skysight-inc/HackerNews huggingface dataset:
> if a single image on the page is not encrypted it jeopardizes the security of the connection

But only in the sense that the article text could say e.g. "implement the authentication algorithm according to illustration #42" and illustration #42 could have been maliciously replaced with an image showing an incorrect implementation, right?

A script served over an insecure connection, on the other hand, would give the attacker access to the DOM and compromise the entire page (and other pages on the site with AJAX).

So does the fact that ads need to be served securely imply that they have the ability to execute JavaScript in the context of the page? By serving ads (whether encrypted or not) am I trusting every advertiser on the network with the session cookies of all my users, essentially allowing them to intercept communications between the site and its users?
Ask HN: Seeking math and science college students to beta test
Hi Guys,

I am looking for college students who are majors in math and science disciplines to beta test http://www.jasymchat.com. Think of it as a lightweight Matlab mobile app with built-in chat :)

Feel free email (see profile) me questions.
It's pretty obvious they're intending the discussion to happen on mailing lists.

We’d love to hear what UA vendors, web developers, and users think. Thanks for reading! We are discussing the proposal on web standards mailing lists:
public-webappsec@w3.org
blink-dev@chromium.org
security-dev@chromium.org
dev-security@lists.mozilla.org

You make it sound like they're eschewing discussion.
Brings up a concern there are no authenticity check in the mobile networks. Who signs the authenticity of cell towers? This should be like SSL with certificates so your phone should only communicate with towers that are certified secure. Hackers have been able todo this for years through GNU radio and FPGA. But this should be a foreign state.

And if there are fake towers around the Norwegian parliament.
Who, which hackers and what malware is potentially inside the computers of the cell phone operators of Norway? I would target them if I wanted to really listen in to cell phone communication across the country.
The Economist audio edition is so well done and has been around for years. I'm surprised no other major publications have looked at it for inspiration. As a one time subscriber of the New Republic, an audio edition would have really had me thinking about subscribing again. I loved the long-form journalism, and it's better content than most podcasts I listen to while doing other things.
The future of democracy?
Democracy has actually survived spying and strengthened thanks to the misadventures of spy agencies through out its history.
The relevant stat is right there in the article:

A Pew Research Center survey from 2007 reported that 41 percent of adults say it is bad for society when mothers with young children work and just 22 percent say it is good.

The US has a significant population of people who are hostile to the women's movement. They want women to move back into the kitchen. They see systems like subsidized child care as an attack on their traditional family values.
As much I heard, the ARM instruction set is also not so simple as it could. So a new, fresh and clean instruction set would be great and the comparison of the two architectures looks promising.

I scan-read the paper, but did not encounter any number of registers. Does anybody know, how many registers this architecture has/supports ... is there any implementation yet?

Hope, there will be an implementation soon, and maybe a smartphone or tablet computer based on it... (or a new Raspberry?)

Edit: Now I see, should be 32 registers, based on the 32bit opcode-format (5 bits to address any register).
We were investigating CPUs for embedded use. I am not sure right now if it was RISC or MIPS. The performance was fraction of ARM or x86. But the consulting company would build SOC exactly to our spec. There were zero licensing fees.

So for embedded use if performance is not important, I would seriously consider it.
> if a single image on the page is not encrypted it jeopardizes the security of the connection

Or, you know, loading untrusted javascript onto your page could also jeopardize the security of your site.
This article is surprisingly better (and longer ;) than I expected, but
it skipped over explaining one important distinction; "ELF" is an
executable file format, but "a.out" is more than just a default file
name; it's also the name of a totally different executable file format.

Originally, the "a.out" executable format, and hence, the "a.out" file
name were due to being the "assembler output" of Ken Thompson's
assembler in 1968. Most all UNIX-based systems have moved to using newer
ELF format, but there are a few hold-outs still using the older a.out
format. As for why ELF formatted executable files are still given the
file name "a.out" by default, even when they are not in the "a.out"
executable format, it's just a historic artifact (or annoyance) due to
compilers and linkers.

http://en.wikipedia.org/wiki/A.out
How is this different from the hundreds of aftermarket fans already available? This article implies that no one has ever thought to redesign computer fans before, yet if you take a glance at NewEgg, there are 1841 listings under the "CPU Fans & Heatsinks" category: http://www.newegg.com/CPU-Fans-Heatsinks/SubCategory/ID-574

It claims "the company’s fans are half the size and achieve 35-40 percent greater thermal performance than traditional PC fans." What is the definition of "traditional PC fan?" Stock fans?
Yes, .attribute syntax is much nicer than brackets, especially on German keyboard layouts (needs "Alt Graph"). Why can't dicts just support both? Because of the Zen? Also this is an old issue, see Alex Martelli's bunch class recipe on ActiveState http://code.activestate.com/recipes/52308-the-simple-but-han...

