skysight-inc/HackerNews huggingface dataset:
He is absolutely loose with the facts. To this day, he doesn't know what PRISM is, unlike nearly everybody else in the press. The leaks would have been better managed by almost any other reporter.
Insert your smoke weed everyday comment
Regarding PBKDF2, you should read Colin Percival's paper on scrypt (https://www.tarsnap.com/scrypt/scrypt.pdf).
To my best knowledge, activists from China did plead to remove CNNIC (China Internet Network Information Center) root cert from Mozilla Firefox but failed.

That cert was added as

https://bugzilla.mozilla.org/show_bug.cgi?id=476766

and the plea for removal

https://bugzilla.mozilla.org/show_bug.cgi?id=542689

Till now, CNNIC CA cert is part of builtin authority bundled in Firefox.

CNNIC was a controversial organization not only because of its govn't background but also its involvement with an infamous malware years ago.

And I cannot get access to bugzilla.mozilla.org without using a secure proxy from China as 'Server aborted the SSL handshake'.
>Encryption only really comes handy when confidential information and authentication credentials get exchanged.

It's 2015 and we have quad-core processors in phones that are faster than my laptop. What reason can anyone possibly have to not at least strive to encrypt everything? When is it advantageous to not encrypt?
Wake up.

Brush my teeth.

Feed the cat.

Read twitter and glance at email while I sit on the toilet.

Shave.

Take a shower.

Wake Steph up if it's a day when she didn't leave before I got up.

Get dressed.

Start some water boiling.

Clean out the coffee pot and grind some new coffee.

Read other things while I wait for the water to boil.

Make eggs and toast and coffee.

Eat breakfast.

Maybe practice a song on the piano if I have a few minutes.

Leave Steph's mom her pills and newspaper.

Start walking to BART.
Ok so this isn't a Google product. In brief (please correct if I'm wrong), Google lets its employees work on their own side projects on company resources if they assign copyright to Google. This means that it gets published on the Google github account, but is then denoted to not be a Google product - it's someone's side project.

I do however have at least anecdotal experience with how these sorts of systems work. The idea is that as a large company, you traditionally pump all of your internet through a firewall, which scans it all online, does deep packet inspection etc to look for attackers.

Then, because it takes up a lot of space, you ditch it, and perhaps keep finer grained logfiles - perhaps just the DNS requests or headers or suspicious packets etc.

The idea here is that for many companies, this isn't helpful when you do get owned - you'll have deleted most of the relevant data (showing exactly what got exfiltrated etc, how it happened etc) and you might have some logfiles showing TCP addresses but you know little else.

Since a company of 1000 will use no more than around 1-10TB per day for its staff, it's actually now feasible to store every packet that is sent in and out of your network - you could store for 90 days on around 0.1-1PB - which is actually fairly affordable for a company of that size.

Then, you either run large (more expensive than can be done in a firewall) jobs over the data offline to look for intrusions, or wait for a breach and then drill down on the data to try to learn exactly what happened.

The reason why this isn't really a tool for monitoring users is:

a) What can you do to track users that you couldn't already do with systems that don't store all the data?
b) The target seems to be corporate networks who can and should monitor what their users are doing on their network.
c) The nature of this sort of data is that because it's not really indexed any specific searches would be very expensive - perhaps requiring runthroughs of terabytes of data. So individually spying on many people isn't really doable without further processing - this is really just a big packet dumper.

If you were going to try and monitor random Joe Public, then you'd certainly be fitting a device like this to a computer their traffic would be passing through - but this isn't useful for someone who's not an ISP or nation state (and in that case, there'd probably be smarter ways of doing this (since here, you can only sniff local connections)). For Google, the most they'd be able to sniff is communications from their users to their own servers - which isn't a huge bonus for the costs.

Even for an ISP, it'd just be massively expensive and unhelpful - a UK ISP (Plusnet) I just searched up has around 800,000 ADSL users, and at peak time they see total usage of 130Gbps-ish. Even assuming average half utilisation of 65Gbps, that's still 702TB a day. That's a massive amount of data to store for any reason. The reason you (bad person) only store the metadata is beause the metadata is the valuable part!

