skysight-inc/HackerNews huggingface dataset:
Really old cars have very simple electronics. Even after computers started showing up in cars, they were pretty simple and didn't interact much with the security aspect of things. When you start a car like this, you're just making a connection between two wires to power up the electronics, and briefly making a connection between another two wires to run the starter motor. The only security in the whole system is provided by the fact that the connection is made by a switch that requires a key to turn it. If you don't have the right key, you can't turn the switch, and that means you can't connect the wires.

The trouble is that the wires must be fairly exposed to the occupants of the car, since the switch has to be accessible. That means you can just bypass the switch entirely by removing the appropriate covers and attacking the wires directly. This is "hotwiring."

Physical locks are also not all that difficult to defeat directly. You can pick an ignition switch much like you might pick any other lock.

Starting around the late 90s or so, car manufacturers started adding more robust security measures. These include things simple like locking the steering column when the ignition switch is off (thus preventing you from driving the car after hotwiring it), all the way up to authenticating the key with a relatively sophisticated protocol, and having the engine computer refuse to run the car unless it can sense a real key.

As a result of these changes, the list of most stolen car models is still topped by cars manufactured in the late 90s. Low-end Hondas from around 1998 are right at the top of the list, because they occupy a sweet spot of being relatively valuable and still fairly easy to steal. Modern cars are stolen literally orders of magnitude less frequently; about 100,000 older Hondas stolen per year in the US, whereas new cars are stolen at a rate of hundreds per model per year at worst. Also as a natural result of these changes, car theft is way down in the US. About 700,000 cars were stolen in the US in 2013, compared to almost 1.7 million in 1991. Pretty much the only way to steal a newer car is to either tow it away or steal the owner's keys. (A common scenario for car thefts is a burglary turned into auto theft when the burglars find car keys in the house.)
While this is probably the right move for users, Facebook OAuth is less and less relevant.

We see a trend across our customer deployments: more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year. Customer preference used to be: 1) Email & Password 2) Facebook. Now it's: 1) Email & Password 2) Google and/or Facebook (tied for 2nd). Other companies in our space (Janrain in particular) have confirmed this.

I bet Facebook knows this and is trying to regain trust. The problem with what they are doing now is that more and more publishers and apps will probably just skip Facebook altogether. The primary reason Facebook was pushed so hard by so many for so long was because of the data provided. Take that away and people may move off the platform entirely.
If a federal site can survive being DDOSed, it can probably survive normal traffic.

And I fundamentally disagree with the premise that there are people who do not deserve privacy. I can not think of a single person I would wish complete exposure of their lives upon.
A Philosopher's Approach to Getting Organized
That's sort of what I was thinking of. I wouldn't say seL4 was written by hand, more cross-compiled in a way they couldn't fully automate, only because they didn't have a Haskell code generator that optimizes well when you don't need laziness or GC.
There is no protected. There's no inheritance anyway.
Rand Paul's Internet Army
In cases where you perform A/B testing it may require a slick interface, whilst still being a POC. In this case I have looked for ways to reduce complexity and ideally any services which require hosting should be clearly hacked together - such that anyone seeing it can give a clear indication that this will not go into production. Choosing to ignore thread-safety and use local in-memory datastores (e.g. non-persistent) will help to not only ship the POC quickly, but also make its temporary nature rapidly apparent.
Aside: Instead of hungarian notation in Rust we do this[0]. Free compile time unit safety :)

[0]: https://blog.mozilla.org/research/2014/06/23/static-checking...
It seems to me that more and more of this comes up as people are moving onto Linux for "cloud services", bringing with them mental models honed on Windows (and to some degree, OSX).
Emoji are the most important WordPress feature in years
Looks very useful, congrats! Cassandra dependency may be an obstacle for wider adoption.

