skysight-inc/HackerNews huggingface dataset:
The word seems entirely appropriate.

As a European, I have not been able to convince family members or friends
that aren't intimately acquainted with the US-American situation that there
is no universal, legislative framework for paid or unpaid maternity leave.

They usually respond with a variation of
"this can't be right; you must be misinformed;
it would be horrible if that were the case."

And you (as a populace) aren't even fighting for it! Not visibly, at least. So, honestly, you
seem to be the one hurting all sorts of causes with this misdirected
attitude of apologism.
Dusting Off a Police Trove of Photographs to Rival Weegee's
The problem isn't so much in architectures, but in silicon processes. HomeCMOS (http://homecmos.drawersteak.com/wiki/Main_Page) is notable in being the relatively rare project to look at this layer in the computing stack at all.

Once you can do your own processors, the architecture is alright. To avoid running into licensing issues all the time, projects like RISC-V (http://riscv.org/) can help - or open cores like Leon (SPARCv8), OpenSPARC-T1/2 (SPARCv9), openRISC and several more.

The problem is, the silicon processes were optimized for investment heavy, large scale operations. To ensure the livelihood of general purpose computing we need a "3D printer for logic gates" (for lack of better term), even if it's economically and technologically less efficient (but not too much, obviously).
Lots of drugs are legal. Alcohol, tabacco, and thousands more that are sold over-the-counter. Plus, all the other ones you can get with a proper prescription (eg: Morphine).

I do agree that education and rehab are of extremely high importance, but if we have that, ilegalizations stops making any sense.
Motherboards bought in stores might omit the option as well. Not hugely likely, but certainly possible. It would probably be more of an oversight though, since it'd kill ~5-10% of their customer base over a menu option.
This is a well-presented version of http://c-faq.com/aryptr/.
I read an article a couple of months back (like October-Novemberish 2014) about the NSA putting a virus into the firmware of a RAID controller on some Dell servers that would patch Windows Server 2003 (R2?) during startup.

So it is not entirely without precedent.

Then again, this did not touch the OS bootloader itself, strictly speaking and might not have been prevented by "Secure Boot". Also, once you're diddling with a devices firmware, you might as well tamper with "Secure Boot" as well and defang the checking of the bootloader or even make the firmware live-patch the bootloader...

So, while I am by no means a security expert, I have been wondering the same thing. The entire "Secure Boot" stuff just seems like a lame excuse to allow vendors control over what operating systems you can boot on their devices.
CodeAcademy is a great way to build up some coding chops, but it doesn't give you the confidence that you'd get from hearing personal advice from the creator of a technology.

CodeAcademy is GarageBand, Platzi is MTV
I offer a USD$500 bounty for the first C++11 implementation of this algorithm that passes my 'make testex' unit tests in https://github.com/pjkundert/ezpwd-reed-Solomon.git. Copyright transfers to me. Resultant implementation will be dual-licensed: GPLv3 and commercial. (See: http://hardconsulting.com/products/13-reed-solomon)

Let's work together to get the implementation into the Linux kernel under straight GPLv2 as well. It uses Phil Karn's implementation currently, with almost no modification. There is a minor deficiency that should be addressesd while we're at it...

It'll be fun to get this into widespread use!

Contact me at perry@hardconsulting.com.
No. Certificate Transparency [1] might eventually make it possible, but it's still early days. A much wider adoption is needed.

[1] http://www.certificate-transparency.org/
>overflowing fountain

please- ahem avoid using phrases like that-

EDIT : For god's sake people, it was a JOKE
That would make sense; thanks!
The filing date on that is Jul 16, 1993, so it expired several years ago.
If there's a way to add keys there's a way to add keys. I don't think I'd rely on a screen being the only way to pull it off.
Obligatory background on the topic of the War On General Purpose Computing:

http://boingboing.net/2012/01/10/lockdown.html

http://boingboing.net/2012/08/23/civilwar.html

I honestly admit, I'm scared. We're headed towards the world of not owning any tools and basically leasing shiny crap.

