skysight-inc/HackerNews huggingface dataset:
This essentially mimics my login flow to every site I only use occasionally (e.g. twitter) and therefore can never remember the password for:

1. Go to login

2. Forget password - click reset password

3. Go to email, find reset password email

4. Login.

I wouldn't really mind if this became more common. I don't trust password managers (and access the internet from so many different devices that the only common thing they share between them is that I can access my webmail client or email on my phone.)
> I find it interesting that Kagan, a former prosecutor, sees no problem with this, while Roberts, a former defense attorney, does.

I find it interesting that a judge who is the former lawyer of one of the parties to a case would ordinary recuse herself, but apparently not when that party is the government.
As someone who thought Sotomayor would be awful on civil liberties due to being a prosecutor, it's worth noting that she's been one of the best in that regard (IMO) since joining the court. On the other hand, Kagan went straight from being a government attorney to the Supreme Court, so maybe you could expect her to be more inclined to side with the government in these cases.

> Is this something that can be remedied just with normal legislation, or are we now in need of a new constitutional amendment?

Legislation can certainly curb it, though it can also be repealed and bypassed if it leaves any openings.
... and what happens if your header happens to run off the end of your buffer amongst the spaces that follow 'Hello'? Cookies can be huge, I can construct a header like 'Cookie: x[8000 spaces]y'
This is quaint but looks too much like "look how I solved this" (PS. give me funding) multiple weeks after the fact, and is definitely coming from such a bureaucratic environment. The overall approach leaves the critical question of service-specific security policy development out of scope.

We've had NSA SEL since 2000, the reason it's rarely used is that regular people don't have time to grok that level of detail. In response, we have things like grsec learning mode.

As with any time app-specific ACLs are brought out, the real question here is process, not technology. I would argue that what is really needed is not a kernel-specific solution or a protocol-specific solution (noticed how many of the new SOA infrastructure half-solutions are HTTP-only or port-level only regarding network policy?) but rather a generic, industry-wide approach toward multi-faceted security policy generation for arbitrary services including all aspects of service behavior (at both host and network levels). That in turn requires a virtualization paradigm, networking paradigm and OS neutral service devops process. This is something that we are moving towards slowly (eg. widespread git use, standardish build tools, containers, VLANs), but is not widely discussed.

We have the tools in major kernels already: syscall monitoring, relatively mature multi-subsystem security policies, network ACLs and monitoring systems, increasingly sophisticated networking virtualization solutions like Open vSwtich, filesystem-neutral monitoring. The pain in the ass is putting it all together in an average-app grokkable manner that doesn't demand comprehension of low-level OS internals from regular developers, nitpicking application behaviour comprehension from operations infrastructure, or the employment of security nerds to reap the benefits of some of the available lower-level technologies.

I fear commercial offerings will never take us to this position: it's simply not an easy sell (intangible, long term benefits vs. shorter overall timeframe and less cognitive overhead / requisite management grok for current and familiar development processes) and too complex to implement .. in most cases requiring a complete devops process change. Instead, I predict that we will slowly see open source devops tools layer upon RCS/VCS to provide a common continuous integration / deployment process that integrates effective multi-subsystem application profiling for security policy development in parallel to regression tests and other pre-deployment processes.

Further personal thoughts on this area @ http://stani.sh/walter/pfcts
More or less, yes. However, to be perfectly fair, this is basically true in almost every nation in the world.

