skysight-inc/HackerNews huggingface dataset:
My first reaction to this... the document says "We are owners of each and every feature we build", but who is "we"? If I write a feature, am I expected to own it throughout the lifecycle?

It's easy to hide behind "We", and easy to say "we isn't me". I might suggest something like "I own everything I build and everything my teammates build". That eliminates a whole class of avoidance and excuses for bad code.

Overall it's a nice distillation of general corporate engineering teamspeak but I didn't grasp anything new or enlightening. This document would be pretty easy to ignore if I were in that group.
The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here:

http://keepass.info/help/base/security.html#secencrypt

Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database.

See also: discussion on feasibility of brute forcing a KeePass database:

https://security.stackexchange.com/questions/8476/how-diffic...
I don't understand why the Moleskine brand has grown so popular when the paper quality is so poor relative to other manufacturers, e.g. Rhodia/Clairefontaine.
It sounds like you are describing either a JIT compiler or a direct AST interpreter.

JIT compilers are indeed fast, but AST interpreters are usually slower than bytecode interpreters.
The point of using a locally-encrypted password database like KeePass is that you don't have to trust Google (or DropBox, or Microsoft). You trust the encryption instead.
Ask Solem (creator of Celery task queue) joins Robinhood
> It is bad manners.

True, it is bad for the advertiser and the ad hosting site. But it is good for the person annoyed by the ads. There is no objective value in blocking ads, it depends on the party. Since there is no objective valuation, it is not bad manners; it is merely an ability of consumers that is undesirable to advertisers and the ad hosting companies.

> It's the same as taking the free newspapers in your area, cutting out all the advertisements, and giving those out to people.

Nice try at an analogy, but removing the ads from free newspapers and giving the results to people could be seen as conspiracy harming the newspaper, because there would be party doing the removing and taking over the distribution. With online ads, nothing of this sort happens, because the consumer requests the newspaper company - not some other ad-removing party - for the newspaper article, the newspaper company sends it to him with hope he will pay attention to ads and the consumer displays only that part of the sent document which he deems worthy of his attention. He does this with help of his computer in which he is entitled to process and filter information in any way he deems useful. No organized action destroying the business is happening, the consumer himself removes the part he does not want on his computer, he does not remove ads for other people. This is virtually the same as when the person buys a newspaper in store and skips reading the ads, which everybody who would read the newspaper is entitled to do. All people are entitled to filter the information other people, companies and government try to feed them, irrespective of the channel, be it paper, audiovisual channels or the Internet. Otherwise our brains would get really dumb from all the fatuous ads.
Most constitutions can be amended, but unless there are people with guns ready to back them up they are, to quote George Bush, "just a piece of paper".
What analysis are you looking for? The purpose of the "diffuser" is well-understood, as are the security implications of losing it. This comes up on HN about once every other month, on threads you've been a part of. What part of the explanation you've gotten here seemed inconclusive?
Oh yeah, I had HTTPS-Everywhere on. Thanks a lot!
It means what it says. Various people have formed companies to try to commercialise the Hyperloop concept. SpaceX and Elon Musk are not affiliated with them.

SpaceX and Elon Musk are behind this competition.
WOW! Quite shocked that google rolled back one of its horrible UX 'improvements' and actually listened to its user base.

It seems like every single UX 'improvement' takes back the product at least 3 steps. Still hoping for google maps 'improvemnt' to return to a usable state (aka classic google maps).

Any ideas on why google gets UX/UI so incredibly wrong?

Google's UX team across the board should employ the George Constanza 'Opposite' philosophy: when your instincts tell you to do something, do the exact opposite of that.

https://en.wikipedia.org/wiki/The_Opposite
It should not alter the user experience. Maybe use at most 30% CPU, leaving priority to the other processes. Also avoid computing on devices with battery, or with low battery.
It's important to distinguish the business model of publishing journalism from actual journalism.

The News Industry is dying. But the creation and effective dissemination of important information is thriving.
Waiting for a prng named Ornette.
Things like this are why I prefer Firefox Sync. Works across all my devices (home laptop, work laptop, Android phone), and uses client-side encryption, so a compromise of the Sync server provides the attacker with nothing of value.
Some people's eyeballs don't get along well with contacts, even single use disposables.

No idea about the Vive headset, but Oculus recently stated that their consumer version's fit over glasses is better than the development kits'.

http://www.polygon.com/2015/6/11/8766855/xbox-one-vr-rift-co... (second paragraph)
Unit Testing Express Routes with Mongoose and Jasmine
Nearsighted and contacts are very uncomfortable for me. Also, astigmatism.

So, yeah. I'm screwed.
Is storing data as bits insane? For a 32x32 image, jpg overhead becomes significant.
Brand marketing and good design. Moleskines look cool, Rhodia and Clairfontaine have mostly spiral bound journals, which don't look as cool. The paper might be higher quality, but I don't imagine most users actually care that much.

