skysight-inc/HackerNews huggingface dataset:
Exactly. The code and executable might not match. As in obfuscated C, the code might be subtly designed to fail. Further, the code might work but be integrated with libraries or deployed on an OS that the enemy knows they can hit. The security case of a given piece of software always depends on the reviewers and knowing you're using what they reviewed.

That this is usually lacking in vast majority of software is why we're seeing a ton of vulnerabilities in both commercial and FOSS software.
Every time I see a service offering some resource as "unlimited", I think of using it as a free backend.
> But there is probably no interest...

FWIW, this sounds like a hook around building a business for "next-gen" garage door openers. Security, quality of build, and convenience are among the factors that could be pitched to early adopters. Heck, this even feels like something that the right small team could work into a really sharp Kickstarter pitch, if so inclined.

One tricky problem is that garage door openers tend to "just work" for a long time. Over and above cost, upgrading is a much larger installation hassle, far larger IMO than e.g. Nest thermostats had to overcome. All of that will limit adoption rates, even for willing early adopters. A retrofit angle would help, akin to the retrofit-smart-deadbolt market.

An "interesting" sales objection would be this tech not working with cars that have built-in recording garage door remotes (vaguely similar to home theater smart remotes, for those unfamiliar).
Haha, I loved that search results pipe! The product was amazing at the time. It's really too bad that Yahoo didn't try to make something more out of it.
I'm not an expert in this area, by any means. And I certainly can't speak for these people. But, I imagine on average that the people who choose/are able to immigrate here have an above average work ethic, skill set, or access to resources. There are probably many people who never have the chance to start a life here. Its not a direct comparison.
drake[0] from factual falls into this category as well.

[0] - https://github.com/Factual/drake
It says in the readme he uses wxPython (wxWidgets). You could also use Qt as I believe both use native Cocoa underneath. You can't do everything that is possible if you were coding on Obj-C or Swift, but the stuff you can do looks native. Both have bindings in many languages.
Jolla (https://jolla.com) was founded by people involved in MeeGo development. While their phone got a lukewarm response, I've heard many good things about their upcoming tablet and have ordered one. As you used MeeGo, how does Sailfish OS appear to compare with it?
No wonder why this is everywhere:

The hungry white ape

aches in the ancient canyon.

Autumn colors crunch.

https://www.google.com/search?q=%22%22The+hungry+white+ape+a...
Not a military dictatorship but they did have "The Emergency" http://en.wikipedia.org/wiki/The_Emergency_(India)
Perfectly worded.
The comment is calling into question the intent of Microsoft in removing the diffuser. They thought it was important in benefiting security. So, did they remove it for performance or yet another concession to U.S. government? It's a valid question in assessing Microsoft's trustworthiness for security/crypto.

Of course, we already have plenty on that subject. A good answer won't change anything. A bad one is extra nails in the coffin.
Here's my own rewrite of selected paragraphs:

> Using a new security system known as Einstein, the OPM detected a network intrusion in April 2015. The FBI said it is investigating the breach.

> Ken Ammon, chief strategy officer of Xceedium - a information security firm - warned that the hacked data could be used to impersonate or blackmail federal employees with access to sensitive information.

> Congressman Adam Schiff has called for database software to be upgraded in light of the most recent attack.

> Americans "expect that federal computer networks are maintained with state of the art defenses", Mr Schiff said.

> "The threat from hackers, criminals, terrorists and state actors is one of the greatest challenges we face on a daily basis, and it's clear that a substantial improvement in our databases and defenses is perilously overdue."

edit: bhauer, your edits are hilarious.
protocol buffers -> thrift
This would be the right solution.
This isn't an area that I'm particularly strong in, but I think that the way that imgur compresses images[0] might have a noticeable effect on this.

[0] https://help.imgur.com/hc/en-us/articles/201424706-How-does-...
There's always a need for special purpose cryptosystems. Something that simplifies key management (e.g., for banks) will always be valuable, and it probably won't be sitting around on some random dude's hard drive.
I'm not sure if this is meant to be serious or not. I suppose if someone has no experience outside of the Java ecosystem (like many of the developers I've had to work with over the years), Maven and OSGi might appear to be 'good' things.
Well, I haven't lived in Canada for a few years . . . I find Canadian reporting to be somewhat better than the U.S., but not nearly as good as some of the international sources like the BBC and Al Jazeera.
Ask HN: How do I get into software security testing?
Are there certifications that clients look for? Are there classes or fields I can focus on while still in University? Is it similar/the same as penetration testing?
Monitor an SNS Topic with AWS Lambda and Cronitor.io
The Cool School: Story of LA's Ferus Art Gallery
What I find most interesting here is that the government is clearly afraid of people using encryption against them, and yet most people seem to not have considered the thought of others using encryption against them...

