skysight-inc/HackerNews huggingface dataset:
YouTube - 命中注定我愛你Fated to Love You MV - Let go of Love
So, for hardware manufacturers, is there any reliable way to identify good quality caps?
Direct mail is far from "throw it against the wall and see what sticks", and of course it works. Marketeers aren't generally inclined to waste money. They generally do trial mailings and if they don't see results (measured financially vs. cost of mailing) they stop doing mailings.

Certain things are bulk mailed to an extremely large group of people, but this isn't always true. Targeting also does not have to be nonexistent. For example, you could go buy this list at ListSource (http://www.listsource.com/) for about $50:

All the people that live in the Bay Area that live in and own a 3 bedroom condo in a building that has more than 20 units that cost above $500,000 and was refinanced in the last 3 years.

You just can't get that with online targeting, and sometimes when search volume is low or CPCs are high this method becomes much more effective than online advertising.
"On odd-numbered days people accuse companies the size of Microsoft of being stodgy, plodding, and bureaucratic, unable to ship anything in less than five years because of all the meetings and safeguards and red tape."

There's a Chinese idiom for organizations like Microsoft: "The Big Tree Catches The Wind." Because of their size and history, the company gets called on things that smaller companies never do.

And yes, kudos to them for farming out the job to someone else, and giving the contractor to do work without constant handholding.

But shame on them for not catching this blatant ripoff of a well-known competitor before launching this to the PRC market. The Plurk clone is not something the legal team should have triple-checked. It's something the China microblog product manager should have spotted on when mockups and specs were passed around.
Having lived through the dotcom bubble, I know very well the terrible danger of runaway popularity. For a while Facebook was positively awash in Kool-Aid -- remember when they were going to be the next Microsoft and every application in the world was going to run primarily on their platform?

That's dangerous. The problem with bubbles is that they distort your view of reality. You do crazy things, like build out a big company with big infrastructure that is out of proportion to your primary use case. Or chase other people's business models instead of your own because you become addicted to the glare of the relentlessly-moving spotlight.

If, indeed, Facebook can't provide privacy while staying in business, that's a very exciting piece of business news. It means that somebody else -- one site, two sites, hundreds of sites, perhaps something that doesn't look like a site at all -- is going to inherit Facebook's use case, the one that built their business: socializing with a select group of friends without excessive privacy concerns. [1]

To work, fellow nerds!

---

[1] Yeah, I know, little or nothing that you type can ever be guaranteed to be truly private. Digital data is too hard to hide and too easy to spread. I strive not to type anything that would kill me if it were cited all over the place. But there's value in the difference between "something that a private detective or a spy can learn without too much work" and "something that the Googlebot will index seconds after you write it". And that value is going to be worth money to someone, even if Facebook is tempted or compelled to turn away from it.
Consider the other side. (These are all things that happened before I arrived.)

Vendor comes in and says, "yes, our software can do it." Then, everyone finds out that it can't. In comes some expensive customization that doesn't quite work right, but everyone has figured out how to work around it well enough. The company is using the database behind the scenes to provide the functionality we need. As such, it's massive heartache to even think about 5 years of upgrades.

However, a fatal error comes up that can't be worked around because of the custom work done by the vendor at implementation time. We need a patch to the executable. However, the idea of just moving up to the new version has everyone here in a cold sweat. Our peers tell us the product has gotten worse than better. It's a 9 month implementation effort, with new training, new workarounds for the bugs, new everything.

You still have the code. You're telling me a simple patch is unfeasible?

This is a very common problem in consultingware. I've seen variations on the theme from both sides of the fence.
At most, this device seems trustworthy exactly to the extent that you trust that hardware hasn't been tampered with. Since there's very little information about how the tamper-proofing works, I tend towards skepticism.

At worst, they've implemented a cryptosystem that, having never been peer reviewed, is vulnerable to basic attacks. Since I can't find out who the authors are, and they use both AES and Serpent with listed key sizes instead of talking about how the design works, I tend towards skepticism.