I've been using Moleskine for years and the paper hasn't bothered me at all. I might just be a pleb though.
Previously on arch linux I had a list of 7 to 10 services in rc.conf that started serially in less than 2 seconds. That was pretty damn simple. Besides that there was inittab which just had the gettys and the main startup script.
Lastpass Hacked Time to Change Your Master Password
Can a mod change the URL to https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ . I found the original source. Thanks.
Manual, so the number of accounts will determine your pain. That said, 1Password has an OSX client + Chrome extension. Day to day is much easier to use.
Xbox One backwards compatibly and what could it lead to
> people don't get "sticky"

People would get VERY sticky against moving away from a subsidised area, even if it might actually suit them better, and they could afford it - leading to sub-par allocation of resources.

Also, there's the question of how/when/if to pull back the subsidy. If you do it according to income, you create a very high marginal tax rate at the beginning of the pay scale - that's toxic to work and traps people in poverty. If you do it when the children are grown, you're suddenly kicking people of of family houses they've lived in for decades (see "Bedroom tax" in the UK). If you don't, then what started as a family neighbourhood becomes a neighbourhood of middle-agers living in large apartments - while their kids struggle to find a decent place to live.

Incentives are HARD.
the article is written by Amplitude (www.amplitude.com) which has, in my experience, the best event-driven tracking product out there today.
That is true of practically every full disk encryption package, because of the nature of encrypting disk sectors rather than files: with no format flexibility or straightforward place to store metadata, and no awareness of message boundaries, it is difficult to meaningfully authenticate data.

Vanilla CBC makes it easier to mount attacks, and XTS makes it harder, and the diffuser may have even made it incrementally harder. But no notion of difficulty here deserves the uppercased "Hard" we're looking for with cryptography: at best, you concede attackers "only" the ability to randomize targeted ranges of stored bytes, which --- especially for the mountains of C code we call "operating systems" --- is a devastating vulnerability.

If you are seriously worried about Highly Capable Attackers, and you lose custody of your laptop, you should consider writing it off.
The client-server API of Matrix only uses http+json as the lowest common denominator baseline for compatibility. Folks are more than welcome to implement custom more efficient transports like COAP/CBOR or whatever.

The server-server API is currently just targetting https+json just for expedience in getting started, but nothing to stop us negotiating more efficient transports in future - capn proto has come up a lot in conversation as a possible option. Handling signing is a bit more fun as we currently rely on signing canonical json, but surmountable.

As for binary transfers... well, random blobs are just handled as pure HTTP with a mimetype currently :)
It's a little disturbing to see Schneier recommending a disk encryption package that offers to encrypt drives using CAST, GOST, and Blowfish.
Assuming at least 40KM distance from the earth, (40/300) * 2 means a roundtrip time of 267ms. That's without processing time, but that's probably in the ballpark of <5 ms.

This excludes many types of internet use cases.
A solution I have found that (I think) is relatively secure. Setup a keepass database that requires the use of an unlock password and key file. Sync the database to Google Drive but never sync the key file! Only store the keyfile on a locally ecrypted thumb drive or only stored locally on the devices (preferably encrypted) that you need to access keepass from.

In random time/day intervals reset your key file and keepass password.

The key to this method "working" which should be "secure" barring total ownage by a state actor or well funded individual is to never sync the key file and database to the same service. Additionally, sync up a "false flag" key file if you want some additional level of obscurity.

tl;dr:

1) Setup Keepass database to require password and key file to unlock.

2) Sync database to cloud service but never the key file.

3) In random time intervals (t=60+days) Randomly change both the password and generate a new key file for your database.

4) Keep your key file on an encrypted drive or on the device (preferably encrypted) that needs access to Keepass.
This is why privacy is a flawed concept and not something we should cherish as much as we seem to. It's an eggshell defense. It creates the illusion of security, but once breached, it can make things much worse than before you had it.

It's much more challenging to figure out how to achieve security with an open system, but once you do, you don't have liabilities like this.
I've never read the debunking, but the NSA's reliance on codenames (even before Microsoft) for everything leads me to believe they wouldn't ever be so obvious.
The terms, as stated, are ridiculous. If you write an article that gets picked up for the NY Times, they pay you for it. If you write an article for a magazine, they pay you for it. Once they do, and you've granted them a partial copyright (in this case most likely second serial rights) then every time they pull an article to include in their "news" they should pay the author.

The much better way to do this would be, "We'd like to include your RSS feed in our News application, if anyone reads an article that you have provided to us we will make a one time payment to you of $X (say $250), in exchange for that payment you give us the right, in perpetuity, to continue to provide access to that article though our News application."