There are many, many laws in many, many countries that if you deal with a biased judge you are screwed. It isn't just the US, sadly. Although the US is at the point where its worse than the majority of the 1st world democracies.
Spotlight – a new contest app: $2,000 per week to the person with the most likes
Ebola: learn from the past
I built an open-source Rails engine for something like this: https://nopassword.alexsmolen.com.
Spotlight is a contest app for people that like to share stories and photos (and videos) soon for the chance to win $ each week. Spotlight also has special prizes (usually $500 or $1,000) on random days coinciding with art, writing and video events. We're trying to solve the problem of helping people to get paid for contributing their content online. Spotlight is run by VUID, Inc. (www.vuid.co), an online ID company that gives people special log-in numbers using 2-FA.
Would love to hear any feedback, good and bad! Thanks, Kevin (kevin@vuid.co)
There's no law of the universe that says big problems must have complicated solutions. Checklists have prevented countless mistakes in aviation and medical care. Scurvy plagued sailors for centuries, but the cure was vitamin C. Until the mid-1800's, doctors killed many of their patients from infection because they didn't wash their hands after performing autopsies.[1]

Of course, banning lead in those countries will have a beneficial effect, but I don't think it will quell much unrest. The middle east was unstable well before the introduction of leaded gasoline. And as you said, car ownership isn't as common there.

1. https://en.wikipedia.org/wiki/Ignaz_Semmelweis
Out of all the PHP frameworks I've used (CakePHP, Kohana, Laravel, Symfony) I have to say Yii is the one of the best.

It's hard to describe why, I think mostly because it feels like it was built and designed by one person who had a lot of experience with other frameworks and knew PHP inside and out.
Hey man. I'd be interested in buying if the revenues are sustainable. Lets talk. My email is: funsecretshq@gmail.com Thanks
What does IIFE stand for? From your I'm guessing it's an immediately evaluating function - but I can't figure the initialism out
Or trying to be funny, but trying way too hard.
It's not the ultimate platform. Arguably, it's not even a very good platform. What it is, however, is the best platform we currently have.

The idea of using email for password exchanges is fraught with difficulty, and not only because there's a lot of terrible email providers that don't even support starttls on their mail servers. Net-savvy people have fought a war to have HTTPS implemented across the web, can you imagine how hard it's going to be to get people to fight for implementation of security they can't even see? Ask your nearest non-technically minded friend if he knows if his email is encrypted in transit, and then ask him if his bank website is.

Someone elsewhere in the thread mentioned they'd only just started using key-based SSH login, and how it seemed to them the best thing since sliced bread. Extend that a little further with keyphrase protected keys and ssh-agent/pageant/whatever macs use, and you have a much, much better platform than "emailing a temporary password."
The problem I see with implementing something like that is getting it off the ground.
It's a bit late for that to be a solution for the current epidemic. And that'll cost more ... calls for a hack, putting tape on the insides or outsides where you need to distinguish between the two. Or a magic marker ... after you determine ones that won't break down the plastic too quickly.
As the OP of the /r/linux thread... What inspired the thread is that I bought an SD card and while on the dev build of chromeOS I was unable to use it with ext4. I distinctly remembered it being listed as supported at one point a year or so ago and then I ran upon this thread: http://www.reddit.com/r/chromeos/comments/2iuix3/trying_to_i...

So I made a thread on /r/linux and it absolutely exploded. I made it figuring that a number of users would click through and post that this was a stupid change and hopefully get the decision reverted. They claimed there was no userbase for such a feature and I knew exactly where to find one. That said, it blew up way more than I was expecting.
Rasmus Lerdorf on the origins of, and rationale behind PHP (2013 video)
because using system flashlight app is too edgy, huh? Why you need extra app for thing you have just build in Android ? Check your widgets for "Assistive light". Problem solved.
Something we are looking to change. The duplication is pretty annoying, but we use AssetGraph-Builder for our production build, which uses ngmin, which doesn't play nice with ui-router. Also, now that 1.3 errors globally when you forget annotations, using NgAnnotate is much more of a no-brainer.
The Tiobe Index front page used to run a monthly historical comparison of statically typed languages against dynamic ones, but removed it about 6 months ago. There was a clear reversal in the trend away from dynamically typed languages 5 to 10 years back. I see dynamic languages as the 2000's version of the 1990's visual programming fad. Only one or two of those visual programming products (Visual Basic and maybe Delphi) survived, and the same will probably happen with dynamic languages: I'm picking Python and Javascript will be the only ones around in another decade.
That's specific to that implementation.

