skysight-inc/HackerNews huggingface dataset:
Sorry but gigabytes network simply bring more pixels at once, it does nothing to remove the latency. It's bandwidth, not speed-related. You still get latency. Whether you notice it or not is a totally different issue.
Well BitTorrent's own project Bleep uses the Bittorrent network as well.

Their protocol is more complex however. Their goals are to hide who is talking who, from entities that might just be scraping the DHT. With bluntly, you can tell who is talking to who, by looking at what peers advertised on the rendezvous node.

Because they have control over the bittorrent protocol, they can go ahead and make changes to it that make NAT penetration easier (a 3rd party peer with a public address acts as a facilitator for putting 2 peers behind NAT in contact) or they can allow for arbitrary data to be stored in the DHT.
> Roy Thomas Fielding (born 1965) is an American computer scientist,[1] one of the principal authors of the HTTP specification, an authority on computer network architecture[2] and co-founder of the Apache HTTP Server project.

http://en.wikipedia.org/wiki/Roy_Fielding

A good read, and he's not just blowing smoke.

> If the IETF wants to improve privacy, it should work on protocols that provide anonymous
access to signed artifacts (authentication of the content, not the connection) that is
independent of the user's access mechanism.

But it seems to me that there is basically no way to request access to any kind of data, without it being traceable in some manner; at the very least the ISP would still see the traffic. I guess you could argue for TOR, but that still allows vectors and has its own issues to worry about.

Funny, we need the same kinda access that radio and TV used to provide; where you could just "tune in" to something and have a listen, and you were more or less untraceable; even if you were to broadcast on that frequency your traceability, while triangulable, is still fairly anonymous. But on the internet, there is no such way to broadcast like that. Maybe that's a design flaw, maybe it's a feature.
Really? FB is one of the perfect examples of how much more execution matters than idea.
My colleagues also want to join is there still spots available??
Because the roles obviously were needed. Did you read the article? And they did not know, one guy was even given a raise just before.
golang is the way
For very low karma accounts, yes. After a while, not noticeably for human operators (I delete my accounts frequently; it gets annoying.)
> TLS is NOT desirable for access to public information, except in that it provides an ephemeral form of message integrity that is a weak replacement for content integrity.

TLS both encrypts and authenticates the response. Is TLS authentication a "weak replacement" for some other, better "content integrity" system that's widely available in browsers?

Roy suggests content signatures... but is there a web mechanism to authenticate those? Or is he just wishing there were something better than TLS? (Don't we all?)
Almost every Cassandra feature has some surprising behavior
Second anec-data point, I'm logged in via TBB right now too. I get captcha-ed when I first hot the site over TOR, but it works "as expected" once past that.

(It wouldn't surprise me too much if some TOR exits end up filtered transiently due to abuse - it might be worth refreshing your circuit (or waiting ~10mins for the TBB to do it as usual))
Its all capitalistic mumbo jumbo talk that has created the fear of the Unions. ;)

In reality its a mix of the American People's fear for anything 'social' mixed with the corruption that has happened in the past in the US. However, these are both issues that are relatively easy to solve (and its not like we don't have these issues in the government). One could almost think that the people in power do not like to share their positions, especially with someone who is supposed to actually stand-up against the governments mistress (or dominatrix, depending on how you look at it), the corporations.
Oh... well that's embarrassing.

So, I half-remembered the actual problem I ran into and found something that half-looked like it mentioned it. Not my finest hour :S

I dug up the IRC exchange for the problem I actually ran into:

jamii
How do I write the type of a byte iterator:
fn next_path<N: Iterator>(nibbles: &mut N) -> u32 where <N as Iterator>::Item = u8 {
That gives me 'equality constraints are not yet supported'
FreeFull
jamii: <N: Iterator<Item = u8>>

Equality constraints seem to still be unimplemented ( https://github.com/rust-lang/rust/pull/22074) but I can write this instead

where N : Iterator<Item=u8>

So that whole section of the post is incorrect. I've removed it and linked to this discussion instead.
Why does someone bring up game performance when the discussion is about JVM versus native code? Languages with a GC compiled to native code have the same problems, even C/ASM calls can be relatively expensive in languages compiled to native code (e.g. see Go).

