skysight-inc/HackerNews huggingface dataset:
It's more complicated than that. Windows doesn't have true inodes but rather uses the name alone to identify files. So you can't unlink any open file. (Try to delete a directory when you have a command prompt open in it.)

Windows did hack on a form of DLL versioning in the form of isolated assemblies. It's ugly and complicated and Microsoft still resorts to suggesting that you avoid DLL hell by bundling local copies of all your shared libraries. Which kind of makes me wonder why they're even called "shared" at all. May as well just statically link.
FBI is now an "organized crime" cartel. It is the Mafia.

This is not unlike the corruption at high levels in places like Russia, China etc. There, they have a grey zone between law enforcement and criminal organizations. Think of it as "regulatory capture" but in respect to law enforcement. Here there isn't as much of a grey zone (yet?), it is more isolated, but the acting above the law bit is the same.

You can look at it as both being a bad thin in an of itself but also a signal (proxy) for deeper and more serious issues coming down the pipeline.

The one thing that FBI has is better technology and resources than any of those other criminal organizations. So any corruption no matter how small will be amplified many times over.
AppSec doesn't solve their problems.

The startup problem is that they need a good product to attract users. If they have no users, poor security doesn't affect many people and can be tolerated. So all their efforts go into improving the product from an end-user standpoint, and security is left for a time when there are enough users to justify.

Security and moving fast are often at odds.
Tengentially related, you'll probably find this case interesting - the police didn't break the law but it's one of those corder cases that's ethically very troubling: http://scholar.google.com/scholar_case?q=mcgacken&hl=en&as_s...

I don't mean to suggest that the police officer here was unethical; it's a structural fault in the law itself.
Of course, it's an intuitive comparison to make. I'm glad you like it! I'm looking forward to working with you and similarly insightful community members on improving osquery for everyone :)
Note that the "within hours" is in the past -- if you didn't patch rapidly on 10/15, you should assume you're compromised.
Ask HN: What are the best designed websites you ever saw?
For inspiration and learning how others are solving design problems, I'm looking for the (in your eyes) best designed websites you know of.

Ideally they should be responsive, work on decently current browsers, and the overall user experience should be good.

Thanks a lot for your posts!
Martin
Nexus 6 is already sold out
As someone who has been coding web apps for a very long time, it feels odd to say this, the PostgreSQL community is doing some very interesting things. I'm excited to see where things go.
THIS. They need to add a "buy now" button or a "pre-order" button. A price estimate would be nice.
Microsoft lays off another 3000
yeah, sure sarcarsm
state school in Kansas or Utah is better that Humboldt University of Berlin or Sorbonne University. Do not flatter yourself.
There are good schools in USA but you can not say that state schools are better than most schools in the rest of the world. It just shows that you as narrow minded and knowing nothing about the world. You do not want to be perceived like this, do you?
The "move fast and break things" mentality is not saying that its good to break things, it's saying that breaking things is the price of moving fast. Failure is bad, but so is being over-cautious. We all already know that failure is bad. No one like to fail so we don't need to keep saying that failure is bad. People often lose perspective and think that it's not worth taking a sensible risk, so we say things like "If you're failing, you're doing something right." to encourage them.
Do you think it would be fair to refer to football (either one) as a sport with a cult following?
Well, they obviously can.

Whether or not they should, OTOH...
Check the Reports to Increase Your Odds
With all the news and tips on Breckenridge fly fishing at your fingertips, there is no excuse for a bad day of fishing. Checking the most recent reports for the most up-to-date information on water flow and hatches can assure you are ready for today’s catch. Check the Colorado fishing reports to increase your chances of a successful day of fly fishing.

