skysight-inc/HackerNews huggingface dataset:
If you can break the DH exchange in the DHE ciphersuite, you can recover the session key and decrypt the traffic. That can be a complete break of that particular session without any need to break the server's long-term RSA key. It's quite possible to have a situation where the TLS_RSA... used a 2048-bit RSA key while the TLS_DHE... used a 1024-bit (or worse) DH parameter. In that case an attacker could have an easier time breaking the 1024-bit discrete logarithm problem compared to breaking the 2048-bit RSA problem.

To answer your question more directly, the DHE does use a different form of key establishment which uses different algorithms, different parameters, and potentially different parameter sizes. The forward secrecy is a desirable property in itself, but under some circumstances implementations might use weaker cryptographic parameters in conjunction with it.

(Daniel Kahn Gillmor first told me about this problem; in TLS_DHE_RSA the RSA key is used for authentication of the DH key establishment -- to stop someone from doing an active MITM attack -- but not for the key establishment itself. In TLS_RSA the RSA key is used directly for key establishment. Thus when you use TLS_DHE_RSA, your security levels may be limited by the weakest link mechanism that you rely on for security, which could conceivably be the DH exchange, depending on other features of your configuration and environment. A number of folks have been aware of that particular problem to some extent for a while and even discussed it at, for instance, the IETF TLS working group, but this paper takes things considerably further and makes the problems really concrete.)

Edit: upthread you can find a link to pbsd and AlyssaRowan discussing forms of the problem half a year ago, including the fact that you can get less security from weak DH parameters than you would have gotten from strong RSA parameters, despite the presence of forward secrecy. In some settings there cost trade-offs are possible for attackers between breaking particular sessions vs. breaking all traffic to a particular service.
That would be a bad excuse for not improving even if GT matched the state of the art. But it's doesn't for many/most languages.
Well with the social discourse in the US of A being what it is, being called a bigot right now is a badge of honor.

Also generational cohorts exist. People got shaped by the great Depression or WWII or Cold War or End of Cold War, 9/11 and Iraq and great recession ... They have/had different experiences, different outlooks, different values and so on ...
Update: PS4 Remote Play App works for all Android kitkat devices again
Nicely put - as somebody who lived through similar imprinting. The imprinting is real, but I do get irked by crude marketing attempts to lump me in with my cohorts.
Programming without for loops
It is called Rust.

Besides, Ada is actually being used a lot in high integrity systems, just not on the Facebook clone of the month.
I agree with most that has been written in the article.

There is an interesting (actually) counter-example to the preformatted typical Ted Talk: French designer's Philip Stark https://www.ted.com/talks/philippe_starck_thinks_deep_on_des...

This talk is so out of line with the other TED talks that I was a bit disturbed the first time I saw it, but actually this is the one that I still remember the most vividly five years after. Of course, it takes a real genius, and not just a marketing "genius", to deliver such a particular performance, and get away with it.
Just so I'm not misunderstanding: we just have to take it on trust that the developer isn't holding onto the data we upload, right?
PSVita’s Mystery Port Explained
Secret vessel to test durability of materials in space
The timeworn advice is: "TLS for data on the fly, GPG for data at rest". With suitably updated TLS/SSL libraries and configurations, and good GPG keys, this is still sound advice.

The big question in my mind is always "Does the server need to be able to decrypt that data?" If the server has the decryption keys, the attacker can probably steal them along with the encrypted data. I store GPG encrypted data on servers where they only have the public key - retrieving the data involves grabbing the encrypted data from the server and decrypting it somewhere else that has the private key available. (This is a handy trick for web forms that collect sensitive data - serialise it and GPG encrypt it immediately, then you can happily send the encrypted blob via non-100%-reliable email,and have the local encrypted blob available if the email copy fails to arrive.)
Mat Latos Throws a Pitch That Nobody Else Has Thrown
> No they are not. A VM is a completely different system, while a container is a packaged application.

