skysight-inc/HackerNews huggingface dataset:
There are solutions in place to combine SSH keys with 2FA. E.g. Duo Security has a solution for that: https://www.duosecurity.com/blog/ssh-keys-that-call-you-back

[Edit: Removed redundant comments.]
The NSA Outlined Bitcoin Prior to Satoshi Nakamoto
"devops"

Dev and ops are completely different mindsets, but each has to understand the other.

You are positioning yourself for career advancement, as you expand the scope of what you know, and the rough map of what you know you don't know.
In this day, I would just use http and websockets instead of dbus even for local communication. It just makes sense
US Senate and House Legislator Terms
I got in Firefox:

This address is restricted

This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection.

It wouldn't even try to connect until I set network.security.ports.banned.override to "8123" in about:config. But now that I've set it, it seems that the website is unresponsive (overloaded?) anyway.
Isn't system administration a "closely related field" to software development, at least from the point of view of the people reading the visa application?
Gmail has made the email ecosystem much worse than it was. Sadly it just marks your domain as spam eve if you do ptr, SPF, dkim, dmarc etc. Really sad
Signature based antivirus, as in "after the fact"-heuristics, remains the most useful. Because, as advanced as the other methods may be, their usefulness remains limited by their public existence. Any malware writer checks their creations against VirusTotal and change it as long as anything flags.
Going to the Handbrake site is a good clue (plus seeing a stream of a few MBs), and HTTPS doesn't protect them from knowing that, since they need to be the only site on that IP and/or use SNI, which sends the hostname in plaintext.
Duplicate. User added more detail to his/her question in https://news.ycombinator.com/item?id=8650381
> the author is sophisticated and that's why they chose RC5

I'm saying that because the author is sophisticated, they know that the strength of the algorithm doesn't matter (so long as it's not something ridiculously simple).

DES, AES, RC5, RC6, whatever. They're all good enough because Symantec (or whoever is analyzing the malware) is going to get the plaintext no matter what. Symantec is not going to do any cryptanalysis whatsoever. Symantec is going to run the sample malware in a debugger and watch it get decrypted. The malware must decrypt itself in order to run.
Native Integer support in Lua 5.3 by Lua creator R. Ierusalimschy, Moscow 2014
It's a good question whether Henry Paulson showed favoritism to Goldman Sachs, but we need evidence to make a judgment about the answer. The rest is speculation about a hypothetical person's choices and their outcomes in a highly complex, chaotic, novel situation.

Most experts, especially those within the establishment, say that allowing all those institutions to collapse would have been catastrophic and that the government should have rescued them. I think it's reasonable to expect that if one of those establishment experts was the alternative to Paulson, a likely scenario, then they would have acted similarly.

If someone acts to prevent catastrophe and succeeds, critics always can (and do) say that the catastrophe wouldn't have happened anyway.
A bit, and it is indeed. Also the light electric scooters are incredibly cheap now. But a combustion engine would still be great when you need the extra range.
How do you feel about reproducible computing in python? R is very well set up to A) get it running on any platform easily B) report the crucial parts of the environment. I know that if I grab someone else's (published) code written in R, I'm pretty confident I can make it work. Part of this is the great package management through CRAN or Bioconductor, and also because often important reference data for bioinformatics is actually available through the package manager.

I haven't done much with Python, but I don't quite get the same feeling (happy to be told that the reality is otherwise!). For example, the opening line of the installation guide for Pandas doesn't inspire great confidence in me: "The easiest way for the majority of users to install pandas is to install it as part of the Anaconda distribution, a cross platform distribution for data analysis and scientific computing."[1] Do I really need to install the HDF5 package so I can split a concatenated variable into two columns??

[1] http://pandas.pydata.org/pandas-docs/stable/install.html
Ask HN: Windows laptop with Apple-like hardware?
My dad loves the hardware on my Macbook Pro but continues to be a hardcore Windows person. Any suggestion on what new laptop he should get?
Really, the only reason Javascripts future looks very bright is because it has a monopoly - it's the only language that runs in the browser.

