skysight-inc/HackerNews huggingface dataset:
I live in a place where nothing fresh or natural grows for 7 months of the year, and for most of the other 5 what's fresh is still growing and "not ready yet". The "eat local" movement is therefore directly opposed to eating "fresh and natural". It's not surprising that practically nobody eats local here. Yet, people have lived here for thousands of years.

Nomadic natives hunted buffalo, and you can bet they got sick of pemmican and jerky after a few months of being snowbound. It's no wonder that they considered liver, plucked fresh and warm from the body of a still-quivering kill, to be a delicacy. Settlers subsisted on stored grains and potatoes stored underground. They ate the occasional cow or chicken too and hunted for venison, but meat was not had with every meal. In the first half of the previous century canning techniques allowed them to greatly expand their diet by storing everything they could lay their hands on in the month or two of plenty. In the latter half of the twentieth century refrigeration let them expand their diet again. Today, fresh food from around the globe is brought in by plane, train, and automobile. Meanwhile, this province produces vast amounts of grains and beef for export all around the globe. By eating globally, we all eat better.

I don't know what global trends are like, but locally we're in the midst of another big transformation. When I was a child, almost everyone made their own meals. Eating out was expensive and rare. There was no local equivalent to England's fish&chip shops or the street vendors of Thailand. Even McDonald's was expensive when compared to home-cooking. That's changed. Restaurant fare has become so affordable that it's almost cheaper to eat out. The main downside to doing so is health. Restaurants always put in that extra pound of butter if the outcome will taste better. There are a few fledgling restaurants trying to carve out a niche for healthy fast-food. It will be interesting to see if they succeed.
You think this is illegal in China? I can't think of anything the government would approve of more than a giant database of creds at their disposal...
Keeping a few supporting words in your wallet sounds really nice.
Obviously some pointy-haired boss wrote this post. Big turnoff for me. How is this related to their product - which I am not interested in anymore.
Not sure why this re-surfaced, but it might be good to read the original announcement from January 2011 on https://news.ycombinator.com/item?id=2089615.
> Password handling (Was: scrypt or PBKDF2): In order of preference, use scrypt, bcrypt, and then if nothing else is available PBKDF2.

What's the reason to prefer scrypt over bcrypt? And, what's the reason to prefer both over PBKDF2? (Asking because I see quite a few bits of software that use PBKDF2.)

> Asymmetric signatures (Was: Use RSASSA-PSS with SHA256 then MGF1+SHA256 yabble babble): Use Nacl, Ed25519, or RFC6979.

Could you make a recommendation for or against using GPG, since that's by far the most common approach for asymmetric signatures? (Obviously such a recommendation would need to point at specific key/algorithm choices to use or avoid.)

> Client-server application security (Was: ship RSA keys and do custom RSA protocol) Use TLS.

Using which of the many TLS implementations?
Of course he values money. And so do you. I can tell because of the site where you're making these comments.
somehow the url had confused me - thanks for the correction - i've fixed the comment now.
Or else? ;-)

Frankly, I'm torn and might spin up a test instance on Monday (it's a day off here) to give it a try. Can't do jack about TFS hosting the sources, but anything that gives me a saner/better interface and usable issues etc. on top would be .. awesome.
Every security library has had vulnerabilities, and I'd be more concerned about libraries that don't (since it implies nobody is looking). Does GnuTLS seem significantly more prone to vulnerabilities than other implementations?
scrypt is also "space hard"

I guess bcrypt is harder by default than PBKDF2
Uhhh... why would I feel like I'm missing out on an overinflated asset bubble driven by cheap money in the hands of people who live in bubbles?
So much entitlement and prejudice in 2 sentences.
This time Munchery and et al are really catering businesses with national level aspirations.
Insecure, and I assume that sharing user-specific login credentials is usually against the Wifi-provider's TOS and grounds for termination

Sustained abuse (or sharing) should be simple to detect for a service provider with a network that has multiple, widely-distributed hotspots. In other cases, seeing many different MAC addresses use the same login credentials might be a way to detect abuse, though the MAC might not be sent to the ISP by standard access point firmware.
I almost created a new account to upvote you twice.
Here are some examples of HMAC canonicalization vulnerabilities:

http://www.daemonology.net/blog/2008-12-18-AWS-signature-ver...

http://daeken.com/confusing-crypto-blobs
Link is broken for me, this one works: http://www.theatlantic.com/magazine/archive/2015/06/why-it-p...
> scrypt is also "space hard"

Makes sense, thanks.

