skysight-inc/HackerNews huggingface dataset:
To paraphrase OED, an apology is an expression of regret for something one has done wrong. An organization cannot experience regret, so demanding an apology from the organization is guaranteed to be empty. An apology from members of the organization may well be meaningful, but the current members of the organization have not done wrong (at least, no wrong that caused the initial passing of the 1937 act).

Basing your voting on whether your politicians are improving drug policy and/or have committed to do so on the future is totally reasonable. Basing your voting on your demand for an inherently empty ritual seems... not.

edited to add:
Note that a Truth & Reconciliation type process is an entirely different thing - exposing and acknowledging the truth can be important and allow healing in ways that have no particular relationship to emotions fictionally experienced by the organization.
That's not fair either. Most of this stuff is happening in the open; you just have to put the effort in to joining the mailing lists, reading the bug trackers, &c.
Actually the speakers settings are set to loud just before the alarm goes off
Hahaha. That level is so much fun to troll people in.

Someone was drawing an X on the correct exit, and I started drawing a checkmark on the one next to it. When they realized, they tried to cross it out.
Since this was for clojurecup, we have decided to remove all references to Scala. :P

On a more serious note, we've only indexed ~25 courses and probably the ones you refer to weren't among them; if you have a particular course in mind, tell me, I'll fire up the scraper..
Apart from the fact that adding noise just increases the measurement cost, the "add random sleeps" solution has two other problems, one small and one big.

The big one: it implies that you actually know what the side channel is, so you can sleep at a useful point. The virtue of relying solely on constant-time operations is that they're constant time by design. You don't have to worry about how the variable-time operations are implemented, because there aren't any.

The smaller problem is that you have to make sure that your noise function is not itself a target of attack, which can be a little tricky because your noise function must be extremely, extremely cheap to compute.

There's also the obvious "non-problem" that reducing a function to it's lowest common denominator of performance defeats the purpose of high-speed cryptography and variably-timed implementations in the first place.
If the mistake had been made using pen and paper it would have been called human error.
Actually, there are several ways to detect such attacks. I work in network security and incident response, and I immediately recognized the URLs in the infection chain from Figure 3 and Figure 20 in the whitepaper. They're using the Sweet Orange exploit kit, which has been around for a while and is not that hard to detect if you have any appliance screening HTTP requests and responses. Example URL patterns: http://malware-traffic-analysis.net/2014/10/06/index2.html

Also, despite Invincea's claims to the contrary, good intelligence feeds and in some cases just proxy domain categorization are often fast enough to catch these for most organizations, at least in cases where the attack isn't specifically targeted at a single organization. This is on top of multiple layers of defense that any decent company should have, many of which could catch numerous indicators (domain patterns, URI paths, Javascript) tied to these exploit kits.

The bidder has to prop up and supply the exploit kits themselves, and most of the time it's Sweet Orange, Nuclear, Rig, or Angler. But these are all "commodity" exploit kits and aren't even remotely custom made like they have been in some APT attacks. APTs may also go the ad bidding route and provide their own handcrafted exploit kits, but they may not want to go through a middleman like this and set up a corporate front.

The only unnerving part is the ability to choose a specific target subnet. If the ad networks or second-tier middlemen of "spreaders" / "distributors" are promising clients exclusive access to a certain group of servers or even an entire ad network for a length of time, and if the client uses a specifically created new domain and maybe even a fresh IP, then that means no one may know about the compromised server/network until it's too late and several people from the targeted organization visit it.

I don't know for sure since Invincea did not investigate more into the human aspect of this, but I suspect for this to be profitable there's probably a lot of "overselling" going on, and the bidders interfacing with the ad networks themselves are serving multiple customers' campaigns (or their own campaigns) on the same servers and ad networks, which makes it more difficult to successfully pull off targeted drivebys or "watering holes" as they will get detected and evicted.

>I'm sure the talented people at the larger ad-exchange-software companies like AppNexus will figure something out - or they already have!

AppNexus has been a major offender here for a long time. They've had numerous incidents of malicious ads over the years. I know because I've seen them myself when investigating malware incidents (e.g. adnxs.com as the Referer in an exploit kit chain). You can also see adnxs.com in Figure 21 of the whitepaper. I certainly hope they start caring more about security and establish a more stringent ad reviewal process.
Back to BBEdit
Hi Folks, Although I did not post this link to HN (and have no idea who did), I am the author of the book. As an FYI, the printed and ebook versions will be available from No Starch Press early in 2015. The online version will remain online even after the other versions are available.

Amazon preorder at http://www.amazon.com/Data-Visualization-JavaScript-Stephen-... (that's NOT an affiliate link)

The current content is just a draft of the final version, but I'll be updating it as the book gets finalized. Significant updates will be noted via the @jsdatavis Twitter feed.