I welcome corrections :)
I may not be doing the article justice, but it seems a bit misleading how this is presented. The title reads almost like "science clickbait" and there's a lot of talk about "safe" and "lower risk" but the study seems to only have actually computed lethal dose. This is an almost entirely useless statistic from my perspective, and by presenting it as justification for any sort of "safeness" seems almost deceptive. They do nod to this with a small section on the other impacts of use, but it seems heavily deemphisized when compared with the core message.

Here's hoping I'm just reading this wrong and looking for the worst possible interpretation; I just worry that when presented without an even hand that these sorts of statements will only impede the goal of more reasonable drug policy and culture.
I have commented it above, but have you checked ToroDB? ;) https://github.com/torodb/torodb/
Manufacturers don't seem to release firmware updates for hard drives very often, but even when they do, consumers may never learn that they need to apply an update to a drive they own so the actual update rate in the wild is probably very low.

As an example of a rather serious firmware update that likely went unnoticed by most drive owners, some Samsung F4 EcoGreen hard drives (the ones Samsung actually made before the Seagate buyout) had a serious bug[1] that caused data corruption if a specific S.M.A.R.T. command was issued to the drive during normal operation:

"The above suggests that the disk sometimes discards a
pending 64 sector write command when a IDENTIFY DEVICE
command is received. This data loss occurs silently.

There is no error message in kernel log, SMART Error log,
NCQ Command Error log page, or SATA Phy Event Counters
log page."

Manufacturers can't notify people directly about these things unless buyers contact info is submitted along with info about which specific drive model they own. I don't know if this patch was pushed out via Windows Update but I'd bet it wasn't. I only heard about it because Smartmontools warned me.

Samsung fixed it in a firmware update but neglected to bump the version number of the firmware, so it's impossible to tell which drives have been fixed. As a result, it's quite easy to assume your drive is fine, so Smartmontools will print this in any system with any HD204UI or HD155UI detected:

==> WARNING: Using smartmontools or hdparm with this
drive may result in data loss due to a firmware bug.
****** THIS DRIVE MAY OR MAY NOT BE AFFECTED! ******
Buggy and fixed firmware report same version number!
See the following web pages for details:
http://knowledge.seagate.com/articles/en_US/FAQ/223571en
http://www.smartmontools.org/wiki/SamsungF4EGBadBlocks

[1] http://www.smartmontools.org/wiki/SamsungF4EGBadBlocks
LinkedIn settles over failure to employ industry standard data protection
No reason?

https://plus.google.com/+BrandonDowney/posts/SfYy8xbDWGG
Suspected "unwanted mental health effects" include full blow permanent schizophrenia. (Emphasis on suspected, for we know there's a lot of mental illness self-medication with psychoactive drugs starting with alcohol.) That strikes me as making it very hard to do ethical research of the sort you're positing.
The links to the App Store and Google Play weren't showing up for me. Here's why:

<a href="https://ad.doubleclick.net/ddm/clk/288696178;115706119;v">Google Play</a>
TFA already explains why carts don't need an id: for this application there is only one cart per account, and users only ever see their own accounts. The representation I was imagining being PUT would be an integer, like "1" or "5". The /api/cart/item_number resource could allow only the PUT and DELETE verbs, and /api/cart/ would handle GET. item_number, in this case, identifies an item that is for sale (EDIT: a SKU), not an association between such an item and a cart. EDIT: Keeping an integer at /cart/sku is the only association we need. /catalog/sku holds price and other associated values. /api/cart/ holds taxes, discounts, and whatnot.

EDIT: It's as if you're arguing based on some theory you've read rather than on what we're discussing.
As a follow up: This was absurdly difficult to get on my phone after I found the app on my computer.

Searching for "Exchange" in the AppStore on my phone led to a zillion results, none of which were this app. I tried searching by words in the description. I tried the name of the app and the developer's name together. Nothing.

In the end, I searched the AppStore for the developer's name and found it.

