skysight-inc/HackerNews huggingface dataset:
FB engineer here. We got extremely lucky then went the backronym route as shawabawa3 guessed.
To be fair these are not rules, just best practices, like naming conventions.

i.e.

> 2.1. MUST NOT use "return"
> 1.1. SHOULD enforce a reasonable line length
> 1.5. Names MUST be meaningful
*(x, xs, xss, ns, are meaningful names by the way)*
> 3.3. SHOULD NOT apply optimizations without profiling

...
How can one not feel guilty when lying?
How much would a certificate like this actually cost, to someone browsing for ssl certs?
I'm guessing they used something like scallion [0] or Shallot [1].

Bench marking Shallot on an Intel 3350P@3.10GHz:

time ./shallot ^a -> 0.09 sec user
time ./shallot ^aa -> 0.12 sec user
time ./shallot ^aaa -> 0.12 sec user
time ./shallot ^aaaa -> 0.47 sec user
time ./shallot ^aaaaa -> 5.92 sec user
time ./shallot ^aaaaaa -> 118 sec user

Unfortunately OpenCL doesn't work with the nouveau drivers so I can't test scallion.

Who knows how much they spent trying to brute force that onion address.

EDIT: Ok looks like they went the backronym route

[0] https://github.com/lachesis/scallion
[1] https://github.com/katmagic/Shallot
>The pay difference is pretty small, about $1.00

Are you trolling?
Are there other male workers getting hired right now at the same rate you were? 2 years is a long time and it's entirely possible they changed their pay scale in that time. If there are other males being hired right now for higher pay with the same experience level then that is indeed a problem. But I wouldn't jump in without knowing as much information as possible.
Exokernels don't, actually, abstract over hardware. They merely manage resource allocation.[1] So, "BareMetal", is not such an oxymoron, provided you're talking about the kernel itself.

[1]: http://c2.com/cgi/wiki?ExoKernel
FCC eyes more power over broadband providers
I assume he means per hour.
While Facebook gets props for their astonishingly clever .onion address, it seems rather odd to promote unlinkability while continuing to enforce their legal names policy. I'd probably respect this a lot more if it was accompanied by setting up Tor exit nodes, which invites actual risk and things like FBI visits.
Haunted Barn in the UK? Watch to Find Out
Just because you get paid one dollar more doesn't prove discrimination. Your need another sample from a male is newly hired as well.
It's a difficult matter, because there's often a taboo around comparing income - and whether that's a good or a bad thing is up for debate. Good because you get less jealousy (X earns Y but I don't believe s/he deserves it), bad because you can get inequality (same pay for same job / skill level, etc).

I'm inclined to believe it's none of your business and it's something between HR and the new hires (there may be reasons beyond what you can see - did you have much more experience or side-projects out of college for example?), but at the same time I'd like equality or at least to sate my curiosity if I were you.
There is a program called scallion [1] which can generate Vanity addresses like these. I am assuming that they searched for facebookwww?.onion and then just made up the acronym for the last character.

They are therefore trying to brute force the first 11 characters of the address. The author of scallion estimates one can achieve 520 MH/s with a AMD Radeon HD5770 GPU [2] which retails for $190 [3], they then give the formula for calculating the time (in seconds) to have a 50% chance of finding a matching URL:
2^(5length-1) / hashspeed
Which with a length of 11 and a hashspeed of 520M, would take about a year with the one GPU [4].
The total cost of the hardware to have a 50% chance of finding the vanity address "facebookwww?.onion" within a week would therefore be around $11 000 [5].

Imho, this is well within the realms of possibility for a company as large as Facebook and does not suggest a weakness in the .onion scheme.

[1] https://github.com/lachesis/scallion

[2] https://github.com/lachesis/scallion#speed--performance

[3] https://www.amazon.com/dp/B0032F63TW

[4] http://www.wolframalpha.com/input/?i=%282^%285*11-1%29+%2F+5...

[5] http://www.wolframalpha.com/input/?i=%24190+*+%282^%285*11-1...