"Don't worry if you are not experienced with these technologies, Kong works out of the box"

These kind of statements are problematic. If you are not already using Cassandra, I'm not sure introducing another data store you don't have experience with would be a good move.
I'd add obviousness here. Make the design and code as obvious as possible. Simple and easy to understand.
They have switched to Disconnect.me as the default search engine. It's hosted by Amazon, in the US. Why did they decide to use it?

Also, the image searches link to Google ("https://www.google.com/url?q=...") whilst saying it's protected. With that said, I prefer the design in comparison to Startpage. But privacy should take priority. Honestly, Startpage could dramatically improve their design just by removing that background image.
Social media analysis suggests links between Baltimore and Ferguson violence
The Colwell paper really is excellent. And given feature sizes of chips today it would be fascinating to see a 432 implemented as envisioned, rather than as possible given transistor counts of the day. It was going to be the microprocessor version of the MULTICs system and much of what it imagined doing in hardware (capabilities) would make for secure environments that you could reason about more effectively. Probably make for a great FPGA project now.
I already posted this link in the epic nope thread that is a sibling to this one, but the paper linked from Wikipedia speaks of an experimental implementation with a return time of 1 ns:

https://en.wikipedia.org/wiki/Distance-bounding_protocol
But how does just reading the synopsis indicate if something is any good? Wouldn't you be better just looking at the IMDB score? Or are you looking out to avoid things with 'dumb' endings?
FWIW in Rust "Can you access the object? Then it exists!" is true too, however you have to wait for the compiler to reach a certain point to know that you indeed were allowed to access it[1], whereas in Go you can figure this out by looking at the code :)

[1]Or internalize the borrow checker, which is something which eventually, automatically happens to all Rust programmers AFAICT. It actually spills out into other programming languages too so you get a nice involuntary mental tool to ensure safety in C++ :)
Nintendo's Wii-U misunderstands what made the Wii a success
I wrote
> 380 such events have happened so far this year

You took that to mean that they were all identical in every way. I wrote it to mean that cops are killing people all the time and it only gets national news when it is a white cop killing a black person, because the media knows that plays very well.

I did take the time to show to you that there are practically identical cases (which you ignored) and that the ones causing riots are not special snowflakes but selected to foment a reaction.

So I have submitted my case, argument, supporting evidence, and a clearer explanation of my points -- you have presented nothing but vitriol.

I can see from your responses that you were not interested in an answer, just to be argumentative for some unknown reason. Fair enough.
Collection Pipelines – The Revenge of C
A spherical panorama GoPro mount for 6 cameras
> Honda doesn't get a cut if I have my car modded at an independent shop.

Not yet at least. However car (and tractor) manufacturers are moving to make such activity illegal using encryption and intellectual propertly laws.

I'm not saying this is a good thing, just that our current regulatory regime supports this model.
thanks; fixed!
Wouldn't that make it Pond Michigan?
That's a great ideal, and I wish them success. I'm more pragmatic. Raids are life-changing experiences, even if nobody gets killed, or ends up in prison. And where I live, freedom to legally run Tor exit nodes is limited, with poor prospects of increasing.

I am not recommending the use of compromised servers. I'm recommending anonymous leasing from legitimate providers, which are located in jurisdictions that are unlikely to freely cooperate with your home jurisdiction. Ideally you run Tor-ramdisk, and store the node's credentials in another anonymous server, so there are no logs.

This is rather like preemptively not talking to police except through your attorney.
Google+ Communities have a lot of the features you're asking for. It's not a perfect fit, but it gets you far closer than other tools I can think of.

Along with Google Drive for data publishing.
> I don't see how the idea that Steam should get a share approaching 30% is any less repugnant than that.

If you don't understand they 30% is reasonable, then you haven't tried to sell a game in the last 5 years.

That 30% you're paying increases your sales by a factor of 50x, and game developers are quite happy to take 70% of a much larger pie.
> "Vault is the sixth such tool we've built. We've also built Vagrant, Packer, Serf, Consul, and Terraform. "

Sigh.