Javascript is a great language for what it is, and ES6 fixes a lot of the warts - but it's still a rather mediocre language compared to many of the other options out there.

It's a great quick-n-dirty language for hacking things together, but it's less ideal for more significant projects. (You certainly can maintain large projects in Javascript, but there are much better languages for this task).

> ASM.js will soon make V8 _much_ faster

ASM.js is not Javascript, and it won't make Javascript run any faster. It's a compile target that happens to resemble a syntactically valid subset of Javascript for backwards compatibility purposes.

ASM.js can only really be used as a compile target for unmanaged languages, and acts as a bytecode that compiles down to pure assembly. It's not something that any Javascript developer would write by hand.
I did learn a lot, thanks for commenting. It also seems like you agree with the premise of the article that there is confusing stuff in, what you called 'informal' spec, but explained why. So, thanks again.
I read it without consideration about the author. Overall I thought it was good general information and took note of the sincerity of the tone to urge readers to snuggle "post-coital esp. with virgin". Was expecting more diving into kinky human sexuality but perhaps seems more like the author is trying to educate the basics to us his brethren.
9vx: a port of the Plan 9 operating system to FreeBSD, Linux, and OS X
May be of interest to JavaScript users, because until now, Lua and JavaScript shared the concept of a single number type based on IEEE 'double'.
I'd be surprised if string cheese was invented in 1976. Armenian string cheese seems like something that has been around for a long time:
http://www.seriouseats.com/2010/06/armenian-string-cheese-br...
This won't solve the buffering problem, but for the record, you can use "open network location" in VLC to watch YouTube videos directly.

Regardless, youtube-dl and VLC complement each other quite well.
> It's Jacob, not Jack.

Whoops. Silly. Thanks.

> I'm really not sure how much credence I give crypto comments from Appelbaum.

In this case it isn't a crypto comment as much as it is a forensic one. His suggestion comes from experience working with and reversing US malware. We do know that some US malware samples did use RC6, but that's hardly enough to say with confidence that this is a ubiquitous choice for all US malware. My guess would be that it is not.

> With RC6 you don't even get good open source library support.

I'm not sure how worried they are about this.
Just six figures? To build this and maintain it over multiple years, including a menu of payloads and exploits? When individual exclusive 0day exploits each rank at 5 figures upwards? Salaries?

That seems unrealistically low for this. Sounds like much better value for money than any nation state would actually get in practice, and more in the ballpark of Malware-as-a-Service outlets like Hacking Team.

(Why the love for .lv?)
It's good for bitrate starved files, but x264 is actually still more efficient for transparent encodes. x265 currently can't handle noise very well.

x265 is also much slower than x264, but it's getting faster all the time.
> I'd love to see a really scholarly non-sensationalistic analysis of who this new nobility actually is and what the real power structure really looks like.

I'm not sure I agree that it's really nobility or call it feudal, but I would love to see some serious research.

One interesting pattern: Many of the wealthy, such as the Koch brothers, push hard against government power and expenditure. That leaves society more dependent on those same wealthy people, giving them more influence both absolutely and also relative to government.

As a simple example I read an article advising people seeking grants for scientific research to network with the wealthy because government research spending has been cut. The same applies to the arts, education, social welfare, etc.
Yup! All of our old maps can be downloaded here: http://mcp-dl.com/
I'm glad you mentioned this because I initially got the Static XSS Scanner and was about to flag the article as "full of lies"
Choosing RC5 is an irrelevant implementation detail; they probably used whatever was in hand at the time. The only requirement is that the function makes things random-looking, really. I agree with alister in that the reason---if there was any reasoning applied here---was likely code size / simplicity.

Look at Flame's encryption functions [1, §4]. This is the malware that burned a chosen-prefix MD5 collision elsewhere, but still went ahead and used the simplest mangling functions possible. You also find plenty of other 'state-sponsored' malware using similarly stupid/weak/outdated encryption.

