skysight-inc/HackerNews huggingface dataset:
> Did you bristle at it?

Point taken.

> Was it a challenging issue for you? I.e., prior to the episode, you believed that everyone on disability insurance was lazy?

No, but I did generally assume they had something so debilitating they were incapable of working. The show basically pointed out that some doctors in areas of high unemployment were signing off on disabilities for people who basically just had outdated skill sets. My impression was that in lieu of any real progressive safety net (basic income, etc.) citizens have started leaning heavily on disability insurance.

I was trying to give them the benefit of the doubt. Do some Googling to see the other side of the argument about that episode.

Also, why is this being discussed at all? This (and shows like it) are basically Chicken Soup for the Soul in podcast form. They're emotional filler but I've fallen for discussing them like they should be some sort of hard-hitting journalism or policy discussions. In a discussion of media responsibility, does Ira really deserve to be the first head on the chopping block?
These are very neat. Thanks.
When you reported the bug did you include a repro? I would appreciate it if someone could post it here.

To be specific, I wanted to know the specific conditions the article talks about under which this causes an issue. Flush will cause writes (obviously) so issuing writes to a file which is pending a flush is an interesting scenario.
Not denying the rest of what you say -- these teams are scary good, but A was really simple -- lot simpler than the first problems I remember from when I coached our school's team.

I just tried the brute force solution in Java, took me maybe 3-4 mins to code up and it finished with the max value of n in less than 1s.
Yeah but you're still charged with something and it's still on your record. It would be more like if you could write the gov't a check to 'pretend this never happened', with nothing on your record, and probably a written promise from the gov't that they'll never say anything bad about you.
Title should be "Downloading Putty Safely Is Nearly Impossible"

Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.
> Exactly. If you don't like that I'm in control of my machine, don't send me content with the expectation of taking over my machine for your benefit.

... but you're the one requesting the site...

Ignoring the drama of your comment (I've never had my "machine taken over") -- no one is sending you content you didn't request. The person providing you that content would like it if you viewed an ad for them since you're gaining something from their content (or you wouldn't be reading/viewing it). Refusing to do that is dishonest -- it's not illegal, you're not stealing, you're just being selfish and entitled.

> Also, you probably want to not try to guess my motives. The screen real estate isn't the problem, the tracking and the resource consumption is.

Yeah, you want to consume someone's content and you feel entitled to do it on your own terms.
Same way I've always done in VQ - with math/logic :)
None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not.

Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now.

Let's Encrypt are welcome (when they arrive), but they still don't offer Code Signing, Wildcard Certificates, and so on. The whole certificate/CA industry needs change, Let's Encrypt doesn't go nearly far enough. I blame Microsoft, Mozilla, and Apple primarily as they decide who gets to be a CA, and could allow non-profits and other disruptive startups into the space if they wished.
This is not just a rant. As of two days ago, there is a hostile version of PuTTY in the wild.[1][2] It's on some mirror sites distributing open source software. It steals login credentials. Right now, it's essential to be able to tell the good one from the bad ones, and it's not easy.

[1] http://www.symantec.com/connect/blogs/check-your-sources-tro...
[2] http://blogs.cisco.com/security/trojanized-putty-software
Yeah that's what I'm really interested in. I get how the shader rendering works for amazingly complicated geometry when it's just a simple function to calculate it, like a fractal or something like that, but when you have a world full of irregular, non-repeating shapes how do you represent that?
Because this isn't really an attack per se. There are some interesting things in the paper, but really this is just low grade crypto being tolerated for far too long in the name of compatibility.

I finally found the Mozilla bug entry for this, they've known of it since 2010 when they raised the minimums to 512-bit DH groups.

https://bugzilla.mozilla.org/show_bug.cgi?id=587407
I love this too.

I'm really interested in using the service for Health related purposes - like assessments.

I started playing around with it and started building a little iOS app for creating and managing forms and displaying them in a UIWebView which works quite well (unlike the creating part I hacked together). Current version works better in the simulator than on the device though, I need to tweak a few things, here's the repo... https://github.com/r3trosteve/typeform-ios
> be prepared to appreciate what is happening in the mind of PayPal--which should hopefully cause you to not being unreasonable or abrasive in your communication, though even if they were being bad that isn't an excuse to get angry at them--and reach out to their underwriting department to prove you are financially solvent in a way that doesn't rely on the success of the event, and preferably also provide evidence that your event will also work.

The problem with this is that people do jump through all of these hoops (and more) and still wind up with their money frozen for interminable periods of time. That is the source of frustration and anger with PayPal - legitimate businesses jumping through every hoop and still winding up with frozen funds, held for at least 6 months.
Right, of course. But there's a difference. Why do you choose bitcoin over dogecoin? Why do most people choose the dollar over bitcoin?

