skysight-inc/HackerNews huggingface dataset:
Forgive me if I'm missing something, but I don't see how to "bootstrap" the trust from an existing, non-OpenBSD system.

For instance, for Fedora, the download page I use (https://fedoraproject.org/pt_BR/get-fedora) has a link on the sidebar to https://fedoraproject.org/pt_BR/verify, which has a link to https://fedoraproject.org/pt_BR/keys, which has the full fingerprint for the GPG keys. That page is authenticated via TLS.

So, for me the trust chain for the Fedora installation DVD is:

- The trust chain root is my current browser (a recent enough version of Firefox);

- The browser trusts the CAs in its certificate store (the built-in CA certificates from Mozilla, plus the ICP-Brasil CA certificates);

- One of these CAs verifies the certificates for the fedoraproject.org pages;

- From these pages, I download a set of public GPG keys, and if I want I can verify their fingerprints;

- The torrent for the installation DVD has the DVD image and a checksum file. I use GnuPG to verify the signature on the checksum file, and check the page to confirm that it was signed with the correct key;

- Finally, I verify the SHA256 of the DVD image and confirm that it matches the value found in the checksum file.

I don't know how I would do it for OpenBSD. The www.openbsd.org page doesn't seem to be available over TLS, so I can't use the CAs trusted by my browser to bootstrap the trust chain. If I had OpenBSD 5.5 installed, I could use it as the root of the trust chain (as explained at the link you posted), but unfortunately I don't have it installed anywhere, so that trust path doesn't work for me.

If I had an OpenBSD 5.6 ISO in hand right now, what could I do to authenticate it? (Assume I have a recent Linux or BSD system to start with.)
Programming Language Network: A Graph of Programming Languages
Then it's quite possible that they spend time together but it's time spent in the same proximity but not spent fully engaged.

My partner and I used to have this exact issue (with me being the one who didn't feel like we had enough quality time). She would often retort "what are you talking about? We spend at least a couple hours together every day!" And I'd go and think about it, confirm that, yes, we would often spend the evening together on the couch, with both of us on our laptops working. And then I'd scratch my head, feel confused about the mix of contrasting thoughts going on in my head, and carry about my day feeling uncomfortable about it.

A while later, I came across 5LL and read through it pretty voraciously. It provided context that I'd never been able to put into words. Lately, we probably spend even less time in physical proximity than we did then, but we spend time together where we're both fully engaged and in the moment with each other. It doesn't take much for us to both feel pretty happy about things.

[tldr: quality can be much more important than quantity re: quality time]
Alright, lets remove tip4commit server from picture. So to put you in jail I just need to find any project you work on, find your name and ask for donations on your behalf? Doesn't this sounds wrong to you?

also, people who downvoting here - make sure to read HN rules about what downvotes are for. They are not to downvote different ideas, but to remove useless posts.
Or, you know, you can run WindowMaker. It didn't go anywhere
For someone who likes old radio dramas (Suspense, Quiet Please, Night Beat), are there any good podcasts for modern audio drama? Serial sounds interesting, and is something I hadn't heard about before.
My web development environment
ChatID (New York, NY) http://chatid.com

We're building a quickly growing platform for brands and consumers to directly communicate via chat across any website and on any device.

Our current openings:

* Frontend Engineer - we're building real-time communication interfaces for mobile and desktop web using Backbone.js, XMPP, and BOSH

* Client Services Engineer - work with frontend and client services to help technically support new and existing clients

* Data Engineer - help us build a data pipeline and analytics service to give our clients insights into chat and consumer behavior on retailers. (this one isn't listed yet but if you're familiar w/ Python and skilled in SQL, and NoSQL, please reach out to us)

* You can see all of our open positions at https://chatid.gethired.com/

About the company:

- We're 15 people mostly based in NYC, but also SF and Austin

- NYC office is in Flatiron between Union Square and Madison Square

- Newegg.com recently awarded us a 2014 Eggie award for "Best Marketing Platform"