[1] http://www.crysys.hu/skywiper/skywiper.pdf
We reset every 3-6 months.
May I ask what the program "ytplay" is? Google doesn't guide me.
Yeah, post-classical would have been the more accurate term, thought I'm not sure it would've had the same comprehensibility.
Are you guys kidding!? JavaScript is not useless at all. None of you use Gmail..? Any other web app of any kind? Facebook..?

I read their page and honestly I don't see who would want to be unable to use 90% of the web to have privacy.
Capability is constrained by more dimensions than just a financial one.

Try to imagine the fall-out of say the Dutch spying on all these countries, including one of their EU countries is interesting. I really can't see any of the EU countries that might be implicated by a thing like this having to admit at some point in time on having spied on Belgium or Austria. That they can afford it is besides the point, though I'd like to see some politician willingly sign off on this.

Since the put-out-to-pasture trajectory of past their prime EU politicians is to be promoted to Bruxelles I highly doubt they would limit their careers in such a drastic way.

Whoever did this needed to have the desire first, the capability second (technical capability, for instance (this doesn't strike me as a small undertaking easily contracted out), but also to be un-encumbered legally) and then finally they need the money. That's the least of the problems but I don't see them crossing the legal barrier to begin with.

The French have had some egg on their faces in the past with actions against non-government entities operating nominally under the flag of other member states (for instance, the Rainbow Warrior incident) and they will forever be remembered because of that. I don't think (or maybe wish to think) that any of the countries that are currently signatory to the various EU and other treaties would willingly cross the lines on something as sensitive as this.

One leak and the press would be all over this.
OSM has this much detail? The buildings and such seem way more fleshed out than I'm able to see on OpenStreetMap. Were those added via some other mechanism, or is there more data in OSM than I thought? Like, even height doesn't seem to be available, much less shapes like spires and such as shown in the demo image.
The "reads on an analog input which is interpreted digitally" are effectively a one-bit ADC or comparator, aren't they?
World’s most advanced hacking spyware let loose
I look forward to seeing the rest of Chromium follow. Hopefully it'll move from Reitveld to Gerrit and repo in the process. Reitveld has SVN support, but it and its command-line tools are otherwise more painful than Gerrit in every way.
For Windows, it's easier to start IDLE than it is to start python from a command line, and the editor is better. It's still terrible, but at least it's better.
You would need to get him a Macbook Pro, you can run Windows on a Macbook Pro using Bootcamp or install it on a VM using one of the many virtualization clients that have some very nice optional integration abilities into OS X.

If he really likes the Macbook Pro, it is best to get him a Macbook Pro, he might become a hybrid fan. Either way with him having a Mac and running OS X he will be able to increase his knowledge base by adding experience overtime with OS X and maybe adding Linux later down the line.
When I was at Intel we saw "breakage" at the packaging level, basically once die were packaged they would be run through a tester and a fraction of the parts would bin out (fail characterization testing). In theory those bad chips were ground up and recycled, sometimes they went missing. (this was back in the late 80's early 90's) At the time Intel invested in ways of tracking chips back through the process when those chips showed up in the market the source of the leak could be plugged.

It is entirely unclear to me if companies like AllWinner which make a bunch ARM chips has similar sorts of controls.
Equity trades are reported, but what about the other types of securities? What about derivatives? You know, the thing that had a huge role in the 2008 crisis?
It's fascinating to read about the blunders both competitors made. One of the many strengths of computer chess programs is that they are virtually guaranteed never to make such mistakes.
Paramiko for SSH and SFTP in Python
I'm not counting payloads and exploits against the cost of the framework, because the framework is all we have to go on. Exploits cost a lot of if you (a) need zero-day, (b) need mass-infection, or (c) need to foil attribution. They're significantly cheaper if you relax those concerns.

Similarly: I assume the payload that physically corrupts a centrifuge array is a bit pricier than the one that scans the hard drive for credit card numbers.