Does anyone else find iOS app discovery, even when you know the app that you want, to be horrendous?
edit: downvotes dont suddenly make samba a good application

Samba being an insecure application doesn't make every decision they made (such as running the auth service as root) necessarily bad.

Don't assume people are downvoting you for "criticizing samba"; they may just disagree with your specific criticism, or even just with your tone.
Bitbucket Outage
For anyone on bitbucket, they are now experiencing a major outage after being slow this morning
http://status.bitbucket.org/
Wow that was on here quick
Don't see what is surprising in this article. I don't know anyone who claims you can easily consume enough marijuana to kill yourself. On the other hand, alcohol poisoning resulting in death is a well-known phenomenon.

When people discuss the "dangers of marijuana", they aren't saying you will take a lethal dose. More typically, there are either claims of impacts on the brain, or claims that it is a gateway to potentially lethal drugs like cocaine or heroin.
Neat. There is also https://www.nsa.gov/about/cryptologic_heritage/museum/ which I've been to, and recommend people check out if they're ever in the area, though the hours suck.
This is why outbound filtering on firewalls is just as important as inbound, especially as manufacturers cram more spy capabilities into everything.
I've got some different take-a-ways. First, time-to-discovery is different from the shallowness of the bug. Increasing the number of eyeballs looking at the code increases the likelihood that:

a) someone will encounter the problem.
b) that someone will be interested enough to dig into it.
c) they will then find the problem before giving up.

That's the power of many eyeballs. It's an expression of interest. With fewer eyeballs, you might get bug reports (a), but not have enough people looking to get (b+c) out of the community. With closed source, (b+c) can _only_ be provided by the team. Open Source means that this can be provided by a sufficiently large community.

That open source projects are having security bugs reported can probably be explained by economics. It's becoming harder to find security problems in closed source projects (windows), so researchers shift to open source ones. With an open source project, there's a lot of low hanging fruit to be had with static analysis, copied code and fuzzing. Closed source is a lot harder, so people go for where the ROI is good - either towards the rewards or towards open source for practice.

Finally, shifting to Java just shifts the attack to the JVM, which is just as hard to secure. I still remember the year of Java exploits, complete with a remote DoS attack based around sending a floating point number to the server[1]. There will always be bugs. If your goal is to write secure software, open source is good. If your goal is to avoid bad press, making it expensive to test is probably the way to go instead.

[1] http://www.oracle.com/technetwork/topics/security/alert-cve-...
Thanks, that's what I assumed. The wording just made it sound like it was available to 'all' startups.
I can't help but feel that statistic they're using is a little disingenuous. Yes cannabis has a ridiculously high lethal dose, more than you could ever smoke or consume. You'd basically have to create a concentrate and inject it directly or something.

I don't think you should be saying that cannabis is 114 times less deadly than alcohol. There are other contributing factors that could cause harm. There seems to be no research into carcinogenic qualities of cannabis smoke for example. I'm an avid user of cannabis but I dont think we need to go around pretending like there are no side effects and its completely harmless.
I moved from 1Password to LastPass for a few reasons not related to UX:

1. Platform support: 1Password only supports Windows and OS X. I use more than those, and want to maintain the ability to jump between platforms at will.
2. Pay twice for OS X and Windows. Seems extortionate.
3. Browser support: I want to be able to try out browsers. At the time I made this decision, 1Password actually reduced the number of browsers they support.
Thanks. I couldn't find the link to the app.
Echoing flockonus' comment, to replace the "drink everyday" thing, unless you're a woman of age 68 or older, if my vague memory of the recent closer look at the data is correct.
That is, in fact, Etsy's goal. But the DIY & handmade is a movement on its own with its own set of virtues, probably an heir to the Arts & Crafts movement as a reaction against mass production:
http://en.wikipedia.org/wiki/Arts_and_Crafts_movement#Social...

So a whiff of mass production is seen as taint.
Here's a free meta-design tool I like:

GeoPattern http://btmills.github.io/geopattern/geopattern.html

I'd love to hear about more. Does anyone know of a list of these tools? I'd be happy to compile a list if people provide suggestions.
>encrypted web traffic costs money for the certificate and for additional server hardware

1.) You can make and self sign your own cert. As another poster pointed out, there's also distributed solutions.

