skysight-inc/HackerNews huggingface dataset:
The same arguments presented by the article could be applied equally to the fate of farmers after the mechanization of farming. A mechanically inclined boy in a rural area is now more likely to grow up and become a tractor mechanic than a farmer.

There is an interesting story underneath this article about how technology displaces people and changes how society sees them (and how they see themselves). But that story isn't told. Instead a bunch of navel gazing about Silicon Valley gender inequities steals the focus.
How do you distinguish between healthy price competition on one hand and "undercut[ing]" and "arms races" on the other?
Chemicals are signals. For example, a hormone is pretty much by definition a signaling chemical.

Plants most definitely have information processing. The entire process of 20th century computation reveals that you can get 'intelligence' from really stupid things (NAND gates) - conversing that we can have computation (and all that implies) from a variety of different substrates (neurons, mechanical relays, semi conductors, quantum bits, etc). People tend to get panicky and start delineating things so that they can restrict plants from 'having thought' but its all pretty silly.
Groupon agrees to change product name
These priorities seem sane to me. Vehicles kill over a million people every year. Self-driving cars can drastically reduce that number.
Yup, I totally missed the docs -- my mistake, was too hasty

Would be nice if docs were higher up on the README though
But wine tasting is mostly bullshit. Double-blinding means even expert wine tasters fail to agree on good wines or to identify years or makers.

http://www.theguardian.com/lifeandstyle/2013/jun/23/wine-tas...

> Hodgson approached the organisers of the California State Fair wine competition, the oldest contest of its kind in North America, and proposed an experiment for their annual June tasting sessions.

> Each panel of four judges would be presented with their usual "flight" of samples to sniff, sip and slurp. But some wines would be presented to the panel three times, poured from the same bottle each time. The results would be compiled and analysed to see whether wine testing really is scientific.

> The first experiment took place in 2005. The last was in Sacramento earlier this month. Hodgson's findings have stunned the wine industry. Over the years he has shown again and again that even trained, professional palates are terrible at judging wine.
But... this isn't actually a vector. It stands to reason that if you use a different data structure then you will get different timing properties, but you are not comparing like-for-like.
Certainly. I was referring to this blog post, http://armoredbarista.blogspot.co.uk/2014/04/easter-hack-eve... however rereading it I see he was saying it was the ones in the hardware accelerators that haven't yet been fixed.
Is Ebola adapting?
I don't get it. If it was some actual code - that would be amazing feat. But this?

Yes, he is persistent, but that's about it.
Exactly this. It would have seemed pretty presumptuous to ask the Debian project to change the support model that they decided worked for them to support us.

We were also faced with a very large new infrastructure build and we knew we were at the end of the line with Squeeze but Wheezy had't quite yet shipped, which put us in an awkward position.

Debian is a great distribution, but at the time we felt like Ubuntu was the right way to go given the existing support policies.
An interesting thing happened when I bought 1989: I listened to it. Repeatedly. And I think that’s partly because I bought it instead of streamed it. Paying for it created connection that made me a bigger fan.

I use Spotify like crazy, and I hadn't bought an album in maybe a year. I listen to lots new music, almost none of which falls under the header mainstream pop. But most of this music gets a couple listens and I move on.

Maybe it's just because subconsciously I feel like I want to get my money's worth, but this Taylor album has been on regular rotation. And I definitely wasn't a fan before. She’s become a fairly big deal with my peer group (women in their twenties in New York), but I wasn’t taking part in the love. Now I am, and I think it’s partly because just a little bit more was asked of me.
I'm not sure I agree with that either.

I'd argue they're both as bad as one another. Since GC is non-deterministic it means you just need more cycles for an accurate result (and plus you're already having to ignore other sources of latency, like network, disk IO, OS lock contention, etc).

Timing attacks are generally a coding problems, both a JIT-ed managed codebase and a native block of code can contain them.
You're "money" quote is provably wrong though. Her music isn't all over Youtube and other services. In fact, you proved this by having to go to the Pirate Bay to download it. They've done a great job at stopping it being available for free anywhere legally. Seriously, try to find any song from 1989 on Youtube that doesn't have a music video released. You can't.