Basically if you're writing is bringing people to the News application they should pay for that. And once they have, they can monetize there end of it just like newspapers and magazines by putting ads on the site or adding other junk.

It sounds like they are trying to construct some novel theory[1] where if someone managed to find your blog and read it they wouldn't have paid for it, so Apple doesn't need to pay for it if they are using it to attract people to their app.

So lets look at it from an information economics perspective, the author's article derives its value from the author's artistic expression. Nobody else is going to write it just like they did, or how they did. The author "spends" that value to attract readers to the blog, and readers "pay" for that value by by exposed to advertisers who have paid the author to be on their page. So you get that?

The reader "buys" their content by agreeing to be exposed to advertising.

The author "sells" their content by providing access to their readers to advertisers.

The advertiser "buys" access to the content by paying the author when a reader interacts with the ad.

Apple is trying to step in, get the content for free, bring readers to their News App and then sell access to their readers to the Advertisers. You can see that without the Author's content there is no "value" to readers in the news app. Authors who agree to this are simply dropping money into Apple's lap.

[1] It isn't really novel people try to rip off artists by offering them 'exposure' all the time.
I find the idea very appealing, but it seems like it would lead to micro service hell. How are you managing the Lambdas for test and deployment?
Online Forms and Online Document Signing: What's Legal?
Show HN: Create Payment Link. Send It. Get Paid
I completely agree with you. Also to me accountability goes to whomever is currently working on the code and whomever manages that individual.

I think what they meant was that when you code something, you have to treat your work like you completely own it so you do a good job but to me that's self explanatory and is only repeated to enforce rules that are obvious.
CodeLens: A reason to start using VS2015 RC
Happy to help! I myself just learned about that nuance the other day.
Google Glass for the Shop Floor
If it ever turns out that Microsoft is willing to include a backdoor in a major feature of Windows, then we have much bigger problems than the choice of disk encryption software anyway.

That might be so, but proper encryption is still valuable. Say you have a disk full of sensitive information. Say your computer was turned off as the adversary gets hold of it. If you have a proper encryption program, no OS backdoor will be able to decrypt it retrospectively (that is, when it's activated after the bust). Broken encryption makes you vulnerable even when you're offline or the PC is turned off.
Is this a warrant canary? /s

What do you recommend for Windows users?
At what point do you think that a majority vote should overrule the Constitution? And what are the consequences if it happens?

It is worth comparing the US and French revolution. Both happened in the late 1700s. The US wound up with the attitude that the Constitution was sacrosanct and the current democratic will of the people is secondary. France wound up with the belief that what the majority wants should happen.

Since then the US has had one nasty civil war, but is still on its first republic.

France by contrast has been an absolute monarchy, a constitutional monarchy, an empire, and a republic. Each several times. (I think they were also briefly communist.) They are now a republic for the 5th time.

There is something to be said for a rule of law that can supersede the democratic whims of the moment.
I'm sensing poor reading skills. This seems to be the offending bit:

"If we receive a legal claim about your RSS content, we will tell you so that you can resolve the issue, including indemnifying Apple if Apple is included in the claim."

That does not ACTUALLY SAY "you agree to indemnify Apple." It's a conditional with a lot of preconditions but even if they were all met it obviously doesn't constitute a legal requirement. It's saying "if it happens to come up that somebody sues us, we'll help you resolve the issue, which may involve us AT THAT TIME asking you to indemnify Apple as part of some sort of agreement we haven't yet put forward."

It's a heads-up. At some point in the future IF legal exposure becomes a problem they expect that they will have a policy about it which would involve the publishers deliberately and explicitly agreeing to an ACTUAL CONTRACT in which both sides get some tangible benefit. This email is not that contract.
Do we have good container encryption that mounts them as drives on windows? I never understood the point of whole disk encryption stuff.
I finally managed to convince my mother to start using LastPass recently; if I'd had to convince her to use two "master" passwords-- one for the encryption key, one for the service-- I'm fairly sure she'd still be using Google Contacts to store her secrets. :-\
Actually, this is about uBlock Origin (by the original developer), so it should be: https://github.com/gorhill/ublock
That being said, this is a good article, dense with information. I don't think Hari's ever been caught making stuff up.

The premise of the thing is that he's taking stuff out of other peoples books anyway :)
The point is that if the author of the article got on a bicycle with 100% certainty of being involved in an accident, I seriously doubt she would get on it without a helmet or some protective gear, despite her claims that wearing a helmet actually increases your risk of injury. Obviously if you knew you would get in an accident you wouldn't get on the bike. I'm convinced that it's the not knowing (and erroneous assumption that she is safe) that makes her comfortable not wearing a helmet, not a ironclad case that not wearing a helmet is safer than wearing one. If put in a position where she absolutely had to decide whether she would be in an accident with or without a helmet, I do not believe she would back up her claim and go sans helmet.

