skysight-inc/HackerNews huggingface dataset:
Lessons learned:

1) Don't engage in businesses that make you a target of the world's best-funded law enforcement agencies.

2) If ignoring lesson 1, don't access servers directly, from home, and don't pay for said servers with personal credit card.

3) Don't pay for your $130K Tesla using BTC a month after you open up a massive illegal drug marketplace that runs exclusively on BTC. Someone may suspect something.

4) When cashing in your ill-gotten gains, don't use your real name.

Seriously, if you're going to do this kind of stuff, paranoia is your friend. "They" probably are, indeed, following you.
Great article. I've been doing a startup this year and despite best intentions it really does take a toll on yourself and people around you.
I can think of at least one very easy way to break Tor, if you have access to a bunch of choke points however I'm nowhere near an expert in security so feel free to beat me to death over exceeding my area of expertise.

In a nutshell: assume that Tor hidden services are not amongst the highest traffic sites, that they still need to be hosted somewhere and that you can make your own traffic to such hosts stand out by sending alternate long-short sequences of packets to a hidden service by crafting requests simply inject a long sequence of such packets into Tor destined for the service you wish to unmask, then monitor your choke points to see where the sequence of long/short packets pops out last. That's the endpoint you're looking for. This undoes all the layers of the onion in one move. It will take some time before you have certainty because that same sequence will likely appear a number of times in a regular bunch of traffic as well but with increasing sequence length you should be able to get to good confidence that you have found the relevant host.
Probably because the substring "dick" in the URL.
Heh. No, I'm not trying to encourage that, but I think it's useful as rough measure of practical size for exchanging data. Like "Olympic swimming pools" is a popular measure.
Attending IT Pro Meetups Is Well Worth Your Time
You're talking about GNU, not Linux. Linux is the kernel space.
I agree that this should point to the whole video, no to the last secconsds.

I prefer a variation of the submitted title:

"Space Station astronauts put GoPro camera into a floating ball of water in space"

The interesting part is that they put a camera there.

A slightly unrelated question about English usage: How do you call this rounded floating thing? It's a water bubble or a water drop?
I've been farting around the software world for a while (but have never touched Perl) and that's the best explanation of Perl's appeal that I've ever read.
http://time.is
When Men Were Men and HTML Was Static
Google's new perk: DNA tests for employees with cancer
Yep. On my insurance plan, I spend about $250 per month on Type I Diabetes supplies. That adds up.
> If I've learned anything, it's that the really important things you're talking about—those get done.

And if I've learned anything by looking at obesity, people stuck in an ever downward spiral of payday loans, people who never saved for their pensions etc, they frequently don't.

> Ironically, the very things that would help its success most are the ones that fly out the window as soon as the going gets tough.

Indeed. That's a great example of companies living for the now. "Who cares about whether my employee will be off with stress in a month's time? That's the future and I'll let future me worry about that. I need this bit of work out now."

Like I say, and I think you're agreeing, it's about balance. What it's not about (which is what I was challenging) is always living for the now.
This gives me an interesting thought for a startup. Provide training and testing for law enforcement for these scenarios. Would also give you the chance to outsmart law enforcement without getting arrested.
Sure, even languages I actually know. I don't understand why this question is even a question.
“This is something we want to keep for ourselves,” he said. “The way we do this, we can’t share with the whole world, because we want to do it again and again and again.”

That is so freaking evil.
Mark Zuckerberg: ‘My goal was never to make Facebook cool’
But then who do they censor it for? "Enemies of the nation"? Do they really think they'll just look at google and be like "Oh well, we tried"?