There are many other classes of applications outside games where a few milliseconds of garbage collection are acceptable. It is no surprise that many server applications are written in JVM languages - the 2x C/C++ performance is acceptable when people get a lot of instrumentation, more safety, etc.
Great storytelling, accompanied by a call to action at the end... but right there at the end a big bold button (or link) is missing, you need to figure out that the tech details are from the menu. Make it simpler for the reader!
My point is that you pay a price for this: LLVM's optimization passes are much, much more sophisticated than those of the Plan 9 toolchain. In optimized builds of Rust, the LLVM optimization and compilation time tends to dominate, so having a simpler type system wouldn't really help.

You could have a more C-like language that isn't so dependent on expensive optimization passes like multi-level inlining and SROA, granted, but I think most any high-level language—i.e. one that isn't a bare-metal language like C and Pascal—is going to have lots of opportunity for expensive optimizations.
That's not entirely true - it only uses monosyllabic words for IPv6 addresses because there's no other way to fit enough bits into the right number of syllables.

For IPv4 addresses, there's loads of space, so I can afford to use some longer words.
Suicide is disrespectful too. Plus, there are insurance implications. If someone commits suicide their heirs don't have right to insurance $. Documentation of a public act serves to surface the truth whether some people want to see it or not.
I make a point of logging in to sites like my local government websites over TOR every now and then to do completely normal and personally identifying things there. I want there to be logfiles full of obviously non evil uses of TOR out there.
or do a drop test haha...will my steam machine survive a fall from the 5th floor? subscribe now!
This exploit seems pretty insignificant since it supposes the attacker already has root; it gives the attacker persistent root. They already own your machine.

Microsoft built a great ecosystem around their products and technologies. They invested heavily in education for engineers. Apple, not so much. We are partners with both Apple and Microsoft and these companies behave in different ways. You do not need to knock on Microsoft’s doors, they are open. Apple is different, you have to knock, take a number, join the queue and wait. That’s why there are many more Windows engineers than Mac engineers.

What's with the unsubstantiated bias against Apple? Even if I believe Windows is more secure and than Mac OS X (which I don't) how is this relevant to the story?
Why do you get the sentiment that:
1) he wants to destroy american spy agencies?
2) only american spy agencies

If we presume his call against the current mass surveilance programs equates with the destruction of the NSA(which I can't really agree with), then ypu would also conclude he dislikes the burgeoning mass surveilance from other countties, e.g. France, the UK and others listed in the article.

He didn't mention Russia explicitly, but I cannot fault his political tact considering his situation.

I don't think your interpretation of his words is very charitable. Their underlyimng message is a poaitive one - people reject something they aren't comfortable with and using many avenues(political, technological, social) they enact change to combat it. In our age where voters are largely disenfranchised, this is a positive demonatration of the power we hold as a society.

There is a discussion to be had about the authority spy agencies should have. Perhaps eventually a reasonable surveillance program with checks and balances may be enacted, which people are content with. We wouldn't even have this conversation, however, if not for people like Snowden. The US government preached total secrecy in the name of "national security", and basically said "trust us, you don't need to know".

Thanks to Snowden, we are, with some hope, on yhe road to such a conversation. That's what I "get" from him.
> You can't agitate for anything you need if speaking out is forbidden, and you can't organize if you're being monitored.

You actually can complain about anything as long as it doesn't challenge the position of the CCP as the only government possible.
Any marginal gains that US might achieve in terms of security are not worth the resources and human liberties they need to sacrifice. Of course for those who are in power there is an incentive to paint a needlessly scary picture take our money and destroy our freedom.

I think public schools without bullying would be better and more beneficial objective than protection from terrorists who do not exist.
> I found the title a bit misleading.