> I guess bcrypt is harder by default than PBKDF2

Does that imply that software using PBKDF2 is equally safe if it turns up the difficulty?
I think GnuTLS beat OpenSSL in introducing TLS 1.1 and 1.2 support.
As an example of non-trivial parallelism with Promises and async/await, here's a (slightly naive) implementation of Promise.auto I just whipped up.

async function Promise_auto(clauses) {
let keys = Object.keys(clauses);
let results = { };
let clausePromises = { };
function runClause(key) {
if (!clausePromises[key]) {
clausePromises[key] = (async () => {
let fn = clauses[key];
if (fn instanceof Array) {
let deps = fn.slice(0, -1);
fn = fn.slice(-1)[0];
await Promise.all(deps.map(runClause));
}
console.log('start', key);
results[key] = await fn(results);
console.log('end', key);
})();
}
return clausePromises[key];
}
await Promise.all(keys.map(runClause));
return results;
}

With the above (note clauses are intentionally out-of-order):

(async () => {
let results = await Promise_auto({
write_file: ['get_data', 'make_folder', async function(results){
console.log('in write_file', results);
return 'filename';
}],
email_link: ['write_file', async function(results){
console.log('in email_link', results);
return {'file':results.write_file, 'email':'user@example.com'};
}],
get_data: async function(){
console.log('in get_data');
return [ 'data', 'converted to array' ];
},
make_folder: async function(){
console.log('in make_folder');
return 'folder';
},
});
console.log('results = ', results);
})();

=>

start get_data
in get_data
start make_folder
in make_folder
end get_data
end make_folder
start write_file
in write_file { get_data: [ 'data', 'converted to array' ],
make_folder: 'folder' }
end write_file
start email_link
in email_link { get_data: [ 'data', 'converted to array' ],
make_folder: 'folder',
write_file: 'filename' }
end email_link
results = { get_data: [ 'data', 'converted to array' ],
make_folder: 'folder',
write_file: 'filename',
email_link: { file: 'filename', email: 'user@example.com' } }

Note that there was no topo-sorting or any other stuff to explicitly figure out an execution order, it just takes advantage of the fact that Promises can have their values pulled out multiple times to sequence things properly.
Cinema 4D Crack Mac 2015 32 Bit Serial Keys Free Download
From a smart friend

Rust needs a better tutorial of ownership. It's novel, so it warrants the most explanation.
What did they say about Pizza Hut and Domino's in the late 60's?
I think sects use mechanisms similar to what is described in your link. Scary read.
Here is the best video I have seen explaining Diffie-Hellman using the color analogy: https://youtu.be/6NcDVERzMGw?list=PLB4D701646DAF0817&t=156
Its all about hustle. I have a friend raking in millions a month now. He started with nothing, took no vacation for 5 years, but now he is enjoying the fruits of his labor. I have been on the sidelines for too long, missed out on the dotcom and the web 2.0 I am working on something now. I think trying to start something is still better odds than winning the powerball lottery.
My small Rust-related link-collection.

https://rust.zeef.com/harris.brakmic
Purescript (while not quite Haskell) also has very small output and is strict by default. There's also the very fun, informative, and productive "Purescript By Example"[0] book.

0: https://leanpub.com/purescript/read
I see your point in hobbyist vs. enterprise, but Python is already used in multiple big corporations and I don't think I have seen any result of it being a problem. If anything, the language gets more and more attention due to its spreading popularity on all levels. Isn't that just for the good of the language?

As I mentioned it is already used in several big corporations. From your point of view - is it a problem right now?
Pretty sure Python is very "enterprise"[1] worthy.

[1] - https://www.paypal-engineering.com/2014/12/10/10-myths-of-en...
I consider it a major red flag if a potential employer starts trashing former employees.

Any employer who trashes a former employee to you, will trash you to the next guy who comes along.
I wouldn't judge that too quickly - it could well be about hiding money stolen from another country:
http://www.independent.co.uk/news/uk/home-news/london-proper...
What's the reason to prefer scrypt over bcrypt?

scrypt is asymptotically much more expensive to crack.

