skysight-inc/HackerNews huggingface dataset:
Thomas,

I perform DNSSEC validation on the edge of my home office network. All my devices use my DNSSEC-validating DNS resolver on my network server-gateway.

That resolver is going to check the DNSSEC chain of trust using DS records all the way up to the root of DNS.

If I get back a signed record for www.example.com (meaning an RRSIG), my DNS resolver is going to validate the signatures back up to the root of DNS.

If the signatures don't validate, it's going to give me a SERVFAIL and prevent me from going to whatever site I'm trying to get to.

If the NSA/GCHQ/whomever wanted to redirect me to another site under their control, they could try to send me the record with a valid RRSIG from their own DNSKEY. My resolver is now going to go to .COM (for example.com) and pull the DS record for "example.com". If the DNSKEY and DS don't match, I'm going to get a SERVFAIL and won't get to the site.

Now, the attacker could try to send me their own DS record for the .COM domain... but that's going to be signed by the .COM's DNSKEY ... which again I suppose the attacker could try to send me a substitute.

But now my resolver is going to pull a DS record from the root of DNS for the .COM TLD. That DS record will be signed with the DNSKEY of the root. My resolver is going to validate that signed DS record and compare it with the DNSKEY for .COM. If they don't match, I'm going to get a SERVFAIL.

Now I guess in theory the attacker could try to send me a DS record for the .COM TLD that is signed by their own key... but here's the thing - my local resolver is already pre-loaded with the public key of the root zone as the trust anchor. So it's not going to trust anyone else's records that purport to be the root zone if the signatures don't match the local trust anchor.

So how does the NSA/GCHQ/etc. carry out this attack to redirect me to another site?
No, it doesn't mean anything like that. My point is that people are resentful about government (an entity that is supposed to work for them) gathering their data while at the same time not minding private businesses mining probably even more data -and- providing those data to gods know home many third parties. It's the disproportion of how much people care that surprises me.
I guess if the micro service is using a bunch of shared code from a Laravel project (maybe just interfacing with the database) or if your team is large and already using Laravel, then the first step of optimizing a service into a 'micro service' is to use Lumen. Then step two (if Lumen isn't going fast enough) is to go raw PHP as you described.

But if your service is getting that popular, memory leaks are going to be a problem, maybe moving to HipHop (or whatever it's called now) or Node or something is a better idea.

Sounds like you're having fun!
Then it is wrong for albert to say he knows the answer.
> I'd say about point #9 is that DNSSEC is exactly a less broken CA system.

I'd say DNSSEC is more broken than the current CA system. At least with the current system you can more or less choose a CA to trust (or, more interestingly, a bunch of CAs), that you can change anytime you want. The only thing preventing you to do it is the lack of tools to actually do it, which is why tools such as TACK/HPKP, or Convergence/Perspectives, are needed.

With DNSSEC, there is only one realistic root ever possible (call it ICANN or NSA as you want, that's yet another problem)
This article is terrible, but the original article has been pulled off the local news site. It wasn't on someone's Wall, it was in a message to his friend.
Apple Acquires Israeli Camera Tech Company LinX Imaging for ~$20M
Phantom Cyber Lands $2.7M Seed Round to Automate Cybersecurity
Is there any support for type providers or code completion for F# in LinqPad? I was (mistakenly) under the impression that F# wasn't supported, so spent most of my time inside of VS and Xamarin Studio for the goodness of type provider intellisense.
I've just created an issue [1] in our FrameworkBenchmarks project to solicit an implementation of our tests on Lumen. If anyone here is willing to contribute such an implementation, it would be greatly appreciated. The promise of performance caught my eye!

Incidentally, Round 10 is arriving soon.

[1] https://github.com/TechEmpower/FrameworkBenchmarks/issues/15...
> Except that it incentivises a company to build a product that requires continuing support.

People say this a lot, but in our case we really haven't seen this incentive for a couple of reasons.

Large organizations are more than happy to pay for training and development support to accelerate their time to market. It doesn't matter how polished your product is -- databases are complex enough that people are willing to pay for best practices, training, and support.