It's pretty idiotic. Build your systems with the foresight that they can be observed from space; just like software engineers build their systems with the foresight that they can be snooped on by the NSA and such.
You might be insterested in quire.io [1] team's article [2] about using dart to build a large application

[1] http://quire.io
[2] http://simonpai.github.io/2014/09/03/quire-building-with-dar...
The New York Times Uses Data to Visualize Sharing Activities
How to Check If Your Universe Should Exist
http://ShareBar.net

http://LaunchSoon.com
I'd imagine you could hack it in if it's not present - "Alexa open webpage dim.lights.kitchen.home" and have your home server use the request hit to tell the lights to go off. Of course an open API would be far nicer.
Blogs for UX Designers
Ask HN: How are IP addresses geocoded to latitude and longitude?
There are a bunch of API services out there that are able to determine the latitude and longitude (and other data, e.g. state, city, etc.) for a given IP address. How are they able to do this? How does one know what part of the world an IP address is associated with?
The $300M button (2009)
Java isn't a great language, but on the server side it actually makes sense in a lot of environments. JSP is only tangentially related in that it compiles to Java.
Right. It also struck me as funny in the video that the Echo had moved into their bedroom. Did they buy two? Or are they carting the thing around the house with them (instead of their phones)?
I've heard reports that Feds were actually moderators of SR2 from the very start. So from the beginning they were actively building a case against the other owners.
Isaac Asimov on How to Create Ideas and How Larry Page Thought of PageRank
Four Reasons Why Plato Matters
Ask HN: How to become a better manager?
Hello everyone, So I recently got my own team to manage and it seems to me that I'm doing a bad job at it.

So I would like to ask you: are there any books/articles you can recommend for me to read? So I could better manage the team? Any advice?
Yes. It is always frustrating to have to dig through paragraphs of text to find out which of the two, basically unrelated diseases the article is talking about.

I really wish they had different names.
Hackers infected Home Depot self-checkout, stole 53M email addresses
This isn't necessarily open-source work, but it is still opportunities to collaborate on real projects with other developers -- https://assembly.com/
> Rafael got to be the best Spanish player of all time.

Easily considered the world's 2nd best tennis player ever, with chances of being the best tennis player ever.
I believe this has been a well known underlying problem with Tor for a long time as it only really provides anonymity. If you control enough exit nodes, or alternatively, control the means of transmission in enough places, you can narrow the net and get closer to finding things. At the very least, one could get close enough to allow one to focus more traditional investigatory techniques. The problem is this is a fairly large scale problem. Now any organizations with the capacity to do something like that? I seem to recall lots of speculation around the time Snowden came out.
Yes, iirc 90% of people rent here.
It's fine, we've done a change so that it works. ;)
John Ousterhout is a professor who really did some amazing programming back in the 90s! Can't think of many people coming close in terms of productivity.
They probably just use the tried and true method of exploiting flaws in the server, then helpfully offering to fix it. Repeat until trust builds and eventually a fed agent is the Sr technical lead with access to everything.
I'm sure it's actually a spooky feeling people are getting but somehow this wired article fails to convince me.

The researchers suggest that the subjects’ brains reconcile this mismatch by creating the illusion of another presence that’s doing the poking. After all, something is poking them in the back.

Yeah, It's a robot! Why is it that people feel like it's a person and not a robot or a coat rack or whatever? That part seems odd to me. Is it not because we tend to only be poked by people in our daily lives so given the stimulus, we interpret it to be a person?
I agree whole-heartedly, and wrote as much in another comment below. This should not be overlooked.
Howl's Moving Castle beautifully created on the web
I was on a Twitter Singapore office visit once, and asked the panel "what's next after hash tags?", the hall fell silent.their panel stunned. Granted this isn't where their product strategy discussions take place but somebody should know.

The panel avoided answering. This question should be keeping Dick up at night.
You'd do well to just avoid the U.S. of A. (and friends, I guess). Take those profits and go somewhere safe and manage your newfound business from there. That could be one of the reasons some of the larger markets are still standing.
Xubuntu. It's like 10.04 but improved.
I certainly hope it's hackable as well. Doesn't look like they're offering any options for developers to get in on it though.
Yes, it's one of the places that legislates favourable rules toward the lodger (stringent conditions on rent increases or lease terminations etc). Lots of people even sublet their favourably gotten rental flats onward for more money.