Finally, I'm with everyone else wondering why deniability is something the market cares about.
You could say the same thing about online advertising though. Sure, some people waste money, but the bulk of people get value for the money they are spending or it would not continue to exist.
The important customers are always the ones who pay the bills, in this case that'd be the advertisers, not the users. This should be obvious, without being able to pay the bills there is no service at all.
Von Ahn just has teaching envy for Randy:

http://www.thelastlecture.com/

Although I never took a class with either, I was at the Last Lecture and went to the Entertainment Technology Center (the program Randy built with Don Marinelli). Every time I saw Von Ahn speak he did not hold a candle to what I saw Randy do.
> Any system that does local attestation can be opted in to a remote attestation scheme.

The very essence of remote attestation is that a digital policeman (a presumably tamper-resistant piece of hardware which cannot be seperated from your computer) pronounces that certain streams of bits which come out of your machine are "blessed," while others are not. All kinds of people (content oligopolies, politicians, etc.) are unhappy that your modem is currently incapable of ratting out your misbehavior. Remote attestation is nothing else than an attempt to correct this "problem."

The very word "trusted" in the phrase "trusted computing" is a bold-faced lie. I would like to think that you have been duped into actually believing it, rather than spreading it knowingly.

The implication is that I, as a user, ought to trust a "trusted" computer more than the one I presently own. The reality is quite different. The only thing a "trusted" computer is trusted (by its makers) to do is to betray me - to disobey my orders to display or flip certain bits, in the interest of serving a hostile third party.
The difference is that you would only have the data plan and your voice calls would go over the data network, and not the call network (IIRC, they use different bands to transmit/receive). So these people would immediately be 'high bandwidth users.'
Thank you.

I will tell my friend to try communication with the other admins.

Kind regards

Adam Żochowski
As long as I have the ability to completely remove Google's version of Android, and put on a custom version of my own, I'm not that concerned with the rest.
Actually I am in favor of this article being on HN. Treacherous Computing is brewing, and will be served in generous helpings to all of us, whether we ask for it or not.

Know thy enemy.
What if they charged each user $1 per month? I would pay that if it means I don't have to worry about my communication, photos, etc. being resold to others.
I'm convinced that if I asked you questions about a real-world remote attestation system, you wouldn't be able to answer them. Suffice it to say that unless you consider yourself the "digital police" or you'll only ever own one computer, the "very essence" of remote attestation is nothing of the source.
This got me thinking: it'd be nice if there were something like sharespost for startups at the seed stage. For instance, a site where you can post your pitch and sell equity in your startup to raise initial capital. With low enough valuations I'm sure it would attract buyers, especially if there were easy diversification options (kinda like lendingclub has) for buyers.

Is there anything like that?
The Intel TPM is a secret plan to take away compilers from general public. Got it. Actually, after years of having to review code from the general public for security flaws, count me in with the bad guys. Muh-hah-hah-hah! Your computer will be first against the wall, asciilifeform!
At first I thought here's a guy who's name happens to be Lou Reed but holy cow, it's actually the Lou Reed. This app definitely has a velvety feel to it (groan.)
Python, Surprise me
A proposal for error handling
I actually did the same a few hours ago, and just pushed it to GH. You can see mine here: http://github.com/grinich/PastryKit
I don't know why people think businesses are immune from spending money on products and services they don't need or which are ineffective.

They may well continue to make money regardless, or for some other reason than the money they spend on direct marketing (or on online advertising, for that matter).

What we need are some serious studies published in peer reviewed journals that prove that direct marketing works, not claims that if it didn't work businesses wouldn't spend money on it.
They're not "blobs" if they are also protobuf/thrift messages themselves.
I wonder if I can pull you closer to my side of the middle by suggesting that it's reasonable for Apple to select for the 5th Generation iPhone engineers who are willing to undergo much more intrusive monitoring, especially if they are compensated for that.