[edit]

Dustcore is very correct, correcting for my initial mistake, it would take 1.1 million years on a single GPU using scallion. Finding that sort of result in a month would require $2.6 billion worth of GPUs. Now I know facebook is known for spending billions on questionable purchases, but this would be a bit extreme even for them. How the hell have they managed this?
There are only two hard things in Computer Science: cache invalidation and naming things and off-by-one errors.
Like you pointed out JSON is used to transmit data objects, but storage of data objects on the server or local file is entirely different story. I hope I don't have to explain further.
Heh, my first reaction was, 'shoot, they brute-forced an address!' and I see that a lot of others had the exact same idea. I wonder how tough that was to do—I'm guessing that they didn't use Shallot!

Looks like some sort of CA structure is going to be pretty vital to Tor…
Qur'an definitely!
Beware of scary fates awaiting your mobile device
Two aspects one might consider when designing a tax is to make sure that it affects each person slightly, so that it won't be worth it for them to protest against it from a cost-benefit standpoint (which also means spreading the tax over as large a population as possible), and to ensure that it can be collected efficiently, that it is easy to enforce and hard to evade it.

Such an internet tax can be considered actually pretty good from these aspects: assuming it is capped (as was announced after the initial uproar) its fairly small compared to the cost of the subscription, and it is essentially collected by the ISPs, who already have the billing mechanism set up and need either licences for the frequencies they use for mobile internet, or right-of-way for the cables they use for the wired internet service and thus can easily be coerced by the government to collect this tax. (for example, income tax will be collected much less efficiently, due to tax evasion, etc.)

Of course, another aspect is what behaviour the given tax will reward / punish, and from this viewpoint such a tax (in any form) is catastrophic, but these two aspects can a lot of the "artificiality" of certain taxes.
Hn
hn
Also commented downthread, but we got extremely lucky then went the backronym route as shawabawa3 guessed. (I'm an engineer at FB.)
$1.00 * 8 * 20 * 12 = $1920 per annum
I want a Coq kernel!

But seriously, I'm not sure writing the stuff in assembly can also optimise simplicity and manageability. Though we are talking about the obsolete X86 architecture here. More reasonable hardware[1] will likely be easier to compile to.

[1]: http://millcomputing.com/
> If they can do that, what's to stop somebody else coming along and brute forcing a key for the same hostname.

The .onion URL is created by hashing the public key (and possibly more information), and then it is stored in Tor's database of hidden service descriptors as noted by this[1]. This would indicate to me that if there's a hash conflict, such as the NSA trying to take over FB's .onion URL, the database of hidden service descriptors would reject the duplicate insertion to the database.

[1] https://security.stackexchange.com/questions/23241/how-are-t...
Well, not requiring OIDs feels like a benefit grin

(I actually understand completely why SNMP uses OIDs, and why they actually have advantages, but man is it tough to get into SNMP)
Fracking Advocates Urged to Win Ugly by Discrediting Foes
Kodak SP360 Action Cam
This is fundamentally one of the biggest cultural changes we have to make. You have to be ok with talking about your personal earning. In a lot of places talking about earnings is more taboo then talking about sex, and sex is generally taboo.

Company culture of not talking about earnings only helps the company. It allows them to pay lowest market value for anyone, under the (often true) hopes that they don't know their value. In short talk about it, and get other people to talk about it.

I would talk with your co-workers get them to open up about what they make, or have the breach subject in the conversation group while the other person can hear. Talk about what you used to make and what you make now. The key if to give everyone more context. Its important to remember that someones value as a person is not their market price.

The more information a person has available, the better the choices they can make.

[$47/hr, 2 years out of college, east coast]
>I really wish I could play music via bluetooth with this.

I was really hoping for that when reading through everything it could do. I know it can't do everything but most of the power at that point would be on the headphones right? I'd be surprised if that doesn't show up at some point.
CA structure is not vital to tor at all. All connections to hidden services are encrypted and authenticated end to end. the URL serves as the public key.
done > perfect

Every software, pretty much ever has to have core components rewritten, sucks and is horrible. Fortunately, it's just code.