1. Navigate to Settings, Finger Scanner, Pay with Paypal

2. Select Install FIDO Ready Support, then Install NNL fingerprint scanner

3. Select Link to Paypal, then Link Fingerprint

4. Login to paypal with username and password

5. Agree to terms

6. Swipe finger to link fingerprint

7. Install paypal app.

1 is obviously mandatory. 2 could be preinstalled. 3 could be combined, but is mandatory. 5 is stupid. 7 should be already installed if you use paypal.

End result: find the right settings area, select link fingerprint to paypal, login to paypal, swipe fingerprint to link, done.

Don't criticize FIDO based on some half-baked implementation. Any problems you have with the setup flow are either Paypal's fault or Samsung's.
It's step 1 of their "3 easy steps"[0].... If you read their Wired profile[1], it's clear there's sample prep involved. I do RNA work quite frequently, (high quality) RNA preparation is finicky and involves reagents you can't buy as a normal person and equipment that may not be "specialized" but isn't in your standard Gen practitioners office and definitely in effectively 0 homes. High throughput RNA extraction -- which is what their Mastermix is -- yields OK-ish quality RNA but works fairly well if you have well optimized RT-primers. There are several caveats to quick extractions though, the two big ones for this product are it doesn't work well for human tissue or blood samples and they're either not doing very much testing (literally only 96 specific tests) or they're doing broad range testing and not using optimized primers because there's not a lot of RNA in any given sample. My guess is a combination of the two, there's a reason why the real microarrays we run for research are both expensive and time consuming.

Doctors already "test" for things, and by that we mean the doctors have nurses do a blood draw and that blood draw is sent the the hospital lab. And the hospital lab does the testing. Even with this device, it's still the hospital lab that's going to do the testing. Your lab results don't necessarily take a while to come back because they're hard or cumbersome or take a ton of time to do, they take a while because the lab is running more than just your samples and your doctor has more than one patient (and also might like to sleep at some point). Most labs (that don't need something like culturing) can easily come back in less than 24hours and assuming you were the only one could come back in just a few hours.

I see no reason to give them the benefit of the doubt, they've shown nothing to merit it. Mass producing what appears to be a hotplate with a non-tunable $5 laser inside a sleek, shiny baby blue case and making a companion iPhone app is gimicky.

There aren't that many diseases that present as binary and those that do have existing, proven tests.

[0]: "1. Extract the total RNA from the patient's blood sample and pipette it in a standard 96 well plate "

[1] http://www.wired.com/2014/10/miroculus/

"You can prepare the blood sample, for instance, using a standard off-the-shelf RNA extraction kit, as well as a Miroculus 'master mix'"
> such as home directories being globally readable unless you change it yourself

Also the case at University of Birmingham. Must be a default somewhere
Perhaps this post is already buried, but if anybody is reading, do you know where the row-selection and precharge latencies figure into the numbers he gave? He makes no mention of them.
Could you point me to this? I did a cursory look through the Servo codebase. It just occurred to me that since Servo is pretty much the reason for the existence of Rust, it is probably the best thing to learn Rust by reading code.

I have had a problem learning Rust by example, the codebases I would like to read don't usually work with the latest Rust releases.

I don't really _do_ C++, but if I could talk to Rust from C++ maybe I could start hacking on their codebases.

Edit: I found the http://doc.rust-lang.org/green/index.html is this what you are referring to?
> I absolutely love formula 1, I've watched almost every race in the last 30 years.

Love, huh! Not an addiction?
That's what I meant by the silently fail part.
If this works, it's just flat out amazing. Leukemia killed a close family member and I still donate to research.

In two separate clinical trials — sponsored by Novartis AG NOVN.VX of
Switzerland and Seattle-based biotech Juno Therapeutics Inc. — almost 90% of
patients saw their leukemia disappear after being given experimental
so-called CAR T-cell therapies. The results were published in December and
February, respectively.

