skysight-inc/HackerNews huggingface dataset:
If all your tech might be spying on you, you should pick the one not controlled by someone with legal authority in your local area...

Unless you are working with military technology, or some real 'secret sauce' company confidential tech, you are probably not interesting to PRC but fascinating to the IRS...
You mean apart from Tokyo?

http://www.numbeo.com/cost-of-living/compare_cities.jsp?coun...
Open and honest after-the-fact is only marginally better than not. The important aspect is what was said during hiring.
Harlem Shake Interruption
>I agree with you that the random number generator in tendermint isn't good enough. I am going to add one I have put in a different cryptocurrency before. Each validator gives the hash of a secret, and later gives their secret. All the secrets are XORed to find the random seed.

Tendermint doesn't have a random number generator at all. You cannot have consensus on random numbers, or else they wouldn't be random. It is a fundamental problem that you are determining the next blocks winner based on numbers that can be influenced by previous winners.
I can't believe that they are outright naming vulnerable sites, that is really classless. Even if the data could be gathered by an attacker now that a vulnerability is known, you don't need to go the extra mile to provide it.
I forget the name of it, but a pro audio company used to sell a very impressive-looking piece of rack equipment with several imposingly-titled buttons and sliders but which had nothing inside, whose sole function was to serve as a placebo for unwelcome meddlers.
And a good reason for someone to claim a patent is invalid is being sued for violating that patent.
From my understanding, trygrid is aimed at supporting specific applications. Paperweight is the entire PC sort of like how you would lease a VPS.
Generics allow writing of algorithms—if you're writing a 'sort this array' function, why do you care whether the elements are integers or strings so long as you can order them.

I do, however, agree with you in general—it seems like he's trying to re-implement generic serialization. Otherwise, it's difficult to see what a 'Bit' (for instance) has in common with an Int and not, for instance, a double.
> I find it likely that Jobs and Page were able to pick up on millimeter & millisecond defects.

Quite possible. It's also possible that Jobs & Page made all kinds of more or less random comments, and people remembered and retold the stories about the times they were strikingly correct.

I'd guess the truth is somewhere between the two.
But will it work with Emblem? Also how does this affect FastBoot?
I have two questions:

1. Did Sandwich make your promo video?
2. What desktop resolutions do you support?
This is a common misinterpretation of this clause. There's been a lot of discussion at length here: https://news.ycombinator.com/item?id=8985722
I'm surprised that anyone (apart from Apple) is bothering to make smart watches.

I stopped wearing a watch years ago, because the extra information I got from looking at my smartphone covered the overhead of pulling it out of my pocket. I've enjoyed not having something strapped to my wrist, so any of these horribly thick smart watches are going to have to provide a compelling benefit to get anywhere near my arm.

Because of size and power issues, you can't actually read or deal with anything but the most trivial issues on a smart watch. So the main value proposition seems to be that they tell you you need to look at your phone, and that's not compelling enough for me.

Apple will get some sales, from those who need their status affirming - just like the people who still wear a Rolex watch. But I'm betting that all the other smart watches disappear fairly soon.

My pick for the next real user interface revolution? Smart hearing aids, using speech as the UI. Inconspicuous, and simple to use - particularly for our affluent ageing population, many of whom need the hearing aid part anyway.
How does this compare to MakeHuman?

http://www.makehuman.org/
Like stapling advertisements to a telephone pole: You don't care whether it actually supports cables that carry power or data.
I hope someone makes you an admin!

yesterday, I got downvoted repeatedly for mentioning that I hadn't seen an IIS header in years. ¯\_(ツ)_/¯
Tragos de Amargo Licor Cover
5 reasons Jekyll is great for developer peace of mind
Valve Announced Source 2 will be free for developers:
http://www.polygon.com/2015/3/3/8145273/valve-source-2-annou...
3X – Execute exploratory experiments
Firefox 36 will have issues, yes. Nightly, Aurora or Beta will do better. You don't need gstreamer for MSE/MP4 support. Just have set to true in about:config the following:

media.fragmented-mp4.ffmpeg.enabled
media.fragmented-mp4.exposed
media.mediasource.mp4.enabled
media.mediasource.enabled

This will use the system install of library libavformat.