I think you have a misunderstanding of terms here, possibly confused by all the fuzz around Docker.
A container is nothing more then a virtualization technology on OS level[1]. What you are talking about is something like rkt, which is how to run an app inside a container[2].
From the point of your app there is no difference between a VM, OpenVZ or LXC.

[1] https://en.wikipedia.org/wiki/Operating-system-level_virtual...

[2] https://github.com/coreos/rkt/blob/master/Documentation/app-...
It depends on the size of the RSA key. With LogJam TLS_DHE_RSA_WITH_AES_256_CBC_SHA is likely weaker; with TLS_RSA_WITH_AES_256_CBC_SHA the client essentially makes up the shared secret, encrypts it using RSA and sends it to the server [1]. That exchange simultaneously establishes the session key and authenticates the server.

With DHE, the Diffie-Helman exponent math is what establishes the shared secret, and if the DH prime is broken, then the shared secret can be derived by a MITM. The public DH parameters are sent in the plain, so a MITM can just observe them. A hash of those parameters is signed using RSA, so they can't be changed, but that's not important to defeating forward secrecy.

So if if the RSA key is bigger than ~1024 bits, then TLS_DHE_RSA_WITH_AES_256_CBC_SHA is likely weaker.

[1] There is some further derivation done to get the actually session key, but that's not relevant here.
Misconfiguration of state.gov website exposes sensitive defense contracts
It used to be that only mechanical engineering was engineering. Now we have civil, chemical, electrical, et cetera. What is happening to software engineering is quite similar to what happened to other branches of engineering. The main difference is that the cost of producing software is usually dominated by design and labor costs (but not always). Before we had a grand tradition of aerospace engineering there were a couple bicycle manufacturers who strapped wings to their contraptions and tested them in a wind tunnel. The dawn of aerospace was all about fashion the same way you describe software engineering today: rock stars cavorting about the globe designing airplanes out of wood, cloth, and instinct, all to adoring crowds.

But the reason it seems like software is all about fashion is because you are browsing Hacker News. Hacker News is a fashion website for computer hackers, not unlike Wired but without its own articles. If you go look at actual software companies you will find a lot more reliance on well-researched tools and techniques. If you restrict yourself to places where other costs outweigh design costs, you'll see that it's much more familiar. Look at the software engineering effort for the STS, for example. Incredibly low defect rate.
FirefoxOS?
To lighten the mood that the Nietzsche quotes in this article may evoke:

http://www.newyorker.com/humor/daily-shouts/switched-standin...
> Prisoners of war ended in Siberian gulags for centuries, while the GDR was constructed at home.

I think you mean decades?
Millennials, consultants advise prospective employers, feel entitled to good treatment even in entry-level jobs

Perhaps because it's the decent thing to do? Just as an older generation would see racism as poor behavior and the next would see sexist behavior as abhorrent, maybe we're on the right track here? When did the golden rule stop applying to those on a lower rung?

Millennials won’t buckle down and buy cars or houses

Millennials earning more than me can't afford my property - they'd have trouble paying rent for it. As for cars, if you live in the city they have a higher cost to the user than overall utility.

tweeting and texting and posting selfies and avoiding responsibility.

Looking around, I see a lot of older people doing the same. Perhaps because we hold the younger people in a different esteem we're just looking for a reason to judge them.
Why Companies Outsource to INDIA?
My side project tries to give secure default settings for all major webservers and other software (like haproxy, mysql, mailservers etc): https://cipherli.st/

From the start it has listed the suggestion to set up >2048 DH keys.

If you want to test your site for export ciphers, you can try my other side project: https://tls.so/ - you can also use the SSL labs test but mine is faster for just testing ciphersuite. (And it's open source, so you can use it internally as well).

Mozilla also has a good wiki page for SSL settings: https://wiki.mozilla.org/Security/Server_Side_TLS
Sadly both suffered from enterprise prices by the compiler vendors.