And, what's the reason to prefer both over PBKDF2?

scrypt is asymptotically much more expensive to crack.

bcrypt is asymptotically marginally more expensive to crack than PBKDF2, but not enough to matter; I'm guessing tptacek's point here is that bcrypt has more library support available (despite PBKDF2 being the de jure standard). I wouldn't say there's a strong argument in either direction.

Could you make a recommendation for or against using GPG, since that's by far the most common approach for asymmetric signatures?

Avoid if possible. The code was written by a colony of drunk monkeys, in an era before anyone understood the basics of modern cryptography; I'm really not sure which is worse between gnupg and OpenSSL. Of course, GPG is the standard for encrypted email, just like SSL/TLS is the standard for web sites, so you may have no choice...

(FYI: https://vuxml.freebsd.org/freebsd/pkg-gnupg.html )
Just One Page Bootstrap Template
To make your analogy really work, we would have to require women to vote for women directors and men to vote for men directors. But as another commenter noted, I question whether the interests of men and women are really all that divergent.
I looked at the code of either this thing or something similar in the past (don't remember). Basically there is a "swarm of particles" that follows your mouse when you draw, and they orbit around it with some noise added, as if it was gravitation simulation. The path of colour trails each particle and it may or may not change over time. So if you stay in one place for long, you get more colour and if you do a quick stroke, particles follow quickly and trail becomes thin. You can also add mirror or star symmetry.
Unfortunately that interface is rather dangerous because of the 64-bit nonces - it is essentially only useful for encrypting multiple messages over a single connection.
Throw in a femme fatale and a couple of murders and this would make a great film - even the name, Witanhurst, has a lovely sort of gothic noirness to it.

This was a really enjoyable read.
scrypt has nice properties that bcrypt doesn't, and gets those properties by design; it turns out that in practice right now bcrypt has some nice properties too, though they seem accidental. We're using scrypt at Starfighter, even though we have to go through a (very minor) bit of trouble to get it. They're all fine though.

If using GPG means you can delegate away all your crypto design, use GPG. What you should not do is roll your own by co-opting all of GPG's design decisions, some of which are not great.

You should use BoringSLL, LibreSSL, Go crypto/tls, or OpenSSL, in roughly that order.
(didn't check the source) It looks like x,y and time as a seed for a function that paints (additively) a complicated line.

click 1 spot over and over, quickly - you'll get a white line that gets a little thicker as it's fully saturated.

click a different spot over and over, but hold it a little longer, you'll see the delta-t effect tracing the same pattern over and over.

one way to implement such a thing, you'd want a function to look at a pixel and it's nearby neighbors, and brighten. red = red+10 or some such. next you'd want a linedraw function, given x,y,t - pick a spot near x and y, step a few pixels away in some direction, brighten the stuff between. repeat that, with a bias tward the direction you're travelling, and cap it out some how. something like steps=(x+y+t)%100 +10. min length is 10, max is 100, kinda vary with time.

Anyway, that's the basics. you can futz around with the specific functions to give a nice effect.

edit

ah, mynegation's comment is probably the truth. particles with inertia would do just the right thing for biasing direction.
I justed visited https://www.mozilla.org/en-US/ and browsed the source, and they still have the Google Analytics tracking crap on their website. Strange for a company that claims to be "committed to your privacy."
If you have a deeper interest in Napoleon I heartily recommend the Napoleon podcast http://napoleonbonapartepodcast.com.

One of the things I learned was that the British started the wars and continuously broke the peace agreements. Still to this day most people think the reverse. It has to stand as one of the most successfully executed propaganda campaigns of history that people still think it 200 years later.

And yeah he was not short. He is listed as 5.2 but in modern units that is 5.7 which was above average height for the age.
I would flag use of GnuTLS in an audit. Sev:lo.
I remember when almost all websites looked like this.
You might be mistaking cause for a reason here.
Leave Britney alone. She's not well.
On generators (2013)
Fake JQuery Scripts in Nulled WordPress Plugins (analysis)
It's a community where the consensus is wherever the community decides. If you didn't speak your mind people like me would be the centre, if I didn't speak mine people like you would be the centre.