- We like contributing to open source https://github.com/chatid

Technologies we use:

- Lua and Prosody [https://prosody.im/] an open source XMPP server started by two of our cofounders, one of which is a member of the XMPP council

- CoffeeScript, Backbone.js, Require.js, Angular.js, D3, SASS/LESS

- Python, Flask, PostgreSQL, InfluxDB, RabbitMQ

- Chef for infrastructure automation, but we're working on switching over to using Ansible and Docker

Sound interesting? Send us an email at careers@chatid.com and feel free to reach out to me if you have any questions: jeremiah@chatid.com
The only thing of value to come out of MIRI so far is some Harry Potter fan fiction.
> also, people who downvoting here - make sure to read HN rules about what downvotes are for. They are not to downvote different ideas, but to remove useless posts.

Can you show me where it says that in the rules or guidelines or FAQ?
For one, there's a massive disconnect in distinguishing between the value of the currency and currency as a medium of exchange. For example, most sites and discussions focus on the value of BTC vs USD. Very few look at volatility and transaction volume.
Beyond EXIF, there's also IPTC, which the afore-mentioned Lightroom is pretty good at managing. Couple that with built in geo-tagging of photos thanks to cameras with built in GPS (or do it after the fact with a GPS logger) and you can have a pretty decent system. Both the geographic feature and the keyword feature allow for hierarchies, not just strictly free tagging.
Briefly
The Army's Pentagon Problem
Tell me what part of the physics you find impossible.
Yeah, I don't disagree, I'm just relating what he said in videos 1 and/or 2 about Rust.

Personally, I'm all for having different syntax for different semantics.
As an interested parent (although of a 4 yr old), did she get bored because she hit a wall in what she wanted to do? With HTML its fairly easy to generate a nonlinear text and image based story, but I imagine trying to add any sort of interactivity through the mess of CSS and JavaScript might quickly lead to frustration. Unlike HyperCard, today's technologies don't seem to have a smooth learning curve as you try and build more complex things.
I think the parent commenter knew that, but assumed that the original commenter doesn't currently live in the U.S. If that's the case, getting U.S. citizenship for their descendents could require a more difficult and expensive trip to give birth inside the U.S.
Amazing how broadly applicable Little's Law is. (I suppose that's why it's a big-L law.)

We were just recently using it in business school to look at cycle times in assembly line output.
"By the way, I can't wget a file from rsync.net either :P"

I'm not sure what you mean ... the very few binaries that we link to on our support pages are plain old file links that you can wget/fetch/curl.

No, you can't wget files in an rsync filesystem, but we aren't a file hosting site - there's no public usage here. Actually, we do allow plain old ftp access for legacy systems, so technically you can wget/fetch a file in an rsync.net filesystem. We'd recommend you don't, of course...
The early days of the Internet in Cambridge
> has built some impressive predictive systems

Do you have any links to examples? I'm not aware of any systems built with HTMs that I'd consider "impressive" relative to what ANNs are doing these days, e.g. learning to play Atari games by watching the screen [1], approaching human performance on object classification in unrestricted images [2], or learning to execute simple python programs by reading the source code [3].

[1] https://medium.com/the-physics-arxiv-blog/the-last-ai-breakt...

[2] http://karpathy.github.io/2014/09/02/what-i-learned-from-com...

[3] http://arxiv.org/abs/1410.4615
You haven't actually mentioned any economic principles; you've just compared Bitcoin to a historical bubble (of which there were certainly many) without any evidence supporting this comparison.

>BitCoin is faux money

Could you expand on this? How do you define "faux" money?
There are three concerns raised in this paper.

The first (A) is that TextSecure truncates SHA-2 hashes and, particularly, HMAC-SHA2 MACs. MAC truncation is extraordinarily common and is a design goal for most authenticated encryption schemes. So far as anyone knows, truncation of SHA-2 hashes and HMAC-SHA2 MACs is completely safe; that is, HMAC-SHA2 isn't somehow less safe when truncated than GCM or Poly1305.