Decades of culture and tradition have molded the dollar into something different from people just selling paper. Bitcoin is not yet such a thing.
This is an article from 2014. Previous discussion: https://news.ycombinator.com/item?id=7334269
The Chevron at truck crossing in Blaine still sells butter, huge amounts of it. As an American, it floored me the first time I saw it.
Show HN: Soal App – Record your audio biography
Well, I don't know about reliability* but there are many other reasons to choose XFS:

1) Support for large volumes: 8EB vs 16TB (Ext4)

2) Support for large file sizes: 1EB vs 16TB (Ext4)

3) Support for large number of subfolders: Ext3 has a 32k subfolder limit

4) Online defrag support (supported in Ext4)

For us, we had to use XFS for MySQL multi-tenent applications.

* XFS had corruption issues back in the day with specific kernels (2.6.9, that's the one I remember).
Ok, we changed the title. If anyone suggests a better title we can change it again.
> For example, in the morning, a user might see playlists like “Wake Up Happy” or “Sunrise Run”

I don't know what the Hell names like that are supposed to tell me. I guess there is some specific kind of music associated with 'wake up happy' and 'sunrise run'...
Well, if they don't want it, I'll take it. It's a great name.
Your environment restricts your available choices and these things are tied back on themselves, so behaviour creates an environment that then influences behaviour. Looking for ultimate causes in current behaviours for social systems that have developed over evolutionary timescales is pretty pointless.
> The dollar is backed by culture and tradition, the government has no control over whether or not you want to use or accept a dollar for goods.

The government has control through the legal system which is the ultimate recourse for dispute over payment of goods, and it exercises this control by assessing damages, when a dispute is resolved through the courts, in US dollars.
This Is a Bug the NSA May Have Used to Break Internet Encryption
Are we going back to inline styles?

How do you make this responsive or improve on it after it has been built?
I'm glad you're enjoying it :)

Be careful with writing that compiler, I decided to add a type system to my hobby language a while back and now I'm doing research in type theory. It's a slippery slope.
Ask HN: Founder networking events in Toronto?
Hi,

We're a Toronto-based startup company and we're looking to get some advice from folks who've gone/are going through the entrepreneurial journey.

Are there any events/meetups in Toronto where we can meet other entrepreneurs?

p.s. We're also open to having conversations with other startup founders on Skype/email/chat if you're interested.
Oops; I shouldn't have used 'Slack' in the domain name. Gonna shut this down for now, but I will leave the source up.
alternate live feed... http://www.c-span.org/networks/?channel=c-span-2
Fabric by Twitter
Most (essentially all) personal electronic devices charge with a fixed supply voltage (often 5 volts) and will draw up to some current. The product of current and voltage is power. Since we have fixed voltage, the power rating of an adapter is really telling you how much current it is capable of sourcing. For instance, in the case of a 12 Watt 5V adapter, the supply is capable of providing up to 2.4 Amperes of current. That is to say, the supply only guarantees it can keep its output at 5V if the device draws less than 2.4A of current. If the device draws more the voltage may sag which may cause the charge process to terminate.

What this means for your question is this: all other things being equal, the power rating of the adapter makes no difference to the charging process. So long as the device does not draw more current than the adapter is capable of supplying the charge process will proceed at the same rate.
I mean use of RSA-1024 or DSA-1024 anywhere, for any purpose, is really too small for safe use now.

By "on your keyrings" I mean that quite a few PGP keys in the wild still use DSA-1024 master signing keys with (often much larger) ElGamal encryption subkeys (as DSA was not specified for a long time with keys beyond 2048-bits).

However, DSA-1024/(ElGamal-anything) is not a safe configuration anymore - an attacker who can do a discrete-log on a highly-valued 1024-bit finite field can recover the signing key, and sign things - including software released under that key, or grant themselves new encryption subkeys of any strength.

It may therefore be a good idea to review your PGP keyrings for any master keys you trust which fit that 1024-bits and below criteria (look for 1024D, or below), as they definitely are overdue an upgrade. You may find that a fruitful search, with a few surprises still. For example, to pick one high-profile signing key that would doubtless have been interesting to Nation-State Adversaries and would have been susceptible to such an attack: http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xE3BA7... ˙ ͜ʟ˙

The common safe configuration for modern OpenPGP (and upstream GnuPG's current default, I believe) is to use RSA signing keys and RSA encryption subkeys, each of at least 2048 bits - really I'd recommend 3072 or 4096 bits, as use of PGP is not as performance-sensitive as TLS and there is no forward secrecy, so I wouldn't really recommend going much below a ≈128-bit workfactor (equivalent to ≈3072 bit RSA or ≈256-bit elliptic-curve).