If you receive hangs on this configuration with FF 37 or higher, a bug report would be much appreciated. Or contact me directly if you don't want to do the bugzilla dance.
Yik-Yak for video
I love the focus on how the Whitehouse/NSA/FBI sites are vulnerable. Someone could use this to attack the White House!

https://xkcd.com/932/
Valve announces Source 2 engine, free for developers
"What do you mean, calibrate my monitor color?"
>My pick for the next real user interface revolution? Smart hearing aids, using speech as the UI. Inconspicuous, and simple to use - particularly for our affluent ageing population, many of whom need the hearing aid part anyway.

I like this idea.

The best part? The elderly are already used to spending a few grand on these and the current functionality is limited to amplifying/filtering sound.
Does this mean the listing doesn't work, or that the original author just never ran it, or that the author hand-assembled it?

Quote:

"Honestly, I don’t remember for certain… BUT… MORE THAN LIKELY, it is a FAKE – i.e., I probably just text-edited a listing in “assembler listing” format for the purpose of publishing the code and “looking professional”… ;)"
I disagree. If seeing their name on this list lights a fire under them to fix it that much faster, this is a good thing. Besides, if the you are an attacker capable of exploiting this vulnerability in the wild, this is the first and easiest part of the process. Scanning the top 1M sites would take you no time at all.

Edit: what really is annoying is that the sysadmin guide is "Coming Soon!". That is the irresponsible part: "here look we broke TLS, we'll tell you how to fix it at 11!"
Valve announces new streaming hardware Steam Link, prices Steam Controller
There's been a lot of talk over the years of implementing a data modem over GSM voice - as far as I can tell, this would solve basically all the issues with the current crop of encryption products. Instead of constantly polling or faffing about with third party servers, one phone could simply initiate a two-way connection to another phone the old fashioned way: via phone call. There's your "push messaging". You wouldn't even have to leave your data on. Your text messages would also probably arrive faster than an SMS.

I'm very disappointed that despite numerous papers on the subject in the past decade (even a DEFCON presentation), no implementation has yet appeared, not even a demo.
Sitch – Find fun things to do near you
I think that the free/open source community lost one of the few places to do free/open source hosting. :-/
Sitch – Find fun things to do near you (SF)
“LaTeX Beginner's Guide” by Stefan Kottwitz available for free download today
I'm in the market for a smartwatch like this and I'm seriously considering this one and I can't wait to hear more about it. BUT I have to say something about this video. I'm from Alaska and do lots of backcountry snowboarding so this kind of stuff probably doesn't matter to most people but this video is laughable for a few reasons:

> guy reminiscing about a memorable camping trip with friends yet can't remember how to get there.

> driving a classic mercedes with rear wheel drive on slick snowy roads.

> using ancient snowshoes that should be hung on a wall as a decoration and not actually used while wearing other completely inappropriate clothing.

> cool, your watch let you know it's -12c hopefully your ears won't be frostbitten off by the time you're done wandering around in the backcountry by yourself without a hat. (wouldn't want to mess up that stylish hair do)

> a watch whose battery will only last a couple days is probably not the best thing to depend on for an overnight trip in the backcountry.

> using google now as if he would have cell data coverage in the backcountry.

I know I'm being a bit harsh and I'm probably not the target audience for this video.

But my honest impression based on that ad is that people who use this watch are fashionable city slickers who have no idea what they are doing and use completely impractical even dangerously outdated equipment in order to look fashionable.

What would actually appeal to me?

>Guy hauling ass on his mountain bike/snowboard/skiis.

>He checks his watch to view his heartrate/trail data on an app like http://www.strava.com/ .

>App indicates relevant data like current heart rate, average speed, trail location.

>scene cuts to end of his ride where the app indicates he has just set both a new personal record for that trail and that he is also the new recordholder.

>Guy is back at his car. Watch indicates he has a fancy dinner appointment in one hour.