Find out whether you should be fishing on the Colordado River or Blue River. Benefit from reports of where other people have found the fish biting. Catch everything from salmon to trout with the added advantage of fly fishing news and tips. Some of the best fishing of the year is happening right now. Find out where.

http://fishcolorado.com/news-and-tips/
I'd be mildly interested in using this as a "Kids can type things ...." doodad, except there keycaps appear to be all blank. Is there an option to get keycaps that are not blank?
No, I'm saying exactly what you are saying. Don't pipe to the shell from curl, download it first, then inspect it. Btw, I can trust a linux binary, because I can verify through checksums, posted on the download site and elsewhere that the binary matches what I expect it to be.

As well, OSX won't let me execute unsigned binary code from unknown developers, unless I manually overwrite it.

The pattern of piping a script from curl and executing it, isn't one I'd expect a site that claims to care about people's privacy to champion. This seems to be exactly what you are saying too.

Why didn't the site owner say, 'curl this script', inspect it, here is the md5 of what it should be, then execute it? Why the cuteness of the direct download and execute? That is my critique.
>and that modular HW was really only good for games

Yes modular hardware is great for games, and for computing components in general. The highly specialized component manufacturers that popped up around the IBM ATX/mATX/ITX/mITX PC form factors allowed for the multi-billion per year Graphics Card, Hard Drive, Ram, etc. and for each to compete internally.

This internal competition over real estate within a computer has driven a lot of hardware innovation. And with servers also conforming to these standardized form factors, we now see almost everything running on x86_64 ATX form factor components.
What are some ways you could find such companies? So basically freelance, build a solution for them and then productize it?

Yeah working for free seems to be quite risky. I mean, if someone isn't willing to even invest or risk then it might not be even worth a product.
>but as with the browser they're only delivering changes because third-party software innovated them and it's making them look bad.

How is that a bad thing? Firefox was kinda stagnant before Chrome came around and took the performance throne, I don't see anyone criticizing Mozilla for that.
More like leadership training, problem solving. There are many critical skills beside job skills.

However ignoring job skills won't get you a job. It'll be a hard sell to get their students hired, especially at any kind of specialty. There's just too long of a runway for many things - art, law, medicine, chemistry, engineering. What does that leave?
Usually poor sales isn't an indication of lack of features so much as the wrong features. Features that users don't use are worse than features that don't exist, because they clutter up the UI and make the product harder to use for everyone that doesn't use them.

Start building into your workflow a regular evaluation of "Do my users seriously love this feature? Does it engender a strong positive emotional reaction for a significant fraction of people?" If the answer to that is "no", then kill it. Remove it from the UI and rip the code out of your codebase. As a side benefit, you'll have less of an urge to rewrite from scratch all the time, because the codebase will be smaller and more manageable.
Great article but I wouldn't call this quick. It's quite in depth.
Well, it depends on the cost of a breach, and the probability thereof. Those in turn depend on how you choose to calculate them.

If my company leaks our customer's e-mail addresses and plaintext passwords, how much cost is incurred? Is it a huge cost, because some of the customers have reused their e-mail password and they lose a bunch of personal data and accounts on dozens of sites? Or is it a small cost because they should have followed good security practices by using different passwords on different sites, so it's their fault they had more than an e-mail address leaked? Or is no cost incurred at all because hey, it's our customers not us who suffer from this. It's not like we're going to pay them any compensation!

Likewise, if there are hundreds of people scanning the web trying to exploit the security problem and it's easy to automatically detect, it's almost certain to get hit - on the other hand if it's difficult to find or exploit the risks may be lower. Of course, if you coded the bug in the first place, you might not be informed enough to assess this accurately.
HTML 6 Spec
No, it's crap, so the only people that do that are beginners, command line tourists, or people using one of the very small number of console programs that support the mouse. Regular console users use the QuickEdit mode: left click to enter select mode, drag box - or double click to select a space-or-line-end-delimited region. Then press return to copy or esc to cancel. Then right click to paste. Squint hard enough, and it's almost like using xterm!

(Bonus feature: you can halt unexpected TTY spew by clicking in the window, giving you a chance to examine it.)

QuickEdit still doesn't fix the box select thing (at least not pre-Windows 10) but it's a massive improvement nonetheless.
This is a great example -- thanks.