The second (B) is that the authors believed TextSecure to have swapped some of the parameters for the HMAC algorithm. Moxie has asserted that this is a mistake by the paper authors, and that TextSecure uses HMAC conventionally.

The third (C, and most of the rest of the paper) is an identity misbinding attack. An identity misbinding attack happens when it becomes possible for Mallory to present Alice's public key to Bob instead of her own, and have Bob reply with a message encrypted to Mallory-seeming-Alice. Mallory can't decrypt the message, but because it's encrypted to a key Alice has, Alice might act based on the message contents. Identity misbinding problems are endemic to public-key cryptography. They are a real issue for protocols in which computers chat with each other and take action (like, authorizing an HTTP request) based on identities. They are less of an issue in chat protocols. Of particular importance, contextually: every other chat protocol has much, much worse key management problems.

Brian Smith says that this paper has value as part of a formal conversation about the security properties of TextSecure. I'm not qualified to evaluate that statement. I don't see anyone saying the paper has practical import for TextSecure or its users. TextSecure remains the best thing out there, I think.
how does the Vulcain2 compare?
I'm not sure what kind of relationships you've been in, but in my life experience (N~=10), evidence is typically not appreciated in this kind of argument. Introducing evidence into a disagreement was my standard approach and it did help occasionally, but the vast majority of the time it made it worse.

My new approach is to listen very carefully to what my partner is saying, especially to the emotions that she's feeling. Evidence isn't going to make her emotions change. There's usually something relatively simple that I can change about my behaviour that will result in her not having that negative emotion. We've been together for 5 years and we both agree that things are the best that we've ever had in a long term relationship.
As a counterpoint, all of my good ideas come while preoccupied with mundane tedium. The mind will try really hard to come up with something more important or exciting it would rather be doing. (The trick is to not go on a bottomless wikipedia spree but first short-circuit the daydream into hastily written notes and return to the mundane.) I'm not sure I would want to be constantly enjoying others' conversation, because when will my own shy thoughts bubble up?
Well all that is fair, the devil definitely is in the details here.

I can empathise with the reasons to avoid opt out for them, if they view themselves as a transparent third party, then their perspective would be the same as the suggestion I put forward. That people are putting their money towards a project by their own volition. From that perspective, there's nothing the owner can do about it but ask people not to do it.

My post was made before I had gone through the bulk of text in this discussion, so I can see the issue there.

I have to agree with all your points, but your conclusion and ours are different.

Despite the complications, I don't see why a projects head have an innate right to prevent donations to that projects developers. I keep seeing this sentiment come up over and over. I do disagree with that.

Thanks for summarizing the issues!
>Very few look at volatility

That is fair. Do you think this is an insurmountable disadvantage?

>and transaction volume.

I don't know about that. Bitcoiners have been very vocal about the regularly increasing transaction volume since its inception. See https://blockchain.info/charts/n-transactions-excluding-popu...
The Flaw Lurking in Every Deep Neural Net
Nice going! Anything to kill the drudgery of washing clothes. I hope the next such venture is making dishwashers! Together with this, it will help make life less dreary for many folks, mainly women (since this is India we are talking about).
Location: Bay Area

Remote: Either

Willing to relocate: Yes

Technologies: Ruby on Rails, JS, Backbone, AWS, Postgres and SQL generally, CSS, HTML, jQuery

Résumé/CV: www.josephecombs.com/pages/Joseph_Combs_Resume.pdf

Github: www.github.com/josephecombs

Portfolio site: www.josephecombs.com

Email: joseph.e.combs@gmail.com

I'm looking to work on interesting projects. I have a broad background of both software development and systems administration. I work hard and I am a fast learner. Let's work together!
Most of my work is server side (vim!), but on a client I just install firefox-esr with pkg_add. If there's a security update that I think I need, I'll 'make package' on the -stable branch in ports, and install that package wherever I need it. The -current branch keeps up to date with firefox pretty well if you want all the new features, but -current tends to move faster than I'm willing to keep up with.
FSL3D (Las Vegas, NV) http://www.fsl3d.com/

We manufacture laser 3D printers, laser cutters, and other digital fabrication equipment for customers ranging from hobbyists to industrial manufacturers. We're profitable and growing extremely rapidly. Please send resumes directly to me (email in profile).