And yes, DalvikVM wasn't very good.
Is it worth bringing up the validity of "equal pay for equal work"? What if this woman isn't as experienced as someone else?

If people actually support equal pay for equal work, shouldn't this apply to every job and industry? Should bench warmers in the NBA be payed the same as LeBron James?
On (Stafford) Beer
doesn't launchd on osx also parse plist xml files? How are those handled?
Agreed fully. It was a bad move to look at the letter (even if it was in the open). Don't follow up with another move that's even worse. Not only will your slip-up become known but you're boss and the new hire will be be mad at you.

Plus, as someone else said: unless you know what male new hires get paid now, there is no evidence of any wrongdoing.

Also: maybe they get some other benefit (e.g. relocation money) you don't receive or you just negotiated better.
> There's nothing wrong in making it clear that the code itself does not target social issues.

I agree, and I suppose if you choose to read my comment completely free of the context of the rest of the thread, my attitude might not make sense. But when you realize he had also said to 'somehow' that he "thought that was the main point of the article?", it's obvious he was missing the forest for the trees.
Yeah, not interested in engaging with someone like you.
Rihanna falls prey to hackers. A nude photo of her was posted
It's MIT https://github.com/johnmq/john/blob/master/src/lib.rs#L3
Conquering Accidental FUD in a Product
Can you blame someone just glimpsing at something you carelessly just leave in the open.

If it's that private why would you just leave in the open like that?

I never understood the problem with shearing how much you earn but apparently it's taboo so i don't share unless somebody asks.
By definition bench warmers do less work (or the same work less well), so of course they shouldn't be paid as much.
caveat: I am by no means an employment lawyer, careers guidance councillor, or anyone with any relevant qualifications! I merely offer this as my own personal opinion, as someone who has been employed in a variety of organisations.

I respectfully disagree with the commenter who says this "is absolutely not your problem". You are right to care about the wellbeing of your colleagues, that's one of the differences between a company (and dare I say it, a 'team') and a collection of freelancers. As far as you know, you've - inadvertently - uncovered evidence that your company discriminates according to gender, and that's a serious matter. Maybe it's not illegal, maybe the company has no real problem with it, but you do, so I feel you have every right to bring it up.

What might happen as a result, of course, depends on the company culture and the opinion of your supervisor (and their supervisor, etc.) The best case is that they've made a mistake, will be very grateful to you for bringing it to their attention, and your colleagues will thank you for your intervention. In the worst case, they'll fire you for meddling where you shouldn't and, if that's illegal in your jurisdiction, you'll need to decide whether to open a claim against them - either way, that case doesn't sound like fun.

Another option is to have a candid discussion about salary with one of your female colleagues. Your company might well discourage that kind of behaviour, but I'm pretty sure there's nothing illegal about it, and it's certainly not immoral IMO. If you're talking to the person you know is being paid less, they might appreciate you empowering them to deal with it however they wish, rather than fighting their battle on their behalf. Although be prepared to offer support if it's requested. After all, if it's really an insignificant amount, they might want to leave it, and you might be OK with that.

Ultimately, I think you need to tread carefully, but evaluate a) what sort of company you want to work for (if they react badly to you raising this, maybe they're not worth it, if you can afford such principles) b) what sort of colleague you want to be.
And in response to the valuation, they could of changed their math; But in the last two years most economies have had growth, so that value to go up to adjust for growth and inflation. The only real reason I can think of that value going down is much more supply to the work force, which I know isn't that true.
Agreed. Likely they required facebook, and required that the rest of it would form words from some dictionary. I'd guess that the "i" at the end is a random alphanumeric (2⁵ possibilities). The positions of the words were likely arbitrary, since www comes after facebook.
Lets arbitrarily say they have a word list of 128 words, that they want words from, all four letters long.
This means we have 2⁷2⁷2⁵*4!/2 ~= 2²³ acceptable possibilities(the division because of the order of the random words).
Let's say you want to update a typo in a lengthy document, I think it's worth the trouble. Good diff algorithm is hard, but there is open source solution.

http://code.google.com/p/google-diff-match-patch
It's been hinted but to make it explicit: we are in more difficult economic times than when you were hired. Maybe every new hire is getting less than back then, irrespective of gender.
So, if you feel incredibly strongly about this, you as a minimum need to gather much more evidence before you can even be sure there is a problem. But you might be better just letting the people more directly concerned identify and address any problem that may exist for themselves - or are they inferior in some way that means you have to do it for them?