Funny thought: will this be the start of the actual professionalization of programming? I.e. you won't be allowed to operate a compiler or a general-purpose computer without proper engineering license? It used to be considered impossible, because hey, everyone can get hands on a computer and a compiler. But if current trends continue, it may soon no longer be the case.
Making Emotions Measurable
Happily, I'd say the answer is "yes."

In the hacker community, I've never seen a article/discussion on the benefits of these substances that didn't include a healthy dose of skepticism coupled with lot of concern regarding the side effects.
The ffmpeg output in the gif shows 7.6 fps
Aren't you projecting your European biases and beliefs on our American system. Who's to say your system is right, and our system is wrong? Europe takes a different approach to labor and economics than the United States. You may love large socialist structures in Europe, but you trade that off with a slow-growing economy. In the US, we have a smaller socialist structure with fewer safety nets, but we get a faster growing and robust economy. There's no right or wrong.
I have read it, and it's quite good. Was about to post the link myself until I saw that you had.
I'm not sure who that would have been. The crowds I ran with (Defcon, Blackhat, Hope) and the crowds I advertised with (k5, Slashdot) had never seen a "VPS" service before, and at no point in 2001 did we have any competition.

As I said, we struggled to even name it, settling on calling it a "server instance", and only later did we see others referring to them as "virtual private servers".

I will say that as I did my (lame, cursory) market analysis in sept/oct 2001, I did see some bizarro product from Verio where (IIRC) they were renting out slices of Sun e10ks that they had. It was exorbitantly expensive and I don't even remember if you got a proper root login ... but other than that, there was nothing.
yeah that's truly incredible. If I'd spent the first two years of my university education learning from a tool like Platzi, I'd be in an incredible place. Can't wait for @freddier to redo the badass "intro to programming course" in English so I can show it to a few folks I know who struggled to adapt to formal CS education
Thanks for being our customer. It was a fun time.
The headline is sensationalist to the point of being false. Microsoft is doing nothing to block Linux on Windows machines. Microsoft is allowing OEMs to ship devices that no longer have an option to disable SecureBoot. Given how they're positioning Windows 10 as a Run All The Things operating system, that's probably just catering to people making low-end IoT devices and tablets and whatever else. Dell and Lenovo have not been chomping at the bit to ban Linux from their laptops, and I doubt they will change anything they're doing now.
> That is really shitty.

They're simply easing restrictions on their hardware partners especially since many enterprise customers only want signed software running on their machines.

This is really not a big deal.
UEFI is designed to scale up - servers that can boot from network, which brings a certain baseline complexity. It doesn't help that the designers didn't want to set any rules and run everything through a central, extensible function call dispatch.

The effect is that UEFI can load and run executables (from flash, disk, network), has a network stack and things like openssl (when did you last update your firmware's SSL implementation? :-) ), all of which process lots of ingress data - while maintaining a larger degree of control over the system than the OS that comes after it.

So, it's not UEFI-specific per-se, but UEFI's design was optimized for the large scale (it pretty much started on Itanium, so there) and at a time when security wasn't much of a priority.

Now they sit in that corner and look for ways out. Such as signature checks on executables (Secure Boot).
Disclosing the private key in this blog post was extremely irresponsible. Although the certificate has been revoked, revocation basically doesn't work[1], so for practical purposes this key will usable for MitM until it expires on Mar 19, 2016. Hopefully browser vendors will push out updates that explicitly blacklist it (Chrome is pretty proactive about this, not sure about other browsers), but that won't help non-browser clients or users running out-of-date browsers.

If you ever do this, please, please destroy the private key immediately. There are other ways to prove you had possession of it, such as by signing something with it.

[1] https://www.imperialviolet.org/2014/04/29/revocationagain.ht...
R Style Guide: Best practices for readable, sharable, and verifiable R code
While the price is disgusting, the price is not what matters most.