The mutate-on-get makes it very similar to how Matlab does its "structs", I'm mostly undecided on that but at times it can be nice.
A regression fit on failure ~ 1 + smart would've presented this data nicely and showed how the various SMART stats interact. If our goal is just to forecast, fitting that regression with a penalized method would've likely provided a great result.
I believe that BitShares Music project is the most tangible effort in making this kind of platform happen.

http://bitsharesmusicfoundation.org/
http://peertracks.com
>They care because they are selecting applicants to a programming boot camp and want to select the ones more likely to be successful.

Just make a programming test. IMO is more certain than relying on knowing algebra well or not. But I don't have any data to show you, is just me thinking about it.

>Prove it.

I can't, you are right. I just said what I was thinking.
Could you explain what differences make Go optimized for server software and Rust for systems software/C replacement? I'm not being rhetorical -- I genuinely don't understand and would like to.

Related: Would Rust be a bad choice for backend web development (ie, an alternative for Ruby/Python) and why or why not?
Interesting. It appears they have done a quite thorough analysis on the data. But of course there are standard techniques for statistical classification from the mathematical community. It would be nice if somebody wrote a classifier for this problem.
Care to update for 64 bits?
That is of course written there: "The full story in Norwegian: Stortinget og statsministeren overvåkes" ( http://mm.aftenposten.no/stortinget-og-statsministeren-overv... )

The English speaking readers are still better informed about the basics when reading the real English article. Google Translate translated Norvegian "National Security Authority" (or "National Security Institution)" (NSM, Nasjonal Sikkerhetsmyndighet) as "National Security Agency" which is very misleading. That is, it's Norwegian "Nasjonal Sikkerhetsmyndighet" (NSM) who says that the spying devices don't belong to them. US NSA hasn't said anything.

Once you read the English version, the Norwegian version can give you a better idea about the scale of the operation (if it's only one entity behind all the devices): the number of the snooping devices and of the points where suspicious traffic was detected seems to be quite big! The content is also nicely presented, all with the videos and the interactive maps (which sadly aren't translated by Google Translate).
In the context of a discussion of the 2nd amendment's [intended] purpose and how those that wrote it felt toward the people I fail to see the relevance of a quote by someone who had no part in writing our Constitution. [John Adams was in Britain during the Constitutional Convention].
Experienced entrepreneurs reveal how they deal with work/life balance
I'm publishing a paper soon on "Using the Blockchain as an Infallible Personal Backup Resource" wherein I outline a proposal for embedding the entire contents of a user's computer in the blockchain via a series of micro-transactions.

Because the blockchain is <memo to self: Look up and copy/paste some stuff about 'distributed','uncensorable', 'irreversible' and 'entire transaction history'in here later> I could have every version of every file I've ever worked on, securely stored in the blockchain, as an infinite and indestructable personal backup.

The only small niggle I've got to iron out is that, owing to the small transaction fee attached to each fragment of data I upload, it is likely to cost me more than the entire GDP of the planet, just to back up my MP3s folder.

However, as I am also currently working on a means of using the blockchain to travel into the past, where I intend to deposit a penny in a high interest savings account in the Middle Ages, I expect to have this wrinkle ironed out pretty soon.

Kickstarter campaign address to follow.
> Almost, he is also converting ordinary dicts that get added as items to his own Dict class

You are right I dind't notice that before.
But looking at the code it seems that the only permitted values are dict and str?!

> But yes, the idea of storing everything twice (once as an item and once as an attribute)
I don't get that, you don't store things twice and nothing breaks, at least with the example code I wrote above. Try:

>>> a=D()
>>> a.lol = 2
>>> a['get'] = 'foo'
>>> a
{'get': 'foo', 'lol': 1}
>>> vars(a)
{}
Postfix when installed has pretty good defaults and works safely pretty much out of the box. Are people actually looking for third-parties like developermail when it's really not that hard?
Won't SOMEBODY think of the CHILDREN!!!1111!!!!1!1
Nice. Perhaps have a look at uclibc and busybox... :-)
Redesigning SoundCloud
10 Actions That Highlight You as a Business Leader
I haven't tried it but here's some issues from a superficial code review:

This uses twice as much memory as it needs to (and opens the door to potential inconsistency) by storing everything redundantly in both the attributes dictionary and the underlying dict.

