skysight-inc/HackerNews huggingface dataset:
... in safe Rust, yes. But Rust isn't perfect, we _will_ have these kinds of issues crop up, especially with regards to unsafe code. Rust will significantly reduce these kinds of issues, but not completely eliminate them. There is no silver bullet.

We've just started unleasing afl on Rust code, and it can still find issues: https://github.com/rust-lang/rust/issues/24276
Stress doesn't kill you until after the age of reproduction. There is no way for evolution to select against it.
> No you don't. You can get free certificates.

The only free certificate authority that actually exists right now that I'm aware of is StartSSL, which I've at least found to be pretty damn horrendous to work with, and which only supports non-commercial uses of certificates, meaning that small businesses are still forced to pay up.

And no, Let's Encrypt doesn't count, seeing as it's not operational yet.

> For any actual website, there are already a multitude of real costs of which a certificate is just one more.

That's one more that can mean the difference between a mom-and-pop shop having a website and said shop not having a website because it's too expensive.

Just because plenty of factories dump industrial waste into rivers doesn't mean that I'm not an asshole if I dump a bottle of OxiClean down a storm drain.
Let's be clear, though, the root of DNSSEC is NOT handled like the root of any CA system. The process of obtaining the root private key is not something where you just break into some system and grab a file somewhere.

The root zone's private key is actually distribute across a set of smart cards possessed by Trusted Community Representatives (TCRs - people like you and me within the Internet technical community) - some number of whom get together periodically in "key ceremonies" to perform actions that require the root KSK, such as the generation of new Zone Signing Keys (ZSKs) every 3 months in what are called "key ceremonies" - https://www.iana.org/dnssec/ceremonies

The entire process of protecting the root zone's key material are documented at length in what is called a DNSSEC Practice Statement: https://www.iana.org/dnssec/icann-dps.txt

Again, the DNSSEC root zone management is EXTREMELY different from that of the CA system. It was designed to be much more secure and to not allow the kind of penetration we're seeing with the CA system.
JVM (not Java) gained invokedynamic, which is an amazing work. invokedynamic work was paid for by Oracle, so at least I am thankful to Oracle for advancing the open source there.
Bigwigs of China Censorship Are Behind GitHub Cyber Attack
Larry Kaplan Interview
All technologies are dangerous, but nuclear is one of the safest forms of power (deaths per Kwh generated).

For the sake of the environment we need to get over our irrational fear of nuclear power.
Some opposing viewpoints from the Guardian: http://www.theguardian.com/commentisfree/2014/jul/03/is-a-ho...
hear fucking hear

EDIT: Ahh yes, downvoted for agreeing. Fantastic guys!
> The CA mechanism used for TLS has the same issue. It's not just theoretical either...

Exactly. Which is why so many of us are looking for ways to add an additional layer of trust to the CA system used for TLS.

One such mechanism is to use DANE and DNSSEC as an additional mechanism for trust.
Dog call 911
Given all the platforms and hardware and constraints sqlite has to run on, what would you suggest replacing it with.
Note that it is against the Google Analytics terms of service to record personally identifying data. So even if someone wanted to do this, reporting it to Google would get their GA account suspended.
LA Dodgers Technology Accelerator ($120,000 for 6% equity)
It actually is (or at least was; it's going to be significantly castrated soon) possible to "create a website for free with HTTP, but not HTTPS" if you use Heroku. An HTTP-only, single-1x-dyno setup is free, whereas if you want HTTPS, they will try to bleed you dry.
> it doesn't matter when some user will create a reset request. Because you can do it for him, right?

only if I know the user's email address for this given service.

with your system the attacker will get a regular flow of emails like this, and can even just track the emails as they're used, so as to then use them later to create a new authenticated session without arousing the suspicions of the user.

even if an attacker was lucky enough to capture a password reset email, they either have to use it immediately (or it will become invalid) or do a later, second password reset. Either way, the user still knows at the very least that something isn't right.