Similarly, databases are pretty critical pieces of the infrastructure. If anything goes wrong, it can significantly impact the business, so people always want operational/production support.

There are many enterprise services that can be built on top of the product that can be very valuable. You don't have to build a crappy product -- there are plenty of ways to monetize with a great product.

Finally, a bad product will significantly limit growth of the company in the long term. There are lots of options now -- you can't get away with building a crappy product and an artificial monopoly.

If you see a crappy product from a company that offers subscription support, it's probably not because of misaligned incentives. Building databases is really hard, I don't think the business model has much to do with it.
Keyczar is meant to solve a different problem. It’s meant to be a simple programmatic API for crypto operations, while being high-level and excluding unsafe options. NaCl (http://nacl.cr.yp.to/) has similar goals to Keyczar.

Keywhiz isn’t an interface for software to do crypto. Rather, it’s a system to manage the secrets/keys used for crypto and making them available to the services that need them. It doesn’t explicitly look at the content of secrets, unless a plugin is used.
please read last comment!

We're not really Quora-sized (4 founders - 25yo).
That would give you security against different threats.

I chose a custom cipher for 2 reasons:

1. It gives some security even when assuming that all publicly known ciphers are broken.

2. It works specifically by using a custom cipher which is normally considered bad and thus makes the results unintuitive.

I think that makes it interesting.
A 3D-Printed, Battery-Powered Rocket Engine
Could you suggest a pull request in docs? (https://github.com/rethinkdb/docs)
Primary 5 maths question goes viral, stumps adults
Yes! No ETA yet, but we're on it.
How is equity divided among the members of a team? There are many ways it could be but unless it is discussed - and agreed to - up-front, if a successful business results, or perhaps if lots of debts result, so will lawsuits.

By contrast I greatly enjoyed MacHack. It saddens me that it's not held anymore. Most people work on their own things, as individuals. The prize is an "A-Trap". It's a type of rat trap; the A-Trap was chosen because Mac OS System and Toolbox calls were implement as "A-Line Exceptions", that is, an illegal instruction, the first byte of which was 0xA.

The objective of MacHack was to hack the system in some clever way; it wasn't to start a business. It was to have fun.
Yes there is always a balance of concerns. Build management with 3rd party deps is not trivial but its part of the lifecycle. In my experience boost integration really is "a day" on windows (including stashing the .libs as their own repo and reproducing a fresh 'git clone' build), and 10 minutes on a platform that you can use the package manager to obtain it. You can always excise it from a project later if you dont abuse 'using' statements. FWIW, I only really use variant and ASIO.

If you were adding boost to a project just to do some weird spirit/preprocessor hacks, I'd be wary. But if you told me you were going to write yet another cross platform ASIO wrapper because you couldn't figure out how to compile boost I'd be even more concerned.
As someone who has recently gotten super interested in soldering and other DIY matters, I would too love to have a central hub for news and relevant stuff in this subject… :)
You're totally right! Thanks for the update.
It's a bit pointless to argue for or against DNSSEC. It exists, and if you are fishing for larger customers in the hosting business, you already have had to relate to that. It is, for better or for worse, infrastructure.

You can have informed opinions on how to change it, just like you can argue for changes in the TLS protocol to extend it or modernize the crypographic primitives. But a fundamentally different protocol would need a clean start, and would need to offer enough advantages to get people to switch. These global systems takes a decade to change, at best, and it can be done. While I would love for both TLS, IPsec and DNSSEC to have been designed differently from the start (i.e. without X509), that's not where we are today.

As for the basic idea, it is wise to ask yourself: Would it be useful for registrars to prove domain ownership cryptographically? If you think that could be put to good use, you will understand the basic premise and what the protocol was designed for.
The smaller they are, the less hard they fall.
Also: I knew there were goose barnacles; never heard of barnacle geese before, though.
The Starbucks logo is alive
A key detail that seems to be missed by this article: these are three types as a subset of hackathons. Not all have to be that way, and many are not.
Drupal 8 is based on Symfony -- things are really moving in the right direction.