On that subject: http://www.gnu.org/philosophy/right-to-read.en.html
Exactly what you said whether people like the lock analogy or not. I used to encourage the use of high assurance security that comes from defense sector. People said "but they might be backdoored by NSA!" I said, "Maybe but they'll protect you from all the other threats which are doing the real damage here. You can always layer something foreign in there if you want to give NSA headaches." Same concept.
"Crime happens when cultural and legal sanctions against crime don't get enforced."

The ways poverty and extreme inequality affect culture and law outcomes are fairly profound though. Cops are loathe to arrest wealthier people on drug offenses considering the legal costs that can ensue. Put enough people in poverty together and desperate behaviour of one kind or another can become normal.
I hate this website. Trackpad scrolling is a workout. Spacebar is glitchy.

How this design is any better than those clickfarming slideshows, I'll never understand.
The availability of real-world signed network datasets is really great, I've used the Stanford Large Network Dataset Collection in the past to test predictive accuracy in reputation systems. (Looks like they added a new dataset to the "signed" category -- wikipedia requests for adminship.)
How easy is it to tell encrypted and compressed material apart? There would be little structure in both, I think.
Possibly. Searching up some of the content on there revealed this[0], so at least some of it is (most likely) data.

[0] http://a858.soulsphere.org/

Edit:[1] shows that this is most likely a false-positive.

[1] https://www.reddit.com/r/Solving_A858/comments/24vml1/mime_t...
We used wxpython, which uses native GUI elements based on the OS. There are bindings for other a bunch of other languages too: https://www.wxwidgets.org/
The problem is that the address is typically larger than the actual data you want to store.
How about just a project that implements an S3-style directory system, with a "fill in the blank" for you to implement the storage backend?

That is, for a given storage medium, all you have to do is implement methods for "write key-value pair" and "read value at key", and you get to piggyback off that medium for your storage.
Paul Haberli made ConMan on SGI workstations:

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.78.5...

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.78....

ConMan: A Visual Programming Language for Interactive Graphics (1988)

Abstract

Traditionally, interactive applications have been difficult to build, modify and extend. These integrated applications provide bounded functionality, have a single thread of control and a fixed user interface that must anticipate every-thing the user will need. Current workstations allow several processes to share the screen. With proper communication between processes, it is possible to escape previous models for application development and evolution. ConMan is a high-level visual language we use on an IRIS workstation that lets users dynamically build and modify graphics applications. To do this, a system designer disintegrates complex applications into modular components. By interactively connecting simple components, the user constructs a complete graphics application that matches the needs of a task. A connection manager controls the flow of data between individual components. As a result, we replace the usual user-machine dialog with a dynamic live performance that is orchestrated by the user.
BozoCrack is a depressingly effective MD5 password hash cracker
its like the dust theory in Permutation City...

", he became convinced of something he came to call the Dust Theory, which holds that there is no difference, even in principle, between physics and mathematics, and that all mathematically possible structures exist, among them our physics and therefore our spacetime. These structures are being computed, in the manner of a program on a universal Turing machine, using something Durham refers to as "dust" which is a generic, vague term describing anything which can be interpreted to represent information; and therefore, that the only thing that matters is that a mathematical structure be self-consistent and, as such, computable. As long as a mathematical structure is possibly computable, then it is being computed on some dust, though it does not matter what dust actually is, only that there be a possible interpretation where such a computation is taking place somehow. The dust theory implies, as such, that all possible universes exist and are equally real, emerging spontaneously from their own mathematical self-consistency."

Great book!
We've called ourselves "nerds" since the very early days, at least 5 years.
Model-Based Machine Learning (early access)
That ring is the future.
wait til they hear that Linux has a stack-based architecture. that all C-based software has a stack based architecture. threads with stacks everywhere: surprisingly fast. it's usually things like higher-level architectural patterns and algorithm choices which make a MUCH bigger impact on latency and throughput, than whether you have stacks or not.
This is the Zen of Java.
Exclusive interview: Eric Snowden tells all
That's not true: it's a myth commonly reported by mainstream security types. They say that despite using so-called remote administration tools such as SSH that are specifically designed to do what they say a "backdoor" can't. They contradict themselves.

So, a secure backdoor means you have to make a high assurance design/implementation of a remote access tool plus protect its keys. The last part is harder to do. NSA already does this, though, with their EKMS. So, most technical problems outside EMSEC and side channels are solved for such a simple use-case. It's the malicious insider risk that worries me and U.S. government is so thoroughly infiltrated that giving them keys = giving keys to top opponents. Maybe.