Setting an item with a non-string key (e.g. An int or even unicode) is silently ignored.

myDict[u'foo'] = 'bar' # <- this ought to do something

Setting or deleting an item with the same name as an existing attribute (e.g. the name of a method) will replace or delete that attribute.

myDict['get'] = 'foo' # <- should not replace the method myDict.get

This can't be initialised with kwargs or an iterator like an ordinary dict can.
This doesn't trigger autocompletion of attributes in dreampie / bpython / ipython - the original implementation does.
Does the number of mutations in a genome increase with the size of the genome, or with the length of time the genome is "in use?" Let's assume that the mutations are evenly distributed throughout the genome. If genetic mutation count is dependent on the size of the genome then it fits your "unreliable transmission" model.

However, if genetic mutation count is time-dependent but totally independent of the size of the genome, then having a larger genome actually does protect you from individual mutations, and it would do so exactly using the mechanisms described previously.

Think of two genomes, one large and one small, both existing throughout time. Both will accumulate a similar quantity of mutations from mutagenic processes which are time-dependent like radiation exposure.
high-status men > high-status women > low-status women > low-status men.

Going to need some evidence of that. Seems like bullshit.
That's what I loved about DOS com executables. Possibly the smallest program was:

int 20;

which got translated into CDh 20h (4 bytes!)
yes agree. a little bit more information would be nice
Circle takes credit cards for them.
The article is interesting, but buried in it is this link to their full stats on the SMART reports which is fascinating:

https://www.backblaze.com/blog-smart-stats-2014-8.html
I think that's exactly it: the output is a complex web of societal effects, and thus does not translate easily into dollars. It is possible that money be extracted out of that output if you push it, but it comes at the expense of some part of that complexity that forever lies in a tug-of-war between authenticity and power.
At some level of scale medicine and law are about human and social needs, but at that same level of scale, programming is about social and consumer needs. Yet by that chart you posted, the level of CS degrees awarded to women in the era of Twitter is half of what it was in the era of Lotus 123. And what about accounting? Big 4 accounting firms are close to parity. And I'm not sure how different the professions are at the lowest levels. Poring through a spreadsheet trying to tie-up a number that's off isn't much different than poring over a core dump. Yet half the people who do the former are women.
Speaking from another European country, for the ruling politicians it's a sensitive topic as there's a reasonable chance that some country, also a NATO member (the biggest one being you know who) is also a bit behind this. They certainly don't want to "risk the good relations" with the gorilla in the room, as confirmed in the events from the last year. On another side, supporting surveillance not done by the country itself is typically unconstitutional and punishable.

Of course, there are also countries outside of NATO capable of orchestrating such an activity. In that case the chances increase that we'll soon hear much more.

Finally, with the greatest probability, the different devices can belong to many different entities, both "allies" and "foes" so it can be tricky, but doable, to talk about only some of them. That's why they've officially just "found something" at the moment.
you may soon be able to do it with Native Client and Pepper
There's a logic behind the vagueness, see my other comment here:

https://news.ycombinator.com/item?id=8745217

But I see you're from Norway, please keep us updated with the info only available in Norwegian! Thanks.
More Noble Exercise
Uh, also the fact that in a MITM situation I can trivially replace your self-signed cert with my own self-signed cert.
I find it really annoying if you have to watch a 1:20 minute video just to get a rough idea how their service works.
The only permitted keys are str, and the rest are silently ignored. This is another bug in his implementation (only the first line should be indented, but both are).

Your code is fine - you're not storing everything twice, but he is (in _set_both()).
Most interesting and most telling.

It seems that Hughes was acting decidedly immature and selfish, and that led to many consequences in such a delicate culture. He had no idea how to lead it, or he just clashed with it too much—and he broke it.

It is a story about the importance of understanding and respecting internal culture, above all. It can be incredibly powerful if directed in a positive direction, but absolutely destructive if it's shaken. A lesson for all of us.
I'll only comment on the opening line and the research it points to about the failure rate in intro to Computer Science. The author of the codeup piece immediately jumps to the conclusion that it's an inability on the part of the failing students to be able to learn to program (a detail that the study linked doesn't comment on). However, my first reaction is that if the failure rate is higher than we want, it means we either (1) aren't teaching the class well; or (2) the students are coming in without proper preparation.

Many students coming into an intro to CS class are already programming whizzes, and then there are others who have no experience with programming at all. So, already the instructor is in an impossible situation. Do you bore the promising kids with the major head start, risking losing future good students? Or do you ramp the class up to their speed and risk losing the kids who didn't come in already knowing the material? Obviously, most departments and instructors will, wittingly or not, choose the latter.
WordPress, the blogging CRM used for anything but blogging…
Coinbase does
People are not forced to use JS. You can make any language available in a script block and have it interpreted using a polyfill. If JS sucked as bad as some people think, this would have taken off - it hasn't.

You can't solve the problems of using OOP in JS. JS is functional at its core. OOP style class inheritance is completely inappropriate, and bolting it onto JS was bad overall for the language as wandering off the functional style creates some confusion and now the language inherits the problems of class inheritance.