Personally, I was a huge fan of Zend Framework + Doctrine, but these frameworks are all mature and great to use.... almost as good as Rails (lol, OK, OK, don't mention Ruby within earshot of PHP fans ;)

[edit] down voted for my opinion! Argh my tiny karma is depleted -- damn you ruby, damn you to hell!
Ooh, swing and a miss. Bluebird is not a streams replacement, streams 3 IS the built-in streams. Maybe save the snark for situations where you actually have a clue.
Also, you can throw a mouse out of an airplane and it can walk (scamper) away from the impact.

It's the surface-area to volume (weight) ratio. Small things have a higher surface-area-to-weight, and therefore lower terminal velocity than big things.

There are lots of scaling effects which seem counter intuitive.
Wait are you telling me there are special classes of inputs that are unsafe to encrypt using the standard algorithms?

This sounds scary and please tell me more. In particular what happens in the pathological case where the input consists of 32/64/128/256 bit blocks, and in each block all bits are zero except the last one which may be one or zero?
Hillary Clinton's millions of fake social media followers
Command-line network speed testing
I don't understand the point you're trying to make. In this case, you're talking about a zone (COM) the USG explicitly controls. They don't need to spoof the delegation from the root to COM, or the anchor key for the root itself.
There is an official spec here: http://rethinkdb.com/docs/writing-drivers/ Not quite TS, but it's well defined and new releases of the spec are carefully managed.
If it truly is a factually incorrect article, why did you even post it, especially when it seems to have absolutely nothing to do with what you said?
>tries to play chess

Go ahead and play chess for fun, certainly, and you might become one of those grandmasters eventually, it's just that you shouldn't be betting people's privacy and potentially safety on the proposition that you already are one when you start.
If your Internet-enabled device doesn't have a DNSSEC-validating resolver (with solid trust anchors for the root zone), then this entire conversation is irrelevant.

If your Internet-enable device does have a DNSSEC-validating resolver either on the device or within an acceptable zone or risk[1] then the chain of trust back up to the root zone of DNS will mean that I will notice a substitution and get a SERVFAIL. It may mean that the attacker could DoS me and prevent me from going to a site, but I don't see where I would wind up on the bogus site.

[1] For example, I have a DNSSEC-validating resolver on the edge of my home network. Yes, an attacker could still compromise my home network and send me forged responses. I consider that less likely and am willing to take that risk.
And to the extent that such a statement is used to empower people to take action, I support it. Still, imho, it's not helpful to further entrench the gender binary with a narrative about men keeping women from their potential and women having to fend for themselves to get what their due.
Well, if we are putting forth other languages, here's Perl 6:

sub pmap(Code $func, @items) {
return await @items.map: {
start { $func($_) }
}
}
I'm not sure if censoring "google" out of the tag is even worth it, considering how recognizable that url is :)
What I Wish I Knew About My Career When I Was 21
Taking Netflix’s Vector (Performance Monitoring Tool) for a Spin
Again you're missing my point. I don't care if it's a viable business, I want to hack on something for the sake of hacking.

> You don't actually have to make the product beyond the prototype stage

But I want to, that's the whole point! Obviously you can pitch anything. I don't want to.

What you're describing is as perfectly valid '-thon' but it's not, at least in my mind and the mind of the author, a good hackathon. (For the avoidance of doubt I'm not talking specifically about SW whatever that is, but in general).

I guess what I'm yearning for is a return to the demoscene days :)
Heh, I might use this in EarthSiege 2 when I manage to crack the compression algorithm used there... thanks for the idea!
"Secure" against what threat model? If your threat model is a passive eavesdropper that simply reads the contents on the wire, but cannot actively change things or impersonate as another hostname, it will be secure.