2.) When we let standards that are going to be in-place for at least a decade be manipulated by the hardware costs at their inception, it's a bad standard.
Followed by the robot being arrested, err, indefinitely detained?
This is still the case in some markets, e.g. in Texas's partially deregulated electric market. Consumers can sign up with any of 20 or so electric providers, some of whom provide "100% green electricity", usually for a price a bit higher than the cheapest providers.
There is no in-kernel API/ABI. The Kernel team is very vocal that the only interface that exists for the kernel is the userspace systemcall/filesystem interface, and any code that wants to use anything beyond that really should live in the kernel tree. Things like the nvidia closed-source driver that hooks into the kernel itself are not using any API/ABI, they are basically just hooking into structures where the people maintaining those structures don't just not care about being compatible, but are actively hostile to people relying on their code remaining same across versions.
Send two more apps to the top and I'll read what you have to say
By the way, from just 10 days ago:

Microsoft just patched a 15-year-old bug that in some cases allows attackers to take complete control of PCs running all supported versions of Windows. The critical vulnerability will remain unpatched in Windows Server 2003, leaving that version wide open for the remaining five months Microsoft pledged to continue supporting it.

The flaw, which took Microsoft more than 12 months to fix, affects all users who connect to business, corporate, or government networks using the Active Directory service.

Bad, bad Samba! Just pay for AD! /s

http://arstechnica.com/security/2015/02/15-year-old-bug-allo...
Wether you're right or not, I've noticed that a common clickbait title strategy is to make sure that the title is technically correct. In this case, a higher ld50 would mean weed is "safer" in the sense that it's harder to overdose. But it's already nearly impossible to OD on weed so that doesn't really mean much, and it certainly isn't what the title implies. This way, when you read it and the article is different than the title it almost feels like your fault for interpreting the title in the wrong manner instead of theirs for push an article about something few people care about.
This is a compelling little essay. I think the author left out a couple of important points, though.

1. Design systems may be "algorithmic," but they're primarily mathematical, and equations remain stubbornly hard to use. Metafont failed to attract designers because no one wanted to cook up high-order polynomials to express their visual ideas. (In contrast, Adobe came up with a good-enough interface for Bezier curves, and now the world uses non-algorithmic fonts.) The new class of designers will need solid grounding in at least high school algebra to get their curves and easing functions right.

2. Any argument about "XXX should learn to code", where XXX is anything other than "aspiring professional software developers," means that there is a significant market opportunity for creating usable software that does not require coding. If people are willing to spend thousands of dollars on bootcamps to learn to code -- when they'd really rather be focusing on their domain problem -- then they're theoretically willing to pay thousands of dollars to not have to learn how to code.

I don't know the state of design software, but if it's anything like other professional desktop tools, it's horrible, creaky software stuck in the early 1990s with very little competition in sight. When I read this essay I can't help but think there's an opening for usable algorithmic design software -- whatever that may look like.
Great article. One thing I would like to mention is that using component state (this.setState) is okay! Central stores, and the flux architecture, are very helpful but if your state shouldn't persist after an unmount, there's no point in extracting to a central store and passing it through your entire app as props. (i.e. Whether or not a certain dropdown is expanded). Just keep that state local.
https://news.ycombinator.com/item?id=9095120
Mark Zuckerberg plans waterside development
"100% renewable" in Denmark usually means a mixture of Danish wind and Swedish/Norwegian hydro. The wind power is highly variable so only fills Danish energy needs on some days, but Denmark has the fortune to be near very large hydro installations further north, which are relatively easy to flex, and provide the remainder via high-capacity links. (For customers not needing "100% renewable", the load is also managed using Denmark's thermal power plants and Sweden's nuclear plants.)

This somewhat unusual arrangement does mean that wholesale spot electric prices are hugely variable, ranging from near-free on high-wind days, to around €0.025/kWh on normal days, to above €0.04/kWh on low-wind days [1]. But you can reduce that risk through long-term contracts.