> There are tons of services out there generating a password for you and sending it over in plain text

and this is fucking atrocious from a security stand point.

> Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.

Care to name some? I'm not aware of any major service, website or application that relies on a OTP via email for primary authentication.

> Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.

You still don't seem to accept that knowing your account was compromised is a security feature. With your system there is potentially ZERO indication to the end user that their account has been compromised. That is FUCKING TERRIFYING to me, and that it isn't to you, is even MORE FUCKING TERRIFYING.

Please stop making claims as if you have any fucking idea about security.
cmder: portable console emulator for windows
As others have said, parsers for complex formats (be it text-based or binary) are exceptionally hard. There are some classes of C/C++ software where the choice of a language doesn't have such a striking effect. For parsers, the effect is hard to ignore.

But parsers are also the kind of stuff you almost always end up writing in C/C++, and there are semi-compelling reasons for doing so - chiefly, performance and flexibility. You can disagree and make your pitch for Ocaml or JavaScript or whatever, but really, if we had clearly superior choices, we wouldn't be dealing with this problem today (or it would be a much more limited phenomenon). There are some interesting contenders, but the revolution won't happen tomorrow, no matter how much we talk about it on HN.

Perhaps a more fitting conclusion is that if you are parsing untrusted documents, our brains are too puny to get it right, and the parser really needs to live in a low-overhead sandbox. Mechanisms such as seccomp-bpf offer a really convenient and high-performance way to pull it off.
Y Combinator sounds like such a great experience. Now if only I had a startup.
>If you can't trust your router, you really just have to initiate a secure VPN connection to a network that isn't out to get you.

:(. that's really frustrating. So you really need to vpn to a secure network anytime you use free Wi-Fi?
Both are acceptable.
Success != a great product.

Often times users have no choice but to use the only choice. That's like saying people choose Comcast because it's a great product. No. People choose Comcast because it's the only product.

Craigslist became popular at a time when thoughtful UI design wasn't repeated or regarded as necessary.
The PuzzleScript gallery is very much worth a look: http://puzzlescriptgallery.tumblr.com/

Alan Hazelden's page is especially good: http://www.draknek.org/games/puzzlescript/
> as I understood it, it needs a dedicated precious IPv4 address

A good webserver would actually be able to provide multiple SSL certs on a single IP address by using "Server-Name Indication" (SNI). This is definitely (as far as I know) supported on nginx, and probably supported by Apache's httpd.
Agreed. The only objection I have to wind and solar is that they are insufficient. We should use them as much as possible, but we're going to need nuclear if we want to replace fossil fuels.
god i hate apple
Finally, someone acknowledging the obvious: property owners are thrilled with the current situation.
It's a start! There is big space for improvement in supporting the complexities of research studies, but this can definitely be a jumping-off and may well support broad consistencies in design and implementation.

There would still be a massive effort to implement most of the requirements of a research study. But, at least the iOS UI implementation and some on-ramps via ActiveSteps would be eased.
I don't know about Perl proper, but PCRE does have an automaton option (which the docs call a DFA but, if I remember correctly, is actually an NFA).

In practice, the vast majority of production regexen don't require backreferences or generalized assertions, so automata are an attractive option. This is particularly true for security applications (e.g. firewalls/NIDS) and public-facing services like Google Code Search. I wouldn't be surprised if people were attacking Snort boxes via PCRE, for example.
> It's not controlled by NSA? The largest nodes in the tree are literally controlled by them.

Perhaps I should thank you, Thomas, for continuing to beat this drum... because it shows extremely clearly how we need to educate more people and be MUCH more clear about exactly how the keys at the root of DNSSEC are maintained. If people fully understand the process, and how it was designed to NOT allow attackers in this way, we could spend our time on much more productive discussions. (Granted, documents such as https://www.iana.org/dnssec/icann-dps.txt do NOT make for friendly reading.)