Although if people owned the flats, the lower income senior citizens would still move: they would find it expedient to sell their now-expensive flats and put the money to living expenses (or grandchildren or travel or assisted living etc). This is happening in other growing cities around the world.

edit: It seems to me renting (or some other form of "right-of-occupancy" arrangement) is actually the desireable choice for most situations. Investing hundreds of thousands in a single unit of housing is not a good fit for most people's savings/investment plan - you'd want to diversify, and possibly hedge against things going downhill in your neighbourhood. If rent market works well, and taxation and rental terms work out, it's better for everybody to just pay for the apartment's financing and maintenance plus a small profit margin in the form of rent.
I think it will be very interesting to see the correlation of "discovery vectors" these LE's purport to have used in locating these services.
Show HN: '2 N Sum' Android App
Git and our distributed future
According to the article the real loss is 800.000€ on a specific branch and could be up to 25 millions nationally.
Yes, it's possible to "communicate with self" in various ways to intercept, but it's really ugly. Also, performance may suffer.
I made Hecl work on Android, but it has kind of languished, unfortunately:

http://www.hecl.org/
That type of traffic correlation attack is pretty well known and understood. The problem is that Tor simply isn't designed to protect against a global adversary.

If you're the NSA, you can inject traffic through, bisect the network by forcing certain nodes offline, ...

Tor can't defend against that. But we don't have anything right now that would.
It is much, much more likely that law enforcement hacked onion domains because of their improper implementations of TOR procedures and/or general shitty security than it is that they discovered a fundamental security vulnerability in TOR.

The weak link here isn't TOR, it's the doofus who bought the Tesla with $130k worth of BTC.

Which is why I would never mess with darknet sites. I trust the TOR network, but I don't at all trust the individual domain owners.
And the US's NSA can get dumps from GCHQ, legally?

Wow, I thought that DoD people took an oath to protect the constitution. Shame on them. At least 4 of the NSA's people had enough principles to resign. That's not a great ratio.
That is awesome. I wonder how well that would do for teaching place values to primary school kids - despite having done binary/octal/hexadecimal and other types of number representations with my kids they still struggle to see how decimal uses places and how carrys work.
Disneys Magic Bands Leap Frog Mobile Payments and Obsoletes Apple Pay
How about a tiny forwarder on each device. It fopens the file and reads to the end, when the file is appended to it will be able to continue reading. Packet up each line and forward to you server using zeromq PUSH/PULL. If you are disconnected they queue up and send when zeromq automagically reconnects.
Forecasting Confidence Levels with the Bipolar Learning Graph
> Agreed. From this point forward Tor is considered harmful.

Planting that seed in your mind was almost certainly one of the goals of this action. Mission accomplished, FBI.
Ask HN: Tutorial teaching a team new to testing and CI how to get started?
A company I work with is in dire straits. They have been delivered a bunch of barely functional very unstable code for a ridiculous amount of money. They have a mixture of in-house people and hired guns that together have built this totally over-the-top solution. I'm coaching them - hands off for now - on getting things back under control.

One of their biggest flaws - besides the over-engineering - is that they have absolutely atrocious testing. I want them to make a start with and eventually move over completely to automated testing. But when I figured I'd send them a couple of links to get them on their way I realized that there are a lot of crappy tutorials but not a single one that stands out as the reference for automated testing for distributed teams.

Is there anybody on HN that can point at a reference for a start-to-finish approach to automated testing?

Pre-emptive thanks for giving this your time.
http://meyerweb.com/eric/tools/dencoder/ - URL encoder/decoder

http://jsonformatter.curiousconcept.com/ - JSON formatter

http://www.colorzilla.com/gradient-editor/ - Gradient generator

http://mp3cut.net/ - MP3 cutter

http://ipinfo.io/ - Geo from IP as JSON

http://www.usdebtclock.org/ - US Debt clock

http://ifttt.com - General purpose web robot
Whenever I think about Erlang's stability I recall the problems mentioned by CouchDB authors and RabbitMQ users. Apparently CouchDB hit some problems with low level disk access that they couldn't trace and that pushed them to migrate away from Erlang. RabbitMQ is allegedly dropping lots of messages for unknown reasons under heavy use. I do not have the links at hand for reference but such stories make me wonder how battle-tested Erlang really is when you need to persist your data (and not just transmit it over the network).
Sure, it is. People often move every 3-15 years, while staying in the same city (or sometime leaving for another city). This is much easier with renting where you just have to take care of finding the new flat, rather than also selling your old flat.