>Then comes Spotify (and friends), and suddenly there is an outcome where I'll part with $120 per year and artists earn money from me that they didn't before. They should embrace that, not focus on money per 'played song', rather on 'money earned per consumer/year'.

Honestly, why should she? She just sold 1.3 million albums in a week. Talking in absolutes about this is silly. Just like when Radiohead released a pay what you want album, different methods will work for different artists. I commend Taylor for not doing what everyone else does just because. It took balls to go against the grain and she came out on top. Good for her. She's not advocating to make Spotify illegal or anything which would be where she loses me. Spotify is great for some things and great for some artists some of the time.
Let's not overcompensate in the other direction.
Right - it is looking more and more like truly constant time code can only be obtained by using hand written assembly or hardware. In that eventuality, I guess the core crypto code in the JVM will have to be changed to use hand written assembly as well, however, SSL is huge and most of it doesn't need to be constant time (certificate parsing, managing network buffers, message parsing etc). That is often where the bugs creep in.

Going with JSSE does have the downside that it's less widely used. Browser makers don't patch it with the latest gizmos like they do with OpenSSL. However, it's at least got a full time development team (unlike OpenSSL until very recently), and ultimately if there are odd conformance bugs lurking the only way they'll be shaken out is by people using it for real. Passing the Qualys test is a good start, but for now my little website is ideal because it is unlikely to ever be popular enough to have serious scaling issues and I can tolerate some incompatibility with odd clients.
OK, this is an interesting approach.
Here are some notes from reading the source:

- Basic model classes: Model and Collection similar to Backbone, but much simplified (no REST-API stuff, validations etc, it's basically just that events are fired when data is changed)

- There are no templates, all or most of the markup is already present on the page

- The Controller class is attached to a DOM element. Specific nodes (called 'refs' as in React) inside this element are denoted by the "data-ref" attribute. These are collected by the controller during init phase and then their state is managed via the render() method.

- there's a special List controller which can be connected to a Collection. It manages a list of sub-Controllers (each attached to an item in the Collection)

I like the simplicity. It's very similar to what I'm using lately for smaller projects.
Very cool! Right now I need to create a PCB schematic given an original circular PCB (and get all of the spacing correct for the holes). I was thinking of using a scanner and am glad to see someone else is doing this successfully.
Ones that get to market, like those from Mercedes, VW, Tesla.

Google's car tech, and software, will never be adopted by an auto manufacturer. And Google will never sell cars.
I'm being downvoted to mean this is not the place to discuss this or I'm straying too far. If you want to know, read up on the Zero Hedge blog (I'm not affiliated, I'm just a reader, etc etc).

But basically what's wrong is Russia and China (so 1.5 billion people) plus the Middle East are all tired of the petrodollar and want out badly.
I wish there was a science magazine that would let me follow particular advancements to know when they announce additional results, begin manufacturing, etc. I keep seeing optimistic articles on battery tech and I have know idea if the ideas fizzle out or just are not sexy enough for continued coverage.
Espresso.js diffs as well, except it doesn't have to diff the entire DOM but only the attributes that you'll actually be changing in effect.

Moreover it gives you the option between declaratively specifying the DOM to imperatively manipulating it when you need to for performance reasons.

It's a tiny library and the approach is much more efficient than diffing the virtual DOM for the entire page, so I'm pretty confident that results would actually be even better in larger apps.
I read The Healthy Programmer and it had a bunch of exercises you could do while sitting. You could also, if body-abled just start working out, jogging or something else.
I think that 'jaybuff was being a little sarcastic. There are some howlers in OP.
> I'm saying they're unfixable because there's no way to tell the JIT to create constant-time code.

Your fallacy is that there are several JVMs to choose from, each with its own set of JIT and AOT compilers.