Current Openings:

Electrical Engineers

Mechanical Engineers

Full-stack Web Engineers

Engineering Aides
Lab Assistants

Marketing
Support Engineers

Open to INTERN; VISA support provided for exceptional candidates. Students graduating in Spring include transcripts with your resume.
The official way of doing this is to buy the CD set in which the code and keys are sent via different channels. You buy the CD set and it is mailed to you. You then verify that against the key on the web site.

If the verification fails, either the CD set or the key is compromised.

I really wouldn't trust a CA or shared PKI to do this to be honest as that means you have to trust three or more parties rather than just two.
Same here, I love using WM with OSS. Feels like bread and butter, especially considering WMMixer (and many dockapps) were made for OSS.
If you set up something to collect donations for exDM69 they might have to explain to the police what was going on.

That takes time, and costs money.

exDM69 can avoid spending that time and money by asking you to stop collecting money for them.

And so now you have a choice: offer to give timy amounts of money to someone who will never accept it; or you could respect that person's wishes by not accepting donations for them. (And that's the honest thing to do for the people giving you the money! If Bob tells you he's never going to accept the money it's dishonest to keep accepting donations for Bob).
How do you deal with multiple versions of a single photo? Ones with vsrious adjustments, or cropped in different ways?
I'm a high school teacher, and we are looking at bringing restorative justice practices into our district. Just starting to dig into the restorative justice framework gives us a stronger way to think about dealing with discipline within a school system.

As I start to have deeper conversations with people well versed in restorative justice, I'm starting to hear really concrete ideas and practices for reforming our justice system in the US.

Edit: To clarify, restorative justice avoids the punitive approach to dealing with crime. Instead, it asks what harm has been done to what relationships when a crime has been committed. The first goal is then to work to restore those relationships. This is an incredibly valuable perspective in schools, where relationships are central to so much of what should be happening in a learning environment. It's a pretty good lens for examining situations in the larger community as well.

One resource, from a school-based perspective:
http://www.healthiersf.org/RestorativePractices/

And a more general perspective:
http://www.restorativejustice.org/
The device shown isn't quite a brute-force attack; it exploits a side channel. Back in the 1980s there was a device called the ITL-1000 that took a couple of days to dial combinations in sequence, with the only feedback it received being whether the lock opened.

Refer to the picture at http://www.sargentandgreenleaf.com/MC-6730.php , which shows a typical combination lock with the combination dialed (as you can tell by the position of the lever; if the correct combination weren't dialed, the lever would be held up by one or more of the aluminum wheels). When the lever is held up, the drive cam (brass thing closest to the camera that's normally attached to the dial) can rotate freely, with the nose of the lever dipping just slightly into the notch in the edge of the drive cam.

When the lever is so held up, one of the wheels does the holding because manufactured things are never quite straight. If that wheel gets set to the correct position, another wheel holds the lever up slightly less, and the nose of the lever hits the sloping edge of the notch in the brass drive cam at a slightly different position. One can graph the location of the "contact point" as each wheel is turned and work out the combination.
Number of global billionaires has doubled since the financial crisis
These numbers are gold even without knowing the exact model of the hardware. I always use them when I want to get a rough estimate for a new system. Should I expect milliseconds, seconds or minutes for a given task in a new system?

I don't really care if my real system is 2x faster or slower than the quoted number.
Thread in Modern Crypto: https://moderncrypto.org/mail-archive/messaging/2014/001029....
Keeping secrets with JavaScript – An Introduction to the WebCrypto API [video]
This sort of analysis underscores how different TextSecure is from the growing number of snake-oil/backdoored messaging applications out there.