Thank you for pointing out the work that needs to be done.
Seems like SOMA could be much taller (and infinitely prettier) without creating congestion problems in the rest of the City.
Hmm... according to that page, the false positives and performance issues seem to largely derive from using the cache structure to store bounds externally. But if you manage the bounds explicitly as part of your data structures, and use BNDMOV/BNDMK rather than BND{ST,LD}X, it should be reasonably fast. What else could Intel do?
Definitely one of the oldest - Shopify is on Rails 4 now, initial commit was on the release day of Rails 0.5!
At this point it's semantics. I feel like we mostly agree. However to me pinch to zoom is incredibly visual. Yes it's gestural but the feedback is visual and therefore does have a look.
Your landlord, however, has an incentive to install solar (and claim the relevant tax credit) in order to increase the attractiveness of his rental by advertising lower utility bills.
Font-icon vs. svg
I have been debating the use of font-icons vs. svg for icons on a web site. As of right now, there is no requirement for supporting IE8.
I have read about a few teams moving from font-icons to svg. I realize this can be a religious argument, but can anybody provide any advice, experience, rationale for choosing one over the other?
Thank you for the answers.

More questions:

If I run my own DNS cache on 127., 172.16. or 10. then do I have to worry about "cache poisoning"?

Do I still need to verify authenticity of the answers to my DNS requests?

What if I can verify the authenticity of the authoritative DNS servers?

If we were somehow able to encrypt the DNS packets between my resolver and authoritative servers on the internet, and I have verified the authenticity of those authoritative servers, should I still have concerns that the answers I get could be forged?
This is a good editorial on trying to develop housing in the Mission: How San Francisco creates its own housing crisis

http://www.sfgate.com/opinion/openforum/article/How-San-Fran...

It took 6 long years with lots of fighting to try and develop a relatively modest 12 unit condo complex that met all zoning requirements.
There are some other interesting choices. Like Rust, or Cyclone.
No, but prices will go up. Free tiers will be significantly reduced or outright eliminated. Cheap tiers won't be as cheap anymore. A lot of individuals and small businesses will now suddenly be faced with more costs, and while $30/month might seem small to you, that adds up considerably over several years.

Not everyone on the internet is a multi-millionare YCombinator alumnus.
Do you think map/reduce would result in performance near what I get from Postgres?
"Building your project in a niche language (not just Clojure, but ClojureScript) is a risk."

If you are writing a tool to help java programmers program in java then writing it in java makes sense.

The problem is he was writing a tool that was not cutting edge enough for the clojure folks, and not easily approachable for its main users.
There are quite a few ways that this sort of software could be on the drive without malicious intent by the police department. This article is pretty light on details but it doesn't sound like anyone has actually examined these drives to determine this.

Some possibilities:

* if the police computer was itself infected and the malware was trying to propagate

* The data was copied from a drive or computer that was infected
Uh, even if anyone aspired to be Houston, it's not surrounded on 3 sides by water.

The developers are not entirely innocent since they always, without exception, ask for more than they are allowed, hence the endless reviews.
Ballmer grew profits, there is no denying that. He definitely missed a lot of things, but there is no qualification for the title of "one of the worst CEOs in history," just like Bush 2 made mistakes but will hardly be remembered as one of the worst presidents.
As a one-time Shopify user, I'd think so. The default model is recurring billing and Shopify's features are super bare bones with the "there's an app for that" fallback that keeps the platform viable. The apps on offer are very hit or miss and many are simply poorly designed or thought out, and there seems to be room (in conjunction with some marketing) to carve out a good space there for quality interoperable apps.
Not if those free-to-host HTTP services are commercial entities; StartSSL's free certificates can't be used commercially per their terms of service.

