skysight-inc/HackerNews huggingface dataset:
Ask HN:

I am asked would I prefer 1. to have a pre-generated cryptographic "signature" of every www page that can be checked against some centralized repository for "authenticity" or 2. to encrypt every www page before transmission or at least have it encrypted in transit?

"Both" is not an valid choice. I have no idea why not; as far as I can tell, they are not mutually exclusive.

Because I mindlessly support SSL (let's encrypt!) I choose option 2 over option 1.

Now I am asked the same question regarding DNS packets. 1. Sign the packets or 2. encrypt them?

Do I still choose option 2 over option 1?

If I choose 1, those DNS requests will be unencrypted plain text like unencrypted HTTP.

Maybe DNSSEC has nothing to do with privacy regarding DNS requests?
> If they can access Redis they can access pre-bcrypt passwords and therefore making bcrypt's rounds completely unimportant.

No. The unhashed passwords are not stored in redis. What I think you're missing is that there's a significant difficulty gap between connecting to, and reading data from, redis compared to gaining root access and reading arbitrary memory on the server.

> So are you arguing that your complaint is petty or isn't? Because this isn't helping your case.

You make a good point - even if it's not the one you were trying to make - and that it's that my benchmark was not particularly helpful as it measured per operation, not per hash.

You missed the point I was really trying to make, though, which is that difference between 5 rounds and 15 (your choice, not mine - I probably wouldn't choose 15) isn't that significant when you're doing legitimate stuff, like hashing chatroom passwords. It is significant if you're brute-forcing.
I just posted the exact opposite of what you said :) Usually these "scroll hacks" are annoying. In this particular case the "flow" of calls is captured really well this way, IMHO.
I find it interesting that some people have a problem seeing the difference between willingly and knowingly giving data to a corporation in return for a service and a law-enforcing organization using that data without permission
Something like this but for JavaScript would be useful.
The problem is clear if you take a moment to consider that corporations don't have a monopoly on the legitimate use of force like state actors do.
While I don't purport myself to be a crypto expert, you can't cite an RFC of a protocol as "proof" that something is secure. For example, if people come up with attacks against DKIM after the RFC is created, they don't issue an errata on the RFC listing all possible attacks.
Technically correct is the best way of correct.

I never suggested my proposal for public protocols for communication between two random parties. I first and all wanted to show the root of this thread wrong.

I'd suggest it maybe for highly confidential communication that warrants the trouble.
> Lawyers are constrained, in that they cannot knowingly tell outright lies

Lawyers may have greater professional consequences if they are caught knowingly telling outright lies in certain contexts, but it is absolutely not the case that they cannot knowingly tell outright lies.
Right, but in the erlang VM (and thus Elixir), processes are not OS processes, they are very very small processes internal to the VM. It's not uncommon to have multiple processes get spawned for each request that comes into a server and to end up having tens or hundreds of thousands of processes on a single VM at any given point.

Edit: Geez, I even did a refresh check before clicking submit. I'm having the worst luck with that lately.
http://www.guardian.co.uk/technology/2008/jan/14/facebook
Brilliant name (Yojimbo) and great cover photo there...
Pretty big distinction actually!
C/C++ IDE from JetBrains hits the market
They run Mangopay, a payment processor.
Already do... https://www.twilio.com/client
jocluteseh - your site seems to be down now (perhaps buried under HN traffic). Perhaps post it as a gist on Github or something like that? https://gist.github.com/
If you care about someone, and they're offended, then you'll change your behavior.

I'd venture to guess you're also both rational adults, and you if care about someone, and they're offended at lots of different stuff (sexist language, passing clouds, the endless sea), then you could talk about why passing clouds and the endless sea offend them.

This really comes down to human decency; if you see women as people first, worthy of respect and care, then you'll probably want to minimize how much you offend them, instead of placing the problem of being offended on them.
And a $15 share (discounted from $20) from 1996 would today be worth $264. CAGR of 16%, not bad—though most of BBC's growth was in the last few years.
when i look at it, it looks "fake"... I couldn't really describe why, until I saw the foam from 2 waves collide between the rocks at 0:20. The foam shifts down the screen (perpendicular to the two waves).