Separation and extensibility are the great things to get. Separation you get in function scopes. Extensibility isn't obvious, so they bolted on OOP. It can be achieved but you have to go deeper into the functional world and people started demonstrating class inheritance as the answer. Was unfortunate.
In that case isn't the problem that their employer installed their own root certificate? The employer could just as well have installed any manner of malware. In the scenario where you are not the administrator of the computer, nothing is secure.
The case for Nginx in front of application servers
What about spam? What about antivirus? What about mail filtering rules?
Weekend != spare time, once you are in an on-call rotation.
"planning ahead"

Whoa, that's fighting talk. Next we'll be doing big design up front and (god forbid) beginning with the end in mind.

That was tongue-in-cheek, only because everywhere I go these days I see people bowing down at the altar of refactoring, rather than doing a bit of planning and getting it right first time.
https://www.google.com.au/search?client=ubuntu&channel=fs&q=...

Pick an article, any article.
> You can make any language available in a script block and have it interpreted using a polyfill. If JS sucked as bad as some people think, this would have taken off - it hasn't.

That's not trivial.

People are cross compiling to javascript as part of a build process though, so you're wrong that it hasn't taken off. Coffescript, Typescript, ClojureScript, Elm, etc.

https://github.com/jashkenas/coffeescript/wiki/list-of-langu...
If you're concerned about it, I suggest getting glass bottles. Bottles with rubber slip covers are available, decreasing the likelihood of breakage when dropped.
Not with certificate pinning.
So something I've been wondering about with all the talk around The Pirate Bay recently is why aren't people using the blockchain to store data needed to bootstrap your joining of a decentralised network.

It could be as simple as storing the magnet links themselves.
But isn't essentially all hiring for a specific job?
Quite a few of these are bordering on over-the-top evil villain territory.

The Great Bear one, and its caption, just made me giggle.
> For a Man-in-the-middle attack, your statement is false.

Not with certificate pinning.
That's a very weak security solution. In some situations it's better than not using HTTPS at all, but not by a lot.
You can add perfume and cologne to that list of personal-care products too.
The website looks like it's either missing CSS or it's straight from the 90's. Maybe this is the intended style, but to me it looked like a very very old website. Super bright colors, serif fonts, not responsive, bad rounded corners, having links to SF (the myspace of code hosting sites) and W3schools (cf. http://www.w3fools.com/), ...

To be constructive:

* Throw away the CSS and start fresh. Use something like Bootstrap, so you can get the basics right. Make sure it works on mobile, because that's where someone would gain the most from not having to type addresses but instead click buttons.

* Maybe show the favicons or screenshots of the website you are linking. Right now, it's just a long blob of buttons and without using my browser's search function, I'd have a hard time finding anything.

* Why do I need both a password AND a security code? Why can't I just login with email+password? On that note: The login form is suuuuper slow at the moment. Don't know if that is because I was giving invalid credentials and the site intentionally slows me down or what.

* http://www.osipage.com/dataExchange.php - I haven't tried, but this looks like I could send spam to anyone. Is this really what you want to allow visitors to do?

* When signing up, I had no idea that the two security code input fields are supposed to match each other. I thought I was supposed to enter something like ABC-123.
I'd like some more info on the security side.
As has been said, job applications are a fickle beast. Just because you found success within a few weeks does not mean it's the norm.

From personal experience applying to jobs as a soon to be graduate, I know many of my friends with similar qualifications didn't even receive an interview at certain companies, even though I know they would do well in them from work we've done together previously. It's also interesting that I received interviews with all of the top companies I was interested in, but I didn't even hear back from several that I would consider the next tier down.

Even better, when I was applying for internships last year, some companies sent me rejection emails in the middle of the summer, seemingly indicating my application was unearthed in the abyss of the job portal by some random happenstance.

As I said, fickle.
I wasn't being sarcastic at all.

If you said "2am tomorrow" I would assume two hours after next midnight. Perhaps this is a result of my usually late schedule because I normally go to bed around 2am, so everything up to then and including midnight is "tonight".
It can also be a result of physical mechanisms elsewhere in your body! The nervous system is large and complex. For example, feelings in your gut can trigger anxiety, and links have been studied between gut microflora and anxiety.
Yes. But many botnets nowadays do bitcoin mining, the overhead in those cases might be small.
Scientists have put a simulated worm’s brain into a Lego robot’s body
> Hope, there will be an implementation soon

It's quite possible: http://www.lowrisc.org/
I had a friend in college who once coded an entire lotto program ("graphics" and all) into 380-odd bytes. Utterly insane.
Anyone know of anything comparable for SSDs?