Don't worry, someone will be along shortly to change the title to something even more misleading.
but not run Java
For once, OpenGL/DirectX drivers contain a shader compiler since the compiled form of shader in these APIs is in IL bytecode and it has to be compiled into the actual ISA code to be able to run on the processors inside the GPU. Such a compiler is pretty complex piece of software and even if it did not have licensed code opening it would expose you to all kinds of patent trolls.

Also, the DirectX drivers (and likely OpenGl as well) contain special code paths for many games/apps to improve performance. When they are telling you to download the latest drivers for your new PC game it's not because the new drivers fixed bugs and the game won't run (though it's also the case sometimes), it's because the new drivers have an optimized code path for that game. Developing these code paths costs money and giving them away for free may save money for the competition since the hardware is pretty similar and most of these optimizations are selecting the best hardware representation for an API entity.
Oh no I meant your area of professional expertise in the area of cyber security. I did not mean this particular hack.

> wealth of information on their servers useful for counter intelligence, economic, political and likely even military gain as well

Perhaps you could go further and tease out why a US company would have information on their servers useful for counter intelligence, political and likely even military gain - beyond of course the merely mundane trope of suggesting that the algorithms or IP are the reason.

I'll take a stab, but I'd love to hear how your characterize it: It's because US tech companies, like other multinational corporations inside the US, partner with the US government which some times means intelligence or military sectors - either to provide products and services - to perform research or to fund research - or to offer capabilities as a de facto extension.

The Foreign Intelligence Surveillance Act weaponized the US tech service sector to provide data and metadata for US intelligence efforts and for the targeting of foreign nationals.

(Incidentally, it's true also that individuals located at Google hacked back into the Chinese C2Cs.)

Chinese Intelligence is fully aware of FISA and the USG use of technology product and service backdoors.

> I don't we'll ever know exactly what all of their reasons were for breaking in, but I don't think the theory that one of the primary motivations was targeting dissidents can be waved away as just spin.

You really don't motivate why we should take the PR statement more seriously than the journalism. And references to 'I don't think we can ever be certain' is an appeal to uncertainty that isn't really there.
See also http://www.liveleak.com/c/surveillancecameraman
If authorities wanted control, couldn't they disable caching?

How is TLS any less private than standard http? You aren't associating your session keys to your browser any more than a standard cookie.
Sure looks cool and like looks of coding went into it.

Whether its something that meets a need, dunno.
Oh yeah, CAs have been broken for decades. I remember reporting way back on Room 641A at AT&T having shadow certs.
Dalvik is ~3x slower than JVM for compiled (JITed) code (on an ARM Cortex A8):

https://dl.acm.org/citation.cfm?id=2388956
Can anyone explain what he's referring to with the statement

> with TLS in place, it becomes easy and
commonplace to send stored authentication credentials in those requests, without visibility,
and without the ability to easily reset those credentials (unlike in-the-clear cookies).?

Cookies are orthogonal to presence of TLS, I thought (unless they're marked as secure, in which case they are only supplied to https hosts?)

Is there some other way of identifying a particular user/browser/session[1] other than the quirks & features enumerator along hte lines of Panopticlick?

If there is (ISTR some 'session storage' for resuming TLS in nginx), is that cross-trackable across different services (potentially all TLS-terminating in the same place, such as Cloudflare or AWS)?

One good point is that I hadn't considered is that the lack of proxyability means every request which can't be filled from the browser cache must hit the actual endpoint, making it easier for them to follow along action-by-action when it might otherwise have been served up before getting to them by a caching middle-proxy.

My (limited) understanding is that you're potentially providing more information to the remote service, but are better secured against people snooping on your traffic as it flows between you and them.

[1] also not including client certificates, because exactly 1 site on the internet actually uses them :P
Fair enough, the HTTP request path can be hidden through TLS. I'm not sure if privacy is a goal of HTTPS, though.