Funny how the brain can perceive "issues" without being consciously aware of them.
Has anyone here got experience with bitmessage? https://bitmessage.org/wiki/Main_Page

How good is it, in terms of latency and reliability?
Yap! Also, Spark added a Python API for Spark Streaming after v1.2 [1]

[1] https://spark.apache.org/docs/1.2.0/streaming-programming-gu...
ZoomCharts Experience: Episode 02, Related Items
Bloomberg's API is real-time, but you have to pay for how much data is consumed.
i don't mean to be overly dismissive or anything, but why do you assume investments are always about direct return through monetization?

lots of heavily capitalized companies have sprung up on the shoulders of docker... it is in their interest to keep the company afloat to better the chances of the features they are asking for to be realized.
Use keybase.io
> Is there some "evolution retardant" in our substances that forces us to not adopt new things too fast, as they might be wrong?

I simply can't wrap my head around how this question is being asked in a post that argues in favor of relying on predefined automated processes to maximize efficiency and safety. The "devops revolution" is the "evolution retardant" you're talking about: the engine of evolution is adaptability and incremental innovation. The Arch philosophy optimizes for adaptability over efficiency: by giving users who are so inclined the tools necessary to understand and interact with the inherent complexity of the system, rather than rely on opaque processes hidden beneath simplistic frontends, it enables users to more effectively adapt their tools to their own needs, solve problems by understanding what's actually causing them, develop new techniques that better serve their purposes, and discover new purposes that their existing tools and systems can serve. Approaches which seek to maximize the efficiency of existing tools and processes are necessarily less adaptable to change, and reliance on them stagnates evolutionary progress.

If you're looking at documentation filled with console commands as an analogue of "click here to install the system" automated tools, then you're missing the point: that list of commands isn't there for you to blindly copy and paste into your shell. It's there for you to read and understand, so you can learn how the system and the tools that manage it work, so you can ultimately use them in the way that best serves your own purposes.

> sent to you with a monthly magazin that contains lots of manual input instructions for your modern device (and a lot of comics)?

I'd love it. I absolutely hate the feeling of constraint and limitation I have on e.g. modern mobile devices. I ended up switching from iOS to Android precisely because of the increasingly common frustration that I felt when I knew exactly what I wanted to do with my phone, but couldn't, because Apple didn't expose the functionality that was clearly there for me to control and direct in the way I wanted to. I was artificially locked into someone else's way of doing things, and any particular use case that they didn't think of in advance was something that was just blocked off to me; and the best I could do was petition that someone else to modify my tools to fit my purposes.

I'd absolutely love a phone OS that made it as easy to understand and control the functionality of the phone as Arch makes it easy to understand and control the desktop, and I'd gladly read a regular publication that was consistently full of information that improved my understanding of how it all works.

It's becoming increasingly apparent that there are two distinct cultures of technology: one that seeks to use technology to extend and improve human capabilities, and one that seeks to use technology to replace human capabilities. Arch is for the former, and sealed black boxes that "just work" are for the latter.
Why on earth would anyone store SSH keys in a PKI controlled by NSA and GCHQ? How does that not make the argument against DNSSEC even stronger?
Here's a map in my functional language (winter). It's not parallel yet, that shouldn't affect the syntax though. (map is already manifestly parallel)

def square(float x) float : x*x
def main(array<float, 256> a) array<float, 256> : map(square, a)
Tangibly bad things would have to happen to a non-negligible amount of users. And, to be honest here, that's the threshold for me to care enough to do anything substantial.

A person's chats being read by some spooky unknown company or government agency has little-to-no tangible effect on a person's life. Until it does, people can spend their effort on problems that do have tangible effects on their lives. And I think that's reasonable. Others might say we shouldn't wait until it's too late... but there's many other problems where it's already "too late" that deserve attention.

