skysight-inc/HackerNews huggingface dataset:
http://shoestringfoundation.org/cgi-bin/blosxom.cgi/2004/07/...
Let's stay on topic, please.

Is this title misleading or linkbait? If so, we should change it as the HN guidelines ask. Would "Two pairs of RSA keys having a common factor found" do? Suggestions for an accurate, neutral title are always welcome.

Edit: We've detached this subthread as off-topic.
Wouldn't RSA just fail if you used a non-prime factor? You shouldn't be able to decrypt any messages if you calculate the totient incorrectly, and for a public key pq, if either p or q isn't prime then (p-1)(q-1) won't be the totient.
There is an extremely interesting post describing what a few days living with RMS look like. It describes a trip of RMS to Spain, to give a talk in Majorca University.

It get to great length to describe how uncompromising and coherent with his views RMS is, to the point of showing how tough it is for him and everyone around.

Unfortunately, the post is only available in Spanish:

https://gallir.wordpress.com/2011/10/29/un-viaje-con-richard...

Google translate version is relatively good:
https://translate.google.com/translate?sl=es&tl=en&js=y&prev...

I think is fascinating insight...
Reasonableness should really only be established by mathematically weighing the probabilities of true and false positives and negatives.
Thanks for your insight, this was kind of what I was hoping to hear. If you wouldn't mind, could you expand a bit on the negative effects you've experienced due to regularly drinking caffeine, and possibly even some good ones?
Its not cumbersome, the alternative is more cumbersome, it just requires memorization. Like I said, zypper is a great compromise, where you could do zypper update and zypper install, or you could do zypper u and zypper i. A bit more intuitive for the newbie but it doesn't make you write words like you're writing a poem in bash.
Personally, while I'm entirely in favor of all reasonable efforts to eliminate aging, and I think it quite likely that SENS could buy us more years, maybe even centuries, I don't think SENS is a complete solution to the problem of mortality. Not least of which because if we eliminate aging but not mortality, the leading causes of death will become accidents, and people are no less dead when hit by a bus.

Plus, SENS eliminates the hard boundary at ~120, but doesn't ensure that we actually get there, and I don't relish the whack-a-mole fight against a thousand random diseases (even if we sensibly prioritize those lower than eliminating aging).

So, personally, I'd suggest donating at least as much to to efforts like MIRI rather than (or in addition to) SENS. My main hope for SENS is that it will buy us enough years for MIRI to give us a trillion more.
Just start programming. You can do worse than the first of the Racket Tutorials:

http://docs.racket-lang.org/

and then Feilisen's How to Design Programs:

http://www.ccs.neu.edu/home/matthias/HtDP2e/

The PLT group has been seriously studying the pedagogy of programming and computer science for more than 20 years. The use of Scheme as a teaching language goes back forty years to its inception.

Good luck.
I think the main point of the article is that the algorithms are applied without deference to real world conditions or impact.

I'm not seeing evidence that algorithms are worse than people in this regard. How many horror stories are there of people citing rules or policy "without deference to real world conditions," or just simply being flat-out wrong? It's almost a cliche when talking about government bureaucracies.

I'm less concerned about algorithms strictly applying policy (that's what they do after all) and more interested in whether overall results are better than what humans do. Most people have biases about one thing or another (race, gender, age, physical appearances) and it's very difficult to eliminate those as they may be operating below the level of conscious thought. Also government bureaucracies aren't exactly known for hiring the best and brightest. It would seem to me likely that algorithms should eliminate those issues, at least.

Edit: posted before I saw jqm's reply
I think you may have solved the mystery, including my confusion about why I couldn't get the vulnerable subkey from the keyservers. My gpg was silently discarding the vulnerable subkey because it doesn't have a proper signature.