Both trials were in small numbers of patients: 22 children in the Novartis
trial and 16 adults in the Juno trial. The patients had acute lymphoblastic
leukemia—the most common childhood cancer—and had exhausted standard
treatments. Both companies are now conducting larger trials.

And that's 90% after other treatments failed.
Practical advice. Making me rethink a project I'm involved in trying to take public.
I agree. The only issue I had with it is that it returns records in an array instead of a Rowset object like Zend Framework. But it contains much less of the verbosity than Zend and is much easier to use and separates things like validation and authorization in a much more elegant way.
The headlines read a bit like those from supermarket checkout magazines.

That's a bad thing for me, but it might serve you and your core audience well.

(My daughter is 20. The idea of taking parenting advice from random Internet sites and strangers is anathema.)
I switched from ngmin to ngAnnotate+uglify. Man this is way faster! Also code looks much better!
The main flaw with this idea as well as pretty much every password reset flow is that email itself is insecure. If I want to attack the login system and I have the ability to intercept the emails at some point, I essentially get access to the link/code in plaintext and now have access to the account. The difference might be that there will be a much higher volume of emails from a system like this than from one that just uses email for resetting passwords, though that's not guaranteed. I'd like to see a system that address this issue.
This is a great comment about F1. You have to immerse yourself in the technicals and the non-technical 'gossip'/rivalries, etc-.

I'd also recommend checking out (either the full thing or some of the highlights) from Bahrain's race this year if you want to see some incredible head-to-head (& exciting) action.
vs. Laravel? anyone?
Rolling Shutters
The 1980's state of the art was a lot better, depending on how long a pause you could afford for incremental GC (fractions of a second, OK for humans, but not a variety of applications. OK for piloting bulldozers, as one company did.)

Interpreted only ... that's a narrow, 4 year window, the first was developed in 1962.

Probably the key thing in this is that most any good programmer could hack out a Lisp implementation in a week or two. Making one preform as well as contemporary languages, strangely enough, took a similar amount of effort, and most Lisps back then didn't.
Even for 2000, this paper is hilariously biased, starting with the observation that Lisp wins over Java in every single respect. If I order an evaluation paper and the paper comes back with 100% for choice B and 0% for choice A, I'm going to disregard it completely because the author is obviously too biased.

One of the strengths that Java has over Lisp is that it's statically typed. At the time, the direction of the industry wasn't too clear cut but this is clearly the trend today.

Another example of the bias is that the benchmarks compare development times (and Lisp wins, surprise surprise) but not maintenance time, which is admittedly harder to measure but a big liability that dynamically typed languages have.
I did the same thing as as a kid with my brother (we broken open batteries instead to get the lead). I never tried to spend the “money” we made, but just used it to impress other kids in the playground. I guess this is where some of the appeal of physical gold comes from - the weight of these coins when held in the hand sure impressed.

We avoided breaking the mould by casting the plaster of paris in two sections. The first you cast to halfway up the side of the coin lying flat and once it sets you rub grease over the top of everything and then cast the over half. Once everything has dried the two half split apart easy. We put in little sticks into the first cast sticking up 5mm so that the two halves could be aligned again after removing the coin. You could use this mould as many times as you liked. I do agree that the effort far out weighed the financial reward though :)

Someone should start making and selling gold plated tungsten coins as a cheap replica of gold coins - I know this sometimes happens as forgeries, but it would be nice to have a few hundred of these to play around with and impress your friends.

Edit. It looks like there is a company in China that actually does this. I have contacted them to see what they cost as I would love to have some of these.
I find pit strategy to be a factor, but rarely the most important ones. A given chassis performs predictably differently on different tracks. I find the technical design and car setup fascinating - and that is what I think the biggest factor is. That's why teams that win the constructors championship tend to do consistently well even when everyone's pit strategy is the same.
I'll bet criminal organisations that use extortion on businesses also make more money than the average businesses being targeted. The fact that trolls use the law instead of violence doesn't make it that much better. Legal but morally offensive practices are certainly not exclusive to patent trolls though. They just get more attention due to the publicity of the action.
For the first time this month the top 5 languages on Tiobe add up to over 50% -- last month it was just under 50%. And those top five are the 5 "C+ languages", i.e...