Anyway, I think it's cheap to imply that people are just lazy (as some do) for not caring about this stuff. It's just they have other problems that deserve their attention.
A lot of people equate "rich" with "I can buy anything I want to at anytime, and cost is not a consideration."
Some people run TACK. Chrome also, IIRC, reports back on when certs have changed and Google can clearly see if there's widespread disagreement on what key is being served to visitors.
Zomato acquires cloud-based data firm MaplePOS
In case you neglected to read the paper, here is most of the relevant quotes from the conclusion section. These are direct quotes from the conclusion section, broken into a few relevant bullets.

> We carried out a large-scale study of email replying behavior of more than
2M users.

> emailing behavior is not well understood.

> users reply faster to emails received during weekdays and working hours

> In regard to demographics, younger users generally send faster and shorter replies, and
men send slightly faster and shorter replies than women.

> replies from mobile devices were faster and shorter than from desktops

> emails without attachments typically got faster replies.

We investigated the effect of email overload on the replying behavior.

> users increased their activity as they received more emails, but not enough to compensate for the higher load.

> Older users generally replied to a smaller fraction of incoming emails, but their reply time and length were not impacted by overload as much as younger users.
you can still do that.
That's probably because the particles in the simulation are orders of magnitude larger than real life water molecules. A lot of the tech goes into compensating for this, but there's only so much that can be done.
Apple open sources ResearchKit
I guess you didn't understand the problem I was describing. I wasn't saying that the problem is that I don't understand parametric polymorphism, or for that matter its realization via code generation, although I’m sure e.g. Philip Wadler understands those things a whole heck of a lot better than I do. The problem was that the Java language designers didn't understand generics, and accidentally implemented varargs in 1.5 in a way that produced a completely unnecessary and avoidable collision with the parametric polymorphism system (designed by Wadler) that they also introduced in 1.5. And there are a variety of similar problems in various parametric-polymorphism systems, which leads me to think that the problem is not merely that some loser at Sun didn't understand these things (and didn't bother to ask Wadler, who surely could have warned him off the particular stupidity I mentioned) but rather that there is a general lack of understanding of parametric polymorphism.
I paid a one-time fee for Pinboard and the survey doesn't have an option for one-time payments.
Australia has a GDP per capita of around $43,000 while the United States has a GDP per capita of around $53,000 [1]

I suggest the United States has the better outcome to choose from, it just chooses not to.

[1] http://en.wikipedia.org/wiki/List_of_countries_by_GDP_%28PPP...
A lot of people find certain features of facebook really useful (e.g. organizing events), and there are still groups of people almost exclusively using facebook chat. Just because people are still using facebook doesn't mean they trust facebook with private data. Even my mother uses facebook, but she absolutely refuses to put anything even remotely private on facebook because she assumes facebook will snoop it.

So even if it turns out that facebook is selling off all of its data to the highest bidder people would probably still use it, unless there is an alternative. For chat we're seeing more and more protocols and apps springing up, both proprietary and open source - e.g. XMPP or the much younger/newer http://matrix.org (which I work on).

For event organization? The key thing that makes facebook useful for this is that pretty much everyone has an account. You could probably build something on top of a distributed/federated chat/data replication system (like Matrix or possibly XMPP, etc.), but I don't see any new closed app being able to get enough traction to overthrow Facebook there.
I'm a PHP developer that works for a major media company. We do large scale deployments, and I'd like to say that PHP is a terrible language that gets a bad rap. It's getting better, and it's already 1000000x better than the PHP4 days, but it's still not a nice language. It's not a nice runtime. The only thing nice about it is that a zillion people and their dogs all know it and it's relatively easy to deploy.
> Maybe DNSSEC has nothing to do with privacy regarding DNS requests?

DNSSEC has nothing to do with privacy.

DNSSEC is entirely about the integrity of DNS requests.

DNSSEC is focused on ensuring that the information you get OUT of DNS in response to a query is identify to the information that was put IN to DNS by the operator of the domain you are querying DNS about.