Incidentally: drug testing is something you and I could bitch together about way into the night.
Here's the django-dev thread:

http://groups.google.com/group/django-developers/browse_thre...

Eventually they wrote an adapter; I don't have any idea how they got the API spec, since they swore up and down they couldn't look at existing code.

(and, to be honest, the initial released version of their DB2 adapter showed some serious issues which may be related to not understanding how the code was supposed to work)
> If you can protect a computer from a virus, you can protect it from a DVD ripper.

The antivirus vendors, champions of "Enumerating Badness", (http://tinyurl.com/8a2uk) would like us to think so.

Yet it is pure nonsense. It is much the same as saying that if a house is safe against burglars, it must also be "safe" against the owner engaging in officially forbidden sex acts in the master bedroom.
Also, does anyone else think that this accredited investor stuff is BS? Why is it darn-near-impossible to invest in private companies unless you have $1mil?
I'm really interested in the LLVM backend! Probably my favourite part of this release.

Also make sure you check out MonoDevelop's feature matrix. I'm currently at work and wanted to try out the Python support but found out it's not supported on Windows:

http://monodevelop.com/Download/What%27s_new_in_MonoDevelop_...
The trouble with not being real-time
Marcus Ranum also believes that closing holes in Linux is "enumerating badness", and counts as one of the "dumbest ideas in security".

Since you didn't make an argument that refered to any technical detail of the antivirus/antimalware problem on general purpose operating systems, I'm content simply to point out that your sources are both comical and non authoritative. Also: let me strongly encourage you to run your views on computer security past Ranum, and report back his response. Warn me first so I can get a get a cold glass of milk to blast out my nose when you do.
Saving Arrays, Hashes, and Other Objects In Text Columns Using Active Record
This is a very popular essay which tends to get posted around the web quite often.

Yet it suffers from many not-so-obvious flaws, as analyzed in the popular linguistics blog "Language Log." The commentary is written in a calmly analytical style (interspersed with some judicious jibes) that I think many YC.HN readers will find rather agreeable ("a beautifully written language crime, though it pretends to lay down the law") ---

http://languagelog.ldc.upenn.edu/nll/?p=992

The entire 'Prescriptivist Poppycock' category at Language Log is generally good reading:
http://languagelog.ldc.upenn.edu/nll/?cat=5
ISkysoft Video Converter for Mac,best Mac Video Converter
How do you figure? The sex video didn't get stolen directly off the tape; the real vulnerabilities are later in the chain of custody.
You mean: unless there's some physical way to determine the recency and timing of writes to the storage media.
Do tell, then, how a remote attestation system differs from my computer at present - other than the fact that under it, I would have less control over exactly what bits exit my network in response to some query.

If this were about genuine security, there would be no talk of hardware. The hardware component is there to "secure" the system against me, the owner. It may have other advertised purposes, but that is its only essential one. The only one, in fact, which could not be achieved simply by writing properly secure software (start with eschewing Microsoft and anything it has ever touched.)

Any technology which seeks to enter my home encased in tamper-resistant epoxy does not have my best interests in mind. No exceptions.
Test submission - please ignore
I think I found a bug in HN -- I'm just using this post to check it out
Climategate: history's message
IIRC, some minor vulnerabilities to TrueCrypt's DFS were found.

Ah, found one link: http://www.schneier.com/paper-truecrypt-dfs.pdf
Is there any nation that has had aid withheld explicitly because of their violations of DDT use? India shirks WHO regulations like crazy (including but not limited to those pertaining to DDT) but received billions in aid during 90s, before they were a nuclear power. And it certainly hasn't slowed down their position in global trade. Heck, their human slavery problem furrowed lots of brows but never amounted to any sanctions that I'm aware of.

