skysight-inc/HackerNews huggingface dataset:
I think Ferguson and Schneier got this wrong. Here's a useful table from Bellare & Namprempre:

https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-...

https://cseweb.ucsd.edu/~mihir/papers/oem.pdf

You generally have two options when it comes to authenticated encryption: use a specialized AEAD mode, in which the details of authentication are settled by the mode itself, or use "generic composition" --- encrypt securely, MAC securely, and safely combine the two operations. Specialized AEAD modes are preferable. But if you're going to do generic composition, the best current practice is encrypt-then-MAC.

Even if you encrypt-then-MAC, you can still forget to authenticate parameters (a good reason not to use generic composition). But if you MAC and then encrypt, you concede to attackers the ability to target the cipher's decryption operation directly with chosen-ciphertext attacks. Those attacks are powerful and have repeatedly broken TLS; they're also the most common form of attack on other cryptosystems (every padding oracle attack is a variant of them).

I wrote a bunch about this here:

http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
Oh ok, I missed the connection to monopolies. Thanks for spelling it out.
Is KVM burstable? From what I know about Xen (very little), at least in Linode's case, CPUs were not burstable. I always thought of this as a feature because while it's that if I need a little extra juice I can have it, I don't want my neighbors parking on my lawn every time they have a party. I'd rather have predictability over performance is my point. Is this still the case?
Hm. How does Cassandra really handle rows if the author is recommending storing timestamps in the same row? Sounds like a really good way of getting un-shardable atoms (whatever that's called in Cassandra) and hotspots.
I'm going create the website and a phone app for it.
Command Line Basics for Devs
I am confused by one thing here. If you and other person had similar jobs, why was the other H1B approved, considering legally they are required to pay comparably?
I keep hearing Tata, Wipro, Cognizant as the main culprits, but being a Grad student in the US, I know quite a few Indian students(being one myself as well) and none of them aspires or even thinks about working for these companies.
600 Mil Samsung devices vulnerable because of the pre-installed keyboard
Companies may not, Recruiters do. Recruiters who ask you if you have done web development and then as if you know HTML.
> The information was not given, it was traded. The consumer's portion of the trade is paid in viewing the advertising.

For something to be traded, there needs to be negotiation between the parties and agreement on the price. Ad hosts usually do not require any agreement from the consumer, they send the web pages anyway (with exceptions). The sole act of requesting the information (HTTP request for an URL) does not imply the requestor agrees with conditions the provider may store somewhere on his web. As far as I know, most ad hosts do not even ask consumers to agree with reading ads, far from requiring they comply. So not really - no trade is happening when I download a web page from an ad hosting website.
Chronicling Los Angeles History, Menu by Menu
That would have been possible if he were able to observe the vinyl in action and had a circular track of audio on the record, instead of working with a square slice.
I'm not sure those are the best resources for a web developer. While these are good things to know, I'd focus on mastering the stack/framework one is using as a web developer.

For example, If you're doing Ruby on Rails, I'd focus on reading a solid book about Ruby and then one about Rails. A lot of people try to get good with a framework, without having a solid understanding of the language used.

Algorithms and data structures are a good solid requirement, but chances are you are doing CRUD / REST apps with a web framework and you need to master the framework and back-end language used first, before you dive deep into algorithms and the likes.
Several restaurants that are not Subways in Amsterdam with steak sandwiches:

http://www.yelp.com/search?find_desc=%22steak+sandwich%22&fi...
golang is my goto.
You forget the part where you need NRC, EPA, and local/state government approval to store highly radioactive waste.
Are you volunteering to fund better reactors and fuel cycles? Because no one has stepped forward to fund them, not even governments that supposedly are pro-fuel reuse and safer reactor design.
How many programmers have actually finished "The Art of Computer Programming" ?
> How can we get back to a time when the food we eat is produced nearby, is high quality, and is healthy?