That's it.

DNSSEC is a focused mechanism to ensure the DNS records have not been modified in transit between the authoritative DNS server for a domain and whatever DNS client is performing the DNSSEC validation.
Here are a couple of relevant articles that people may find interesting:

An overview of a 2008 ULA proposal for mid-air recovery of first stage rocket engines: http://selenianboondocks.com/2008/09/partial-rocket-reuse-us...

An article about Hiller's 1965 proposal for using a giant helicopter to recover an entire Saturn V first stage: http://www.thespacereview.com/article/1045/1
This is a very intriguing move for Intercom. They've gone from offering products that are designed to solely work inside your SaaS product to customer acquisition. A very interesting shift from a company perspective. I'm sure there must be many competitors in the customer nurturing / lead acquisition business who are eyeing up this product release very closely.

I'm curious if it will catch on or if users stigma against livechat will hurt. Have to ask yourself when was the last time you used livechat? I'm having trouble remembering the last time I did.
Best Tools to Analytics and Research Your Website Visitors
Interesting. There certainly seems to be a bit of cherry-picking in the author's quotes. From the abstract of the first article

"Thirty-two poor readers were then tested with the same material arranged in longer lines averaging 12 words, and no disadvantage of justification was found."

So the only time that there was any evidence of poor comprehension in that study was with very short lines - 7 words per line - and with poor readers.

The third one was published in 1991, and again seems to be based on narrow lines - 4 column newspaper. And if the examples on page 29 are anything to go by, it's potentially also based on fixed space type - and I'm not going to argue with anyone about justified text with a fixed space type looking poor.

> This is aside from the fairly obvious aesthetic argument that looking at ugly things (like right justified text) inherently lowers your quality of life

But if you don't notice it, then you presumably don't think it's ugly.
A ToC of the 20 part linker essay (2008)
US lottery security boss charged with fixing draw
Protecting infrastructure secrets with Keywhiz from Square
Just to keep the timeline clear, it only predates web-based email by a couple of months. Jennicam started in April 1996 and HoTMaiL came out two and a half months later. It predates those other things by years.
It's funny how people forget that IE had supported multiple languages for a very long time: http://en.wikipedia.org/wiki/Internet_Explorer#Architecture

Internet Explorer does not include any native scripting
functionality. Rather, MSHTML.dll exposes an API that
permit a programmer to develop a scripting environment
to be plugged-in and to access the DOM tree. Internet
Explorer 8 includes the bindings for the Active
Scripting engine, which is a part of Microsoft Windows
and allows any language implemented as an Active
Scripting module to be used for client-side scripting.
By default, only the JScript and VBScript modules are
provided; third party implementations like
ScreamingMonkey (for ECMAScript 4 support) can also be
used. Microsoft also makes available the Microsoft
Silverlight runtime (not supported in Windows RT) that
allows CLI languages, including DLR-based dynamic
languages like IronPython and IronRuby, to be used for
client-side scripting.
Erlang actually has this in the rpc module, in the standard library:

http://erlang.org/doc/man/rpc.html#pmap-3

So you could call that from Elixir if you wanted.
Considering that the original comment never specified web developers, you seem to be responding to an argument that wasn't made.
Show HN: Reddit “The button” flair chart
In an alternate universe: "Popular Linux Package Manager (apt|yum) Raises $<few>M, Launches Private Repositories". Something sounds strange.
Just goes to show you, context is everything.
Show HN: Haml.io
Helicopter proposed for midair first-stage recovery of the Saturn 5 (2008)
Most of the responses seem to be talking about A -> Custom -Strong -> Unstrong -> Uncustom instead of A -> Strong -> Custom -> Uncustom -> Unstrong*.

Some potential problems with applying a custom transform to the cyphertext:

- The custom transform might have effects on cache that
create opportunities for timing attacks

- The custom transform might have a buffer-overflow (just like any other excess code)

- The custom transform might support features exploitable in DOS attacks, like run-length encoding

- The custom transform might be slow, costing time and money

- Sometimes applying two transforms is equivalent to encrypting with a different key (e.g. DES has this property). Might create meet-in-the-middle attacks.