I'm not sure what you are trying to achieve. I've said my comment, I've re-iterated it. You have made two meta comments about HN that I have zero interest in. Create a new thread on HN meta and write about it.

Again: the author of the book has a great blog and I'd highly recommend subscribing to it.

Have a very positive, non-supercilious day.
A workable limit is trivial, how about 100 zombie process IDs per user.
This again..
If you're concerned about attacker data hitting the AES core, Salcha20+Poly1305 doesn't have that problem, and is generally preferable to AES-GCM in every scenario anyways.

Right. And I'm optimistic about Salcha20 and Poly1305, but I'd like to see a few more years of people attacking them before I would be willing to recommend them.

we should be clear that you're advocating for "bootstrap with /dev/urandom and then expand in-process"

Right. Or to be even more precise: Use HMAC_DRBG with entropy_input coming from /dev/urandom.

Also: For $DIETY's sake, if you can't read /dev/urandom, exit with an error message. Don't try to fall back to reading garbage from the stack, hashing the time and pid, or any other not-even-remotely-secure tricks. Denial of service is strictly superior to falsely pretending to be secure in almost all conceivable scenarios.
Not directly related, but it reminded me of this: http://everything2.com/title/The+ability+of+planarian+worms+...
In what scenario would you run out of 64 bit PIDs? How many per second for how many centuries?
> so when one user logs into a hotspot, his or her credentials are added to the database so that everyone else on the app can also use that hotspot

Can it do this without root privileges on Android? Or does it ask the user to enter the password for the hotspot?
> If you can get away with it: use SHA-512/256, which truncates its output and sidesteps length extension attacks.

Note that "SHA-512/256" is a separate algorithm, not to be confused with "SHA-512 or SHA-256" which are two other less secure algorithms.
The Unix way: A note on composability
There is also a slow dissolution into a different state of being.

I imagine humans living long enough to begin augmenting their bodies and brains into a thing that no longer resembles the original being. Or even a form of life as we understand it today.
I have to wonder how that would have worked out before modern times.

Ancient North America was not a wilderness; it was a crazy quilt of tribes and states and alliances, all bumping against each other.

Crossing from present-day New York to Vancouver in CE 700 you would have run into at least a dozen major ethnic groups, each of which would have needed to decide what to do with you.
> But employee-owned cooperatives, for example, will be completely unaffected.

Cooperatives (this will depend on details of structure, etc.) are often still subject to minimum wage laws, and of those that are, paying workers minimum wage as the only guaranteed payment with dividends/profit sharing/etc. on top is, as I understand, a not uncommon arrangement. So a minimum wage increase does increase the labor cost to the corporation (and, since wages are taxed differently than capital income, it has a net effect on the worker/owners, as well.)

Now, obviously, the effect on a labor coop or its worker/owners will be different than the effect on a traditional corporation or its shareholders, but there will not necessarily be no effect on the former.
Much like YouTube was originally or Uber is now?
You're assuming that people like this models from an Econ 101 textbook.
The question I have is: why does it take 2075ms to load for me? I have 30mbit cable...
Well, in the more general case "huge symmetric keys" is a flag for "doesn't understand crypto", but 448-bit blowfish keys are the most common place I see this happening.
For those wondering what Firefox tracking protection is - https://support.mozilla.org/en-US/kb/tracking-protection-fir...

From my, very quick, tests it appears to work quite well as a poor man's adblocker as well. Nice!
The tutorial in here seems pretty good:

http://doc.rust-lang.org/book/ownership.html and the following three pages discuss it in some detail.
I feel like I'm missing something here.
"To enable Tracking Protection in Firefox
35 and later, visit
about:config
and set
privacy.trackingprotection.enabled
to
true"

Edits -

This quote from the article is interesting, especially considering Google the worlds biggest advertising industry company also has a browser.