If this is the explanation, then this is either an attack by a random person or an attack or flaw in a keyserver, but an attack that's unlikely to work because users will discard the bad key rather than using it.
I've been considering doing something like this as well, how are you able to prevent yourself from becoming dependent on it?
That one sounds optimistic:

"Based on my research it seems that over a very long time the use of PGP
implementations with deeply
awed random number generation functions was very rare."
Discussion: https://news.ycombinator.com/item?id=9558976
That sentiment was already expressed in the article, in the form of the tigers and snakes. There are far too many small-scale distractions that people find appealing to focus on, whether because they seem more approachable or because they're the actual culprit in the death of specific people.
I suspect he would have been right out front on integrating these new ideas into yum; he had a long history of pushing yum forward (which is why it became the standard for RHEL and Fedora despite Red Hat having developed one of their own; but, it was clear to everyone, including Red Hat, that up2date was inferior in every way to yum). So, I tend to think if he were still around, we wouldn't be talking about something replacing yum, we would instead be talking about new features in yum. I think it is unfortunate that people felt the need to fork rather than enhance.
Exactly this.

I often describe programming as creating tiny bureaucracies.

You put some information into a "form" (e.g. a search bar). The front desk bureaucrat (mouse, keyboard, screen, etc.) sends it off to other bureaucrats and they follow a bunch of rules to process it and give the front desk some new "paperwork" to give to you (e.g. the resulting web page).

What we are doing with automated algorithms is getting rid of the human bureaucrats and replacing them with "robotic" bureaucrats. That can be a really bad thing depending on the context, but even the human bureaucrats in many cases were already ~ robots.
First I'd start by experiencing programming.

Don't be serious, take anything to start, go through http://code.org Make it easy - ensure you will have success right off. Then take what you know and try something on your own get a feel for how to write effective code. Once you get past the fear of programming then you can start enjoying it.

From there you then can think of what you want to do with programming and figure out what tools you will need and what to learn.
"The best way to get a bad law repealed is to enforce it strictly."

Yes, it's done wonders for the drug war.
> No, it really wasn’t – it was perfectly fine, you’re just being a snob. The Web works well for me with the ads displayed.

I have a lot of trouble reading when there is something moving on my screen
Litrík Stormur (Aurora Borealis in Iceland)
Oh, this research is very much in the interest of the businesses — because staying at home also means spending less money. The idea is that if the taboo around "having fun" — aka spending money — alone is broken, then well… profit! This article of course contributes to these interests.

Personally I think time spent at home is can be as good as time spent out side of home. The article in question does not do any comparative study — it is just assumed that staying at home means not having fun.
The Federal government sends taped propaganda pieces to local TV news stations, and they air those pieces without citing their source.
Because code is data is code in lisp. That's not the case in C or Java or C# or Rust or whatever.
> Would "Two pairs of RSA keys having a common factor found" do?

Yes, that works. There's potentially a serious RSA keygen issue here, but nobody's broken RSA itself, and the headline does a very poor job of communicating this fact.
It is not immediately obvious to me what a "pocket" is. It sounds like a bookmark, but I assume it is something else if they aren't calling it "bookmark".
Valid points about other software, but I don't think 1000+-digit random-looking numbers would be easily memorised by someone looking over your shoulder casually.

http://www.recordholders.org/en/list/memory.html#numbers-1mi...
Ask HN: Simple alternative to Google Analytics
I'm looking for an alternative to Google Analytics. The reasons:

- Referral SPAM has become huge, and I'm playing catch up trying to filter them out.

- It's way too complicated now, and I'm looking for simple measurements.

What I'm looking for:

- Accurate, no ref SPAM analytics SaaS

- Visits, Visitors, Geo, Page Views, Duration, Bounce Rate and Traffic Sources.

- Simple and easy to use interface.

Any suggestions?
Drink tea.

It has a milder, but longer lasting effect.
It's also less likely to cause a 'violent' bowel movement :) .