So, is it fair to say that there's no privacy concern if the API only exposes a one-way lookup? I.e. "here are the access points I can see -- where am I?"

That also addresses the other concern raised below, that the database could be used to search for known-vulnerable routers.
The SQL engine part of osquery is backed by SQLite's parser, lexer, query planner, etc. MySQL would be awesome as well though, mostly because of how easy it might be to integrate the MySQL remote access protocol to do remotely authenticated queries!
Author of the original post here. Happy to answer any questions!
FINALLY! \o/
TL;DR: Store your bitcoin on Coinbase, without giving up control of your private keys.
Indeed, when I first heard about Perl 6 so long ago, it seemed to be trying to remove some of the most quirky, but also most useful features of Perl 5. I more or less immediately decided to ignore it, so I haven't followed what's been going on since apart from being secretly pleased that it has never really shown up.
That's precisely it.

It's simply not realistic to have a group of law enforcement officers to investigate their own alleged wrongdoing and expect them be impartial.
How many different merchants to do you deal with on a regular basis?

What is the risk of fraud or of bad product and or bad vendors when both ends know each other? Why introduce a 3rd party in those transactions that gives back a fraction of its fee to the payer? (5) Instead why not reward repeat business with preferential pricing? (not directly possible but attempted via loyalty programs that cost a lot to deploy)

The credit is provided by the issuing bank (4). It can exist independently of the credit card network.

And with any electronic means, 1 is pretty much a given.

Credit 3rd parties still have a reason d'être if a solution that shortcuts VISA and MC when both ends know each other catches on. A Credit 3rd party is needed as an insurance policy when two unknown parties do a transaction; that insurance is bound to cost more than today given less volume; but it could be efficient if pricing would be market driven instead of diluted in 100-1 day to day transactions.

Thanks to the down voters, BTW. Again HN is showing openness to look at things from a totally non conventional angle. I think I'll log off for good. So long, and thanks for all the fish!
I once quit halfway through an application to some company (a consulting firm? this was years ago) because the web-based form wouldn't let me advance without filling in information about my high school that I no longer have.

I did have all the information about my AA and BS, but apparently that wasn't enough.
Maybe the problem is perfectionism. For me it's often hard to know how important what is. So it's easy to get stuck in a problem that is not that critical right now.

I hope that helps a bit, Martin
> COINBASE KEY: The only key that Coinbase stores.
> SHARED KEY: Encrypted with your password and stored
> both by you and Coinbase.

Are these the same key, or is there an inconsistency with the language here? How many keys does Coinbase store?
Ah, I saw this when it was released. Essentially, Sᴘʀɪᴛᴢ is a polished RC4 with knobs on. Two big things to point out:

Firstly, security: "Further cryptanalytic review is recommended before this cipher is used in critical applications." I echo that. Have fun cryptanalysing it by all means, but please don't use it. Many already have deep concerns about RC4, and I know I wouldn't feel too comfortable with anything particularly RC4-like, because it's not clear to me yet how pending public results on RC4, or unpublished "cryptanalytic breakthroughs" from Nation State Adversaries (cough) may or may not read on ciphers with a closely similar design. Doesn't inspire confidence.

Secondly, speed. Sᴘʀɪᴛᴢ is not winning any speed contests; in fact, it's pretty much coming in dead last. Looking at cycles/byte (lower is better), in generating sustained keystreams, which is the kindest I can be to it, Sᴘʀɪᴛᴢ clunks along at 24 cycles/byte on their Macbook Air's Core i5, which I think is an Ivy Bridge? For reference, taking the eBACS benchmark results from SUPERCOP, the modern stream cipher CʜᴀCʜᴀ20 runs on an broadly-equivalent processor (h9ivy) at 2.75 cycles/byte—nearly 10 times faster than Sᴘʀɪᴛᴢ! Ouch. http://bench.cr.yp.to/results-stream.html - actually even AES-256, in software, is faster at encryption. From the paper, I also think it's slower at hashing than SHA-512 or any of the SHA-3 finalists.

