skysight-inc/HackerNews huggingface dataset:
It also uses physical memory, not virtual memory and no protection to prevent 'userspace' programs from modifying the kernel. I quote userspace as it doesn't technically have the same distinctions that you are used to.

This has some interesting performance implications.
Specifically there is no need for a traditional "kernel bypass" when you want to work with hardware from userspace.

For instance in Linux we have stacks like the Infiniband networking stack and some userspace TCP stacks (usually based on PF_RING) that are quite a hack to build in Linux that would be "just the way it is" in TempleOS. (though it's worth mentioning that TempleOS has not networking capability, apparently Gods decision)

These sorts of operating systems were common before multi-user computing but died out because of the need to protect the operating system from it's users and the applications they may want to run.

However the world is coming full circle again. Unikernels are back, sometimes they are written in C, sometimes in OCaml (MirageOS), sometimes in Erlang (ZergVM or something I think).

TempleOS may actually provide insights for how to do these sorts of things as it's been built this way for a long time which can't be said of many other modern operating systems.

Alas, people would probably need to see past the somewhat spiky exterior (Terry himself) to appreciate his work.
Sure, but it's such a waste to even talk about it.

There is so much more productive discussion to be had.
I agree with your better idea for a title.

I respectfully disagree with what I read in the rest of your post, there is a fine tradition of free speech which goes even so far as to allow the KKK to parade with a police guard. Even the Westboro baptist church are afforded this. I find both organisations abhorrent, but the principle is sound. In the author's situation the debate is shut down time and again.

As a thought experiment, in a deeply religious country if something is considered offensive by your measure of "respect for others" for example women being banned from driving:

How could anyone change public opinion? There is simply no way to do that without offending people in that situation, so I think the truism you close on is totally wrong, it results in a non-free society.
No problem haha. Took about 30 seconds with the code being there. Thanks for the awesome tutorial.
> Digital Pokemón Cards. Basically the ability to create digital collectors items.

Benefits from being distributed, but can use a simple, trusted timestamping service given the low stakes.

> E-books that could gain value. You could sell ebooks at a premium and allow people to re-sell them. Because the history of their ownership is recorded you could even see them gaining value if they had been owned by a celebrity.

Celebrities are, by definition, not anonymous, double signing is not a problem. Doesn't need a public ledger.

> Private but public healthcare records for research and usage. Store the health-records publicly as personas but allow individuals people to link it with their identity. This would help with research in completely new ways.

That's a distributed database with signed edits. Since it doesn't require to maintain a mutable singleton, it doesn't need a ledger at all.

> Voting made public but anonymous Make it impossible to fake voting results by making the results available for everyone.

Potentially a good use of a decentralized ledger.

> Artificial Intelligence Using the protocol to create automated consensus models.

Also potentially a good idea. Those two ideas seem to be related to this proposal, http://tezos.com

> Companies without owners Build a company with a political purpose without any owner.

Potentially a good idea.
Only if that service intended to do some signing on the developers' behalf, which could make sense for cases like this in which app data would be updated more often than app code.
It's trying to avoid user from going to the website it's finding results from.
Thank you for your comments.

> TempleOS for all its eccentricity is also very beautiful and in its own way remarkable coherent

As a visual designer myself, his highly-symbolic visual language demonstrates what I understand as a telltale lack of nuance common to those suffering from certain mental illnesses, but the impressive part to me is that he really maximizes it. He seems to have access to an amount of "flow" that many people would kill to harness for their own purposes (of course without its drawbacks in this case). I was wondering if this may indicate that he is receiving a level of care that is fitting for his current needs.

I would love to see many other concepts expressed and illustrated with his current visual vocabulary, but I guess limiting it to Israelite Vision is part of the tradeoff.
And you'll have a lot of statistics there, such as the average number of words / characters used in all of their push notifications, frequency etc. That's really useful to get an overview.
I think the idea is that you don't need the extra security of signing, because if the file was served over HTTPS then you can be secure in the knowledge that it has not been modified.

The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.
Perhaps 802.11ac, since it uses 5GHz, is less congested and thus has less problems?
It's easy to debate trolls and there are worse than him so really it's a bit weak to shut him down with what effectively amounts to censorship.
It's very rare to see something like this in Scotland...
Technology revolutions, and the fates of companies involved in them are very much how Ernest Hemingway described how he went bankrupt "two ways -- first gradually, then suddenly." I am reminded of that reading this article.
Why? You can protect against insider threat by auditing the target system itself and streaming said audit logs to write only media.

Building a single point of compromise has no advantages over this and many disadvantages beyond just security.
There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things.

In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts.