This is the first time that I actually feel overwhelmed. That nagging feeling that I'm doing something in some way solely because of habits. And that someone somewhere has created an awesome tool that would have allowed me to go home two hours earlier.

The amount of new tools cropping in the last couple of years alone is the 'culprit'.

These are awesome times, of course. Still, a part of my brain misses the time where you could ftp crap away to a server (even if automated by a Capistrano tool or similar) and spend the rest of the time arguing about the merits of puppet vs chef.
And on a related note, congratulations to Matei Zaharia for winning the ACM Best Dissertation Award for his work on Spark: http://awards.acm.org/doctoral_dissertation/
>Curtis Green was at home, greeting the morning with 64 ounces of Coca-Cola and powdered mini doughnuts. Fingers frosted synthetic white[...]

>Green waddled to the door, his two Chihuahuas, Max and Sammy, following attentively.

How do the authors know any of these (useless) details? They weren't there. Is this a factual recount or fiction?

I hate it when these failed novelists try to make a run-of-the-mill story sound like an Hollywood movie. Next time, just stick to the facts and save me a couple of pointless pages of unsubstantiated claims. Is is that hard to do?
You can't charge based on the modder's intent. If a mod was made out of love vs. money grab is irrelevant. If people want to pay for it the question is how much money should the modder get?

You're saying the 25% is a raw deal. Maybe it is, but that's the mass-market deal. If you're mod is awesome, then maybe the publisher is willing to buy it or pay for it. Counter Strike was a mod that Valve bought and made into a standalone game. If it is shitty, well then you get the mass-market deal or nothing. Everything is a negotiation. If you think the company is treating you like shit, then don't do free work for them that they didn't ask for.
from your link:

> The term "Hispanic" broadly refers to the culture, peoples, or nations with a historical link to Spain.

I guess that was what I was getting at, but I do take your point that it is not as cut-and-dry as my short remark made it seem. So today I have learned something new to me.
That's pretty sweet, I'll remember that trick. The `range` trick was another one that took me some time to realize, there are lots of neat sugary things in Go like this :)

> I think it's less that folks prefer run-time checks on principle than that they simply don't yet have in hand great ways to strengthen compile-time safety while meeting their other goals

Agreed, that sentence was a bit unclear from me. I did mean that they're okay with losing compile time safety over other benefits.

> All in I love this--I tire a bit of posts that are like "I wrote a toy program [or not even that]; here's Why Everyone Else Is Wrong" (because anyone could give an opinion that informed given a day or two, and hot takes are getting old). But it's cool to see someone who, by virtue of working on Rust (and seeing it evolve) has unusual perspective on tradeoffs and seems to have written, you know, pretty thoughtfully and maturely about them.

Aww, thanks :D
Are there any plans to abstract out the datastore or make it pluggable. For example, we can replace cassandra with rethink-db or leveldb
Ah yeah, I'd like that more as well because I really like driving without ever taking the keys out of my pocket :P I was mostly clarifying for the person you responded to.

Although from what I was seeing in the rest of the thread it seemed that preventing relaying may be more difficult than expected (as most methods relied on timing the signal response). I don't expect it to be impossible though.
Or just architecting something in general. This talk [1] proposes a way to approach application architecture that will result in the programmers writing their own monads (or rather, their own FREE monads)

[1] video: https://www.parleys.com/tutorial/composable-application-arch... | slides: https://dl.dropboxusercontent.com/u/4588997/ReasonablyPriced...
Haptic Gloves Use Air Pressure to Simulate the Feel of Virtual Objects
>> I am afraid I might be hurting the system

Seriously?

Just buy one guy's smile for a dollar and move on. No harm to the system is done.
So it isn't clear that you are donating towards carbon offsets ? Thanks for the feedback and will incorporate.
How the Company-Startup Thing Worked Out for Me, Year 3
It dropped in rank because users flagged it.
Your claims about aspartame's safety are not correct, and do not lend confidence to your argument about GMOs.