That time never existed. Factory farms and food processing have historically represented huge improvements in safety as well as affordability and availability. Not that this isn't a great idea, just that it's not a return to any kind of wonderful world of plenty.
...running both in production sucks...

I'm sure it does. Can you describe the situation that has forced you to do this? Do you rely on modules that are limited to one or the other? Are those internal modules?
What?

http://www.localharvest.org/csa/
No, because the entrepreneurship business has boom and bust cycles. Here's a portrait from 1982:

"Q: Why are people so willing to sell out their employers?

A: Two reasons. In the confrontational style of American management, people are pitted against each other ruthlessly. There is no trust, no loyalty. Reason No. 2: Money speaks. Life in Silicon Valley is very fast, very competitive. To keep up, you have to drive a Mercedes, live in a $300,000-to-$500,000 house, have a pool in the backyard, a cabin in Lake Tahoe if you’re a ski buff, a yacht in Santa Cruz Harbor if you like to sail. You have to belong to the Decathlon Club or the Palo Alto Golf Club and send your kids to private schools like Bellarmine or St. Francis. Then there are business dinners, cocktail parties, barbecues. It all costs money."

(from http://www.people.com/people/archive/article/0,,20082780,00....)

But then the 1970s entrepreneurial revolution faltered and SV had to reboot. Between 1984 and 1992 most of the old power centers were weakened. SV could reboot, and did with the Internet companies. Similar thing happened after 2001.
What makes you believe that charities spend money more effectively than governments? I would expect the opposite; the government at least has the press and voters trying to hold them to account, whereas charities have very little oversight.
Is it just me or is modern web design degrading into flash-era sludge where you have to sit and watch 20 seconds of lines dancing around before you can get any information? As a nerd who can appreciate the technical aspects I'm even finding it extremely overdone and obnoxious. There are cases, such as telling an interesting/interactive story, where it makes complete sense. However for an informational/product web site, I'm generally not there to be W0W3d by your 31337 w3b skillz.

Am I just old fashioned?
Preston McAfee (head economist at Microsoft) and Ted Bergstrom (an economist at UCSB) have been studying this for years:

http://www.econ.ucsb.edu/~tedb/Journals/jpricing.html
Venom was a vulnerability in Qemu, not Xen, which has a containment mechanism (stub domains) for this class of vulnerability. In addition, PV Linux VMs do not use Qemu, so were not vulnerable. Qubes contained Qemu in stub domains, so was not vulnerable, https://groups.google.com/forum/m/#!topic/qubes-users/uRg6gk...
Or you could start using another web analytics platform which spammers don't know and you'll have total control: https://github.com/fiatjaf/microanalytics
Are you suggesting that Fox News should be censored? And how do you decide what is a cult vs. what is a religion?

"Hate speech," btw, has no legal definition in the US judicial system. The term doesn't exist in First Amendment jurisprudence. How does the EU define it?

I'm quite happy to be thus reminded of our freedoms in the U.S.; Lord help us if we go down this route.
If I'm not mistaken you can't grant an application read-only access to a repository? GitHub really isn't very granular in their permissions...
Uber Hires Google’s Former Head of Maps to Oversee Location Technology
What is a Yuccie?
KeePass – weak on Android (and it's Android's fault)
If you're using KeePass on Android, you're most probably syncing your database via Dropbox, Google Drive, any other cloud service, or even some P2P sharing.

Whatever you're doing, there is a severe weakness in security that's due to Android.