C (plus is implied)
C++
Java (3rd to rise, with syntax based off C++)
C# (4 pluses joined together to make a sharp sign)
Objective C (5th to rise, tho around for longer)

Whereas all the "dynamic" languages in the top 20 (i.e. Basic, PHP, Python, Perl, JavaScript, VB.NET, VB, Ruby) make up only 18% in total.
LastPass was considered secure on HN in the past, has this changed? Or is there a reason you don't like it? Not attacking, just curious about my own security.
I don't know of a defined syllabus but here is what I did:

1. Write some basic synthesis code(naive oscillator and volume envelope) and some way of sequencing it. Write little toy trackers and some procedural audio with this technique.

2. Try and fail a few times to write dataflow engine for audio like Pure Data. (this is kind of a big project and it turns out, you really don't need it to experiment.)

3. Write Standard MIDI Format playback system for a one-voice PC beeper emulation. This turns out to be a gateway drug for me learning more in depth because all you have to do is add "just one more" feature and every MIDI file you play sounds a little better.

4. Expand MIDI playback and synthesizer in tandem. End up with polyphonic .WAV sampler, then Soundfont playback. Learn everything about DSP badly, and gradually correct misconceptions. (DSP material can be tricky since the math concepts map to illegible code, and a lot of the resources are for general engineering applications instead of audio.)

5. Rewrite things and work on custom subtractive synthesizer, after getting everything wrong a few times over in the first synthesis engine. Still do not know to write nice sounding IIR filters; steal a good free implementation instead.

And that is where I stand today. I know enough to engineer complex signal chains, how some of the common formats are structured, and some tricks for improving sound quality and optimizing CPU time; what I miss is the background for writing original signal processing algorithms, which gets really specialized(there are some people who devote themselves entirely to reverbs, for example). These algorithms and their sound characteristics are effectively trade secrets, so the opaqueness of the field is not just a matter of the problems being hard - DSP just hasn't become as commodified as other software.
A matter of taste. Try both and see which one you like best for yourself.
It's very possible they just didn't like you and wanted to make your trip miserable. Or they were just hoping to find contraband, mainly drugs. Or they were bored. Or there was no reason. Who knows? From my experience and research, that is SOP for law enforcement in the US. If they can harass (or worse) you, they will.
#ForzaJules
That's already the case. The threat of this kind of asset freezing was used at least as far back as the Drexel Burnham Lambert investigation in the 80s.

"The threat of a RICO indictment unnerved many at Drexel. A RICO indictment would have required the firm to put up a performance bond of as much as $1 billion in lieu of having its assets frozen. This provision was put in the law because organized crime had a habit of absconding with the funds of indicted companies, and the writers of RICO wanted to make sure there was something to seize or forfeit in the event of a guilty verdict. Unfortunately, most of Drexel's capital was borrowed money, as is common with most Wall Street firms (in Drexel's case, 96 percent—by far the most of any firm). This debt would have to take second place to this performance bond. Additionally, if the bond ever had to be paid, Drexel's stockholders would have been all but wiped out. Due to this, banks will not extend credit to a firm under a RICO indictment.[5]

By this time, several Drexel executives—including Joseph—concluded that Drexel could not survive a RICO indictment and would have to seek a settlement with Giuliani."

http://en.wikipedia.org/wiki/Drexel_Burnham_Lambert
What is analog authentication? FIDO is a general protocol, it doesn't mandate fingerprints or say how to recover if a fingerprint scan starts failing to match... that's up to the implementer (the site you're authenticating to). Watch some other videos or read more docs on FIDO for a better idea of how it works. It's a generic protocol for 2 factor authentication done right.