Comments, suggestions, and criticism are all welcome. You can reach me directly at stephen@sathomas.me.
Web Services and Marketplaces Create a New Data Science Economy
You are totally misundersting how it works. A cryptocurrency that can be exchanged directly (by the Fed) with cash doesn't change how anything currently works. The author points this out:

"The existence of cash doesn't get in the way of this process, nor has it ever gotten in the way. Bringing in a third liability type, Fedcoin, the quantity of which is designed to fluctuate in the same way as cash, would likewise have no impact on monetary policy."

I.E., the Fed can debase the "FedCoin" cryptocurrency just as much as they can debase USD.
I feel bad that I don't have a good response to this comment right when the thread got usefully technical (but maybe 'pbsd will jump in and correct me on something). The fact is that I like libsodium and do not actually believe that the port itself introduced problems --- although I'd be a little concerned about any additional crypto functionality they ever introduced.

I'm just saying: I wouldn't trust libressl if Vincent Rijmen wrote it. :)
That's... not what labor laws cover.

These ships also have an electronics engineer aboard to take care of such stuff. That's aside from the usual team of marine engineers handling the heavy equipment. In this context, the electronics engineer handles everything from the office equipment to the deck cranes. The engineering team handles the actual engines. They kinda step on each other handling the smaller equipment around the engines (steam plants, pumps, etc -- yes they have steam plants).

And they have excellent machine shops. I expect a consumer joystick to be a) simple to fix and b) cheap and small, so plenty of spares on board.

Source: sailed aboard oil tankers.
i hope that twitter has 24/7 team to respond to this.
Hey, my dad was aboard that one.
It isn't self-reflection. It's a talk he gave to an audience that puts his research into a current events context and provides a backhanded roadmap to the kinds of crypto research topics that are important to the project of securing the Internet against the NSA. As that, it's pretty effective.

It's pretty hard to make a credible argument that Bernstein and Schwabe and Lange did a poor job with Nacl, since the next best alternative is Keyczar, which might not even be maintained anymore. What's the other credible high-level crypto library?
What an oddly specific question.

Angellist (angel.co) has 21 startups listed in China (from what I can find). Couldn't see any that were hiring for Java at the moment, but might be worth a shot.
This is pretty awesome – I’m writing a Python extension in C++ that piggybacks on top of NumPy dtype codes, and I thought that I could “just” use templates to deal with dynamic typing. It proved to be waaaay less straightforward than that, and I had to hack through a lot of stuff with cumbersome macros, and wound up with a gigantic binary image as a result. Actually doing type erasure in C++ (which type erasure, as I understand, is like de rigueur in Java) cuts through all of that cruft… and so, to the refactormobile! Yes.
There's absolutely no inherent problem with tax cuts for the wealthy - or anybody for that matter.

The problem has always been deficit spending. That spending wasn't cut with the tax cuts; or that tax cuts weren't paid for out of surplus (which obviously the modern US Govt. has rarely had).

For example, had George W. Bush not gone on a massive spending spree, there would have been zero deficit problem during his presidency in relation to the tax cuts. The problem was the extreme spending increases during his eight years, combined with cutting revenue.

There's no inherent moral basis to claim rich people should always get soaked on taxes, even when there's plenty of revenue such that you have a surplus - it's a question of balancing.

I'd argue unchecked spending expansion, drastically faster than the rate of population increase (ie what has happened in the last 13x years), is far more destructive than tax cuts for the wealthy. If you run a disciplined budget, and an efficient government, you will more than likely be able to bring down taxes for all people over time. The US has done the exact opposite lately, as have so many other failing welfare states across the globe.
Note: We created in 20 hours at the TechCrunch Disrupt hackathon, where we were 1st runners up.
--
Appilepsy is a mobile app that detects if you are having a convulsive epileptic seizure through an intelligent algorithm which analyses accelerometer data in real-time in your phone's background. Following the detection of a seizure, the app runs a countdown for an adjustable amount of time in which the alarm can be deactivated, in case of a false positive. If the alarm is not deactivated, the app automatically sends your emergency contacts both a text message and a computer-generated voice message utilizing the Nexmo API. The text message contains a link to our web app, which is a responsive site that works on any screen-size. This site displays the location of the phone at the time of the seizure on a map generated by esri's arcGIS API, as well as a link to citymapper for directions to that location. While the app sends these messages, it provides real-time updates of whether the emergency contacts have seen the message/received the call. It also provides a map to the nearest medical facilities and instructions for people aiding the person seizing via computer generated voice commands. http://appilepsy.phil.bio/
Well, I guess the whole reason for their blog is to garner interest in the product and good for SEO etc. However, it's still can be somewhat interesting :)
No, it's not absolutely critical. You can do a lot of your own programming without using hooks and forks. Your programs will be somewhat simpler - and whenever you need to use a variable in several places, you'll have to explicitly name it - but still.