The reason this is absolutely outrageous is that Microsoft gets to say what OS's you're allowed to install, because they control what they sign.
> alleged actions (if true) are clearly anti-competitive

I think you may be confusing monopolistic practices with anti-competitive practices. The former does not imply the latter. If Google were also illegally protecting a monopoly (e.g. leveraging monopoly in another market, let's pretend they have an office software monopoly, to protect their monopoly in web search) then we would have a problem, but that hasn't been shown.

> I personally am aware of at least one deal where they used their size to squeeze a smaller company.

Again, the facts would have to show anti-competitive practice and not just being bigger. Are they doing anything unfair like taking a loss in their victim's market, or threatening their vendors?
The keys are stored in a separate hardware module with a defined interface (which I'm sure is standardized somewhere). From what I understand, part of that interface would be a flag you can set to say "do not accept new keys until next reboot" (I assume there's also one for "do not accept new keys, ever again"). If the firmware sets that not-until-reboot flag before booting the OS, then going thru the firmware really would be the only way.
Finally someone who knows what they're talking about!
Android 5.1 Fixes a Wi-Fi Annoyance
You shouldn't take modafinil daily though as you can develop a tolerance. You should take it 3 consecutive days and then rest the other 4 days of the week. Also extreme focus kills creativity so the rest days allow for a productivity/creativity cycle.
Indeed. Hopefully browser vendors will consider this certificate for explicit blacklisting using their proprietary channels. (I've already asked.)
We started bytemark.co.uk around the same time, with the same lightbulb, using User-Mode Linux which was way slower :) We're still selling virtual machines (using KVM), and dedicated servers at bigv.io which I submitted to the site, and have our own data centre in York. It's still a great business to be in.
> Melatonin is OTC in the US (sadly not where I live) and the efficacy of melatonin on sleep quality is pretty hard to dispute.

The Mayo Clinic's website doesn't quite feel as strongly as you do about Melatonin:

> The hormone melatonin helps control your natural sleep-wake cycle. Some research suggests that melatonin supplements might be helpful in treating jet lag or reducing the time it takes to fall asleep — although the effect is typically mild. Side effects can include headache and daytime sleepiness. [0]

Another page from Mayo Clinic's website:

> Melatonin might also reduce the time it takes to fall asleep — although this effect is typically mild. [1]

I wouldn't tout Melatonin as the great counterexample of a nootropic that's OTC, considering it's questionable value and limited long-term use.

[0] - http://www.mayoclinic.org/healthy-living/adult-health/in-depth/sleep-aids/art-20047860?pg=2
[1] - http://www.mayoclinic.org/healthy-living/adult-health/expert-answers/melatonin-side-effects/faq-20057874
"Debugging Applications" by John Robbins is an old MS Press book, now 43 cents on Amazon, that covers everything from high level code structure to a nice primer on reading x86 assembly. I have more recent books, but this is the one that taught me to gird my coding loins for a fight.
ModafinilCat is well regarded and stocks the gold-standard Modalert for $2 a pill.
I think it's awesome that you linked to smile.amazon.com. Thanks for the reminder.
Ah, thank you for the links.

So the concern is that the virus is installed like any others on Windows; but then it keeps itself installed through the boot process reloading it. Thus it must intentionally damage any internal Windows protections that would try and check for it during its own startup. Which of course would be a cat and mouse game.

Okay then, what stops a theoretical TDL5 from using a Linux distro's signed kernel/bootloader to boot a little mini OS that then does the same thing TDL4 does now? (even if the Secure Boot Linux kernel locks out kernel driver access; maybe it uses a privilege escalation exploit to regain that access)

It would seem like the only way Windows could be absolutely certain that only its own code executed up to the completion of boot would be if Microsoft were the only company that could sign working boot code for a hardware device. The gains in security wouldn't be worth the loss of freedom.
The more common advice is to get up at the same time every morning, regardless of when you went to bed.
Your link points to the middle of the video.
Assume for a moment that the 3D printer for logic gates is a little too much of a long-shot. So if somehow the funds for a large-scale investment into 'open' RISC-V processors are obtained, it is theoretically possible for a community of hackers to write their own BIOS'es on a these processors? And then eventually the whole stack going up to userspace applications. So the only problem right now is that of funds? What other obstructions will be there to build a completely libre system from the ground up?