... and the next time someone leaves private correspondence in the open, cover it or turn it over without reading it, and tell them at your first opportunity. That way, maybe they'd pay you the same courtesy.
Tor still uses SHA1? I understand clueless download sites (such as FossHub) and projects still using MD5 and SHA1, but I would hope projects that are supposed to be about security would've stopped using SHA1 a long time ago. If they dread moving to SHA2 because of its much slower performance, they should at least use BLAKE2 [1].

Even NSA-influenced NIST recommended against using SHA1 after Dec. 2013. And when NIST recommends a deadline for change, you know you should be doing that at least 3-5 years earlier to be safe against state sponsored/NSA attacks.

[1] - https://blake2.net/
In Europe we don't really believe in "it is your choice you make" (on other topics) because there are so many factors which prevent you from making this choice freely.

For example the choice of accepting Samsung's TOS could be bundled with the choice of flatsharing with someone. Or being a guest of someone. If you need to refuse attending a party because you've made the choice of disagreeing with Samsung's TOS, you're forced.

It is a classic feature of commercial products: Bundle the choice with something much bigger (such as: socializing) so people don't really have the choice of saying no. Worth saying that if phones were invented under a European jurisdiction, they'd be full of infinite more or less relevant option lists. Ironically that's probably why they weren't born there.
The big reason for the taboo against talking about income is jealousy. Almost every job feels harder than it looks, and almost everyone feels more skilled at their work than they look.

So if you tell someone your salary, your job probably feels more difficult to you than it looks to them, and you probably feel more productive than they think you are. If you make the same or more than they do, there is a very high risk that they will think you are overpaid.

This is obviously a risk to the company, which is why most companies (at least in the US) have a policy against it. But it is also a risk to you and your relationship with that other person, which is why few people share their salary information with their friends.

You are right that this is a fundamental problem for equality. But it is not an easy or safe thing to change, which means it will take a lot of time and effort.

I am not saying that the status quo should remain. I'm just pointing out the reason it is difficult to change.
Agreed 100%. I find the "don't talk about it" culture surrounding pay in companies pretty disgraceful. In a more civilised future, I'm pretty confident all pay will be totally open and public, and a swathe of problems will be solved as a result. Sure, there will be an awkward transition period, but progress is usually challenging.

[38K, ~15years experience, tiny non-technical startup in London]
The url isn't facebookwww? though, it is facebookcorewww?. The additional 4 characters didn't have to be "core", but the fact that it is an english word and relevant adds significant difficulty to your estimates.
What about using a more modern, future-proof TCP/IP stack like PicoTCP? https://github.com/tass-belgium/picotcp/
Good point that stopping pedophiles from using the web won't stop pedophiles. It's that kind of global view of these things that we need more of, and I suspect was missing when this tax-bandwidth idea was put together.
E-stonia Wants to Become the Uber of Economies by Introducing Virtual Residency
Turn any webpage into an API
As @wernerb already pointed out, the idea is to use context.become such that inside your actor the only side-effects happening are due to context.become, otherwise the data structures are left immutable, the helper functions are left pure, etc... and it becomes easier (less error prone) to manage complex actors that way.

Another side-effect of this for example is that you're not going to worry about vars that leak into Future computations, which is a mistake that even experienced developers are doing, because it's an easy one to make.

