were right so who cares" either.

If they never had probable cause to get images of this server, what gave them the right to a warrant for it?

More importantly, the world needs to know how the heck they did know, so that we all know what the government is capable of.

Ulbricht is still an idiot, and it's not surprise he got caught eventually- but we can't let the police bullshit their way into convicting anyone, even idiots.
As of yesterday, the links weren't updated beyond the RC3 release which came out about Aug 13. My guess is they updated this forum post with the final release.
That's exactly the issue. This is designed to work in conjunction with HTTPS/Tor such that if the server is compromised, unsigned JS payloads cannot compromise the user.
The Winter Olympics are in trouble in general.

They have now grown so big that you need a city to support all the visitors, media, athletes, events, etc. But you also need big mountains with reliable snow.

The combination is hard to find, and it's getting harder every 4 years, probably due in part to global warming. Across most mountain ranges, permanent snowpack is shrinking, anomalous warm spells are happening more frequently, and mountain glaciers are losing mass.

Sochi had snow problems, which was not that surprising given the latitude, but so did Vancouver--and that was surprising. So did Turin. So that is 12 years of snow problems at the Winter Olympics.

They need to either shrink the footprint small enough to fit into real high altitude mountain towns, or give up some snow events. Neither seems likely.
No more than NoScript forks the web.
The Drake index for academics
Microsoft Releases Elastic Scale (Sharding) for Azure SQL Database
Vancouver cab company tells drivers they’ll be fired if they sign up for Uber
Electrically the 500 is much much more important than the 34/40 - every modern landline phone has something in common electrically with the 500 set.
Leading Indian Travel Bloggers and What Make Them Tick
https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downtur...

Also, isn't there a new Silk Road already?
They'd drop the case before they admitted parallel construction. The old Silk Road is gone and if Ross Ulbricht isn't innocent he won't ever be trying anything like this again knowing that the NSA and the FBI are going to be surveilling him to the best of their ability so they only thing they lose is locking him up in prison.
So if I hack a website what's stopping me from serving javascript with no signature or my own signature?
The original idea I had was to have an index (think hybrid cache.manifest and Content-Security-Policy header) of relative URLs and their SHA3 hashes, then that file was signed. If anything fails to validate, it doesn't run.
Elusive Form of Evolution Seen in Spiders
Great idea! Framing is an incredible hassle for exactly the reasons you describe. Would be cool to partner with small artists to pass out discount codes on physical cards they could include with rolled & shipped art.

For the future -- provide exact specs on the acrylic you're using to front the pieces (and consider offering museum glass in the future). UV exposure is critical depending on the placement of art and, perhaps ironically, particularly for the more inexpensive pieces people may be wanting to frame with your service that may have been printed using materials more prone to fading/etc.

Also, when you eventually offer additional matting colors/textures, put together a sample pack (using the cut scraps) that can be mailed out. Mats, particularly colored mats, look very different when actually adjacent to a piece of artwork than viewed on a screen (much more so than most framing material).
14.07/ 29-Sep-2014 09:39 -

14.07-rc1/ 13-Jul-2014 14:46 -

14.07-rc2/ 31-Jul-2014 11:30 -

14.07-rc3/ 13-Aug-2014 08:25

http://downloads.openwrt.org/barrier_breaker/
Maybe this is a problem with GitHub. Too much re-centralization of the git protocol. How many people ever learned how to use git without GitHub?
> Quora has used time freed up by Lever’s communication workflows to double down on strategic sourcing. Last quarter, over 40% of their hires were sourced, top-tier passive candidates, a rate 5-6x greater than before.

Can someone explain what this means, in English?
So I hand you a malicious USB stick, you plug it in, the computer asks you to unplug it and plug it back in. You do so, because you trust the USB stick (why wouldn't you, free USB stick!).
Hm, so there is basically easy way to use filters to block any website (at least temporary) for the Russian segment of the Internet? I don't see how it might go wrong.
300 signups over a couple of weeks does not imply "high visibility."

Keep in mind that this is a tool for businesses, and they are charging money for it. Their potential pool of users is several orders of magnitude smaller than that of a free consumer app (there are only tens of millions of businesses, compared to billions of people).
They changed their story because the truth is that they violated the 4th amendement rights of anyone who browsed Silk Road for a period of time. They executed drive-by Javascript code on the computers of hundreds of unknowing silk road users, without a warrant. At worst, that's extremely illegal, and at best, it's in a definite gray area. I don't blame the FBI for trying to cover it up.

(Citation -- wired article I read at some point; maybe someone else can find it.)
Great, now that site's totally going to be taken down...
I do, because its awesome.
Comedic sci fi is getting me back into it:

John Scalzi writes a kickass tale- Old Man's War series

Robert Kroese just hilarious - Starship Grifters

Read a while ago and couldn't put it down - Avogadro Corp: The Singularity is Closer than it Appers by William Hertling
And a new DPR to go along with it
Research at Facebook
Why would they incur a massive scandal for one guy they can surveil forever?

If enough doubt is cast, they'll drop this.
There Is Much to Learn from the Paper Towel
Apple: Luxury Brand or Mass Marketer?
Thanks for the feedback. It's extremely frustrating to try to ask innocent questions on HN, especially with the influx of people who enjoy lording themselves and their own personal expertise over people who have admitted ignorance and are here to seek knowledge. Given my lack of knowledge, the only way I can hope to try to formulate a precise question is to "throw myself out there" and attempt to do so. That, of course, results in stupid questions and statements, but that was the entire point: to correct the stupidity and not live with it.
Tru-Colour: Startup Takes on Racial Healing with Reimagined Bandage
Build DevOps processes from scratch
If they hacked the servers, they've tainted the evidence.
There is no "buy-out" option that's why people probably will be mad.
Unless you [backed up](https://github.com/joeyh/github-backup)!