Although Ada seems to be quite well in high integrity systems. At least that is my perception from the, now regular presence, at FOSDEM and European safety conferences.
Introducing the future of Social CRM technology
That's a good point. I suppose this thing is a natural driver of the recent focus on user-traction over profitability.
New tanks in the age of unmaned drones and high precision veapons, state sponsored ressurection of dogmatic religions, as if last 3 hundted years of philosophy and sciences never happened, rapid transformation of the ruins of Soviet Union into an olygarhic Orwellian state.. We are still so deep in the past century, ignoring and distorting the objective reality in which we are losers who ma aged to ruin themselves due to greed and ignorance..

There are not a sigle chance of making a successful rival to Android, simply because it requires much more than a huge pile of dumb money and based on self-delusion arrogance.
So good! That could be a fun public speaking exercise, give an inspiring talk without actually saying anything.
Tizen, since Samsung's all over it like a cheap suit. And South Korea is a lot closer than the USA and far more easily controllable/nuke-able if they misbehave and put backdoors into Tizen. I could definitely see Tizen becoming China's next mobile OS.
Given that there are in fact phones on the market that do not include Google's Play or apps, such assertions need references. So what "draconian agreements" are you talking about?
I'm on the unstable channel here (44.0.2403.4 (Official Build) dev (64-bit)) and even that seems vulnerable.
Nooby Ratter got caught
Found a ratter with bad encrypting skills ran his program through virustotal, hey what do u know his ip is there lol

DNS requests:
stefanbeltran.no-ip.biz (147.194.144.51)

TCP connections
147.194.144.51:9999

UDP communications
8.8.8.8:53

His location
147.194.144.51	Canada Ontario Toront Comwave

43.6181	-79.4967
Thanks here as well. I never even thought such a feature might exist. Love it!
Amazing stories...

I found myself "struggling" in college (3.5 GPA in American, 26/30 in Italian) and I am surrounded by successful kids that have no answer to the question: "What you want to do ?" nor I see any effort on them to learn anything other than what its feed in our young brain...

I am going back to class to regain my humbleness...
I cannot recommend FlashGraph strongly enough. FlashGraph was one of the first graph computation engines to enable near trivial analysis of the Web Data Commons Hyperlink Graph - 3.5 billion web pages and 128 billion links.

For smaller graphs, analysis using FlashGraph is hilariously quick.

If you're interested in how this is achieved, refer to [1]. From memory, Da Zheng said he created FlashGraph primarily as he wanted to prove how efficient the storage system was. Full details on the FlashGraph (though FlashGraph runs far faster now!) in the paper at [2].

Note: I'm a data scientist at Common Crawl, the dataset that the Web Data Commons Hyperlink Graph is based upon and the main developer of Flash Graph, Da Zheng, wrote a guest post for us on this very topic[3], so I'm rightfully biased as to thinking this is an amazing project!

[1]: http://www.cs.jhu.edu/~zhengda/sc13.pdf

[2]: https://www.usenix.org/system/files/conference/fast15/fast15...

[3]: http://blog.commoncrawl.org/2015/02/analyzing-a-web-graph-wi...
Money Temperature (thoughts)
Unknown Hackers hit systems at Bundestag
Just because it is in ASM, doesn't mean an exact equivalent in C won't smoke it performance wise. Just sayin... Aside of intellectual curiosity, one would be very hard pressed to write ASM code that is even barely more efficient than C code generated by a decent compiler, i.e. clang, or Intel C....
Thanks for this clear explanation, the IO monad is starting to make sense to me now...
Asm can do anything. :)
u p v o t e!! Brilliant (IMHO). I don't even want to think how many shift+: chords I've done could have been just a semicolon.

Even better:

nmap ; :
noremap ;; ;

Idea from http://vim.wikia.com/wiki/Map_semicolon_to_colon
Start with the end in mind
Yup. Agreed. This was war. Putting young humans whose brains and morality are still in flux into such insane situations = a loss of humanity.

It's more surprising to me the naiveté (which is hard to see as anything other than a put-on in this article) with which we view these events.

Humans do horrible things to other humans in war.
2KB to blink LEDS? seriously? this needs to be on the order of a few ten of bytes to be competitive...
Love telling stories with data? Amplitude (YC W12) is hiring a writer
Amplitude is a mobile analytics company committed to providing user insights that help drive growth for app product teams. We’ve built an analytics platform that enables our customers to understand their users and discover the user actions that lead to app growth.