> Scene cuts to him changed into fancy clothes and putting on his nice blazer/spiffy trenchcoat. His watch indicates that he should leave now in order to get to the appointment on time complete with a map and directions.

>guy is seen at dinner with watch displaying a classy watchface showing off that it is suitable to be worn with formal attire.

ad ends.
Or pretty much anything in *.google.com, for that matter.
Leonard Nimoy’s photographs of fat, naked women changed my life
Why does systemd make a reboot necessary?
"All problems in computer science can be solved by another level of indirection, except of course for the problem of too many indirections." ~David John Wheeler
27 Interactive Apple Watch App Videos at WatchAware
Marching One by One
No upgrade needed: CloudFlare sites already protected from FREAK
"The idea of a branded exploit – one that is carefully curated for easy consumption – is a new one. Historically obfuscation, either real or inadvertent, has been the watchword in computer security mostly because not everyone cared about major exploits. Heartbleed, in a way, was different. It was worldwide, very dangerous, and oddly photogenic. Whereas a Java exploit or Adobe Reader problem is “invisible” to the average user, the idea of a hacker watching your passwords scroll, Matrix-like without security systems setting off alarm bells is compelling and frightening. By creating a “bugs 2.0″ page for the exploit, Codenomicon inadvertently allowed the average user to understand and potentially react to the problem."

http://techcrunch.com/2014/04/09/heartbleed-the-first-consum...

EDIT: To the OP, I totally misread your point. I thought you were complaining that people were naming vulnerabilities (i.e. FeakAttack, Heartbleed, etc), whereas you said "naming the sites that had such a vulnerability". I agree with you, it's a bit tasteless. My bad! I'm leaving my comment here anyway, because I do think it's worth noting the benefits of branding a known SSL bug/exploit.
9 ways to stop being miserable and start being happy
The Mac OS X terminal also saves and restores the window position, working directory, and scroll back of each terminal.
> nyc is also helped once you realize you can get by with zero cars. Your transport cost is $112/mo for an unlimited metro card plus perhaps $100/mo for the odd cab. That replaces car payment, insurance, parking, gas, and repairs -- easily $400+/mo.

Now consider the rent differential between NYC and any other "cars required" city in the US. There goes your $400 and then some...
I really disagree with your perspective here, but I do concur that a fast fix is desirable for any impacted site. Notifying impacted sites ahead of public disclosure would have been a better move, and particularly ahead of public shaming and attacker targeting.

While these notifications may have gone out, there is no reference to any such thing on the page. Also: do they plan to update this list? Or are these sites to be shamed forever?

edit: and yes, the lack of a steps-to-fix is unforgivable. This feels like a race to be first rather than a race to responsibly release and resolve the issue all around.

Especially considering that the fix is beyond trivial:

Apache: SSLCipherSuite ALL:!EXPORT
nginx: ssl_ciphers 'ALL:!EXPORT'

(although you shouldn't use ALL, this is just an example; use https://mozilla.github.io/server-side-tls/ssl-config-generat... if you don't know what to do)
In this model I think you'd distribute something in an intermediate bytecode, like .NET does w/ MSIL, and then the target system would be responsible for precompiling.

Edit: just saw this:

https://news.ycombinator.com/item?id=9140001
What approach did ksplice take?
This article is fascinating and struck a very particular chord with me. It puts elegantly and concisely into words feelings and intuitions that I've been having in the recent years, and gives me a vocabulary to deal with hard situations I am encountering currently in my life. Thanks to the author for writing it.
I personally swear by Logitech's trackball mice (the ones where the trackball is operated with the thumb); less wrist movement involved, meaning less strain there.

In contrast, my wrist hurts just thinking about the Mighty Mouse or whatever it's called.
I thought this map

http://www.dailymail.co.uk/news/article-462091/How-children-...