- If the custom transform is given the same key as the strong crypto, as a lazy programmer might do, it could leak the key

- Switching the ordering of the transforms is a deadly mistake, but easy to glance over

- If the strong transform starts with an HMAC, as it should, that can be used to break the custom transform's key anyways (see the post we're commenting on)

Mostly those are small things. But the security benefit you get is also small.
> I've talked to people doing large-scale deployments in PHP that complain about things like memory-leaks, etc in the language

What does it mean for a language to have memory leaks? Are you talking about a problem specific to the PHP runtime or common PHP idioms that lead to leaky code? A specific example would be helpful as I've never known PHP to be particularly vulnerable to memory-leak bugs (at least not any more than any of the other popular imperative scripting languages).

Also, what's the substance behind the "etc" in your comment? I'm not really sure what naturally follows in the sequence of "memory-leaks and so on...."

Your comment seems to simply cast doubt without much substance.
Building a Quick and Dirty Client-Side Blog Search Algorithm
Getting every London landmark in a single photo
Nobody uses FTP for deployment anymore, but the idea is still the same: just get the file to the server.
Related: I hacked Quote Stream (https://github.com/nodesocket/quote-stream) together a while ago. It pushes real-time quotes (not delayed) from Google to your browser via websockets using node.js.

Heads up, it has not been touched in 3 years.
Why so nasty?

Instead of calling it a 'dang thing', which seems incredibly mean, why not just say the keyboard wasn't right for you?
> Thanks for agreeing that we don't lose security when using my construct.

I don't agree. The construct may not degrade security under several caveats. Most implementations are extremely likely to share resources, which will introduce weaknesses. I'd wager those weaknesses would degrade security much more than the composition would enhance it, but it'd depend on the exact situation.

> Yes but it would involve highly paid cryptoanalysts. My proposal is first of all to disprove the root of this thread. Secondly, it makes surveillance more expensive while it's free for us. That what's cryptography all about. Making their life harder while not so much for us.

My exact point was that those cryptographers would already need to develop generic attacks for all the non-standard (read: non-secure) cryptosystems out there. Composing a homegrown cipher with a peer-reviewed secure cipher will not make their lives harder. It will make maintaining and improving the system harder. The net result is overwhelmingly likely to be detrimental.
Going All-In on WordPress
It seems that Docker could follow a very similar path as MongoDB -- be the preeminent supporter for docker and supplier for turnkey + validated solutions. Building an ecosystem of add-ons (closed or open source) around the core product puts them in an even more central role
There's a "view as one page" link on the first page of the article.
There were a couple other conversion sites out there but I wanted to create one with a little nicer UI and make it open source so anyone can contribute. https://github.com/interviewer-io/haml.io
A Math Problem from Singapore Goes Viral
The same holds true for Silex[1], the Symfony Components-based micro framework. Silex and Lumen look very similar (not only because Laraval/Lumen use Sf Components as well), not only because both use (just as Laravel) Sf Components. Slim 3 seems to move in the same direction of modern PHP frameworks, where you return a response from your controller, instead of setting up some global state (the main thing I don't like about Slim 1 & 2).

For now, Silex is still my favorite, as it has the temporary bonus of having more providers available to integrate 3rd party libraries. Sure, I can drop-in whatever library I like, but having someone do the setup (configuring Twig alone can be a burden if you want to get it right) just makes it easier for me ;)

[1] http://silex.sensiolabs.org/
I might have missed the obvious but what is the difference between this and hosting your own private git repository?
Just for the record, I see the same thing on FF 37.0.1 on OSX 10.10.3.
I'm the author of this post. Looks like some of you want the JS used that was analyzed, so here it is:

https://blog.korelogic.com/2015/01/12/javascript_deobfuscati... (pass: infected)