We’re looking for a full-time writer to help us tell interesting stories with our data and produce actionable content for our readers. This job is for you if you:

- Love telling stories with data.
- Are eager to come up with interesting stories to write about that relate back to Amplitude’s area of expertise.
- Are skilled at synthesizing lots of information and explaining complicated concepts simply.
- Enjoy doing the research necessary to write a good story.
- Are passionate about any of the following: mobile, apps, analytics, and most importantly: data!
- Are comfortable working with a technical product. Amplitude is a technically complex product, and you’ll need to communicate the value of our platform to an audience of both technical and non-technical buyers.

Responsibilities will include:

- Coming up with story ideas and writing regular posts for the Amplitude Blog (blog.amplitude.com)
- Working with our data science team to find and tell interesting stories with our data
- Writing high-quality, actionable content for our target audience and customers about growth and analytics best practices
- Helping produce other marketing content, such as guides, eBooks, or white papers
- Helping to distribute content across multiple channels: social, e-mail, guest posting, etc.

We are interested in hearing from a wide range of applicants -- anyone who has great ideas and a desire to write stories.

This job is for you if you're looking for a challenge and want to push your boundaries and grow as part of the team. Although we're a small startup, we're growing quickly! Everyone here has to take on more responsibility than they've ever had in a previous job. Job descriptions for every role (including this one) will change every 6 months. That opens up a lot of great opportunities but you also have to be comfortable with change.

How to Apply

Send us an email (careers@amplitude.com) with the following information:

1. What you consider to be your relevant resume information (links to your online footprint, your Linkedin, your resume, etc.).

2. A list of story ideas. Check out our blog (blog.amplitude.com) to get a flavor for what kind of topics we’ve covered. We’re also planning on using the proprietary data we have on app usage to find interesting trends and write stories about that, so please include some ideas that utilize that data as well. Please include the angle you’d take rather than just a topic or headline.

3. Your best writing sample. Send us a link or attachment of the writing sample that you’d like us to read. You can send along more than one, but please specify which one you’re most proud of.

We look forward to hearing from you!
--
Meet the Amplitude team here: https://amplitude.com/team
Benefits, etc. here: https://amplitude.com/careers
Show HN: Building a Twitter Bot
It's refreshing to see honest assessments like, "I am honestly not sure what it means — VC machinations escape me.", particularly from as high a profile a journalist as Kara Swisher.
Candidates for Neo900 WLAN/BT/FM/NFC module (2014)
Stunt Hacking: The Sad State of Our Security Industry
It's not particularly surprising to the IETF TLS Working Group either, which is at least partially why https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe... exists.

Minimum 2048 bits, please note. 1024 is not safe - and has not been for quite some time. GCHQ and NSA can definitely eat 1024-bit RSA/DH for breakfast at this point (although it does still take them until lunch).

(Those of you still using DSA-1024 signing keys on your PGP keyrings should reroll RSA/RSA ones. I suggest 3072 bits to match a 128-bit workfactor given what we know, but 4096 bits is more common and harmless. 2048 bits is a bare minimum.)
Of course, the dynamics of video-game playing in zero-gravity should be interesting. (Do optical drives work in zero-g?)
I should clarify, not kill others, kill each other. Its tricky living together for months and months, isolated away.

Cabin fever is a thing.
I dunno, is operant conditioning just a formal term for what was always practised? The only negative conditioning is the lack of a reward?

(And what did you fly? A pleasant surprise to meet another falconer on HN. I flew Harrises and various accipiters. Lost my last bird in January to a wild peregrine and am considering a female sharpy for my next bird.)
Absolutely spot on - between FlashGraph and Frank McSherry's COST work, the two have really pushed the envelope on efficient large scale graph analysis.