(which was created in an earlier round of reporting on this topic) was quite impressive. It shows, on a single map, how far each generation of children in a particular family was allowed to walk by their parents. (Spoiler alert: there's a decrease by factors of 6, 2, and 3 in successive generations.)
The WoT is both PGP's strength and weakness. Lacking anything else, key security staff for various Linux distributions and key EFF members isn't a bad starting point for this. Assigning those "marginal" trust means that you'd have to have three of those signing a given key to trust it.
To be fair, XNA's support was atrocious (non-existent?) off of microsoft platforms.
I read that discussion. The patent grant is very asymmetrical. Why should an entity using React be vulnerable to being sued by Facebook for unrelated patents and be unable to challenge those patents?
I attended one of his lectures about this body of work, and it was stunning. I thought of Leonard Nimoy as Spock, and maybe a couple of other roles. I had absolutely no idea of the range of his artistic intellect. My mind was reeling from the expanding horizons. It's always thrilling to me when I learn how much more complex someone is than I had been assuming. It's a lesson that a lot of people aren't so easy to pigeon hole as we first think.
> Basically any system which prosecutes crime is going to be biased against poor people

Bias indicates prejudice. It's central to every modern system of law to avoid prejudice.

> Poverty is correlated with criminal activity

Men with non-receding hairlines (no signs of baldness) are also correlated with criminal activity. It doesn't mean that they should be treated any differently by the justice system. If a person should be punished for a crime then they should be punished for the crime, not for their socio-economic background.
I didn't find the sex trade particularly off-putting my only time in Vegas; what I did find awful was the constant hustle and hard sell. The public transport actually seemed pretty good, and I would have been quite comfortable walking about if it weren't for people constantly, constantly in my face, trying to sell me something.
We offer free hosting on GitLab.com (also for private repositories) and there is a great list on wikipedia https://en.wikipedia.org/wiki/Comparison_of_source_code_soft...
I'm interested in this field of study. Correct me if I'm wrong, but it seems like it's primarily economic theory applied to the brain/neurons?

If I were to be interested in learning more about the ideas and theories that this article inherits from, where would I start?
Mercurial and other DVCSs are also about simple DAGs but git has the disadvantage that you really need to learn the underlying data model and lots of terminology (trees, refs, blobs, revlog, etc)
glide works really well for this: http://technosophos.com/2014/09/22/how-glide-solves-go-vendo...
Compare with:

Prognostic Value of Treadmill Exercise Testing
http://circ.ahajournals.org/content/98/25/2836.long

Maximal Exercise Testing Variables and 10-Year Survival Fitness Risk Score Derivation From the FIT Project
http://www.mayoclinicproceedings.org/article/S0025-6196(14)0...
Digit Classification using KNN/Clojure
To clarify: do you watch filesystem for template changes, then store the parsed template in memory, or do you execute the template every time?

I'd be curious to see benchmarks against nginx with the equivalent html files already generated.

> The droplet hosting the former site only accepted its key, so losing the hard drive meant I lost access to maintain the site.

Droplet as in DigitalOcean? As long as you still have access to your DigitalOcean account, you can "Reset Root Password" and use "Console Access" to re-establish ssh.
This is a very disappointing trend in security. Publicly shaming sites into action is not a benefit that outweighs making it easier for attackers. It's ridiculous to argue that it is.
Gotcha, sure I can make that change.

Just next time don't flag an appropriate post.
> More or less, what I want to archive can be done with old world NSData: data.getBytes(&i, length: sizeofValue(i))

That doesn't work in C/C++ if you are using a modern optimizer.

C does not have the other Swift issues the author mentions, so shifting into the largest int and casting from there does work.
>Depends on the application and the purpose of the blockchain, but the paper isn't explicitly premoting address reuse.

It defines a system in which addresses are reused.

>Users don't consider blocks committed until they've seen +2/3 of commit signatures, so a fork implies that the victim has evidence of double-signing.

No it doesn't, unless you have a severe misunderstanding of information theory and think everyone know all information everywhere (including attacking forks not published). Your security assumption shouldn't be that the attacker is dumb enough to announce that he's attacking and giving up his money by broadcasting forks.

>Not sure what you mean -- Maybe an analogy will clarify. Is this a problem that isn't present in Bitcoin? How can a brand new Bitcoin user securely join the network for the first time?