Don't judge Java by OpenJDK, it is only the reference implementation.
What Christopher Nolan Movies Teach You About Winning Hackathons
I've found out what is reason for this! It only affects text mails: Gmail is analyzing the links in text mails and when it is adult content it refuses to make them clickable!
For me this is censorship. I'm an adult and I can decide myself what I want to see and what not. I do not want Google to filter out adult links (categorize them!) and make them not clickable!

Solution: Make HTML Emails
Java has certain qualities that make it sometimes harder to optimise, which is one reason it relies so heavily on profile guided optimisation. For example, it's very vulnerable to GC stalls if escape analysis can't identify all your variables as eligible for stack allocation. Escape analysis is complex and a little fragile, from what I've heard (I never tested it myself).
In the Bay Area, there's such an outside mall in Emeryville (east bay, right next to Oakland). There's ikea, a movie theater, uniqlo, and an H&M, along with many other restaurants and stores I don't go to. It even has a Barnes and Noble! (I thought they had all disappeared)
> Bottom line, why do investors care about control at the early stages?

Because interests can diverge and if you have control you can protect or advance your own.
Startups can now buy insurance against threat of patent trolls
> Part of Spotify’s pitch to the music industry has been that its royalties — as low as 0.6 cent per stream, according to the company — will accrue to significant levels as the service grows

> “Wake Me Up” had been played 168 million times in the United States on that service, yet yielded only $12,359 in publishing royalties, of which he kept less than $4,000.

These numbers don't remotely add up - they're off by 2 orders of magnitude. What gives?
3 Years at Venmo
The early ones had a capacitor that held enough charge to allow you to change the batteries without losing state.
Heh, I was arrested for going into an abandoned* mall and walking around and taking pictures with my friends.

*Turns out it wasn't as abandoned as we thought. Someone was doing something there, and someone or something called the police in.
Google Books isn't making a dime. If you got rid of it Google would be just fine and all those women would be looking for jobs.
www.gnome.org is the first result in google when searching gnome.

It takes extraordinary amounts of willful ignorance to not find the existence of gnome.org

If their product was something marginally connected to IT I would have assumed good faith either.

If tomorrow Elon says - the new Tesla Gnome - the world's first electric sport bike, there will be no backlash.
Digest.nyc – feedback needed
Hi, My name is Daniel and I am the founder of http://digest.nyc/ , a new web portal for the New York tech, business and startup scene.

My goal is to bring together the tech and startup communities with information and resources to help people succeed.

I would love to get your feedback on this project. I am also looking for contributors to the website, so if you are interested in becoming a content writer or want to be interviewed about the New York tech and startup scene, please let me know.

You can check out our site at: http://digest.nyc/. I look forward to hearing from you.

Best!
GS Collections by Example
At some point, we flee after Joe630 demands "hugs" from us... something he continues throughout the conference. "Touch me not, boy... I will not submit to your fondling," I tell him behind clenched teeth as I back out of the room.

"I'll only hug a man if he's buying me drinks or I'm trying to lift his wallet."
> It's only when you build an online marketplace that this kind of race to the bottom emerges, because the vast majority of participants on both sides will be completely unknown to each other. So the few objective signals the marketplace offers, like price, become the only means available for party A to evaluate party B.

Except that creative freelancers usually post some sort of online portfolio, which seems like an extremely fair thing to judge a candidate by, all things considered.
this is the repo where most of my older academic stuff is. (blamestross is my personal account). It is a bit ironic because we do everything on university hosted private gitlab server now.
https://github.com/BrendanBenshoof
Sorry, I realised I'd failed to address your other point:

"What does that even mean? If you write your fail and success states to follow the same exact code paths (i.e. no branches, breaks, returns, or similar for failed) then you've created a "constant time" function."