Frank McSherry wrote a "call to arms" for the broader graph community at [1]. The main point of interest is that academia generally compared their work with existing distributed graph processing systems, celebrating when any achievements were made, yet not aware of the significant overheads brought on by the distributed approach. Both Frank's work (run on a single laptop) and FlashGraph (run on a single powerful machine) run far faster than the distributed approach and have very few disadvantages.

Note: I'm a data scientist at Common Crawl and Frank's graph computation discussion article was a guest post at our blog.

[1]: http://blog.commoncrawl.org/2015/04/evaluating-graph-computa...
Nasdaq experiments with Bitcoin's blockchain
Absolutely agree with the sentiment.

A few times I had to help out friends customize something I was horrified at the overall level of code quality. It looks as if a B-level programmer started it and C-level programmers helped... And I think this is the crux of it. A-level programmers in general are not interested in such frameworks because they know how to use less friendly ones (and thus don't work on WP & co.) while C-level programmers need such a solution and are willing to help... to the best of their ability of course.

That said, they made WP very convenient to use (great admin console, easy installation, no major headaches... well, apart from vulnerabilities ;). Other projects should learn from that. Who cares about great foundation if UX sucks? (Typo3 anyone?)

EDIT: replaced "C programmers" with "C-level programmers". I am not talking about those who use programming language C. :)
" We further estimate that an academic team can break a 768-bit prime and that a nation-state can break a 1024-bit prime. Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains."

We need a new web.
Hey no need to apologize, I didn't even know about v until I tried it. So thanks for that.
TEDx might be largely garbage, but it has this talk which actually changed my life: https://www.youtube.com/watch?v=d0yGdNEWdn0

Strangely, this guy does not even promote his book. His book completely changed my mental approach to language learning. I highly recommend it to anyone who is learning a language.
> self-delusion arrogance

What else do you expect from a country lead by a guy who rides bare chested on a horse in his campaign promos? I might be biased and all, being originally from Ukraine, but this effort is clearly grandstanding and nothing else. Remember, this is the same country where one of the main news anchors goes on TV regularly, and announces how Russia is the only country in the world with with will and the technology to wipe the United States off the face of the planet. Even the politburo back in the USSR days wasn't stupid enough to say something like that, not because it isn't true, but because they understood how mutually assured destruction works. The scary part is, it's possible that the leadership in Russia really is stupid enough to do it.
This reminds me of the good old PlayStation2's "Emotion Engine" hardware; it has a 2,560-bit wide memory bus in the GPU. Of course that's three independent read (1,024) write (1,024) and read/write (512) buses, but still it was pretty wild back in the year 2000.
Economy Looks Like It's Picking Up Which Could Mean a Slowdown in Tech Investing
You are likely keeping them for a reason, but I'd like any and all unique copies.
Accessibility on Apple Watch
North Korea says it has miniaturized nuke weapons
Mobile Parking Lot: the tool that lets anyone know you're paying attention
Fibonacci Clock - Try telling time with this clock
Doesn't seem to work here (Finland) either.
Great points, and fits my observations of this post-technology culture. Distaste and disgust are systematically being moderated out of this community, along with creativity and risk.

To the Church of YC congregation, Sam Altman worshippers, VC plantation hands, and michaelochurch haters... why didn't you kill yourself already when your parents slammed you for getting your first A-? The majority of you are only here because you want to fit in, so props to michaelochurch for always bringing the realness.
I love that if you google "unbeardily," all the results point to this story. Do you think it's a "trap street"?
HTTPS-crippling attack threatens tens of thousands of Web and mail servers
This would help me tremendously if it was an open source lib.
By far David Lee and SV Angel have been one of our best angel investors at Comprehend! Sorry to see him go, wish him the best!
Yes, why wouldn't they work, they don't particularly rely on gravity to operate. But then the question is why use optical drives at all?
Scrypt in IETF
I agree with everything you've written here. It's not unreasonable to look at large groups of people with something in common and draw statistical conclusions about them. What's unreasonable is to look and a single person and think "because he's from this generation he must think that".
They actually considered four projects (AOSP, FirefoxOS, Tizen and SailfishOS), but first two are maintained by US-based corporations and apparently Samsung is also not reliable partner in their eyes.