A quick search on google scholar found dozens of articles like this that suggest problems linked to aspartame use:

http://m.ajcn.nutrition.org/content/96/6/1249.full

The jury is still out, but it's not correct to say that aspartame has been proven conclusively safe.
> The most obvious example is that you don't want to bog down your countrys civil defence agency with SSL/TLS protocol negotiations, if their website is being deluged by people trying to survive a natural disaster.

If TLS overhead is the last straw that brings down a web site, the site's infrastructure isn't suitable for delivering safety-critical information.
It should also be noted that Facebook is going to app-specific IDs, which means that App A from company A can't share data with App B from company B, and the app-specific ID isn't your primary Facebook identifier.

There is a Business Mapping API that lets different Facebook apps from the same company share data, and theoretically Company A and Company B could collaborate on that.
I think we're going the same direction. The investment is less before you have to change. If you spend 6 months gathering requirements that are obsolete (or wrong for unanticipated reasons) before they're finished, you've lost 6 months. Working in an iterative process ("Is this what you want?", "No, how about this?", "Or this?") reflects the reality that requirements change sometimes for external reasons, and sometimes because people don't know what you want.

Agile also shouldn't be an excuse not to document. My (perhaps not fully informed) view is that it's more about iteration.
File parsing is a pretty hard problem. Let's take for example a Microsoft .exe file. They all start with the string MZ. However, saying something is an executable file is just the start of the rabbit hole. Is it purely a DOS executable, or is it a windows PE executable? Or is it an OS/2 LE executable, or is it a wrapper around a COFF file created by DJGPP? Okay, now, we know it's a PE file. Is this PE file actually a self extracting archive file created by PKZIP? Or maybe RAR? All of those are also things which have definite headers and offsets that you have to look to, and which the file utility needs to know how to look for, and where things can quickly get complicated.
When I was in graduate school, we did studies on human-robot interaction. Users very quickly moved from "tool" to "partner" with their robots. They even held funerals.
Re: Go errors for unused imports

> This rules out some workflows where I partially finish the code and check if it compiles.

Sounds like a great job for an IDE to automatically add/remove the appropriate imports for standard library stuff.
there is liteide already which does exactly that (right click on a symbol refactor->rename symbol under cursor)
Ketchapp stole my iPhone game
We used to have `#![deny(unused)]` in Servo, and it was quite annoying. Especially because a compile takes a while and the lints run mid-compile (after type/borrow check but before the llvm stuff). Quite annoying, eventually we turned it off. But it wasn't so bad; because when writing Rust code there's more fixing of type/borrow errors and less waiting for a full compile and running tests; since most of the "correctness" is encoded in the types used.
The Little Traverse Bay is a true treasure, and yes, when I was on it two summers ago, it was crystal clear every day.
Yes and no. For a mod that is essentially changing some variables in order to change some of the gameplay, yes.

However, if you create a mod that changes all of the game sounds, using your own recordings, why should most of the profit go to the game company?

If you create a mod that completely overhaul the shader system, why should the game company get the most of the profit?

If you create a mod that makes all of a game's textures HD, using your own textures, why should the game company get most of the profit?

If you create a mod that patches all the remaining glitches and bugs of a no longer supported game, why should the game company get most of the profit?

Those people are already supporting and increasing the games quality. They are pretty much passionate and talented volunteers. Either you don't pay them, or you pay them an honestly. You don't establish a system that allow you to piggy back on their work in order to make profit.
This was a PITA for us, since we had been using App Requests as an invite channel, not snarfing the entire user graph like other sketchy apps do. Then Facebook changed the rules so that you had to be in the Games category to use App Requests -- kind of a strange policy unless you are trying to shut out competitors.

Now there are App Invites which seem open to all apps, but I'm tired of the churn. Already our messaging app is shut out of certain platform features like Audience Network because we are deemed to "duplicate core functionality" (despite having this feature 3 years before they did). I may as well assume the ratchet will tighten even further and diversify, putting minimum effort into Facebook support.
Try designing a system that can't be exploited and must rely on its algorithm's correctness such that only a brute force solution exists.