I wish those briefing Congress would bring up this side of things more often while citing DOD's own documents on their thorough compromise by Chinese, Russians, and so on. "Trust us and our double agents to protect your secrets against foreign governments" can't look convincing to most of Congress. ;)
His argument is hearsay. There's no conclusive evidence that a stack-based VM will always perform worse than a registered based one. There are tradeoffs between both designs. With all of the optimizations you see from register based VMs, you end up with larger instructions due to the lack of a stack pointer.

You can claim that the JVM runs faster than Dalvik though, because it has a better JIT that has had years more to improve.

But I don't know why JVM is being compared against Dalvik when ART is where Android is going in the long run, and has AOT compilation that beats Dalvik's JIT.
I think the stipend is much lower but yes. It also depends on the university how much the stipend is. At some schools it might only be like 15k which is not enough to live so you would have to find some way to work also.
Freedom is slavery.
Ignorance is strength.
War is peace.

It's scary how prescient Orwell was.
Yep, the US is a foreign country and hey they do it too. Every country spies!
Being the fastest VM doesn't make a VM fast. It's just faster than other slow things.
ahaha I understand why it would. I meant that the framework is extremely unobtrusive. All you do is create the beautiful expressive javascript objects which act as your models and controls, and then you just mount it with a mithril command, and that's it!
The issue isn't that it's old news, the issue is about how smug the author sounds saying he discovered this himself, when he even documented himself proof that others had already discovered this before.
They mention that the cross-signing means that their certs will be trusted by all browsers out of the gate. Does anyone know if this includes other platforms such as Java? I'm assuming so, but I don't actually know how the cross-signing works.
How much does Spotify cost to run? (2009)
The last panel is also quite similar to the last panel of the last C&H strip as well: https://i.imgur.com/Xdoqd.png
Part of the reason for raising tuition is also to discourage out of state students from applying so that they can provide a relatively high quality of education to state's residences that is accessible to many of the state's residents. Georgia does this, as well as some other schools.
About 90% of positions of the scrollbar are unusable. You have to scroll like crazy to find that specific position that actually displays the page correctly. Horrible.

The page introduces another parallel scrollbar (that has the same function as the built-in scroll bar) and it works really slowly and breaks the built-in UI. At web designers: you have a built-in UI, everyone it used to it, it works, it is tested, use it!
Anything that has "DST Root CA X3", I think.
The angle between your arrow and bow arm may have been too high.

The strongest position is when your arms and shoulders form a straight line (with your shoulders low). So the closer to parallel the line of the arrow is to this, the easier it is to hold.

Now, technically you are correct. If your release is perfectly clean there should be no problem. But in reality, there will be some degree of 'plucking' going on. Your fingers can't open fast enough. So the string actually vibrates a bit from side to side. I have seen some weird follow throughs that avoid this problem.

There are very few top recurve archers that shoot without a guard.
Hopefully 10 will be familiar enough for casual users with the start button back and all!
He's far from an empty suit given the diverse work he's done that's arguably good. He does occasionally make spot judgments that seem weak and go in what I believe is the wrong direction at times. Unlike many, I post counterpoints to him each time on his own blog and he makes no attempts to censor/grayout those via moderation. He rarely gets into those debates: we sort them out instead. Yet, he lets it all stand for his crowd to read.

Not the typical action of either someone trying to hide their incompetence or an ego-maniac. This attitude of his is why a number of us contributed there for years. Plenty of what we posted also pre-empted the Snowden leaks (incl many TAO attacks). Plenty to learn archived over there.
Plotting with Dots
I like roachDB.

It sounds a little more palatable, whilst still keeping the spirit of the original.
Facebook lite
Security contests are the worst way to eval security. It might have something to do with the java prize only being $30K (cuz it's so fucking easy) instead of $75K.

If Fischer Price made "My first exploit" kits it would ship with java.
me too, I have about 3tb of stuff from the Napster days and I've always wanted to upload it all somewhere so I can stream it on my phone.
Show HN: KnowTip app – Know how much to tip worldwide
You Can’t Handle the (Algorithmic) Truth
You're right, I forgot about that.

Since you brought it up, I wonder if encryption and compression aren't both instances of a common mathematical phenomena. They seem very similar to each other.
How to Setup Python Virtualenv on Ubuntu
Curious, wasn't Vista shipping on computers that had to have more processing power and memory? Do you think that would negate the performance argument a bit or not be sufficient? It's hard for me to reconcile Microsoft's argument about security for lower-performance machines when they were forcing upgrades on customers at same time. Not to mention Vista's efficiency tradeoffs. (shudders)
Giorgio Armani didn't accomplish anything until his forties
On a similar note is this flowchart which walks you through recovering from various Git mistakes:
http://justinhileman.info/article/git-pretty/
"companies shouldn't put their customers' access to encryption ahead of national security concerns"

Which "companies" and which "nation"?