And if StartSSL is the only option, then I'm sticking to HTTP. They're a nightmare to deal with even for non-commercial use, let alone commercial.
Yup. Entire article seemed hinged on a false premise about Microsoft. I stopped reading as soon as that became clear.
The comment about bias against going to school in the South really resonates. I mean, in one sense it's hilarious to think that there are people who don't realize that schools like UNC-CH, Georgia Tech, Clemson, NCSU, Campbell, Wake Forest, South Carolina, Georgia, Virginia, Virginia Tech, William & Mary, etc. are great schools. But in another sense it's very, very sad. And I almost find it weirder to hear that about people from the West Coast, where the stereotype about people has them being so much more open minded and accepting, vs. people from the Northeast who are stereotyped as being more elitist and dismissive of Southerners.

Oh well... at the end of the day, all you can really do is, as they say, "Be so damn good they can't ignore you".
As others here have pointed out, US technology companies are very likely to be complicit, having chosen to play along and get along. Are they sacrificing their overseas revenue? Only the revenue from places that aren't the NSA's beotches already. The ones that are know they have no autonomy of decision-making and are comfortable with that.
"In the case of the taxi data, one way to improve on the hashing would be to substitute a random number for each license ID, then hash the random numbers. Not only does this make the hashed values harder to re-identify (because the input has no consistent format), but even if the data are re-identified, the random values are not personally identifiable."

What is the point of re-hashing the random numbers? Once you have replaced the actual values with random numbers I don't know what you get from then hashing those.
That was a good read. Thanks for sharing.
Yeah, that one surprised me. Hosted rentals are obviously much, much less risky. Perhaps the enforcement was going to be a problem? Not a great excuse.
The effort that you put into quantifying potential traction would also count.

As somebody pointed out above, a "soon to launch" Web site, a large-scale survey with potential customers, a successful Kickstarter campaign, etc. provide some validation before traction.
I agree that signatures are of no value unless validation is done... but please do note that current measurements are showing about 13% of all DNS queries globally are in fact being validated:

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g...

If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating.

In the USA, about 23% of all DNS queries are being DNSSEC-validated:

http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1

So the argument that "no one is checking" is no longer true.
DSU has always been an interesting field to me, and I've wondered why the idea of hotpatching systems while they're running has been so relatively underrated.

Related is application checkpointing, where you can freeze the state of a process (fds, sockets, pipes, sigmasks, open ttys, etc.) into binary images and overlay them back. Useful for all sorts of nifty cases. See CRIU for a Linux implementation: http://criu.org/Main_Page
The article points out that the police claim to have "real-time AV protection." And it would probably have passed through a police computer at least once, I doubt they'd be booting into a seized hard-drive.
Can I suggest adding a section on responsive web design? Thanks!
> a biased coin ... TFA argues that there is no such thing.

The article repeatedly admits biased coins exist, it just adds a flipping protocol that can mitigate this bias, a protocol that can only be verified by a nonflipper who can accurately measure the angle of spin and number of rotations with the naked eye in under a second.

You can instead generate unbiased "flips" through math, rather than physics and trusting someone else's thumb.
> I am sad that LT didn't succeed as I hoped (I was a backer)

Ditto. I'm especially sad that while it's a cool editor that does some neatish things, it's still just an editor + some neat stuff. The demo that was originally shown and pitched[1] was much more of a re-imagining of the concept of how we use editors, and _that_ was what I was looking forward to. I downloaded LT once and then decided to wait until those concepts arrived. At this point it's pretty clear that day will never come.

[1] http://www.chris-granger.com/2012/04/12/light-table---a-new-...
If the malware came from the Police computers then wouldn't that likely taint all the data supplied, to well everyone? Every defendant for at least the last year will be taking a shot at this and why not?
It would have to run in a web browser, for me.
In that case, you might be better off using a MIPS based device (old router, maybe?), since ARM is gaining popularity.
"Says police department brass tried to infect him, seeks criminal sanctions."

First, the lawyer most likely found the malware via an anti-virus software and did not detect a new malware specifically targeted to him. Second, the police probably used the drive at an unsafe machine.