Kudos to moxie and team for building usable free software; it's so much harder to build something that people can use than it is to criticize others' work.
Job brokers steal wages, entrap Indian tech workers in US
Ah, that's nothing. The brits still haven't paid off the loan some guy named William III took out in the 1690's.

Shirkers.
The Insanely Great History of Apple 3.0
I've studied quite a bit of criminal justice and constitutional law, but one thing that still eludes my understanding is the incentive structure.

Why do prosecutors seek to put innocent people in prison? What's in it for them?
Huh, that's odd. I hoped Facebook's earlier privacy policies might be available, but it seems the 2012 robots.txt blanket exclusion applies here, even though the archive outdated it, and hasn't been updated since.
Things have improved greatly! With Drupal 7, there are two main solutions, the configuration management module, and features. With Drupal 8 (likely coming out within the next year, currently in beta) YAML-based exportable configuration management is baked into core and will be much more accessible for custom development and contributed modules.
I have a rule of thumb, which is to multiply p by 10. My limited knowledge of statistics tells me that the "correct" value of p depends on knowing in advance all of the hidden correlations and sources of bias in the experiment. Padding the p value 10 fold takes care of this.

So the gold standard of p < 5% (p stands for publish) can in practical terms be regarded as being as good as a coin toss.
Periscope - fulltime in SF. Visa-transfers OK.

Periscope is a data analysis tool that uses pre-emptive in-memory caching and statistical sampling to run data analyses really, really fast. Customers typically see a 100x-10,000x speedup of their analysis queries on the day they install.

We also write the popular High-Performance SQL Blog (https://periscope.io/blog) which gets tens of thousands of monthly uniques, and espouses our marketing philosophy of helping analysts wherever we can, whether or not they end up buying.

We’re hiring salespeople, designers and engineers! See:

* https://www.periscope.io/relentless-sales-hustler

* https://www.periscope.io/user-experience-designer

* https://www.periscope.io/data-obsessed-engineer

We’re a team of 5 ex-Google and Microsoft engineers and PMs. We have venture funding, paying customers, > 30% m/m revenue growth, and a spacious loft apartment in SF to work out of.

Email me (harry@periscope.io) if you have questions!
San Francisco - Flair http://www.flair.zone - Hardware/Software company looking to bring HVAC into the twenty first century.

We are looking for 3rd (and possibly 4th).

Primarily interested in an Industrial Designer/Mechanical Engineer who wants to take a product from early beta to market.

Also interested in a UI/UX pro not afraid to code. If you comfortable taking on some marketing responsibilities that's a big plus.

We have some funding and are willing to share significant equity for the right person. We will be working in China as we near manufacturing in a couple months - more information if you ping me privately.

dan a t flair.zone
Those are from the NavCam. The high resolution Osiris camera can capture an area of 19x19cm per pixel at a distance of 10km from the comet.
Just a dumb joke :)
Looks great when they try to run for office.
14 year olds can sound very precocious in the right environment.

Source: I was that 14 year old once upon a time.
This sounds great. Too bad I can't seem to play it on my phone. I would've been pleasantly surprised if it worked. Maybe one day we'll get there.
The Uber for Gentleman Companions
In the US we can only dream about cities built the way they are in Europe. I am moving to Stockholm in a couple of years and just based on the change in available infrastructure, I will be able to die a happy man.
> But note, I want to be able to safely backup my entire digital collection wherever I choose. Perhaps backing up the Amazon Glacier, or something like that. I don't trust that a new dotcom is going to necessarily survive.

I completely agree. One of the features that I love about Picturelife is the ability to setup your own storage. Instead of paying for the service, you can connect it to an Amazon S3 bucket. All the photos you upload are stored in a bucket that you own and you only pay the S3 bills.

Then, because you have complete control and access to the bucket itself, you could setup a backup to Glacier every week or something.
it's terribly ironic that a company that facilitates reimbursements doesn't reimburse for travel on behalf of the company :P