On the internet layer, IP packets can still be traced from origin to client. I'm probably not involved enough to formulate an educated opinion, however.
Yes, and Roy's claim is that TLS doesn't provide that privacy, so is still basically useless for public content.
That story only means that guy's execution failed. And that you didn't try and now rationalizing that your idea was bad just because someone else failed with that idea.
How does TLS disable anonymous access? My identity and/or location is not a single bit more exposed than it already is when I access a site either with or without TLS. There are indeed authority and centralization issues with the current CA system, but again, it has nothing to do with my anonymity.

Meanwhile, caching is such an overused and undersubstantiated argument that it's not even funny anymore. How many websites you recently visited was served by a cache operated by anyone other than the same party who owns the website, or a CDN that the website owner trusts enough to let them have the TLS keys? Are untrusted proxies (read: MITM as a service) such an integral part of the web that we must keep them alive at any cost?

There are decent reasons to eschew TLS for public information -- for example, PGP signatures that can be verified out-of-band are much cheaper for large blobs of static data such as .deb packages -- but anonymity and caching are not among them.
agree also

tls is not https3.

tls already has been broken 3+ times.

this is an open ticket for 1 year in the TLS repo for an exploit.

and the author of TLS released a MITM exploit on TLS he wrote (not that other protocols are not vulnerable to MITM)

theres no reason to put this in SSH/SSL/HTTP and run all internet communication over it.
Proper title, please.
Java is where it is now because it is a stable platform. They would be foolish to introduce compatibility breaking changes.
Except we Europeans would pay for your kids education, and get nothing in return. Win/lose.
This doesn't feel right to me. No one can touch this man's credentials, but lets suspend the argument of authority for a second and look at what he is saying critically: Is TLS more private overall than plantext http?

If you want to remain private, how could TLS prevent this that plaintext would not? HTTP is not tor.
All java software installed on my computer are still slow as shitting.
All my java projects need minutes to compile fully and to startup.
All my java programs uses hundreds Mb memory.

On the contrary, Golang programs run much faster, compile much faster, use much less memory.
I'm not sure I get the analogy to being the most ambitious person in the room. I think you mean that relative to intelligence agencies (not just US intelligence) and the most elite hacking groups domestic computers are products are not up to snuff?

I'm not sure that top intelligence agencies backdooring products has really made that gap so much worse.

I sorry I don't think I fully understood your point.
Woah, that'd be a lot of tweets. Even reddit with its 10000 char limit per comment has loads of comment trains if you want to store a sizable amount of info that way. With twitters 140 char limit, that would be a huge amount of tweets. You'd probably run the risk of being identified as a spammer if you send that many tweets at once...
> Those are the constraints that cannot currently be expressed in bounds, not where clauses.

Yeah, I got that whole thing totally wrong. I've removed that part of the post and linked to this discussion instead. Thankyou for de-confusing me :)

> The second argument can never be self. It's always the first.

I think we are talking past each other on this point. I'm thinking of the design-time choice between eg:

trait Observe<Observee> {
fn observe(self, observee: Observee);
}

trait Observe<Observer> {
fn observe(self, observer: Observer);
}

trait Observe<Observer, Observee> {
fn observe(observer: Observer, observee: Observee);
}

Analogous to the typical OO problem where it's not clear which class a method should belong too.

Because I mistakenly believed that where clauses are less powerful I thought that the above choice had additional significance beyond code organisation, because it would affect the kind of constraints I could write. But they aren't so it doesn't matter :)
Am I right that you gave your idea away, it wasn't stolen?

The startup weekend I went to said very strongly that you shouldn't share an idea that you were not willing to have used by others (no IP, no NDA, no comeback).
Edit: "Real" is, I suppose, arguable. By that I meant: Java's lambdas don't support mutation of captured variables.

Then Haskell doesn't have closures either ;).

I think the definition of a closure is: a lambda abstraction / anonymous function that uses a free variable in its definition. So, Java's lambdas are real closures.
If you are referring Java Platform by JavaEE, Its alive, please read below to have an idea about next 20 years :)
https://blog.heroku.com/archives/2015/6/4/the_next_twenty_ye...