Few algorithms are correct such that their computational complexity alone is what provides their security. Without a formal proof, an audit and some testimony of experts I will not believe your hand-rolled algorithm is correct.

This is why you rely on proven algorithms and implementations and never roll your own. But you should not believe that using a correct algorithm alone should be enough to deem a system secure.

Its implementation might be exploitable in a way that sidesteps the security provided by your algorithm.

The idea that it might take an attacker five billion years to brute force your cipher text for a solution is nice, but if you're exchanging keys in an insecure way then that security goes right out the window.

Storing your salt on the same DB? Your search time for a solution is cut down since you can grab that as well.

This is why emphasis is placed on tearing apart a system that claims it is secure. Most of the time it isn't, and usually in ways that are easily identifiable.

Having good faith in the developer isn't an ideal when the well-being of many people might be at stake because of claims that cannot be backed up.
Ask HN: Why not show password rules during failed password attempt?
Most of the times my password is same as/a variant of a generic password that I keep on most of the sites. Now usually what happens is that some website has some specific rule for setting passwords like it should be alphanumeric, have one Special character, or a capitalized character etc. Due to this, I end up resetting my password which wouldn't be needed if I was aware of the password rules. Wouldn't it be simply better if websites can simply tell you the password rules in case of failed password attempt. I don't see any security issue with that. Do other HNers face similar problem?
You’re assuming perfect information. Amazon sells plenty of ebooks you can get for free on another site.

Honestly, they could have pulled this off. If they made a new game with the option to sell mods and had some sort of review process doing due diligence that would have been something else. Or even some sort of auto check for conflicts. But, this seemed like a horrible money grab where they wanted to extract 75% of the income without doing anything.
How the Chinese Web Came to Believe the CIA Tried to Assassinate Snowden
I think including a keyfob buzzer would be a hard sell. The whole purpose of these keyless entry systems is convenience and asking buyers to hover over their keyfob like a baby monitor is not convenient (nor cheap).
Medical tools have been home-brewed for decades. The first artificial arteries for cardiac bypass surgery made of Dacron sewn at home on a standard sewing machine. https://www.bcm.edu/about-us/debakey-museum/legacy-of-excell...
Are we all born with perfect pitch?
Many smaller, connected lakes are clear too due to invasive zebra mussels.
Fun ways to split up boring tasks among a dev team
Any body here have any experience with this sort of situation?
Our team of 10 devs supports a legacy monolithic Rails app with almost no test coverage. So, in order to be refactor friendly we decided to write feature tests to cover all of our controller actions. That way we could refactor heavily without breaking or rewriting tests much.
It sounded boring so I decided to make it a bit more fun by gamifying the whole task. We're writing our controller actions onto Post It notes and putting them up on the board where the devs can grab one and when they're done writing tests to cover those actions they can put it in a column under their name. And then in the end, I don't know, free beers.
The challenge with this is that we have lots of controllers. So I wrote this gem to automate the action grouping and print out process. What this gem does is introspect on the app's controllers, grabs all the public actions, counts their lines of code, and then groups them together so that all Post It notes have a roughly equal total lines of code.
So I thought that was neat and wanted to share. Here's the code: https://github.com/DiegoSalazar/post_it_note_actions
What the... JavaScript?
Interesting point about image search. In fact, when I perform a Google image search through disconnect and click on an image I see a record of it on google.com/history (while the search itself is not present).

I suppose its only to be expected once one thinks about your observation that the links are pointing at google.
Is dual-boot not an option? Or... if you're not allowed to do that, you could always use a live-cd or live-usb version of your favorite linux distro. Might run a bit a slower, but maybe a live-usb running off of a SSD drive with a thunderbolt connection would be fast enough.
7 Debugging Tips to Rapidly Improve Your Programming