While the authors note that theirs isn't a particularly optimised implementation right now, I unfortunately don't think there's too much scope for improvement, because what it shares with RC4 are the characteristics that bottleneck performance - if you're code-golfing for minimum code size, fine, but for speed optimisation it shares the same 8-bit-oriented structure with a huge state (bye-bye hardware implementation) and pipeline stalls due to iterative dependencies. This overall design pattern may have made some sense when RC4 was designed, for an 8-bit CPU with no cache, but not so much now - they acknowledge this in the paper and in fact suggest "other word-oriented architectures may be a better choice than the byte-oriented RC4/Spritz style". I agree.

Should you use it, at all? Oh heavens, no. I see nothing to recommend it whatsoever. I do think it's kind of cute though. Made me smile.
Its also 'static' to assert that people not like you are dumbheads. Not productive; not even right. You want a discussion, you pitch it at the level of the others in the discussion. There's a large spectrum, and always newbies coming to the arena (or the arena is dead).
Please just let MySQL die.
> but I'm pretty sure it's not illegal for me to lie about who I am to a girl at a party to further my goals.

Right. I was talking mostly about lying to the authorities. Why can they lie to us, but we can't lie to them?

> How about police officers? Do you object to undercover officers?

That's a good question - I don't understand how it works well enough. If my spouse is having a heart attack and I call 911, can an undercover cop pretending to be a paramedic come into my house and then can a search warrant then be granted based on what he saw in my house, even though I thought he was a paramedic not a cop?
HFT does have some benefits that doing this eliminates:

1) It provides markets for securities that would otherwise by relatively illiquid.

2) It compresses the bid/ask spread so that the price better approximates what buyers and sellers are willing to pay.

The people who HFT affects are the institutions that are competing directly with them. For the most part it doesn't affect what you or I should choose to invest in as long as we assume we're investing, rather than speculating. (And even if we're speculating, our time horizon is probably much longer than a HFT firm's.
That's funny because I don't think my computer science classes taught me much about programming (other than learning about deterministic finite automatons) or thinking and the best preparation I had for real world programming came from formal logic classes. Which were in the philosophy department.
It won. Google built their empire on what were at the time functionally over the counter hobbyist computer motherboards.

Today most servers are built with the ATX form factor in mind since dipping into the sweet cheap ATX form factor components can bring big savings.
AppCode joins Swift club with 3.1 EAP
Reddit has already swallowed gallons upon gallons of bad press. Half the time Reddit hits the mainstream news it's about paedophilia or harassment or misogyny. Not saying that Reddit is full of incredibly vile people, but that's the "if it bleeds it leads" news about Reddit that hits the larger media world. At this point anybody who uses Reddit is either immune to scandal or already gone.
>“Why would you spend a quarter of a million dollars and four years to learn to code in Python?”

The "learning to code in Python" part qualifies you to earn in the ballpark of $125K USD per year, on average, over a career that will last ~42 years. ROI is 2 years (after graduation), capital will last literally for a lifetime. What's not to like?

The "quarter of a million dollars" part will give you the opportunity to know and make friends with people that can pay that kind of money out of pocket (not like you, middle class boy, who had to take a lot of debt for the privilege). Those friends will open doors to you and apply a multiplier factor to the baseline scenario ($125K per year). Best case, they will be your co-founders in a multi-million acquisition event. Worst case, you do not do any friends and coat-tail in the fame of your institution (with multiplier factor between 0.9 and 1.5)
As much as I wish it were so, I do not think that is the case at all. What worries them, if anything, is more people using Macs, and more people ditching their PC/laptop in favor of shiny smartphones and tablets.
That's as big as it can be. We started seeing attacks hours after the initial disclosure and shared some of them here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

This is a lot worse than Heartbleed, Poodle and others. Full database / server take over for 700,000+ sites that use Drupal.
I actually like the idea of cutting out the middle man and tying in a rewards program. It is not a new idea as it follows reward incentive programs that everyone from airlines to retail stores have had for years. While we can not be sure that the saved credit card fees will not be pocketed, if they are not, then CurrentC could become something great.