Here's your sample translated into a state-machine with 2 states: https://gist.github.com/alexandru/63eebe8e49e796f31e73
So Eve could also get a cert for facebookcorewwwi.onion?
A good proof that "Worse is better". By using a worse implementation, then gaining market share, then fixing the core architectural problems bit by bit, Android was a success. Plus it had some really good ideas in there from the beginning.
How offensive is (Arch) Linux community anyway
This is one reason why we'll all be better off when our cell phones are disintermediated. That is, we will have one or more wireless modem devices, and one or more voice communication devices, and they will be connected through a personal network. With that setup, we'll be able to proxy the voice comms to keep it under control even if it's vulnerable to hacks.
OpenCV – Single command installation
Ultimately, though, you should be able to eliminate jealousy because a) you pay everyone exactly what they're worth b) you don't hire irrationally jealous people :-)

(oh, and c) you pay everyone a decent base so that they really don't have anything to complain about anyway)
Depends, multidomain certs aren't horribly expensive. Non-EV multidomain certs usually start around $100 and cover 3-5 domains in the "base" certificate and you can pay $10-20/year more domains. EV multidomain certs start around $300 and usually cover 3 domains and additional domains are +80/year
Privacy, or Something Like It
Etsy’s Trying to Fix Tech’s Women Problem
People need to be ok with talking about it, but at the same time, it still should ultimately be each person's choice to talk about it.

[$67/hr, 2 years of experience, senior frontend engineer, Palo Alto]
This is really terrible practice. You should only do this if you really have no SCM available.
That is extremely lucky. That's, what, 82 bits if you'd chosen the whole thing?

A more manageable 61 bits for 12 characters or so, from my recollection. Did you pile a dictionary attack on top of that?

I don't believe this does "break hidden services". That's just a truncated key fingerprint, not the key, and a collision would I suspect (but haven't checked) be a loudly visible error.
Weekly news roundup for app monetization
This exchange made me grin :)

To add some value to my comment, here's a cool video from one of armadillo's test rockets: https://www.youtube.com/watch?v=9u0qlIoSSkQ
Reminds me of this scene form The Departed (great film):

> Patriot Act. I love it! I love it! I love it!

https://www.youtube.com/watch?v=GdqEuLhlexY
Whatever one gets, one wants more or something else. In general. He's not an exception.
Really, you should be paying someone based on their position and performance rather than their experience. Of course, this is difficult to do right away. Anyway, the OP addressed this: his female coworker has exactly the same level of experience.
This fear of sharing income information is crazy. Get over it.
Did anyone else read this and get the feeling they'd absorbed words but learnt nothing?

To be honest I don't know enough about the argument for/against to form an opinion. However this article did absolutely nothing to sway me. The article gives a couple of "reasons" as to why stack unwinding is hard, and seems to imply that they wouldn't be an issue with API level error reporting - but doesn't explain how or why or give any reasoning or practical examples.
Accessing an .onion address via Tor is slower than accessing a normal website via Tor. If this onion service is now the official way to access Facebook via Tor and direct access doesn't work well, then this is slowing things down.

Tor's current support for detecting usage is patchy. You can't query a random third party website for every login for a system like Facebook, so you need a list of IPs that can be refreshed quickly. But such lists tend to be incomplete or behind e.g. the "exit" flag doesn't mean what you'd intuitively expect, so it's sometimes possible for Tor traffic to turn up from an IP that is not identified as an exit.

Re: MITM security. Even if Facebook got lucky here, we're talking about an 80 bit identifier and brute forcing these has been demonstrated before, I believe. I'm not sure this is much of an upgrade over just regular SSL CA + HSTS pinning.

(edit: last paragraph)
(De)websockify SSH to avoid lockdown in hotel rooms
If jealousy is a common trait amongst humans, and it doesn't interfere with their ability to do their jobs, then why would you choose not to hire jealous people?
Project Ara Module Developers Conference
How Confirmation Bias Can Lead to a Spinning of Wheels
who in software gets paid an hourly wage?
It does most of the same things - the objections to systemd around covering multiple overlapping areas in a single project would also apply to launchd (and the Solaris SMF).

The best way to make cron / at / sysvinit / syslog / daemonize / xinetd / supervisord fans happy is to let them keep using cron / at / sysvinit / syslog / daemonize / xinetd / supervisord.
Season of the Witch: How the Occult Saved Rock'n'Roll
Scala Best Practices:

1. Don't use Scala
2. Rule #1 is blatant opinion.
Slack raises $120M Led by Google Ventures and KPCB at $1.12B Valuation