Personally, I used to drink coffee day and night, while now I only drink tea after 7 or so, PM.
Arch always posts breaking changes to its mailing list. If you are complaining about the bleeding edge part, that really has nothing to do immediately with pacman as a package manager, you could always pull a Manjaro with real package introspection to keep tabs on incoming software.

The only real missing piece of pacman is that there is no distinction between a feature and security / bugfix update. But then you should be more stringent with upstream to beta test their feature releases better.

Really if you wanted to automate pacman nothing stops you from creating your own custom repo as a gateway to some workstation or server cluster you have and setting it up to use your custom repo exclusively for all packages. It has delta support, does checksums, uses the best compression format available, and is a lot easier to use for custom applications than the OBS or alternative packaging tools.
The keyservers aren't secure anyway. The are more like a big public walls on which everybody can write any number.

The users are the ones responsible for any key verification.
AngularJS Trivia
Waiting to get my fingers on this
It is actually a pure factorization of two separate keys. But subsequent evidence in this conversation (from agwa above) makes me think that they aren't valid keys that are actively being used by the people in question, but rather spurious additional data being returned by keyservers for some reason, that probably wouldn't be accepted as valid by gpg.
Being addicted to anything is simply something I dislike strongly - I have learned to control addictions by simply taking control of doing only what I want to do.
Show HN: Optional.js – Java 8 Optionals for JavaScript
I'm writing this from Panama on a solo trip I'm on. I get more vacation time than my wife so tend to go on a couple solo vacations per year. It's great. I can work as much as I want, make my plans on the morning of each day, and spend a week walking miles with zero small talk.

The only drawback is having to occasionally justify to friends why I don't bring a friend along (aren't you lonely? Aren't you bored? No). Probably a lot like the dog and pony show vegans have to put on when they meet someone new (don't you miss the eggs and cheese?)
Coding? The hardest is the first step
I think it's safe to say at this point that it is you who are dead wrong and not Erik.
You must find some way of doing A/B testing ;)
That said, once you can automate this stuff, there are new types of policies you can make which would be too complicated otherwise, and that is a place where we can unwittingly innovate into new ways of hurting people.

On the other hand, exposing the inherent inhumanity of strict bureaucracy via conversations about automation may actually be a force of awareness and change. An opportunity to explicitly create "human integrations" at key touch-points where people would otherwise fall through the cracks (think API hooks where you can integrate PagerDuty).
I usually drink a couple of cups of green or black tea per day, usually with honey. At some point, when I was in the office, I was drinking up to 4 cups of tea per day. I was miserable at work, tired for other reasons, and felt like I needed it. I was probably pretty dependent on it at that time.

I understand very well how you might end up drinking a lot caffeinated beverages, but I wonder if you can have a placebo effect by drinking water and taking a quick walk outside instead?
Well, obviously something went wrong. But the way I understand it RSA shouldn't work at all if you used a composite factor, decrypting a message will just give a wrong result.

Unless, by some incredible fluke, they managed to find a carmichael number.
Show HN: Hnplain, output Hacker News in plain text
Good to know, thanks Hacker News. Better "dependency solving" is appreciated. Though I stopped using Fedora, I assume this will make it to CentOS eventually.
I think there is also a different thing going on. Most companies expect their
hires to already have significant experience, but little are ready to train
new hires to match (future) needs. It's understandable where it comes from:
employees are not that loyal anymore, so any training would be an investment
that returns to somebody else.

On the other hand, times when companies were loyal to their employees are long
gone, and this is pretty much why employees switch jobs so often nowadays.
RFP: Request for Press
Host your own analytics using Piwik - http://piwik.org/
Coming from a guy who has no idea of Rust, and since we are talking about memory safety. In a c++ library, we use RCP (reference counted pointers) which dis-allocates on it's own, so we never call naked delete. Does such a thing exist in Rust pointers, because this memory safe feature I'd love to have!
Cause it would add an extra layer to my solution, which might be more complicated to get right than just bare C.
That one is in the "failure cases" segment
There was another project like this posted a few weeks ago https://news.ycombinator.com/item?id=9491978, and I have the same question for this one. :)

Why did you decide to use a supervised learning approach for this? You're hard-coding the categories in this manner.