The premise itself I am a fan of. Using QR codes however, not so much. The infrastructure can be changed though, if QR codes become too cumbersome, they have the power to change it.

I was being partially sarcastic in my initial comment, but partially serious.
It seems pretty crazy to me to want to do that. If you need to select that element, why not give it an id or a class? Angular attributes should be considered to be purely directions to the templating system.
I've been using freesounds. They have a large selection of free sound effects: https://www.freesound.org
I'd love to see the exclamation mark requirement removed from the rust spec. It makes macro invocation feel "wrong" or "special" in a subtle way and betrays a lack of confidence in the macro system.

I'd rather the language designers assume that future tooling for IDEs and editors will syntax highlight macros.
As someone who works in the information security space, I've seen this touted over and over again, and repeated as nauseum in the media. However, the only place I see these terrible results is reports from AV Test specifically. And it bothers me, because I can't see why they would rate it a flat zero, when it certainly did not score a zero in their testing.

It feels to me like AV Test is being dishonest with their scoring. I don't know if they have any stake in who buys what product and I certainly don't want to claim they are biased since I have no proof of that, but the way MSE/Defender has been vilified in the media following the results from AV Test, I do have to say rating the product as a zero when it did not score zero feels incredibly dishonest to me.

Zero should be the security you have with no AV, and MSE rates 75%-80% in their testing.
Zork I for the Kindle e-Reader (almost)
But Creative Commons doesn't permit the use of the art past marketing. Not allowed to include it in the actual project for instance. Do I have that right?
>Ideally they should be responsive, work on decently current browsers

So you mean this website? http://motherfuckingwebsite.com/
Case Study Expedia: Hybrid Cloud Framework, Higher Developer Productivity
Good point. Probably not. It needs some sort of outsider status. Which star trek doesn't really have any more but that's debatable.
I wish I could finish a blog post in only one hour. My last few have taken 8+ hours. :)
The time where any of those points could have a meaningful impact on the political status quo has long passed.

Even in extreme situations where governments are overthrown, foreign intelligence agencies have perfected their ability to totally manipulated the chaos to their benefit.

Which is why it is no surprise the leaders who end up taking power are pretty much always puppets for much more powerful external states. Leaving the general populous in even less of a position of power than pre-revolution.
That the process is being memory limited shouldn't make it impossible for another process to read its cmdline. The cmdline data of the process should already be in memory.

EDIT: I suspect that this problem is a consequence of a silly design that argv in the process holds the cmdline. Since apparently you can change the process name by changing argv, see:

http://www.uofr.net/~greg/processname.html

This seems to allow any process to mess with what the kernel sees as the cmdline. I hope there's not a "more" serious security issue hiding.

This is more of a suspicion than fact, I'm planning to look into the kernel code to get more info on that.
Very cool stuff. I started to play with Rust some more and started to really like it. Haven't gotten to macros yet.

I've been reading the official guides. Those helped clear up some difficult points for me: lifetimes and interfacing with lower level code.

http://doc.rust-lang.org/#guides

Also in what seems like a very short time, Rust community addressed the entries in Shootout Computer Benchmark game. Those are toy scores and one should not take them seriously. But unfortunately people do. So they made those fast.

http://benchmarksgame.alioth.debian.org/u64q/code-used-time-...
You'd think they would write a description of the product. Basic SEO.
Then the failure wasn't free. This customer and all other customers paid for this failure. Other customers, who may have done more and more expensive work to avoid failure, are stuck paying for this failure. Insurance thus incentivizes a race to the bottom -- using other customers to finance ones own risk.
Different key. The other key is encrypted with BIP38 with your chosen password. I don't know how the actual interface works, if it is encrypted client-side or server-side. Anyway, on paper it sounds fantastic.
Looks cool, but not sure I could get into it without any sort of haptic feedback.
Login pages in real life