[1] Forecast for the coming week (look at the DK1/DK2 rows): http://www.nordpoolspot.com/
Would using code that converts data into standard visualizations (e.g. heat maps, sparklines) be considered meta-design? If so, it's not so uncommon (e.g. ggplot2, Tableau, matplotlib, Excel charts…).

Another example of a parametric meta-logo is the one Wolfram created for the National Museum of Mathematics (MOMATH), see http://blog.wolfram.com/2013/02/28/behind-the-scenes-at-the-...
Have you ever clicked an ad? Do you think your target audience clicks ads?

You'd be surprised at how few people click them. If I wasn't at work right now I'd love to go into how some of these people trashing search are flat wrong. Showing up in the organic search results for even a relatively lame search term can increase your views/impressions exponentially.

User acquisition, though, is something that goes way beyond just putting up an ad or getting into search results.
This reminds me of Het Ding, a sculpture at the University of Twente.

http://wiki.student.utwente.nl/nl/wiki.php/Ding
Also, https://password-hashing.net/candidates.html :)
Facebook's documentation is quite good: http://facebook.github.io/react/docs/getting-started.html

They also merge pull requests quickly if you have suggestions or clarifications.
How I Forgot All I Knew of Programming and Relearned It Using ReactiveCocoa and MVVM
Some of these are cheaper over at KalyHost.com.
Interesting. I normally try to stay away from the "logged in context" when I'm defining API endpoints since it limits what can be done with the API. I try to define the API for data, and let the consumers decide which data they want to show, as long as they can access this data. For instance, it could make sense for admin users to see other user's cart, but this design makes it impossible.

I would normally go for something like `/cart?user_id={{id}}`, forcing API consumers to pass in the `user_id` (possibly reluctantly defaulting the value to `current_user_id` for convenience.)
LOCAL Search Resources: URLs That Count
Thanks for the links, I'll have to take a look at that gdb/OCaml debugging video. Might as well dive into the OCaml internals a bit too. I just really wish OCaml would move to a fully threaded execution model instead of forcing evented systems on everyone.
Also which ones are restricted from switching registrars? I once bought a three letter .tv domain for $150 assuming I could transfer to a cheaper registrar and found out I could not.
The danger of allowing unencrypted traffic to dominate the web for another decade is not worth the convenience to developers.
Would also be interested to know more about the one in 1820 and 1950. There's nothing on the lethal injection wikipedia page.
fair enough on the single-cart bit.

however, when you do PUT, you leave it up to the client to choose the destination id (if it is not already known), this is not good. You should add items by POSTing to an item factory such as /cart/items. The cart will create the item(s) for you and that item resource will almost certainly hold additional data that was not passed in from the client (usually just SKU + qty) such as base price, calculated discounts, tax, etc. a PUT would not be appropriate as it requires the entire resource to be replaced (or created) at the destination specified by the client. the client rarely knows the entire resource (or has the permission to modify it at will), so follow-up updates should be done via PATCH /cart/items/<iid> or (mass) PATCH /cart/items

http://restcookbook.com/HTTP%20Methods/put-vs-post/
It's legal here in WA and we haven't had a problem with it being "unsafe". These articles kind of remind me about articles on coffee/wine. One day they're bad for the heart, the next day they boost heart health. I think these types of articles are why we have those anti-vaccine people.
Thanks for the suggestion. I'll take a look at SnowPlow :)
Of course they want it as fast as possible. But they also want the code to not slow the team down later on. And they want a cure for cancer, eternal happiness and world peace too.

My point is that people say and want all kinds of things, but when you engage in dialog about tradeoffs, they usually understand what refactoring is and how it affects long-term development speed.
That is, don't be afraid you'll lose other people's money. And use that as a reason not to act.
With an 18% conversion rate from a 'random new products' (non-targeted) website, this tool sounds like it would be fine with traffic from anywhere. Schedule this Facebook ad management tool for an aqui-hire before this fall!