EDIT : Also, HomeCMOS doesn't look active as of June 2013.
Adventures in wearable computing
coreboot has a very different architecture, and we try to avoid having it parse external data (except for hardware registers).
It also has next to no presence during the runtime of the OS (no API for the OS to call into, and to exploit) - which is part of the "no external data" approach.

It's also much smaller: A minimum UEFI for QEmu that can barely boot into Linux loaded from SATA is 120kloc, coreboot (plus payload) for the same purpose are about 20kloc.

These differences should stop some of the exploit approaches right from the start.

Regarding the switches/jumpers, hardware is now complex enough to set up that a wakeup after suspend requires more data than what CPUs can store by themselves to revive memory without data loss. That data ends up in flash, so something needs to change in that area before a flash chip could be write protected with a jumper.

(Disclosure: I'm a coreboot developer and no fan of UEFI)
>So, while I am by no means a security expert, I have been wondering the same thing. The entire "Secure Boot" stuff just seems like a lame excuse to allow vendors control over what operating systems you can boot on their devices

From http://www.linuxjournal.com/content/growing-role-uefi-secure...

>Malware developers have increased their attempts to attack the pre-boot environment because operating system and antivirus software vendors have hardened their code. Malware hidden in the firmware is virtually untraceable by the operating system, unless a search specifically targets malware within the firmware. UEFI Secure Boot assists with system firmware, driver and software validation

>Without UEFI Secure Boot, malware developers can more easily take advantage of several pre-boot attack points, including the system-embedded firmware itself, as well as the interval between the firmware initiation and the loading of the operating system

>Nevertheless, in a variety of implementations that have already reached the market, UEFI Secure Boot has proven to be a practical and useful tool for improving platform integrity and successfully defending the point of attack for a dangerous class of pre-operating system malware.
Jeff, you mention valid concerns but there are two things that make me feel reasonably comfortable with this: there will be laptop manufacturers who will provide selective disabling because of market pressures, and, I think the 'new Microsoft' sees its future as providing productivity tools cross platform. I find the web based versions of Office 365 to be handy to have on my Linux laptops and I would be a little surprised if Microsoft does not eventually offer native apps for Linux.

Although I am a fan, for my own projects, of GPL and AGPL licenses, I do like the availability of commercial apps on Linux. I like Linux because it is a great development platform but I am less of a purist than I used to be concerning an occasional commercial app.
The problem is that if you are the type who knows how to get out of jury duty it's likely you'll never be selected for a jury.

I was told by several lawyer friends that my chances of being selected for a jury were in the neighborhood of 0% recently when my name came up in the pool to serve. Basically one side or the other will be spooked by my profession. They like teachers and people in retail or food service, that's about it. As a result, I saved everyone the time while still contributing to the community by identifying a terrifyingly high number of vulnerabilities with the online jury duty registration and management site. Note: don't do this without written permission. Playing with a system of the court without their authorization is likely the dumbest thing anyone could ever do. I got permission by making some initial observations which didn't require anything remotely resembling an intrusion attempt like pointing out the "F" they got in the Qualys SSL Labs tool. It was so bad that the local court had to scrap what they had and find another vendor to provide the service.

To avoid serving I ended up using a process vulnerability in the law to get my call-up number near the end of the candidate pool. The law states that anyone called up for jury duty must complete the juror questionnaire. I refused to fill it out because the website hosting the form was SQLi vulnerable and it was possible to get all the completed questionnaires. As it turns out the law states that while everyone must complete the juror questionnaire, if they don't, there are no criminal penalties. They'll simply be required to fill it out on paper at the court if their number is called up. If they refuse at that time then they can be held in contempt, but only after going in front of a judge to work out the issue. Out of practicality, the local court doesn't want to deal with individuals who failed to complete the questionnaire so they assign those individuals call-up numbers at the end of the queue. My name was fifth from the end and I was never called to serve. Your state and local laws may vary.
Chronometer – client-side app performance monitor
Yes, and in my personal experience they're more effective than drugs alone.