People usually buy a house or flat only when they are very good situated and are founding a family. And even then most prefer renting simply because you have to take care of less things (owning a house can be quite time consuming).
The $11M Tool That Could Help Computers Write Their Own Code
I got the sense that Erlang overlaps somewhat with node.js in terms of what one might use it for. Could anyone familiar with both compare them?
Entrepreneurs Break Out Their Best Pitches at Babson
A global guide to World War One – interactive documentary
But what happens when physicians' criteria don't align with the priorities of a patient?

Take this hypothetical example: you wake up with a dozen marble-sized tumors in your brain. A combination of BRAF and PD-1 inhibitors has a small chance of curing you. This is backed by science, this is already a known result. Without the treatment you are dead within six months. With the treatment, you have a small chance of being cured.

However, due to potential known complications of PD-1, it is not yet approved as first-line for patients with brain mets. So the doctor says you must first go through whole brain radiation.

Your oncologist's only goal is to extend your life, he doesn't care about what you value and what kind of life you want. Therefore WBR and then immune therapy is the logical choice.

But maybe you don't just care about not dying, maybe you expect a certain quality of life and are willing to take the risk of foregoing whole brain radiation, because life after whole brain radiation is not a life you'd want to live.

What right does anyone have to tell you you are not allowed to take that risk?

These pure theoretical reasons for not giving patients the right to choose are so far removed for the day-to-day reality of someone dying of cancer, it's ridiculous. We're not dealing with abstract data with the goal of reaching some life-expectancy maxima using one-size-fits all treatment. We're dealing with people who have different priorities, and maybe care about more than optimizing for the treatment that is statistically most likely to squeeze an extra month of existence out of them.
Some guy in a fedora and freebsd t-shirt hanging around sleazy bars downtown waiting for his flipped FBI agent to come around and drop him some new juicy goss on the latest... TF2 hat update? Sounds legit
> I believe so too.

That sounds strange, as I believe we're in disagreement. I believe the flexibility should exist, and choosing the transport medium of already encrypted data should be an option for the developer. This is completely unrelated to the security critical configuration of the TLS protocol, i.e. certs, keys, ciphersuites, etc.
Scale covers lots of things, including statefull v. stateless and (appropriate to this discussion) asynchronous comms and the ability to queue requests. Scale in that sense is facilitated by retrying a remote call that failed - possibly because the server is at capacity. That implies store/forward, which is what the "queue" part of message queuing does. You can definitely use tools like ZeroMQ, MQ Series, MSMQ or WCF to achieve that. You can also use a database table with a flag indicating whether a message was delivered or not (ref. my link above).

Not quite sure what HTTP has to do with message queuing, other than being a protocol one might use. If scale is so important, perf is a concern, in which case UDP would be a consideration. Would I go down that road? Doubt it, because I suspect the acceptable answer lies somewhere between HTTP and UDP, and I also suspect that better gains can be made by optimising end-to-end throughout and solution design rather than worrying about the semantics of a protocol. What's the benefit, for example, of streaming data over a TCP connection when that data is XML? TLV or some other binary format will serve you a lot better.

Final words on scale - asynchronous delivery (such as message queuing) is one technique. Another is to scale servers out and/or up. Also, as already mentioned, server state and of course pipeline/routing efficiency. Whilst I stand by what I said, I've not had the opportunity to work at the scale you have, so I'd love to know what problems you've encountered when scaling to millions of nodes.
A very quick one sentence hint: be the person that you would like to work for. And ask your team what you could do to improve.