You could try using clustering instead (K-means) to group the posts together into their own categories. This is similar to a "trending topics" approach, where the categories could change each day.

On a side note, the domain name is terribly confusing.
Yes, there's definitely some stuff in there I hadn't thought of like how to handle strings as char[xxx] vs string ptrs.

Thanks.
Did HPA publish this key anywhere? Tell anyone to use it?
I still believe in a future where programming-by-specification and advanced theorem proving systems result in the ability to make systems that are provably without a certain class of bugs. Then it would be possible to upgrade systems effortlessly by simply proving that they satisfy the same primary specifications.

Then of course writing the spec is the hard part, but I'd at least be interested in seeing what those challenges turn out to be like.
I trivial tool I wrote that outputs Hacker News in nice plain text, I use it to send myself and email at lunch time with the top stories on HN.
I think you might block some identified spam sources URLs!
But it's not all the time very efficient!
Will also be happy to have some recommendations on that point!
Was it publically known that something was being built?

And then there's this:

> Oak Ridge used one-seventh of all the electricity produced in the United States

(Source http://www.u-s-history.com/pages/h1652.html)

You'd think someone might notice.

Truman, as vice president, did not know it was being built. It cost over $20 billion in current dollars.
Incidentally, anyone who suspects that I, Mircea, or Hitler fabricated these keys in order to troll the planet, is free to contact anyone who runs an SKS mirror and ask to examine their copies.

I do not know where the key came from, and especially whether it originates from the person who it claims to belong to (other people have found persuasive evidence that this is not the case) but I did find them 'in the wild.' Doubters are encouraged to check for themselves.
Code Climate is a service that does this for Ruby code. I'd much prefer something running locally, though.
In the short term, charge at least as much for the service as it costs. In the long term, rely on the resulting wealthy and thankful patrons.
AKA getpocket dot com

shame

I fear that FX will become bloatware, soon...
People might choose websites with a "more polished UI", but better converting isn't always better for consumers. Most websites are like junk food: clearly optmized for getting users to "convert", but lacking in any real substance.
Endangered Safari
Thanks a bunch for that, khash looks really interesting, and it does what I kinda wanted to do, but didn't really realize was possible.

Suddenly, the C preprocessor doesn't seem quite as far distant from C++ templates as I'd thought...
I think you would have to admit that the 1945 general election that removed Churchill from being PM and that went on to introduce the NHS was most definitely a swing to the left.
If you had a 2048-bit public key modulus, each factor (only one factor is sufficient to reconstruct the private key) is only about 308 decimal digits, or 256 hex digits. :-)

We also know from Nadia Heninger and Hovav Shacham's research that you can reconstruct private keys relatively efficiently if you have some missing bits.

https://eprint.iacr.org/2008/510.pdf

But I think you're right that human memory isn't a very significant threat to RSA private parameters. Realistically, cameras would be the threat, not a human being glancing it them.
I believe Magic already got funding. Only took a few weeks if I remember correctly.
Things You Should Be Using Siri For
Then I don't have it?
So Caleb would have a reason to cut his own skin. That seemed motivated more by "the next scene needs it" than internals.
Bycatch a newly released card game about drones and surveillance
> The notion that some people are overweight or obese simply because their will power is less than others' simply doesn't fly any more.

What does, then? Definitely there are other ways of losing weight (surgery, drugs), and there exist a few people here and there that have actual health problems (i.e. their bodies are functioning incorrectly), but I think their numbers are greatly exaggerated. Even if it might be harder for some people to do so, most people can lose weight by being disciplined (i.e. by willpower). Unlike many other medical issues that a person cannot solve by themselves (or things that were considered medical issues in the past, e.g. being gay).
I realize that I am capable of continuing this discussion on this forum but I'm not going to. I do not consider the comment thread on this article on Hacker News an appropriate venue for an extended debate on moral absolutism, the value of the existence of government, and the ethics of taxation and robbery.