It worries me that you can't answer this and you're working on a cryptocurrency. They can achieve consensus because they can be supplied a proof by any of their peers of the transaction-output database. Not allowing reorgs allows a peer to give you a proof that prevents you from achieving consensus.

>For example, if my phone wallet hasn't synced with the network in a while (longer than the unbonding period) then it should warn me the next time I connect, and perhaps ask me to validate a fingerprint of the blockchain via outside channels.

The purpose of a blockchain is to achieve consensus without trusting anyone. If you trust that group, you probably would get along just as well with them managing a centralized database of transactions for you.

>I'm aware of how checkpoints prevent reorgs in other protocols like PeerCoin. That's not how Tendermint works.

I never mentioned checkpoints. The paper basically said it wouldn't allow large reorgs when it said it could prevent long range attacks and ignore the fork.

>Stakegrinding is less of an issue in Tendermint because of the deterministic round-robin algo for choosing the proposer, and the fact that the remaining validators need to commit.

The entire reason stake grinding is possible is because the selection of the next blocks winner is deterministic. The previous winners can change the seed over and over again until they win.

>and the fact that the remaining validators need to commit.

This is not relevant, you can wait until the end or ignore theri validations completely.

>Check out the DLR algorithm first, "Consensus in the Presence of Partial Synchrony (1988)"

This paper is fine, but it assumes 1/3 generals aren't traitors. Your system makes it trivial for a traitor to pretend to be all of the generals.
Its a bit annoying that I still have to frequently go back to stackoverflow whenever I need to do a git operation I haven't done in a while. Git doesn't have strong abstractions and the commands are organized in a very adhoc manner so its hard to predict how something will work without having to go check some documentation.
I am really interested in how this is measured. I have found this info on free sources so far

"The FIT Treadmill Score, calculated as [percentage of maximum predicted heart rate + 12(metabolic equivalents of task) – 4(age) + 43 if female]"

And this from another interview.

"In addition to age and gender, the formula factors in peak heart rate reached during intense exercise and the ability to tolerate physical exertion as measured by so-called metabolic equivalents, or METs, a gauge of how much energy the body expends during exercise. More vigorous activities require higher energy output (higher METs), better exercise tolerance and higher fitness level. An activity such as slow walking equals two METs, compared with eight for running."

If anyone has access to the paper and could better show the algorithm I would be super thankful.

EDIT: I think I figured out more but still not positive about MET unless the 2 for if heart rate hit max walking and 8 for if heart rate hit max with running.
[(Measured Heart Rate Max/(220-age))100 + 12MET - 4*age + (43 if female)]
Modern sport is an invention by British noblemen. Greek olympic games were very different: a preparation for war, a preconfrontation. See the difference between say criquet or polo and weight lifting or javelot.
This support is for the Linux kernel only. So if the Xen hypervisor itself needs to be updated, it's reboot time.
I'm talking about cities. The dengue fever mosquito is an urban plague.
Interesting article. Thanks for sharing
Export cipher suites have been known to be weak for years.
Just a food for thought (I agree with you that if you call yourself an attacker this is baby stuff enumerating over the top 1M sites): would the author publish google.com or twitter.com if google.com / twitter.com was among one of the affected sites? Would we consider google.com more important than sohu.com and with that we would less likely publish google.com without first notifying Google? You certainly can do your due diligence by notifying everyone on that list, give a one day and then publish the full closure? I don't know. But I am interested in the timeline and looks like this CVE might have been out for a while?

Certainly there is one site ranked #27 but I doubt you will get anything out of reporting that to the site adminstrator. I am pretty sure that site (a Chinese portal and search service) does not have bug bounty.
In this title, 'everywhere' means 'across browsers', not 'throughout all JS execution'.
Thanks for the mention! We're rather obsessed with quality email with a positive delivery reputation at a budget price.
https://freakattack.com/clienttest.html

I just tested my devices. Linux machines running firefox all passed. On the other hand my Android phone did not, lots of RSA_EXPORT ciphers accepted.

But as with nearly every security story: linux/foss software for the WIN!
Rails security – Dropping your code into shark-infested waters
FTA "... a straight while male savior is always fraught". This is why we can't have nice things^Wpeople.