Is he proposing Baidu need to work with the FBI to further US national security? Or Xaiomi? Is he proposing Apple and Google should provide whatever-he-wants-to-rename-backdoor-keys* to the Chinese and Iraqi governments for their "national security"?

[*] I propose "Freedom Keys" to replace "backdoors"…
you're just paying for some of the services (transportation, meals, housing, etc.) around it

Heh, that's just a vague line item in a typical US college bill...(university activity fee, computer fee...). The system here is so extortionist on students. Sickening. Go Germany!
Those people don't get the point of Erlang. You'd have to be completely oblivious to complain about performance on the Erlang VM. The Erlang developers will always sacrifice performance and everything else in favor of reliability and response time. Consider that every actor has its own heap and GC. That's slightly absurd, honestly, but it makes sense when you think about Erlang's goals. I just get so frustrated when people say things like that.
"Engineering Culture" photo makes me think of a call center. Why would I want to do something as brain intensive and doesn't do well with disruption as software engineering in the environment depicted?
I agree with the train of thought, but jhallenworld has a point - there's no way to trust the actors sworn-in to uphold such a contract are actually following the contract - nor is there any accountability for such.

I believe you're on the right track, but the underlying problem of corruption - at any time, any person trusted to use their position of power as they're "supposed to" instead of skirting their limitations or trying to find ways around them - still exists in the system you described.

- What happens when the authority figure decides that actual terrorist threats aren't the only things they should pursue with their unilateral control?

- What happens if they take that heroin-snorting secret gay tryst you were in out of context, and blackmail you with it (as happened with the information about intel agencies allegedly knowing about that high level CP ring Britain was involved with)?

Once again, I'm happy to see someone besides myself think in terms of how future social contracts should be modified to address the problems our current ones don't; but I think the problem of corruption underlies any potential social contract solution - because at the end of the day, no matter how many rules and limitations you write up, the people who spend their day-to-day living within the contractual system you've created will find (or create) weaknesses to exploit in that system.

Anonymous redundancy (multiple people needed to access some data; they don't know who the others are) or internal watchdogs (people who don't have control over the system, but can see how others who do are using their control; watchdogs are also not known so as to limit bribery potential) or something would need to exist as a sort of 'immune system' against the evolution of corruption within the contract.
And just for the hell of it, let's throw in the (nearly-never cited) 3rd Amendment.

It "places restrictions on the quartering of soldiers in private homes without the owner's consent". This explicitly was to prevent citizens from having to bear the capital costs associated with the government's own decisions, but it also appears to have been borne out of a fear of having a government agent be able to observe one's most private affairs.

For better or worse, the 3rd amendment doesn't come with the precedents of the 2nd or 4th. There is an argument to be made that by having a General of the US Military capable of monitoring me while sitting on my couch (in a realistic scenario via my cell phone or Xbone), that the military is overstepping its constitutional bounds with respect to my privacy. This would not apply so much to the FBI, but it might eventually were precedent to be pushed in the correct direction.
By the way it is very surprising a description of the 12-bit Genie protocol does not appear to exist online.

Look at the datasheet for the IC they use. 2^12, as it's known, is a very common code and the ICs out there implement only a handful of variations on it.

The other common variants are 3^9 (19683 codes), 3^12 (531441 codes) and 3^18 (387420489 codes).
I've run a few photo sites and one of the things I do on all wild incoming JPGs is do a minor compression on them and if that saves more than about 30% on the file size I just use the compressed version. Then anything that's been camouflaged in there gets dropped.
True, but thankfully the JVM is faster than most compiled languages as well.
What about those who would give up essential safety to purchase a little temporary liberty (not saying that applies here)?
I sometimes don't know where to start with comments like these.

We do in fact know what it is, because no matter what the bits of the secret key are, the use of the key in Microsoft's software is published: the code we're talking about isn't obfuscated.

You say "[l]ogically, we should assume it was a COMSEC backdoor for NSA so Microsoft could make money on exports". You say that as if it was impossible to look at the code and see where the key is used. It obviously isn't. People have done that work. They did it years and years ago. They explained what the key does. But the conspiracy theory about NSAKEY being a secret backdoor keeps coming up.

Once again: the key we're talking about doesn't even make sense as a backdoor. It's a second authentication key, the first of which is a key Microsoft already has, and could already use to the exact same effect.
Pipes was certainly an inspiration behind what we've been working on at tray.io - sad to see this come to a close.

Hats off to all those that worked on the product - great to see it remembered so fondly.