While this attacker is too weak for most security use cases, it will cover many forms of passive mass surveillance by ISPs and governments, so it is quite valuable in that sense.
Have you been measuring the server load of this at all since this thread has been open? Very curious as to what that looks like.
Tokutek (TokuMX/TokuDB) Acquired by Percona
i use evernote a lot for bookmarking (often saving only urls, or whole articles), bookmarking with the browser tends to be a black hole for me too, as others said.
with evernote i can assign tags to the bookmarked item, so i can find related things better later on.
Understood! I'd looked at Keyczar in the past as a component of a system to manage secrets/keys, but I see it's actually providing about 0% of what Keywhiz does.
http://reddit.com/r/DIY
Why do many exception messages not contain useful details?
WEDG Privacy Project in Legal-limbo [pdf]
> One point I disagree with in the article is that cash prizes are harmful. I just don't see evidence of that—prizes at university hackathons have been getting bigger and bigger (tens of thousands of dollars) but it seems like the technical sophistication of hacks continues to rise. So long as you have good judges (ie. hackers, not marketers), large prizes just provide an awesome reward for awesome hacks.

I think the point of "avoid big cash prizes" rule in the article was to foster inter-team collaboration and minimize competition. It's a good goal. On one hackaton I attended where prizes were cool but not that big (items worth less than $1k each) it was not uncommon to see people spending some time talking to other teams, helping them set up, solve some obstacle they encountered or just playtesting their project.

Competition creates a bad atmosphere and it's better to reduce it to minimum. It's much more fun to care about maximizing the amount of cool projects being created than just fighting for the top spot.
Eh I still dont understand how you can arrive at july 16. Albert knows the month and bernard knows the answer. How would the outside observer know for sure?
The difference is not in the complexity of the code, but the magnitude of the attack. You would need to subvert every DNS request from a certain client, for the duration of the TTL of all signature points. (Exactly how much harder it is depends on the circumstances, but a travelling target would be even harder than a well known stationary one, even if you control large parts of Internet infrastructure and is willing to use it.)

But that's not the point. The only point is that between it and the SSL CA infrastructure, the latter is the one NSA has more control over and a much easier time generating certificates for, so the labelling the former "NSA controlled" is slightly disingenious.
Which project reuses laravel components?
Have loved the idea of 'lifecasting' since the very begining.
From Jennicam to Justin Kan's original JTV (and iJustine rocking on the same platform.) to Frank Taylor who is still broadcasting for many years over at: http://franktaylorslifecast.com/

There was also the oft forgotten Control.TV which Seth Green was a part of. The show focused on one guy living in a house completely rigged with cameras who's day to day activities were decided by the viewers. Almost everything was sponsored, so he would eat Snickers bars all the time, drive a Ford, etc.
Of everything, control.tv was my favorite and I'm still looking for something to replace it.

Alas, I dont think Periscope OR meerkat will be that thing.
Core.Logic or prolog ftw
I might have missed something here, but I think your explanation for the second "instruction" isn't exactly valid.

# now B knows-- cut dup days

You're not removing duplicate days. You're removing months that contained "days occurring once".

Because A knows: B doesn't know. Which means A knows it's not on May and June -the only months containing "days occurring once.

I solved it this way (in my head).

#MONTH doesn't know and knows DAY doesn't know

Remove "all days occurring once"

Remove "months that contained single occurrence days"

#DAY didn't know, but knows now.

Remove "duplicate days"

#MONTH knows now.

Remove "Months with more than 1 day"

Leaving July 16. :-)
Would it have worked if it just provided a sessionID to each request that could be matched on the backend to account number and such for their analytics?
"given the game's age, I expected the 3D format to be quite simple and straight forward." lolz :)
Logic questions are about as far from aha! as you can get. Next you'll be telling me that FizzBuzz is an aha! question. Sure, for some people it is, because they don't have a clue. Others are able to solve it systematically, and these are the candidates you're looking for.

The same holds for the logic puzzle in the OP. You can solve it step by step, without any leaps. The main difficulty is getting over the initial intellectual "flinch", and making yourself actually engage with the problem. IMO that's an important skill for developers to have.
Awesome. Will try it soon. What would HN readers recommendfor near zero latency audio only? Our client needs to connect two devices within a LAN (no throughput issue) but near zero latency. We have tried Twilio PSTN, other webrtc technologies but they all have noticeable (half a second) delay from device to device. Any thoughts?
> Have you seen sample code using a JSON API?