Well, if you've got a JIT that is analysing which code actually executes, and no control over the optimisations then how do you achieve this? If the hotpath is normally the success condition for example then the JIT will optimise that more. The rare and more dangerous condition will be optimised less. If this happens of course will depend on the engine, but you can't control that without working at a much lower level than managed code offers.
Two new Xen vulnerabilities will be dropping soon.
Moneyball Hiring: The Interview
> Timing attacks are often the result of optimisations within the crypto library which inadvertently give away information, for example a loop which breaks on X != Y, instead of setting a failed = false bool and continuing to iterate through the rest of the array.

I would say this is false. Simple differences in time caused by cache line ejection in table-lookup implementations of AES provide a very strong timing attack. (http://cr.yp.to/antiforgery/cachetiming-20050414.pdf)

In RSA (and in fact DL based cryptosystems), modular exponentiation without extreme care leak tons of timing information about private exponents. 'Blinding' is one way to handle this, but performant solutions typically fiddle at the bit level and exploit CPU guards and features to minimize branch prediction/cache line/etc leaks.

In higher level languages absolute control and care of crypto implementations can not be taken and the JIT layer adds another layer of obfuscation (though I know of no attack employing that...).

The out for memory safe languages is to provide built in crypto operations that have been implemented at a lower level.
I believe this data directly disagrees with cancer.gov's dataset, overstating deaths from cancer.

http://seer.cancer.gov/statfacts/html/all.html
CVE-2014-6321: Vulnerability in MSXML could allow code execution via IE
Both because of technical itches he wanted scratched.

With Linux it was the ability to use unix without having to stomp over to the university computer lab during the Finnish winter.

With git it was creating something that could handle merging patches from a disparate set of developers.
KDE Releases Plasma 5.1.1
Did President Obama Just Break the Internet?
Can I use Deis with only one CoreOS node?
In my experience, much of the pleasurable taste of gallon-jug-water comes from the fact that it's refrigerated, rather than from any intrinsic properties of the water's chemical composition. A glass of tap water left in the fridge for a while will also come out tasting 'fresher'.
IANAL but I think it will be nightmare for their accountants.

There should be some safeguards in the law that you cannot easily re purpose solicited donations for a cause.
"Right - it is looking more and more like truly constant time code can only be obtained by using hand written assembly or hardware. In that eventuality, I guess the core crypto code in the JVM will have to be changed to use hand written assembly as well, however, SSL is huge and most of it doesn't need to be constant time (certificate parsing, managing network buffers, message parsing etc). That is often where the bugs creep in."

I completely agree with you there. X.509 is a nightmare and it's not an area where constant time matters at all. Being resistant to buffer overruns and general logic errors is much more important there.
> I've always assumed the tradeoff here is a safe language is slower, and slow crypto is no bueno.

Back in the day Extended Pascal, Modula-2,Mesa... and C compilers had similar code quality.

If today compilers for safer languages are slower than C compilers, it is mainly a consequence of compiler vendors focusing in improving C optimizers.
I've thought about doing this bidirectionally. Besides implementing that all, the problem I see would be having a reasonable "cutoff". It probably wouldn't make sense to use the shortened <bra|ket> notation if the term was insanely huge. So There would be some heuristics, meaning it can't be guaranteed a 100% accurate back transformation.

Still interested? Or maybe there could be an export-mode where the pretex math is backuped in a comment or a separate file to help reconstruction. But that might get awkward fast. Hmm

I was hoping that most of the changes are so trivial that this would be unncecessary
As a musician, this is a topic that hits close to home. The fact of the matter is that Spotify is making boatloads of cash off the works of artists, and they are not paying out enough to those artists.

Straight from the spotify website [1], they say the average revenue from a stream to a rights holder is between $0.006 and $0.0084. The poverty line is $23,283. That means an artist needs 3,326,142 plays in a year to just hit that line. That's not sustainable for the vast majority of artists.

[1] http://www.spotifyartists.com/spotify-explained/#wait-i-thou...
Yahoo to Acquire BrightRoll
Magnifying the Bootcamp Research Experience
I'm not done reading yet, this is very well explained. Thanks a lot.