Edward Snowden trusted RSA-4096 signing and encryption keys with his life, and that obviously worked out fine for him at the time.
I've never been poor in the terminal sense, but there was a time when I had no money. I wasn't desperate, and I was beginning a career with a lot of promise, but I was also too proud to ask for help from friends or family.

During that time my car broke down, and it would cost $3000 to fix it. This was money I didn't have. The car was otherwise reliable, so overall it would have been a good financial decision to fix the car that would have provided me with more than $3000 worth of transportation amortized over its future useful life.

But that didn't matter, I couldn't afford to fix it.

I did need a car though, or I couldn't get to work. What I could afford was to take out a loan to buy a used car, even though that used car was not as reliable as my previous car and cost more than $3000.

I ended up getting the used car. My decision to do that was based on my need to get to work and keep my job. It was the right decision, but had I had an extra $3000 in cash, the right decision would have been to fix my otherwise reliable car.

People without extra cash are constantly one misfortune away from a downward spiral.
Why not fork PuTTY?
> Don't most people install stuff in Windows through Ninite when possible these days?

No, most people do not.
Because, and maybe I'm old-fashioned, I don't think it is the appropriate place for it. Besides, I try to find other ways to express myself. Swearing, to me, is lazy and I don't want that to be something someone remembers me by.
The second-to-last point makes zero sense in this context. What makes you think that your browser is any more trustworthy?

And of course, none of this matters when you're running this software on a closed-source operating system - one which you, therefore, have virtually-zero ability to independently audit. So even if your programs are perfectly trustworthy, the underlying operating system has free reign to compromise them without you being able to detect it or do anything about it.

Probably the most surefire way of being actually secure is to drive to Calgary and pay Theo de Raadt to burn you an OpenBSD CD-ROM right before your eyes, then install it on your computer (and even this is fraught with danger; who's to say that Theo isn't going to backdoor your installation?). Virtually every other method of installing anything is insecure, whether you download the thing or have the thing mailed to you or what have you (the sole exception being to download the source code, manually audit it yourself, and manually hand-compile it to machine code - can't trust that compiler to not be compromised, after all). And on that note, you therefore still can't trust Theo's custom-made OpenBSD CD-ROM, since he very well might have compiled it with a compromised compiler, so now you have to take the OpenBSD source code and hand-compile that to machine code before you can do anything else.
Status Update on Upb and Ruby Protocol Buffers
With macros being so easy to write, and so idiomatic to the way the language is used, isn't it very difficult to understand a Lisp codebase that you are unfamiliar with?

While I like Lisp a lot for my own projects (well Racket in Dr. Racket to be specific), I don't feel very comfortable trying to understand other people's code.

Other languages like Go, for example, seem a lot more tractable when you have to grok a large foreign codebase.
Sounds interesting. When do you expect to launch ?
Oh, the irony. Your website is blocked at work.
Perhaps my wife enjoys BDSM and thus loves being beaten while at the same time being in a loving marriage with me. Different perspectives yield different conclusions, especially when whether or not something is "currency" depends entirely on perspective itself. Hopefully you can realize that.

I'm curious to hear why you think it's more then "currency." Personally I think you can't even call it a currency yet.... Though this may change down the road.
> Forget the "do you have a product" economic argument, it's a simple matter of fairness/reciprocity:

Do you gain anything from reading/viewing their content?

Yes? (You wouldn't have requested their site if you didn't) Then why should they not gain something in return?

> as I defend myself from those dangers that they have unilaterally introduced.

You were "unilaterally introduced" to dangers from the site you specifically requested by either clicking the link or typing into your browser?

This is all pretty dramatic - they're ads.
> Where is the line?

There is no bright white line. It's more a thing of legal compliance. A death by a thousand cuts/thousand checkboxes.

If I rent an office floor and run my own datacenter then I'm legally responsible for all of it. There is no need for a data processing agreement because i'm not having my data processed by a different legal entity.

If I colocate in a datacenter but the servers are my property then i'm still legally responsible and only have to show that the servers are physically protected from unauthorized access (locked cage and such)

If I buy a managed server things already get dicier. It means a 3rd party has access to the data. But at least you can find a hoster in your own country which removes a lot of headaches because it's fairly easy for them to comply with local laws. You sign a data processing agreement, they secure their datacenter (physically/organizational/networking) and you're done. In case of a data breach you might have to hash out responsibilities.

Cloud services on the other hand easily span continents, are run by foreign companies and span multiple legal systems and the machines they offer are a lot more ephemeral and more tightly integrated into a shared management architecture, which makes it much more difficult to audit and demonstrate isolation of your machines.