I've got Lyft on my Android phone, but not Uber. I look at its permissions and the only dubious looking one is "access to take photos / videos." Is this perhaps for signing up as a driver and photographing yourself and your car? I don't see anything else that doesn't make sense.
Have you felt like this for long? If it's been months, then maybe a big change could be needed. Sometimes I get these lows for a few weeks, and it's almost more about me than my job/surroundings. You may find your enthusiasm just gets reignited all on it's own.

In the meantime, start trying to think up ideas and write them down, even half baked ones. Idea generation is a muscle. At my peak I write down a new idea every few days. Sometimes that slips to once a month. Regardless, you'll find that if you start doing this, you start getting excited about those ideas which leads to....

...moving forward. Either to a new job, an open source project, learning a new skill set, approaching your boss with an idea, or a new geekup meeting or whatever.
World’s Largest Containership Also Sets Record for Largest Engine Ever
That's what I'm saying. When you ask "How tall is Kobe?" there is a very small chance that you will click on Wikipedia page.
I'm not sure what you mean by Step 1, however what you're suggesting is more akin to an engineer at a SaaS provider carrying out maintenance or debugging a fault and stumbling across something suspicious. What's being suggesting is active monitoring of every communication.
Good points all. I was a bit harsh in my earlier criticisms because I felt the writer was still missing some key points and the article had an air of poverty tourism despite the underlying good intentions.
Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language.

Apparently the author has not ever heard of REST. I'm a little shocked by that.
Sonny = typo.
Thank you for writing this. I think the skepticism of HN is what keeps me coming back. My (more or less) ignorant perspective on so many topics is offset by comments like these, which without, I'd have nothing to temper the marketing material within the links themselves.
A MITM attack? What then? Seems you need signing then.
The nymag.com article tries to add a funny angle with the selected photo and a wishlist of smells.

Much better article about the founders behind the company and their plans is http://www.inc.com/jeff-bercovici/sweet-peach-founder-speaks...
It's like how digital cameras took over and killed off film. It took a while, at first there was no comparison, but eventually it became almost impossible to source film at all.
Denying applications the ability to send faked input events is one of the design goals of Wayland. This makes some things more difficult, e.g. virtual keyboards.

http://lwn.net/Articles/589147/
"while non-white people struggle to find work in tech?", said nobody who has ever been in Silicon Valley.
Since the formatting of the "King of Canada" box and the "All Hail King Barack Obama" box are different, I guess they are produced by different pieces of software. I had only seen the second kind before, where Google shows a snippet from a webpage with some bold text to highlight why it thinks the website provides the answer to the query. But the first kind, for "King of Canada", just prints the answer.

I guess they probably have some set of Wolfram Alpha-like programs to answer particular classes of queries (like artithmetic problems, or names of monarchs), an a different program to generate the snippets.
OfficeFetish
I'm as sceptical as anybody of the merits of IQ as a means for assessing "intelligence", however the fact remains that it is simply a test of memory and logical reasoning. You might as well ban giving maths tests.

I think you'd agree that IQ does not discriminate based on race at all, it discriminates based on class.

It seems common in American discourse to dress class divides up in some kind of "-ism", to subvert the individualistic views that many on the right hold. Everybody wants to fix racism, but many Americans seem to treat systemic poverty with an "every man for himself" attitude.

Unfortunately this has the result of burying the issue, because even if all racism in America were eliminated, the class divide would still remain.
I took a quick look.

I have some doubts about your anti-Sybil attack measures:

* The more CPU my arbiter nodes can prove that I have, the heavier my arbiter vote. But at the same time, I can pretend to be many, many small nodes, which I'll program to side with my arbiters if someone challenges them as being corrupt.

* Can't I just DDoS the other nodes to increase the likelihood that my (sybil) nodes will be selected to be arbiters? I'll just attack nodes (or attack the request submitter) until you pick a quorum of my sybil nodes by chance.

* If all it takes to write to a DHT node is some user's signature on the data (that or an arbiter log; I'm assuming from your wording that one or the other or both will suffice), can't I just create a bunch of key-pairs for each of my sybil nodes and pretend to be a bunch of different users?

Regarding code:

* What steps do you take in the sandbox to prevent the (untrusted) code from denying service to participants? I could use some malicious code to deny service to other nodes (helping my nodes get selected to be arbiters).

* No entropy in the sandbox will limit the things you can do here. You can't (safely) do cryptography, for example.

Regarding storage:

* Have you heard of Permacoin? [1] You can have proof-of-storage without arbiters or a DHT.