What I'm trying to say here is if the hammer is going to come down on your country, it's likely doing things waaaay worse than revamping its ecosystem with pesticides.
I think you think that you don't haven any control over the contents of a TPM, because you've never read anything technical about them. In your universe, the TPM is a scheme to allow Intel to control your computer, and could never be used to allow a Linux kernel you compiled to sign your trusted known running image of a security VM.

I also think you're a troll, but I'm waiting for IE7 to install on a VM, so I don't mind batting you around a bit.
I am genuinely curious as to how you think this will come to pass.

We are finally seeing commercial PC/laptop vendors selling preloaded Linux and OpenSolaris. One has the freedom to remove the preloaded OS or even the BIOS, and install the programs of one's choice.

So, how do you see this trend being reversed through "trusted computing" to the point that we will all be forced to run Windows and Apple (effectively without the right to use root powers) and proprietary media players from Sony?
Nope, false alarm.
Cacilda, a py wiki powered by Cassandra
hehe...mind if i take a look at the source?
Lying is actually against Facebook's ToS. Just called them out on it here: http://www.techcrunch.com/2009/12/15/facebook-lie-terms-of-s...

I think they're making a lot of mistakes and are going to hurt a lot of users. But ultimately they'll make a lot more money.
I have never heard of Ranum before. He was simply the top Google hit for the well-known phrase "enumerated badness." For all I know, he might also be, say, a Creationist. This is immaterial.

Please make an actual argument, as opposed to trumpeting my supposed ignorance of everything in general terms.

Does your front door lock work by checking a video feed against a database of known burglar mug shots and clicking shut in the event of a match, or by staying locked sans a key?

Security through enumerated badness (as opposed to actual robustness, as in the above example) is Bad. The phrase has a meaning. If you believe that it means something other than what I believe it to mean, please say so.

So far, all of your arguments have been thinly veiled appeals to authority. Please take a moment to think of one which is not. I would like to believe that you have genuine thoughts, and would like to hear them.
I can never keep up with Language Log, and 3 grafs into this I have to say that this post is fantastic, and absolutely justifies the re-re-re-re-post of this essay on HN. Thank you!
Apple recently did something weird with the Cocoa documentation. It seems like the titles of and links to all API docs and user guides are stored on one gigantic page. They then invoke some JavaScript magic to search through the titles of all documentation. The end result is that the page is slow and jerky in Safari, extremely slow and jerky in Firefox and refuses to work properly in Opera.

I wish people stopped using JavaScript to do things it wasn't supposed to do :(

EDIT: Momentum scrolling is delicious. I'm really enjoying this :D
I am concerned not just about my own computer but about the market dynamics of winner-take-all network effects, so I'd like to either prevent these evil programs from being written in the first place (e.g. if PCs never provide attestation then nobody will write apps that require it) or makes evil programs ineffective (e.g. you can download a crack). That's why I don't like "neutral" trusted computing and I'd prefer to find a variant of it that can only be used for good. Maybe this isn't possible though.
Gene Healy: Making criminals out of all Americans
Calculating the "real value" to society of different professions
> I think you think that you don't haven any control over the contents of a TPM

You think wrongly.

The user is permitted to control some, but not all of a TPM's contents.

I have read the publicly available specs of a number of TPM modules. Each contains a portion designed to resist readback and/or modification by the owner. Almost every spec touts the chip's cutting edge tamper-resistance properties. I challenge you to show me a counter-example.
This sounds funny, and well, let's face it, the idea of it is pretty funny, but then I think of the stories female friends used to tell me back in college of creepy old guys that would drive by real slow, fapping away, while they were walking to class, work, home, etc.
Facebook Suggests You Lie, Break Its Own Terms Of Service To Keep Your Privacy
Anything that an OS can use to prove it is running code you've approved, and not code snuck in over the internet, can also be used by a DVD player to prove that is playing video over a protected pathway, and not into a raw video capture program.