It's really not that different than most risks we take, such as unhealthy eating or exposing ourselves to ultraviolet radiation. We're immune to the danger until we're not.
So it would be wise to change the LastPass master password and also regenerate the Google Authenticator key. LastPass does enable you to regenerate this key from the account settings page.
Only if the software itself has a vulnerability - and it isn't that hard to secure a website or server that can't be accessed at all without a password, as opposed to one that needs to provide some level of service to anyone. Centralized services are also at risk of generic attacks such as convincing the hosting service/domain registrar/a company employee/etc. that you're authorized to change things, while pulling this off for many independently hosted site instances is considerably more difficult.
He might be using the IOProtocol Extension:
http://keepass.info/plugins.html#ioprotocolext
Not sure I'm with you on the "responding well" part. Why blog about it before even notifying your customers? And Joe's whole post seems fairly low-key given that this was a security breach and security is their entire business.
Bitlocker, and then authenticated encrypted archives (for instance, PGP'd ZIP files) for anything sensitive, including your mail spool.
That's an extreme example, but I'll play along.

No, I what I mean is TV manufacturers/broadcasters, if they so chose, could make it so that if you use their TV and press the mute button, you accept the TV will inform the broadcaster -- who may deny you service in the future. They should be free to decide if the consumer who doesn't want to watch any ads can watch their content, or if he has to pay subscription.

As a consumer you're not being "forced" anything: you can always subscribe or not watch the channel. Ideally broadcasters would tolerate muting/black-screening many ads up to a point, and if they see you're automatically blocking every ad they may ask you to subscribe.
Not only is there support in practice, but PNG files have been technically-valid .ico files for a decade.

Edit: Actually on further investigation they might be omitting a header, but they're still 99% valid.
If web ads were more like newspaper ads, I think I would find them more agreeable.

Newspaper ads don't animate and distract me from what I'm reading. When I flip to a different page in the paper I don't have to "wait ten seconds" to start reading. I've never had an ad spontaneously appear in front of the newspaper article I'm reading.

Newspaper ads don't track me, and no matter how sketchy the ad is, it doesn't put me a couple of clicks away from installing malware on my computer.
My guess was orbital plane (inclination with respect to the orientation of the earth. So everything in the same orbital plane is going round the same direction at the same speed and distance.
Yeah, there is a $14 version of this on CodeCanyon so...good luck though!
I personally can't use Moleskines. Not because of the paper or binding lacks quality, but because they _are_ so nice—I can't bring myself to "mess up" an expensive notebook with my notes. I much prefer to use regular copy paper. That way, I can freely get ideas out without worrying about messing up a relatively expensive notebook.

Once as an experiment, I bought a Moleskine, unwrapped it and promptly scribbled like mad on the first page in an attempt to get past that. Didn't work—I still felt really bad about it.
Same here, moleskine notebooks just hold up better in general, vs rohdia where by the time I've filled it up half the pages have fallen out. The paper is of good enough quality that it doesn't matter too much, and I use a fountain pen.
Same here, Moleskine notebooks just hold up better in general, vs Rhodia where by the time I've filled it up half the pages have fallen out. The paper is of good enough quality that it doesn't matter too much, and I use a fountain pen.
HipChat service shaky this morning
Lmao, not really. They're both fucked up. At least in NYC you can build up, in SF you've only got SoMa you can build in.
I would love to hear about some success stories that involve alternate languages on the JVM. If the 50 MB limit proves to be restrictive, please let me know!
I agree with the point about the benefits of physicals notes, but I still don't understand what is so special about Moleskines. Maybe it was just because I was an early hire and not a founder, but I actually preferred Mead's line of Five-Star notebooks. Since I had to wear a variety of hats, from eng to hr to content creation, the subject dividers were great for keeping everything straight. They also seem to last forever.

My only wish was that they intermingled some engineering style quadrille sheets with their college rule.
Bitstring Physics
Yes (although with five or six times as many satellites).
Imagine if the blog post was malicious and the password reset endpoint was actually a honeypot to collect your master password?

No thank you, I'll trust the encryption to do its job. Don't see how changing the master password is going to help any.
Hah, we just decommissioned a server that had an on-premises urchin installation on it a couple weeks ago. http://i.imgur.com/481dUsZ.png is what the home page looked like right before it left us.
Just visualize it.. :)
Sudo appears to have only one core developer
Well, don't get your hopes up. I talked with one of the 'data science' guys at Netflix and he said that user ratings are basically completely ignored in their algorithms. Apparently a large subset of their users actually rate movies before they've seen them, so hiding rated movies would only serve to decrease views overall.
Some answers here: http://www.oneweb.world/

(It's very promotional though, not very technical)