If your system gets audited then either your auditor will have to inspect the system himself or will require certifications of your providers adhering to specific legal standards. Having a large, international, tightly interwoven provider makes those certifications more difficult because they have to comply to multiple, possibly conflicting legal systems. If they cannot offer those certifications then you cannot use their services because your auditor will reject them.
Oh, I'm well aware of why the WP hegemony continues. Just wanted to point out that it's not through lack of alternatives.
FUSE and SSHFS on OS X
I assumed it was from Rohl Dahl's The Big, Friendly Giant...
Downloading BINARY software safely is impossible indeed.
Downloading SOURCE software poses no security risk.
As long as only human read those sources, to check for this software behavior.

WHEN the sources have been audited, and cleared for any security or other bugs, you may consider compiling them.

That's where the real crux of the problem lies:
https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
http://c2.com/cgi/wiki?TheKenThompsonHack
You cannot trust software more than you trust your compiler or your interpreter or in general, your processor.

Since big commercial OS providers are KNOWN to be collaborating with the NSA to but backdoors and spy on you in the first place, you cannot have any trust there anyways. Why worry about random binary software on the web, when your base OS is already compromized?

Otherwise, you may choose to use hardware that you trust, preferably, that you have built yourself. Alternatively, you may build a computer using triplicate parts from different sources (eg. put an Intel, an Elbrus-4C and a Godsoon, and compare bus traffic. As soon as a difference is detected, raise an exception and abort the process), similarly, put three different network controllers, made in three different countries, and compare output packets. As soon as there's a difference, drop the packets and signal the process. etc.

Once you've got a trustable hardware base, you can build a trustable software layer, using only sources and bootstrapping binaries by hand (with people you trust, preferably yourself), and as indicated in Countering Trusting Trust through Diverse Double-Compiling, http://www.acsa-admin.org/2005/abstracts/47.html
you may implement also at the software level, a similar kind of redundancy that allows you to increase the trust you may have in your bootstrapping chain.

But there is no way out, you have to start from the sources, read them and consider only source code when exchanging software.

Notice that debian is a binary distribution. Gentoo is a source distribution. Gentoo is more trustworthy (but you need to be careful how you bootstrap its installation, which is not easy).

This is why licenses such as the AGPL, and also works to make software higher level and shorter (understandable and therefore trustable by end users) such as Alan Kay's, are important.
Already been done. Meet KiTTY:

http://www.9bis.net/kitty/?page=Welcome&zone=en
FTFY: Creating websites with very light fonts and low contrast is a bad idea.

tl;dr: Using the wrong tool for the job makes life difficult. Go figure.
> Briefly wonder if Tatham’s PGP keys are noted in a central registry, such as MIT’s PGP key server. Nope.

Putty's keys are on the MIT server if you search for "putty": http://pgp.mit.edu/pks/lookup?search=putty&op=index

Still, agreed, it's a lot of work -- most people won't have gpg/pgp installed. Someone should sponsor Simon's codesigning cert for now.
What causes you to say that putty is pretty awful?
> However, the carry flag produces false positives because nearly any negative delta will cause a carry to happen.

Correct me if I'm wrong, but I think that when going to the right, the carry flag indicates that it wrapped, while when going to the left, the carry flag indicates that it didn't wrap. So the flag is still usable when going to the left, just interpret it the opposite way. Do you think that's correct?
The current butter crises is not as bad as the previous ones. While my local grocery store regularly has a sign saying "butter sold out nationwide" the 7-11 down the street seems to have some and the bakery next door is using a lot of butter in their products.
Towards a Taxonomy of Logic Puzzles
Besides all the waffling here, what I'm reading is that some people want insurance against a bubble popping.

And that seems reasonable, but I'm not sure how you expect that to work, given the last bubble caused entire companies to go under, and multi-year commitments to staff might cause even more to go under, or at least through bankruptcy proceedings where they will shed those staff anyway.
They've been hiring Android developers recently to work on the Beats music app, which is likely to become the Apple streaming service, so there's a good chance it'll be on Android too. No idea whether it'll be any good, of course.

I suspect the main thing that will limit Apple's streaming service is availability: iTunes Radio is only available in the US and Australia. I think they're being punished a bit by the record labels, after Apple took over the digital downloads market, much to their displeasure.

That said, if Apple's streaming service comes to the UK, I know I'll drop Spotify in a heartbeat. I couldn't be more disloyal to Spotify: I only use them because they're the only service with the exact combination of features I need (besides Rdio, who I don't use because their desktop app is - incredibly - even worse than Spotify's).
Try the following:
-start/stop exactly on 1.00
-start/stop faster than 0.10
-spell stuff upside-down (0.7734, 55378008, etc.)
As someone who left the valley. I think not. I think we are the lucky ones.
The valley is only useful for VCs and having an enourmous choice of startups.
But honestly life is better away from it. Unless you can afford a 3M$ house.
Show HN: CrudKit – Open Source CRUD Framework. It's Like Django Admin for PHP
Are there any optimizations or explicit support for proximate ordered joins?