Incomprehensibility happens in part because all ASCII characters are used - so you have a lot of differently-looking symbols; because [ and { aren't paired with ] and }, and " isn't paired either; because you often have . and : as the second character of built-in entities, so you've got a lot of dots... APL used the symbols invented explicitly for those purposes, but the price - non-ASCII alphabet - was considered too high. So - no, I wouldn't say forks and hooks are the source of 90% of uncomprehensibility.
When Will Self Driving Cars Become Mandatory?
I wonder if he's actually qualified for any bug bounty given the public announcement, even with the dangerous parts blacked out.
Even better, they can bid based on the IP address range and only pay for the suckers they target. Why go to the trouble of making a harmless ad when you'll never need to show it?
Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).
A stupid 1am question: is it common among ops teams to replace these "common" binaries by a honeypot-like wrapper which notifies the security team immediately, just in case of a complete meltdown on the web developer side?
that is not ShellShock, but it can potentially exploit ShellShock, which points out how dangerous both this and ShellShock are.
Sorry, any citation on people saying that boys failing is a success? And this is "boys failing", not "girls succeeding". Two counter examples from NYT alone:

http://opinionator.blogs.nytimes.com/2013/02/02/the-boys-at-...

"The rise of women, however long overdue, does not require the fall of men."

http://www.nytimes.com/2010/03/28/opinion/28kristof.html?_r=...

"At a time when men are still hugely overrepresented in Congress, on executive boards, and in the corridors of power, does it matter that boys are struggling in schools? Of course it does"
Drinking pop daily can shorten your life: Study
Looms and the history of looms were featured on 'How do they do that' (or a similarly titled) TV Programme that is shown here on channel Dave. Looms are pretty well known in the history of computing and we learned about them during our A Level and Degree (UK) ... but I love to see rather odd historical 'computers' or programmable devices.

It'd be neat to see a loom take either punch card or textile as input. So you could write to the textile, use it as memory and instructions. Then when the program is finished just cut it up and make a rather fetching cardigan from it (the textile, not the punch cards - silly!)
... by the kinds of people who pick cryptographic primitives because they were authored by Bruce Schneier.

(ducking)
Swimming Nanobots Carve Out Next-Gen Computer Chip Lithographic Features
<__>: it's fake

<__>: the SSL seal is missing

<__>: it's a javascript edit

<__>: open a https site in firefox and look at the addressbar

<__>: sec

<__>: yeah

<__>: it DOESN'T appear if you used a javascript hack to make it go away

<__>: and changed the page
d3.js/vegas as a bit of a learning curve but I don't use I could ever go back to any other libraries.
Also featured on Connections (BBC James Burke). A particularly memorable episode.

https://www.youtube.com/watch?v=itd-4lMoXgI
I tried to understand your comment twice, but it doesn't work for me. Figures, the comment is wrong.
Sorry, I don't have an answer to your question, but in theory, how would it detect an intrusion for automatic notification? It seems to me that detecting a bad operation from a good operation is the same thing as securing the system. A vulnerability would likely sail past any such notification system.
The other problem is what little vetting the ad platforms do is easy to circumvent when they allow advertisers to host their own content. A few years ago the New York Times was serving out malware because they approved an ad and later the advertiser swapped it for an exploit.

http://bits.blogs.nytimes.com/2009/09/14/times-site-was-vict...
Apps to Watch: Mango, Boldomatic, Typic and Others
Does government itself work? I think that is what people need to ask themselves.
Without setting up an evil-twin network, if the wifi network has client isolation turned on (i.e clients are only able to speak to the router), is it possible to perform ARP spoofing still?
I think there are a couple of things that would have to happen in order for that to work:

1, we would have to set up a global registry for SSIDs, like we have for domain names. (Otherwise, what's to keep someone else from using a colliding or misleading name and getting a certificate for it?) And even then you run into the problem that the CA infrastructure used for the web is pretty terrible.

2, clients would need some kind of policy database to know what kinds of traffic must go over a "secured" AP and what kinds, if any, can go over the local coffeeshop's or convention hotel's wifi.

And all of this to secure just one link of the communication— all the rest remain vulnerable. Really what we want is end-to-end encryption, not link-by-link encryption. If you have #2, for example, you could instead use that policy database to implement mandatory IPsec (or equivalent end-to-end encryption; MinimaLT if you prefer) for all sensitive traffic, and bingo, you're secure against whole classes of attack even when you are using unknown APs.
While I would love to say 'just be reasonable' you should take some care here as you could be breaking the law by emailing people without permission. While laws differ by country you are best doing 3 things;

1) Include a check box saying you will mail people when they give you their email via sign-up. It's generally considered OK to pre-check this these days.