Latvia's just the smallest EU economy that came into my head.
Plan9-style namespacing -- as something that users can do directly without privilege -- has definitely not been adopted outside plan9. What we have is a pale pale shadow of the capabilities exposed by that.

Unfortunately, true user control over the namespace is incompatible with the unix security model (thanks to setuid being the only means of privilege escalation), and the namespace compositing that makes, for example, just stacking bin directories onto /bin instead of using a PATH requires that it be possible to have more than one file with the same name in the same view to work well, which is (probably?) incompatible with POSIX.
Python's pip is pretty good though not quite as polished as CRAN. I have had few problems running complex code from third party sources, though one always has to be aware of the Python 2 v 3 "problem" (though it is diminishing now with most things available on 3). If you get pip up and running on a new Python installation you can avoid Anaconda/Canopy if you want a clean installation, and I have installed fairly complex Python setups in multiple locations without too much trouble. Let's be fair, R can also be tough if it calls a lot of third party libraries. Just try to get rJava working properly for example if the local R and Java installations are not both 32 or 64 bit. It can be a complete mess to disentangle this sort of stuff in R. Or for example running code that uses Cairo, on a mac. My experience is that Python's poor package management reputation is not really deserved anymore. Python's virtualenv also allows you hermetically to seal away an entire python environment, including its libraries, so that it will not conflict with other python environments that might have different versions of the interpreter and/or libraries. I am not aware of anything this robust in R.

Reproducible computing? The ipython notebook is awesome, though I am not sure if there is anything as good as knitr if your workflow is LaTeX oriented.

R "hands" will usually find Python a backward step when it comes to vectorized data manipulation, but its a forward leap if your data becomes too big or if you have to step out of the comfy environment of exploratory analysis into any form of (even trivial) production settings.

And no you definitely do not need HDF5 to effectively use Pandas.
Yeah, it really is kind of shocking how bad American string cheese is. It's kind of an extruded cheese stick, with very little stringiness.

Armenian-style string cheese, on the other hand, is rather salty with a wonderfully dense braid, and the black caraway seeds add to the taste. The only downside for me is that it tends to spoil faster than I can eat it.
? hence the "so special" in my question. There are plenty of these tools already and it's been so for long time. As a hacker you should know. So again, what's so special about this?
Word2vec Algorithm on Harry Potter
Thanks! I love reading about how people solved problems without our contemporary tools.
hacking is a style of programming, hacking is being a cool start up guy, hacking is being a computer wizard, hacking is X, hacking isn't Y.

why some people keep trying to use the word hacking for what they do no matter what, it's because it sounds cool?
Java syntax doesn't have any of the spiral type parsing behavior that C's has. So it's unclear what you have to complain about.
The server has enormous lag because of this post. I managed to find a castle full of melons just a minute before I would have starved. I guess I'm lucky.
I thought the UK was the only one insane enough to think human rights were a pick and mix. I recommend Conor Gearty on why the Uk should not pull out (LSE podcasts on iTunes)
I moderately hope some news agency researcher carelessly reads this thread and we get some big cable news company blaming this malware on Latvia.
Linux Namespaces: Powerful Isolation and OS Level Virtualization
Absence of a built-in simple database model, I think.
The unix way is to use a flat file, which turned out in the long term to be inadequate. Part of the underlying reason for systemd on Linux is that people want to configure their system with a robust database, not shell scripts or ad-hoc text file formats which must be edited by hand, or by custom database drivers (like Berkeley DB). Proplist might be another partial solution to this requirement on systems which lack an active data model. BeOS had a strong database-like file system which may address the same thing.

See
http://martinfowler.com/articles/languageWorkbench.html#Acti...
In NL they replaced a perfectly good system for train tickets based on paper with an electronic one that is failure prone but allows the operators to track the movements of half the population.
Ask HN: Hardware in Ireland
My interests have always stayed a little bit closer to the metal than seems common; embedded development with a fair share of hardware interfacing is far more appealing to me than the web-stack du jour. E.g. wireless stacks are a peculiar favourite of mine.