I would be happy to continue the debate in a different venue — a thread with the ethics of taxation as it's core concept, a different website, an e-mail thread, a phone call, or an in-person meeting. Let's take this to a more appropriate place, and I'll happily continue the discussion as long as it remains productive.
Amiga 500 had A590 among others, 20 MB hard disk. Lattice C was the compiler used for Amiga.
Pocket is basically integrating a third party service in the user's default bar (you can remove it in customize)

It feels like its there for commercial purposes... Has mozilla lost its user centric values though? Theres enough ads and sponsored stuff on the web already.
I thought (inspired by Person of Interest TV show and photo supersaturation) after the Boston bombing it would be a good project to use publicly available photos, video, security camera video to track or search for suspects.

Or it could be used to search for a kid such as during an Amber Alert.

But I have no skills to do this :(
I don't understand this well enough to know what an accurate title should say. Can you or anyone suggest one?
If the author says "transistor-level simulation" I would expect that to mean all transistors in the simulation are modeled. Is that true?

Since they are nonlinear devices, doing so is relatively expensive computationally.

If so, I'd be interested to learn the rationale for it. I would expect (and could be wrong) that an Atari could be simulated at the logic level adequately.

From "13.1 Types of Simulation" from from Application-Specific Integrated Circuits available at http://iroi.seu.edu.cn/books/asics/Book2/CH13/CH13.1.htm

> Logic simulation or gate-level simulation can also be used to check the timing performance of an ASIC. In a gate-level simulator a logic gate or logic cell (NAND, NOR, and so on) is treated as a black box modeled by a function whose variables are the input signals. The function may also model the delay through the logic cell. Setting all the delays to unit value is the equivalent of functional simulation. If the timing simulation provided by a black-box model of a logic gate is not accurate enough, the next, more detailed, level of simulation is switch-level simulation which models transistors as switches—on or off. Switch-level simulation can provide more accurate timing predictions than gate-level simulation, but without the ability to use logic-cell delays as parameters of the models. The most accurate, but also the most complex and time-consuming, form of simulation is transistor-level simulation. A transistor-level simulator requires models of transistors, describing their nonlinear voltage and current characteristics.
I'm almost certain this news is wrong. I know that because I made the same mistake a while ago. Luckily for me I didn't publish it, but I already had written mails to a number of people (including hpa) warning them of a compromised key (which was a false alarm).

Here's what's going on: There are a number of keys on the keyservers that are faulty copies of real keys - they share most of the values, but have some errors. I don't exactly know why that is happening, but I assume it's because of network transmission errors or server crashes during transmissions.

These keys don't really do any harm. GPG will refuse to import them because of the faulty self-signature. So nobody will ever encrypt with those keys.

A Batch GCD attack on the PGP keyserver set has already been done a while ago by Lenstra and again by me recently. If you replicate this you'll find two old broken keys with unknown origin. These seem to be the only vulnerable ones, but they're expired. You'll find one key which looks like a test by someone and a large number of those broken keys with small factors.

I wrote a paper about my findings:
https://eprint.iacr.org/2015/262
Also some code:
https://github.com/hannob/pgpecosystem

And if you want to replicate the batch GCD attack Nadia Heninger has released source code for this:
https://factorable.net/resources.html
The degree of uproar is independent of how hopelessly broken our (meaning the UK) system is though.

FPTP is demonstrably unfair but as I said turkeys voting for Christmas.
Agree completely. A life time of privilege is codified in a series of classifications that have absolutely zero predictive value of a person's intellect or capacity for learning.

Cue the refrain: "but we need SOMETHING to differentiate students by"
Wizcraft Hack Tool 2015 No Survey for Android iOS