To be sure, your OS can make it harder for DVD players to do that. Linux can take advantage of a TPM, but won't provide a protected video path. But that's an argument for Linux over OS X, not an argument against the TPM.
Canine, an easy Ruby "binary" library
What exactly put you off? I mean, it's not the best site I've ever seen, but I hardly had the visceral reaction against it you seem to have experienced.

There's a balance to be struck I think - you can't look too Netscape 4.0 but I'd, if anything, be made suspicious by an obvious focus on marketing bling. I would have thought this site is a little drab but serviceable enough, decently put together, certainly enough to avoid losing credibility.
The problem is that the case might have to be heard in China, whose judiciary system is not something that I can trust.
I think the article's author is missing a key point - there are equally valid reasons for taking 6 weeks. Say, it is company policy and Feedjit is not high-profile enough to warrant going against a policy that errs on the side of caution.

Or it could be the case that, yes, it does take 6 weeks to update the database without doing some kind of emergency, invasive fix. But you know what? If you wanted instantaneous fixes for "obvious" mistakes, you are either going to need a damn good definition of "obvious" and be prepared to still handle complaints when it doesn't work properly, or you are going to need to have some person dedicated to this issue.
I don't personally believe in the "trusted computing apocalypse", but the way it is supposed to play out is that you can run Linux but it just won't be useful. (A cynic might observe that this is no worse than the status quo.) Already you can't legally play DVDs or Blu-rays on Linux and you can't officially access iTunes or Netflix streaming. Extrapolate that to a scenario where you also can't access Facebook or play any multiplayer video game, etc.
Um... As a paranoid person, good web design is going to do nothing to allay my fears. A good track record or independant verification might on the other hand. Also, I like the design.
They're tamper proof to the extent that they can verify their own integrity. They aren't tamper proof to the extent that they can secretly relay your Gmail password back to Portland. The core of the TPM provides a very simple method of verifying memory contents, and enough cryptography to build a remote attestation scheme --- which you could just as easily use to manage 10 of your own machines as Intel could use to secretly control the world's PCs.

The comical part of this argument is that in the TPM-free world, we have basically no privacy, because our computers are all controlled by people with enough time and energy to find secret flaws in the software we run. But hey, everyone's gotta have something to get all crazy about. God bless you. With me, it's how crappy xkcd and BSG are.
I thought the exact same thing! Can't remember if it's James Bond or what not, actually I think it was Ghost in the Shell, but it involved a heist whose detection was prevented by faking a video stream.

My first thought is why isn't there end-to-end digital signing from the camera to the monitor. Sure, you could probably still fake it out by getting into the camera and reading the key from ROM or whatever, but that's a hell of a lot harder than just tapping a cable.
For about 6-9 months in 2006 We had a series of Dell Optiplex GX 270s that had a remarkable failure rate - close to 60% of our systems failed. We knew that Dell must have been having a tough time, when the FIRST question they asked on a support call was whether we saw any "Bulging Capacitors on the Motherboard" - I mean, not "Have you Tried Rebooting", or, "Have you tried powering down for 90 seconds", but "Do you have bulging capacitors."

I'll say this for Dell though - they fixed every last one of those systems within 4 hours of our call.

I have to wonder whether Large Manufacturing organizations are aware that there is a good chance that going with subpar capacitor manufactures will cost them, but do so anyways because of the amount of money they save.
The predictive power of Google data: US Unemployment
Creating a Flash platform game with Flixel and Flex - Jet pack
I couldn't believe he didn't conclude the article talking about Google's Go

It's remarkably close to what he wants. You can currently ignore a return value by assigning it to _ -- all that is needed for his proposal is another token that causes the program to halt if it is assigned non-zero. If they ever allow overloading assignment you could do it yourself!

I don't think they'd spring for the semantics change of allowing assignment to fewer return values.

And backslash as a destructuring operator? Seriously? That's a syntax hair-shirt even beyond PHP's use of it as the namespace operator.
It sounds like this is going to revolutionize the child-porn industry. :P