This style of work seems hard come by in my native Ireland, and I'm strongly considering emigrating to somewhere like Germany where, from what I understand, it would be more common (e.g. industrial control, consumer electronic/computer engineering, etc.)

Do any HNers know of companies in Ireland doing any of this style of work? Most of the software dev roles seem to be service oriented.

Thanks for any suggestions.
Ask HN: How can i work from home?
Switching dbus to websocket/http instead of its own outer layer equivalent would get you about 1% done implementing dbus. It doesn't address or answer 99% of why dbus exists or what it does.

So it's a fine thing to consider (since websocket exists now) but I'd question the word "just" here.

It's like saying the way you'd implement an Amazon web service would be to "just use http." OK. Now what is the service? ;-) I hope that makes sense.

It's a mistake to view the problem solved here as "sending messages." The problem is all about the semantics of sending them and the lifecycle services provided by the central daemon.
But that's already the case if you company uses Google Docs or Office365.

If a company is intent on constraining access to data from its office space only, then it wouldn't select or open itself to such systems.
How Would You Redo the Google Interface? (2004)
They wouldn't have survived? Based on what evidence? They had already liquidated the majority of their bad debt and hedged away more of the risk onto their own clients by the time TARP came around.
You link to "a Plan 9-inspired userspace on top of a Gentoo base system", which was preceded by plan9port.[1][2]

But they're only a (admittedly important, but insufficient) subset of the Plan 9 operating system.

[1] - http://swtch.com/plan9port/

[2] - https://en.wikipedia.org/wiki/Plan_9_from_User_Space
I guess if you're saying you can't read RC5 as being a point in favor of or against GCHQ, I find your argument plausible. RC5 is more plausible at least than RC6, which (a) few people have at hand and (b) calls significantly more attention to itself.
Reminiscent of this:

http://lukehalliwell.wordpress.com/2010/08/05/project-myworl...

long-since morphed into this:

http://recce.com
UI/UX is a very serious thing of its own given that the most popular consumer OSes today are arguably not the most technically superior.
In my experience (having submitted many patches) it is very hard to get patches accepted to fdo projects. It may be because the maintainers are salaried by RedHat, so they get new task assignments and are removed from maintainership of the packages. E.g here is a six year old patch lingering:

https://bugs.freedesktop.org/show_bug.cgi?id=16783

Someone certainly could write a bunch of patches to make the dbus specification better. But to get those patches included into the official dbus specification is a completely different problem. And you know that. Having spent a lot of effort in this thread defending the dbus spec as adequate, you wouldn't be the one spending your time integrating their patches.

You could see the blog post as a bug report. Pointing out weaknesses in the spec that could use improvement. Or you could see it as just another guy ranting on the internet.
I've never had any audio sync problems with Handbrake, then again I've never done anything 'exotic' (basically encode my dvd's to x264+audio passthrough) and everything has worked fine.
The Next Web NYC Hackathon
They should be, because popular open source implementations (really, any popular implementation --- it just happens that every popular crypto implementation is open source) provide deniability.
More correctly AuthorizedKeysCommand is in mainline OpenSSH, thus every recent release of all major distros have it.
So blogspot.com is being merged with Google+? I only rarely bother to disable my JavaScript/ad blockers to read things there.

Looking at the source, it's a big pile of minified/obfuscated javascript crap. I can't be bothered to decode it.
You talk as if these investment banks were poor helpless living creatures or something.

They gambled and they lost, then they had their government cronies bail them out. An analogy would be an idiot gambling away his entire live savings on the slot machine, and then going to the house and complaining: "I deserve all my money back because I didn't win."
If you want to self-host the agent (solves the sharing code problem) then Buildbox[0] is a very impressive tool.

[0]: https://buildbox.io/#learn-more