"That Firefox is first and foremost a user-agent, not an industry-agent"
inside their dmg file:
-rw-r--r-- 1 buddha staff 163840 Jul 21 2014 password_pro.sqlite

sqlite> .tables
pwd
sqlite> .schema pwd
CREATE TABLE "pwd" ("password" TEXT NOT NULL );
sqlite> SELECT * FROM pwd;
a30e502c125899a41cb562a7a36b4bd0
c58675db0ba9266fb5307982e4368ab0
5631e619f6e280c0740704a25a8298f6
...

i don't know how they are using this pwd, but seems like a good starting point.
Life Hacks: 29 Essential Time Management Tips to Optimize Your Work Productivity
It boils down to this:

Make sure the data fed to your MAC is unambiguous. Or rather, make sure the data fed to your MAC is done in such a way that you cannot have different messages appear the same to the MAC encoder.

For instance, say you sort and concatenate your options without a delimiter. Then ["ab", "cd"] will have the same MAC as ["a", "bcd"], as in both cases the actual data fed to the MAC will be "abcd". This is a very bad thing.
Restaurants like Applebee's, TGI Friday's, Chili's, and the like tend to have lots of menu items that are scarcely better than fast food. Their menus are full of over-salted, frozen, deep-fried things like fries, onion rings, mozzarella sticks, etc. that have no redeeming culinary value.

There may be some reasonable items at these places, but a lot of their food really is just dressed up versions of what you might find in a high school cafeteria.
When you say out, do you mean there is actually one for sale that I could buy today?
All Windows Phones already come with this: it's called Wifi Sense. Technically it only shares logins with your outlook contacts but in the end it's effectively the same, except Microsoft-Sponsored.

edit: I guess it's only secure until someone jailbreaks WP8.1
I agree. However, there is a lot of information about RAII in C++ that's reasonably translatable.
Also:

For each key you use, pick 1 format of messages for it to authenticate. Document that format. Version-control that documentation along with the code that uses it. If the format changes in a non-back-compat way, pick a new key (so try to use a backwards-compatible format). Ensure the documented messages make sense (try not to have a "fire this person" message without knowing who is that person) - timestamps and/or nonces can really help here.

If you can't pick just 1 format, you can say have the first 16 bytes of the message be a UUID, and document each UUID-format (with the same documentation rules as if you are not using a UUID).

Seriously, that and "don't mix secret and unauthenticated things" together covers 90% of all vulnerabilities.
> "overpopulation (from immigration) makes many problems worse, drives down workers’ wages, drives up inequality, drives up unemployment, leads to political disempowerment, and creates sprawling suburbs which destroy habitats."

You should see the equality statistics when you add workers working in Mexico and the US in the same diagram - see what their wages and unemployment rates and political empowerment look like before they immigrate.

As for habitats, forget the suburbs: the real habitat-mangler is agriculture.
Some points:

1. It is not uncommon for some of the most expensive properties in London to have "mostly absentee owners, hiding behind offshore corporations based in tax havens". [0]

2. Highgate does have associations with wealthy Russians, perhaps due to the presence of the Russian Trade Delegation building, and that has sometimes led to friction with locals. See also Terry Jones's "Trouble on the Heath". [1]

3. The pub associated with Dick Turpin is the Spaniards Inn [2] (The Flask is on the other side of the Heath).

[0] http://www.vanityfair.com/style/society/2013/04/mysterious-r...

[1] https://books.google.co.uk/books/about/Trouble_on_the_Heath....

[2] http://en.wikipedia.org/wiki/Spaniards_Inn
It's a valid objection. GA at this point is on most websites you visit. The data is forwarded to Google where it's processed and stored forever. GA is one of the biggest threats to privacy on the web, and any company claiming to care about your privacy should not be using it.
The thing with chain restaurants is that you'll likely be receiving lower quality food than a local mom-and-pop shop. People who work at chain restaurants generally are there to make some money and then get on with their lives. They're less likely to be passionate about food and sharing that joy with customers. They're using corporate recipes and the cheapest ingredients from massive suppliers.

When I go to small local joints, I see owners who are in love with their business and really want to share their passion of food with customers. This care really shows in the quality of the food. They made the recipe themselves, so they know every nuance of it. They often get fresh local ingredients.

Now this is just a generalization, there are plenty of passionate workers in chain restaurants, and plenty of apathetic local restaurants. It might just be a local thing too. I just had a revelation once I moved from the chain restaurants of midwest suburbia to the local shops and food carts here in Portland. It was a night and day difference of quality and general experience.
So much idiocy in one.