I found a little typo in the line : "if A and B are very var "
Reading the comments, I can see the Google Brigade is back in force.

Reminds me of worker bees dutifully trying to protect the hive.
it looks logical - once influenza was stopped from killing people before age 40-50, people started to live into the age where cancer/Alzheimer are among the majors. Once we reign in the cancer/etc... and will be living well into 80-90-100 something else will be the majors there. For example something computer induced (i'll personally have 65+ years at the screen (or at/with mental implant which will replace the screen in 10 years) by the age of 80). Or something like "you've been terminated as ratio of you production/consumption fell below 1" :)
Amazon Cloud Drive Launches API
Sri is the SVP of engineering.
I've been to the mall from the article. Every time I go there I just feel bad.
He's talking about a couple of recent very clever timing attacks on JSSE. However they are not comparable to Heartbleed or this SChannel overflow in severity at all:

(1) They require you to have a pre-recorded SSL session you're trying to crack. Random script kiddies won't find it useful.

(2) They require sending a lot of traffic to the server to try and break that single recording (you can get caught quite easily!)

(3) They don't reveal the private key, only per connection premaster secrets (if I understood correctly).

Basically, the first attack was possible because JSSE returned "internal server error" when faced with a particular kind of malformed packet instead of "bad padding" - this binary yes/no thing was enough to allow the attacker to divine some internal state and with enough queries retrieve the PMS. The second was a similar trick but instead of observing a different error code, it exploited the fact that internally the code was throwing an exception and this made a difference of some microseconds in the response. Over a LAN, with enough queries, that was enough to eventually reveal the PMS. However when running over a much noisier environment like the internet, number of queries required goes up quite a bit. I believe, they did not test that.

As I said before, they were both fixed, and I think Rich now agrees with me that they were fixed. There may be others that would require compiler support or hand coding of assembly to fix. Certainly there's nothing in the design of Java or the JVM that makes that impossible however. Stuff handling key material is only a small part of the overall SSL picture.
I wouldn't call someone who's beaten a Billboard record for most albums that sold 1M+ copies on its first week up and coming anymore. :)
I'm not tptacek, but right now I think the answer is: "We don't know."

There isn't an acknowledged proof-of-concept, so we're not sure that it's exploitable. It hasn't been made clear whether it's wormable, either.

My bet is it will affect XP if it's exploitable, but only for those who added IIS (not default, and not terribly common). It will likely remain unpatched forever, as Microsoft is unlikely to send a patch to an "unsupported" OS again, like they did with the Internet Explorer 0-day [0]

[0]: http://blogs.technet.com/b/msrc/archive/2014/05/01/out-of-ba...
No. As a PaaS designed to run enterprise workloads with high availability, Deis has a 3-node minimum.

If you're looking for a similar workflow but with a smaller footprint, Deis now sponsors the Dokku project: http://deis.io/deis-sponsors-dokku/
Linus on “Media commit causes user space to misbahave” (2012)
inner layers can be repaired but it is even more labor intensive
http://www.circuitrework.com/guides/4-2-6.shtml

things can get even crazier:
http://www.circuitrework.com/guides/6-2-1.shtml
"yellow badges" are contractors at Google.
She was getting $6 million a year.
To clarify the corporate structure generally:

Shareholders: They are owners and elect the Board of Directors. There could be different classes of shareholders, some with/without voting rights.

Board of Directors: They generally vote on the corporate officers and authorize corporate action outside the day to day control/operation of the business. Voting rights, powers, terms of directorships and the like are typically defined in corporate documents, and if none exist, then generally this is all defined by a given State statute/code.

Officers: Titles include President, CEO, COO, CFO, Treasurer, Secretary, ect... These people are in control of the day to day operations of the company. Again powers, terms and the like are typically defined in corporate documents, and if none exist, generally are established by default by a given State statute/code.

This is generally the default structure throughout all the states. All these things can be modified/defined in greater detail through shareholder agreements, by-laws, restrictive agreements, ect...