I develop on Java since 15 years, all these years I have seen most of the fortune 500 customers trust Java platform for their enterprise systems.
Custom built high end PCs have problems getting 60fps at ultra with maxxed AA in some games. Literally nobody is expecting such performance from these machines.
But how they self organize is important with respect to their ability to do "actual" journalism. Setting aside the fact that Gawker's whole point is to provide a narrative and to take sides, this type of agreement is important exactly for the reasons you state: collective bargaining will give them the power to push for more time to gathering facts, write bigger stories, etc. Otherwise, the corporation's interests may very well result in clickbait links and hyperbolic headlines.
Https for everything is worthy for at least one reason: to shut up the scum operators who insert their ads. Privacy and confidentiality are of a much less importance.
So a couple of questions. What's up with the agar.io picture and what's up with the cursors? I'm intrigued.

I also find the "Update: Wow, this really exploded, thanks to all 366 people currently reading this page :-) We even got 26 orders since this post went live." cool. That's it's updating live that is.
> If the IETF wants to improve privacy, it should work on protocols that provide anonymous access to signed artifacts (authentication of the content, not the connection) that is independent of the user's access mechanism.

He basically wants a better version of Freenet. Fine. However, that's orthogonal to the effort to make all channels secure channels. IETF can do both, if people are interested. Plaintext TCP needs to die, and building the infrastructure to move everyone to HTTPS is a step in that direction.

He shouldn't obstruct HTTPS just because it's not Freenet(bis). To use his Freenet(bis) vaporware, people will need to become familiar with managing private keys. HTTPS has a similar requirement, so HTTPS Everywhere is a step in the direction he wants to go.
OpenCV video editing tutorial
C++ is still mostly what I use, but I need neither speed nor bare metal. Maybe add C) people doing UI and applications?

There aren't many other good options:
Java: UI looks terrible; it's annoying living in Noun-land when CPUs are, if anything, more about verbs than nouns; and running properly on Windows is not trivial.

C#: Up until recently, not cross-platform unless you're ok with Mono. (But, might be worth looking in to now)

Python: great for scripts and experiments. The lack of static typing is a real problem when working with code other people wrote. Also, UI is not a strong point.

Go: what UI libraries? (I'm sure they exist)

Objective-C: even on iOS/Mac-only projects, I still prefer C++, because it's so much easier to use STL objects than NS data structures.

C++: you can pretty much get it done, and often you can use Qt to get it done quickly and cross-platformy.

I'm hoping Rust will be the C++ I always wanted.
Besides Session IDs and Session Tickets[1] which already exist in the TLS protocol. He could be referring to the Token Binding Protocol Draft[2] which, quoting from it's summary, "allows client/server applications to create long-lived, uniquely identifiable TLS bindings spanning multiple TLS sessions and connections".

[1] https://en.wikipedia.org/wiki/Transport_Layer_Security#Resum...

[2] https://tools.ietf.org/html/draft-ietf-tokbind-protocol-01
I think the opposite is true. Modern hardware is so complex[1], made even more so by its constant interaction with a complex OS, that any sense of familiarity with the actual performance model is illusory, unless you're doing something very controlled and very specific (like, say, DSP). Modern hardware itself is an abstraction, hiding its operation away from you. We can no longer hope to tame hardware with meticulous control over instructions as we were able to up until the nineties.

Forget about clever compilers; forget even about smart JITs; even if you look at such a big abstraction as GCs and only consider large pauses (say anything over a few tens of milliseconds), it is now the case that in a well-tuned application using good a GC, most large pauses aren't even due to GC, but to the OS stopping your program to perform some bookkeeping. Careful control over the instruction stream doesn't even let you avoid 100ms pauses, let alone trying to control nanosecond level effects.

[1]: http://www.infoq.com/presentations/click-crash-course-modern...
Haskell's types are used for a lot more than type-checking.