In fact, with out a process or at least a process-oriented approach in place, ADHD medication or other stimulants alone can create hilarious-but-frustrating situation where you're all hopped up on meds and your laser-like focus gets "locked onto" something totally useless, like reorganizing your music collection instead of completing the programming task that really needs to be done.

However, medication (for those that need it) plus a process-oriented approach (or at least a solid task list) is the most effective combination of all.
When I was first learning C, pointers scared the crap out of me, and it took me longer to understand them than I am comfortable admitting to.

Then I got pointers and this big "NOW I get it"-moment and felt really clever.

And then came the moment I had a problem with pointers and arrays being interchangeable most of the time and became very confused about when they were not equivalent.

People who like C (which I do, too) will often point out C's perceived simplicity when compared with, say, C++, but C definitely does have its murky corners, and the need for backward compatibility with existing code will most likely prevent them from getting cleaned up.
No.

The first time you log in to a server with ssh, it asks you if you should accept the particular fingerprint it just got. You either say yes or no.

Thereafter, if it changes, you get a big fat warning about potentially being hacked.

From a security standpoint, this is no different.
I wonder how Tesla software will handle this problem.

Also who will get sued when it actually happens.
Why should someone be paid for adding nothing of value to a company (by being on maternity leave)?
The key part of the headline here is "in C". In C, it's known that "name of the array is the address to its first element" which is one of the things that lead people into thinking that pointers and arrays are equivalent - in C.
There's also a new contest for Underhanded Crypto -- https://underhandedcrypto.com -- that just finished what I think was its first year, though I know the Underhanded C competition has a longer history.
Yeah. Was trying to not link that coz I don't want to spamvertise.
>I read an article a couple of months back (like October-Novemberish 2014) about the NSA putting a virus into the firmware of a RAID controller on some Dell servers that would patch Windows Server 2003 (R2?) during startup.

I'd say that there's a better than even chance that the NSA already has Microsoft's secure boot private key.
Then shouldn't revocation be fixed?
A very interesting point. Note the pattern in responses:

1. Lots of people criticizing the proposed metrics.

2. Hardly anyone proposing ways to improve them (e.g. augmenting them with information about the difficulty of the cases that were taken).

3. Hardly anyone pointing out that even worse criticisms can be made of the informal criteria customers currently use (the shape of someone's nose, where he went to school, who he knows, the amount of money that was spent on his office).

Most of the criticisms made in #1 are true as far as they go, so looking at any one of them in isolation wouldn't tell you anything much. It's the overall pattern that's informative.
coreboot works on emulation/qemu-riscv, and the communities have somer (small) overlap. We (at coreboot) intend to support coreboot on real RISC-V hardware as soon as possible.

For the higher software stack, Linux on RISC-V already exists, and from there it's open source, a compiler plus some portability work to get a useful stack.

But that's only the CPU side. Good enough for embedded applications and maybe even servers - but at some point, data has to hit a display.
http://www.miaowgpu.org/ or something like that could help there, but I know next to nothing about it.
When another Dutch ISP launched in 1998, I was able to register the root@ email address and a friend of mine got info@. It took them over one year to figure out that they might want to take those away from us.

Surprising to hear that this is still possible all those years later, especially with an ISP like xs4all.nl. Those guys always had a good reputation, security-wise. I see they still have the tradition that you get an apple pie for responsible disclosure (https://www.xs4all.nl/over-xs4all/beleid/responsibledisclosu...). So bon appetit!
Seems like IBM was innovative back then. What happened?
China operating under an unprecedented level of transparency!