* Even then, Permacoin is slow--way too slow for interactive I/O. So is Bitcoin. Your system will be slow as well, since you're not only replicating writes to a blockchain, but also you're funneling them through a handful of nodes that were chosen for their CPU, not their network connectivity. Note that you're writing multiple sets of entries per computation (the arbiter log), in addition to storing the results of the computation.

Regarding presentation:

* Outline your goals up front, as a bullet-point list.

* Outline similarities and differences with related work as a grid, with the set of systems as rows and the set of features as columns. This will make it easier for readers familiar with other systems to quickly grasp what your system does and does not do (readers will look to the text for clarification of the table).

* If you're constructing a protocol, you should consider adding a protocol diagram for both the successful case and the error cases. You should also show (or prove) that your protocol makes certain guarantees, if possible.

Hope this helped!

[1] https://www.cs.umd.edu/~elaine/docs/permacoin.pdf
thanks for reporting the findings... they should make it so you can block the specific settings after-the-fact and see if it actually breaks anything
Climbing a Glass Building? Try a Gecko’s Sticky Pads
TLDR: Uber's Android app is literally malware

Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:

- SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested]
- call history
- wifi connections
- GPS location
- every type of device fingerprint possible (device IDs)

It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.

From my understanding, which the author somehow missed, is that it is using http://www.inauth.com SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.

Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.

Edit: here is a copy of the decompiled source code http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu... note the name "package com.inauth.mme"

Edit #2: here is a screenshot of Uber's permission request https://i.imgur.com/4MmYrJH.png no SMS on the list
Perhaps I misunderstand you but since it's HTTPS, in theory there are no MITM attacks.
Thanks!

We have some ideas about solving the trust issue — https://news.ycombinator.com/item?id=8660233 — but yep, native apps are definitely on the way.

Still playing around with the site, I'll set aside some time to dig into readability issues (I was noticing the same effect at certain parts of the video).
PUT and DELETE are standardized. http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
Take a peek behind the scenes of your favourite startups.
She looked at me like I was a Martian.

It wasn't your $100 you were trying to get her to spend.
Yeah I noticed that as well, it makes me wonder about the rest of his technical assertions that I'm less able to judge.

Just in case anyone was wondering here's the HTTP 1.1 rfc: https://www.ietf.org/rfc/rfc2616.txt A simple search will show that it does include PUT and DELETE.
See my response here https://news.ycombinator.com/item?id=8660294
The Secret Life of a Crime Scene Cleaner
> knew that Canada is part of the Commonwealth of Nations, which means that its queen is technically the same as the British Empire's queen.

(1) There is no British Empire any more, and
(2) Queen Elizabeth II is Queen of Canada, but not because Canada is part of the Commonwealth of Nations. The Commonwealth of Nations is not coextensive with the set of nations that happen have the current monarch of the United Kingdom as their monarch as well (Queen Elizabeth II is also Head of the Commonwealth -- a title created because King George VI stopped being monarch -- Emporer, specifically -- of India while India remained in the Commonwealth), though there is still substantial overlap.
> His is a wholly self-directed life

Assuming he has the capacity to reject medication.
I wasn't saying that meditation isn't measurable, or that it's a waste of time, I was talking about the idea of the brain as a "receiver of consciousness". Meditation is definitely interesting, but it is dangerously easy to cross from "this helps/interests me personally" into "I have constructed an irrational belief system based on insights that are ill defined and not supported by evidence"
Let me know if you want to work for our team in Dublin! We build distributed databases - pretty much as high tech as it can get :)
You clearly have not lived in Woodbridge. There are literally thousands of commuter parking spaces just for people slugging into the city.

For instance, 2,425 parking spaces just for people slugging into the city[1].

[1] http://www.slug-lines.com/AM_Lines/Horner_rd.asp
Thanks for the reply!

As someone involved in computing research (sometimes OS kernel research, even) I can appreciate the need to actually get something going.

Ideally, if I was starting off a project with the intent of focusing on something like distributed data management, I'd want to sit down and figure out what I actually need and write a kernel to do that, rather than pulling in Linux with its DECnet drivers and 300+ system calls and what-not. Maybe a Unix-like system with POSIX calls isn't the best way to approach the problem. The problem is that you end up spending a lot of time dicking around with the scheduler and figuring out why memory allocation sometimes screws up, and less time implementing the real deal.

I've had good experiences working with a 64-bit Plan 9 kernel, since I was already familiar with the code and it was quite minimal, but I still ended up fighting the compatibility/driver crap you mentioned. It's also pretty easy to get functionality, but getting functionality and performance is a pain.
It's worth noting that the quick summation of Android permissions given to users isn't quite accurate. There are a limited number of permissions, and many of them (such as SD card read/write access) are very broad. So the summary Google uses is a lay description of the worst possible thing an app could do with those permissions, which may be much more invasive than what it actually does.
NZ Herald cartoon and optical illusion – can anyone explain how it works?
I'm happy Lyft is demonstrating that it actually cares about its core/founding values of decreasing car usage.