2) Distinguish promotional vs service emails you send. Its generally OK to send service emails without pre-consent e.g. new terms and conditions but you need permission to send promotional emails e.g. New refer a friend program.

3) Include an easy to find stop contacting me link on every communication. Don't try to hide this or make it difficult to use e.g. login in to update preferences. If people start marking you as spam this could hurt your ability to communicate with users once ISPs view your mail as lower quality.

Additionally I would avoid doing pop-up/notification style prodding. Any app that does this to me gets removed quick smart. Perhaps do this one time to update your current base but if you do this with any regularity any short term gains will likely come at a long term price.
Correction: Mark Suster was the VC who notably responded to the Kauffman critique:
http://www.slideshare.net/msuster/final-2014-pre-money-deck
So does MasterCard (for "3D Secure" 2 factor auth) - I had to do a whois/traceroute on the domain before I trusted it the first time.
spoken words...? so we are searching the audio of the lectures?

how were you able to access the coursera videos without registering?
“Moral Combat”
> There's absolutely no problem with tax cuts for the wealthy

The data say otherwise.

> The problem has always been deficit spending

No. In Kansas they cut spending along with taxes (no choice -- a state can't run a long-term deficit). The result has been such an unmitigated disaster that even many prominent Republicans are now supporting the Democratic candidate for governor.
I proposed something similar to this as a way to handle fraud or non-performance in Federal contracts:

https://plus.google.com/u/0/+StevenFlaeck/posts/BNzLK4wwwPY
Even though the icon looks like it was made for OS X < 10.10.
Oh, I'm sure the guy could cope with the world changing. But can his future boss? You're acting as if that were in his control.
In case anybody is still interested, it's now up on http://kparc.com/cs107/readme
Apparently Sha1: http://csrc.nist.gov/groups/ST/toolkit/documents/dss/NISTReC... - Appendix 4-7

Which is fine, given that even today Sha1's preimage resistance is not practically broken.
There's a thread on Reddit from a few years ago that gives a more mixed picture. Sure, the C code is terse, but that comes partly from doing things like deferencing pointers without checking they're not null. One of the Reddit commenters describes it as "optimistic" coding. http://www.reddit.com/r/programming/comments/8cckg/arthur_wh...

Without wanting to psychologise this too much, when I put the reckless coding practice together with a paragraph like
"Whitney is no respecter of rules. One of the scariest things I ever did as a young man was following him through central Toronto on a bicycle."
I get the impression Whitney thinks he doesn't have to follow other people's rules because he is an infallible genius. Seriously unbecoming and offputting.
A naive approach could be defining that the software stack to use is under /opt/twitter/ and everything under /usr/bin/ and /bin/ is just a honeypot, so any legitimate developer using those would also trigger a notification. But anyhow, it smells like overkill, the wrong place and not worth the extra mileage. The only case I can think of where this would be useful is when management or timing problems prevent proper and secure development -- which is not a problem ops should solve. Would still be interesting if someone actually does this.
> There's absolutely no problem with tax cuts for the wealthy

There's absolutely a problem with relative tax burden shifts from the poor to the wealthy (which is what tax cuts disproportionately for the wealthy are), independently of overall spending/tax balance.

Whether deficit spending is a problem is a completely separate question (though I'd argue that the simple "deficit = bad" position is ludicrous, current spending in excess of revenue is good or bad based on what the spending is for and what the rationally expected outcome of the spending is; sure, interest has a cost, but there are benefits to weight against that cost if the spending is well-chosen.)
Thanks for that. Man, Robin Williams would've played the heck out of a Feynman movie..
Safari is sending every search query to Apple
Hey, I'm Writing a Book About Uber
It's also over what, 50 times as much as the production cost?
How is this different from creating symlinks?
Once you have a central authority that everyone trusts, what does the blockchain add?
I rent one on BuyVM (http://buyvm.net/). I use it to run an IRC bouncer and an IRC bot.
The Ending screen is the best thing since using Paint on Windows 3.11 :D
Money is speech. Freedom of speech doesn't mean standing on a soapbox in a public square denouncing King George. It covers most forms of communication; oral, print, radio, tv, internet, billboards, you name it. Just because the 1st Amendment doesn't explicitly protect PACs doesn't mean that they're not an extension of what the Founding Fathers meant to protect.
Are we supposed to be surprised or outraged? Or just think, "well, dadgum, they're correct!"? Because as near as I can tell, it's always been this way. US public schools have always trained kids (train - not educate, that's for the upper classes) for a world that no longer exists.
Registering is free and transcripts are provided for each lecture.
Does anyone know if it's possible to buy these online from somewhere?