Is it only me who finds this illogical nonsense?
It sounds like if I get a "real world" infection like xyz flu - I have the right to seek criminal action against the person who got me that infection.
My question was not off-topic. I simply asked for some evidence to support his claim. I explained why I thought he was wrong.
Raspberry Pi does make a lot of sense. It's cheap enough, small, and doesn't consume much power so it's easy to have one around for this purpose.
> but for out-of-city travel (i.e. a trip where you would
need to charge before you get to your destination), you want the equivalent of a gas station, which is 1-10 minutes for a stop, not 45+.

I appreciate that 'time is money' and people want to get where they are going sooner rather than later... but I wonder if there are social benefits from a transport infrastructure that requires us to stop for 45 minutes to recharge, not just the car but the body? Could potentially result in fewer road fatalities from fatigue if technology enforces a break on drivers? And potential economic benefits for small towns to offer charging stations right by a place to buy a meal...
ContainerDays Boston 2015 (un)conference
Container Days (un)conference is coming to Boston June 5-6, 2015.
Tickets are $50 and are now available at Eventbrite: https://www.eventbrite.com/e/containerdays-boston-2015-tickets-16078800124
Chris didn't give up, he just changed his approach to something that has a better chance of working.

Those of us who have been working in this field for awhile already guessed that many of the features promised by the original lighttable kickstarter would require a new programming model to really work out.
i use both, randomly. It should be used for a pRNG.
Who Writes Linux, How Fast It Is Going, Who Is Doing It, What They Are Doing
Landlords push people out of housing in SF every day. It's often under shameful circumstances. And its not just Ellis Act, though that's a big part of it.

Suffice to say, the lease isn't the problem.
The "initial torque" is not really a problem with sufficiently powerful contemporary electric vehicles (the whole electric motor thing of "maximum torque at zero rpm" gives you that for free). The G forces are still limited by tire/road traction and friction coefficients - even top fuel dragsters with _way_ too much power, rubber heating burnouts, VHT TrackBite, and perfectly groomed launch pads – barely hit 5G sustained.
Interesting. What's your plan for dealing with state?
This is no mystery.

If you want to make money, the best place to park yourself is between the government (on the one side) and the real world (on the other side).

Government causes friction and denizens of the real world will pay to remove or reduce friction.

Source: I am a tax lawyer. :-)
> Even RSA which has stood the test of time since 1977, is only considered 'safe' in so far as there's no algorithm better than brute force for factoring products of large primes

https://en.wikipedia.org/wiki/General_number_field_sieve but most of your point still stands. RSA is edging slowly closer to the abyss.
> You shouldn't, and that isn't my argument.

That is your argument. The company decides what it values, not you.

> If your employer says "your value to this company is equivalent to the value of unskilled entry-level workers", when you are in fact a highly trained and experienced worker, that may well be difficult to swallow.

Your value doesn't necessary map to your training and experience.
Those of use in the AV industry know that in practice AV software misses a lot of stuff, and updates need to be deployed properly as well. It's quite possible that AV software was installed but failed to catch this infection.
Does vim really have an order of magnitude more users than emacs? Is emacs really lacking in mindshare? I have no real reason to doubt those claims but I find them kind of mind-boggling. I'd have guessed they were close to parity (for the first).
Lol. You missed a really interesting real-life soap opera series about io.js/Node/npm/core developers. I believe at one point isaacs wanted to do npm stuff inside Joyent but management was an issue.
> That's the point. The value of the output of various workers in various positions is NOT the same.

The company decides the value, however, and they pay according to that. Are you suggesting this is not the case? This is literally how practically every company I know of works.
Vertical ok only after you learn 5 m/s is TOO FAST.
It'd be really hard to convince me that immortality is even possible. So it's unlikely I'd get into a situation where I'd be violating certain ethics.
Electric WRC would definitely be fun!
How long before apps run off the trunk itself?
The thing I'm trying and failing to avoid is boredom. In short I try to alleviate boredom by going on the internet, however I am still quite bored.