They could have viewed this as a distraction to expanding its existing dedicated-driver model, in order to better compete against Uber. (Lyft Line is just multiple passengers; Sidecar already does "driver destination" aka real carpooling, but they're also playing a different game focusing on drivers in general, and don't have the scale Lyft does)

If they can get traction, they'll have cracked a problem that many people have tried to solve and failed at: how do you get Americans to carpool?

Context: Lyft's founders pivoted into Lyft from Zimride after five years of building white-labeled carpool sites for colleges/companies + a public long-distance carpool/rideshare board, and discovering that a) that's not a VC-scale business, and b) 90% of Americans don't "do" traditional carpooling and they're not about to start

Anyway, I use Lyft over Uber when possible for many reasons, but this is one-- they started out trying to improve society in a particular way, and still are, even as they've changed their approach. And I think they should be commended for setting an example for how to achieve an activist-y goal through a startup/company. Or since it's not achieved yet, at least trying.

(I have no affiliation with Lyft, see my profile.)
FYI, the time alloted to each challenge seem to increase with the difficulty (the first couple of problems are 48 hours, then 72, then 96, etc.).
Nope; you can download "master" (or branch) zip from GitHub, which contains the original with modifications, not separate. It's clearly against the licence.
lol, thanks! We're definitely trying to make Cyph the dopest chat app out there ("dopest encrypted chat" just doesn't sound like a terribly high bar to me).
Could you please "translate" few phrases for the sake of learning english? Namely, "having a feel day" and "pass with flying carpets".
> find an open-minded employer who might listen to the situation and be willing to give Terry a shot?

When you strip away the notion, or often the facade, that jobs are not a form of enslavement then you might be asking yourself the question I'm asking: Why would you want to do that to him? It's not like he hasn't been able to find a purpose in life to keep himself happy. Or do you really know anything about him or what his needs are to suggest a 'job' would be of any help?
Yep especially men in white vans on the phone :)
1. This is not about being perfect, this is about being trustworthy or secure. Right now this is very dangerous to be promoting as even remotely private, as you claim on both your website and twitter. This is no more secure than chatting over facebook. There is no 'clever solution' to get around crypto in the browser, it's always bad.

2. There is absolutely no point to using end-to-end crypto in this setup because it can all be intercepted. Not to mention there is no key verification, so even if you're JS wasn't interceptable it's still trivial to intercept messages. It's a red herring at best and at worst deceptive .

3. I stand corrected, although JS (regardless of whether it's in the browser or not) is usually considered terrible for crypto implementations because of it's math bugs.

4. You might want to check yourself, https://www.ssllabs.com/ssltest/analyze.html?d=www.cyph.com&... you're pointed to cloudflare's SNI server.

I think what you fail to understand is you're relying entirely on TLS for all of your security, which means a LOT of different people are able to read these messages. It's not just your CA that could be compromised to hack you, its ANY CA. So for example the chinese government decides they want to read everyone's messages, all they need to do is publish a cert with your domain. Or any of your staff. Or anyone at cloudflare. Or anyone with access to your server. Or access to your home computers which have login credentials.
It's a common practice to do this "just in case" you need the permissions later on. When first installing an app users are likely to hit Ok to whatever, but when permissions change on an update they are hit with another screen that tells them the specific thing you are now asking permissions for.
Docker 1.3.2 – Security Advisory [24 Nov 2014]
Don't wanna be too old for this shit Bmx Racing Crowdfunding project
Heh. How many impressions did you get from startup lister if you don't mind me asking?
Yikes, uninstalling now. I haven't used Uber for a while, but it's been useful to have just in case Lyft is +200% and Sidecar doesn't have anything available... Now it's not even worth it to have the software on my phone. Thanks for the summary and link to the decompiled source code.
also mentioned in the release notes for 1.3.2: https://docs.docker.com/release-notes/#version-132
Google cached

http://webcache.googleusercontent.com/search?q=cache:6rWGz01...
I wonder if it's a similar deal to the conspiracies and finding patterns that aren't there. Mentally healthy people already have trouble with cause and effect with race issues, so instead of going "Lots of black people in jail -> The war on drugs is absurd and our justice system has problems" he connects "Lots of black people in jail -> black people are bad."

/ Not a psychologist. unless internet armchair psychology counts
The article says he's down to one medication.