Of course.

> Yeah, but have you seen sample code using a json API.... * IN GO!?!? *

(mindblown)

http://i.huffpost.com/gen/1025913/images/o-JON-STEWART-WEED-...
Another good one for testing distributed systems/databases is blockade: http://blockade.readthedocs.org/en/latest/
> some people just have so much self-entitlement on something that is free

Self-entitlement would be expecting personal customer support. Finding out the firmware is buggy BY DESIGN is reason would seem to be a perfectly good reason to dismiss the firmware.
I wouldn't call this a math problem but rather a logic problem.
https://news.ycombinator.com/item?id=9375643
> "Rozenblit and Keil (2002) have demonstrated that people tend to be overconfident in how well they understand how everyday objects, such as toilets [...]"

I'd be really interested to see what misconceptions people had about flush toilets, but Rozenblit and Keil's paper doesn't seem to really expand on this. (Assuming I found the right paper: http://www.yale.edu/cogdevlab/aarticles/IOED%20proofs.pdf%20... ?)

I've personally assembled and installed a toilet so I am confident that I have an accurate view of how toilets work, but that experience wasn't exactly illuminating; I already knew how they worked. Toilets are pretty simple, anyone who has ever opened the tank of one and looked at it for a minute or two probably has it figured out.

Edit: When other questions from that study include things like " How the liver removes toxins from blood", I don't doubt that they found an overall trend, but it bothers me that a paper like that could include mention of asking questions about toilets, not actually say what people got wrong about toilets, and then because of that paper it is taken as truth that people don't know how toilets work.
I remember Gherkin (Cucumber for Ruby) had this!
It does beat having a ton of assertions.
Smart Data Governance
Can you be more specific on the original promise MongoDB didn't fulfill?
Yes, agreed. However it seems more likely a company funded by In-Q-Tel would cave to government pressure sooner than another. If a government entity directly funds you, then you do what it says or you may lose the funding. If I'm a security conscious consumer I would opt to skip the unnecessary risk of signing up for a security company on government payroll.
People who don't know much about programming, let alone computer security, doing the hiring. They can't write an attractive job description. They probably don't offer enough money. And, they probably are unable to identify the good candidates reliably even if they do show up. This is a cost centre for the business, not a revenue centre, so it probably will never get the attention it deserves.
This is another name for "design by committee".

The best systems are designed by one hacker working alone, or a small team who share the same vision. (Or if they don't, then the system only reflects a small number of visions integrated into a coherent whole.)

Rather than "take the temperature out of the room", what you want is "go to a different room" (where you can just write code).
This attitude, the illusion that RoR is year zero in software development is the #1 reason why Rails has become toxic for many companies.

Hordes of hipster RoR developers making the same mistakes all over again because they refuse to learn from mistakes already made by others. Turning project after project into an unmanageable mess with a marginal life expectancy because they believe their superior elegant language and one-size-fits-all opinionated framework means they don't have to think about architecture and design.

In all my years I've never seen a developer movement piss away its initial success so rapidly as the Rails community.
Good article. I’m planning to write about conflicts in product choices soon and will reference this. Given that it’s a common and important issue, I tend to see relatively few articles on contention in teams about code and features (Michael Lopp a.k.a Rands in Repose does cover this topic in his writings.) For me it’s one of the most emotional and cognitively intense parts of working on digital products, and requires seriously engaging one’s analytical and communication skills.
I don't like problems like this, for me it's just brute forcing: you first eliminate the dates that would have given Albert a chance to know Cheryl's birthday (the dates whose months have a unique day in the list), given that you eliminate the other dates that would allow Bernard to know the birthday, and finally you keep the date that allow Albert to know. It doesn't require any smart thinking at all.
SpaceX Dragon CRS-6 Launch Webcast