I've worked for a variety of managers over the years and the styles varied from 'management by fear' to 'no management that I could detect' and everything in between. What helped me most to grow when managing others was to observe what did not work elsewhere and which traits I appreciated in the people that managed me (in so far as I'm 'manageable' :) ).

It's not something that I ever managed to get out of a book though I'm sure there may be such books. This is a thing that you'll probably only really grow into over time.

The biggest change for me was when I finally learned to really listen to what people say, both in plaintext and 'between the lines'.

One question you can ask yourself since you are saying that you are doing a bad job at it is why you think that and then to use that as a starting point for a list of points on which you can improve.

Best of luck!
Just how law enforcement agents were able to locate the Dark Web sites despite their use of the Tor anonymity software remains a looming mystery.

Do you happen to have a source for the "personal credit card" and "Tesla for BTC" lessons, or is this mere speculation?

Edit: Tesla downpayment documented in Blake Benthall Criminal Complaint: http://www.scribd.com/doc/245744857/Blake-Benthall-Criminal-...
Nice to see Fossil SCM being used as the website host. Thanks SQLite creator!
autossh + ssh -C + tail -F ?

kafka sounds like an enormous overkill. If you want to store the logs locally while tailing, just add in a tee.
The only criminals here are the feds. Each and every one of them belong in a cage.
Startup Builds Sensors That Will Analyze Sweat to Track Your Health
> To me, this looks like it still requires sockets or fds.

Yes. Which makes it useless for protocols that carry TLS. e.g. EAP. So I can't use it in my pet project: http://freeradius.org/

The new API is useful if you want to do TLS over sockets. It's completely unhelpful for everyone else.
TIL there's a very logical reason that ads have gone for the "random awkward humor" vibe in recent years. Cool.
Shamsi and Harwood, an Electronic Archipelago of Domestic Surveillance
Scala: Sorting on multiple fields and Tuples
AVG 2014 (Branded Version) – Free
A few points:

- A large system never runs on a single machine if you want any level of realistic fault tolerance. Two nodes is a bare minimum, 3 an acceptable one.

- The number of nodes will always depend on where your bottlenecks lie. Erlang developers would be rare and few to write CPU-bottlenecked code directly in Erlang. The usual approach would be to write your system in whatever is appropriate, and then too coordinate things with an Erlang layer.

- I would a hundred times more willingly maintain and debug a running Erlang system than a C++ one. I'm kind of sold on the idea though, and wrote http://erlang-in-anger.com to share my experience there.
I would agree with that logic. Don't look for a wave of P5 programmers to switch.
"As a former TIBCO and MQ developer..."

I'm reaching here, please forgive (and correct) me if I'm wrong. This comment makes me think that you've not tried delivering the same functionality without TIBCO and MQS. I used to do a lot of MQS and MSMQ work, and have not encountered a scenario these products handle that I can't as described in my link above.
They're hiring a webmaster. But I think it's in a different cold place: Madison, Wisconsin.
http://icecube.wisc.edu/jobs/show/webmaster
> I refuse to believe that the FBI is privy to a funamental TOR break[...] and they're risking revealing it with some darknet busts.

This is probably the best analysis I've heard.

If the Tor protocol was broken in some way, agencies would be sitting on it to vacuum up as much information as possible. If the underlying cryptographic primitives were broken in any way, that information would be restricted to the highest levels of government and used against state actors.

Darknet busts mean JS browser injection attacks, poor development practices on the server side, or bad human factors (probably this one, from what we're hearing).

But more importantly, increasing the frequency of darknet busts gives a hint of what the authorities think about Tor: they don't have fundamental attacks, so it's best to scare people away as much as possible to discourage use.
First of all you can do a whois on an IP address to get where the company that registered is located.
If you traceroute the address you can sometimes get hints on where it is.
And then some big sites may use geo locotation services on their websites that query the browser/APP GPS where the user is located and then it may be concluded that the whole /24 net is within that area and then the site will sell this information to geo location services.