An attacker could just operate as follows:

1. They build an app that has both the "" and the "" permission (most apps have that already)

2. As the external storage is publicly readable, they can just scan it for .kdb and .kdbx files

3. Any such files that have been found can be collected by the malicious app

4. (Optionally, the collected files could be encrypted locally by the malicious app)

5. The files can then be sent to a remote server in the background, without you ever noticing

6. Having a free app with millions of downloads is not that hard (and you could even buy one on eBay)

7. With millions of users, you may collect thousands of KeePass databases (stored on your remote server) that you can try to decrypt patiently
In our class, we have discussed repeatedly that the best way to make money would be to start a new journal with the word "International" in it. The problem with some open access journals is that they accept anything. Apart from Computer Science(and physics as mentioned in the article), where most papers can be found as open access, there isn't an alternative for universities to buying content, even if open access were to be the new norm from now due to large amount of historical content.
Exactly. Clang makes platform-specific lowerings and bakes in some ABI-specific gunk. Granted not so much as the object code on the other side of the back-end. Enabling target-specific vectorization and whole-program optimization are probably the goal.
Math.SE report 2015-04
Elegant Functional Architecture for React
Pharaohs of Silicon Valley: My Journey Through Google
Actually, no, apparently Firefox downloaded an OpenH264 blob [1]. See message 51 at the bottom (presumably "FF" means "Firefox").

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909#51
My original statement was inadvertently strong, they've found a causative link between red meat and cancer.. not necessarily the link that explains 100% of the association or anything of the sort, but a link that's universal across red meat, is dose dependent, and is readily repeatable.

It really is a landmark study: http://health.ucsd.edu/news/releases/Pages/2014-12-29-sugar-...
wait, but didn't you just contradict yourself?

> cool that xen rolled out fixes before zero day

> not cool that your vm was promptly rebooted to apply the fix
Wait a second, you just want to ban all the feminists?? If you would like to see hateful things just pull up any of their actions.

Example:

http://www.independent.co.uk/news/uk/home-news/bahar-mustafa...

She is racist and sexist at the same time, a whole mob is, I don't see anybody taking these things seriously and she kept her job.

Similar situation different players:

http://www.dailykos.com/story/2015/06/10/1392082/-Woman-Invo...

Lady loses her job.

I don't see that limiting free speech if going to be good if it is implemented with the same hypocrisy and biased way as our society is (including media and people) now.
That particular arbitrary line in the sand seems mighty.. well.. arbitrary. The data is being collected either way, but it only becomes objectionable because a computer is involved? On what grounds?
>...then let's all see what happens to their revenues.

The people who care, will run out of places to shop, while the stores make more than enough to offset the loss in customers. Same thing that happened with security cameras.
"battery gains have been mostly linear for the last 25 years" After a whole paragraph about how Li-ion improves by ~5% per year. Reporters don't understand what exponential means!
I simply haven't had the time to upgrade some but others are running on Elastic Beanstalk which is capped at Node 0.10.26 believe it or not.

For newer things I'm running io.js 2.x and patiently waiting for the first merged release but wanted io.js for the ES6 functionality and IIRC Node 0.12.0 wasn't out yet.
> carry a gpg private-key file around

You could get a yubikey (or other gpg smartcard) ;)
Are you going to be running a delivery service in your area?
'IT FOLLOWS' - a 'MOVIE TALK' Review; with Guest Critic Jake Ten Pas:
A Global Map of 132 #Information #Technology  #Startups Is Now Live
"Paravirtualization" can refer to two somewhat different things, both of which count as guest-assisted virtualization. The original idea behind paravirtualization, and originally the only type of virtualization in Xen, was one where Xen presented itself as its own PC-incompatible machine type using the x86 instruction set, and you had to port the boot code, memory management code, etc. over to Xen hypercalls, and you don't have access to real mode, the x86 MMU, etc. But you also need to port all your driver code (disks, networking, graphics) to Xen hypercalls, since you also no longer have access to the BIOS interrupts, PCI bus, etc.

It's possible to isolate the second part -- paravirtualized drivers -- without requiring the first part -- paravirtualized bootup. Since bootup isn't guest-assisted any more, the hypervisor now has to emulate the entire PC-compatible boot process, including minimal emulation of BIOS interrupts for disk access, etc. But once that's completed, you can switch to paravirtualized drivers for optimized performance, and the actual performance benchmarks people care about are the steady-state disk and network bandwidth.

The only somewhat tricky thing is that you need to handle MMU updates somehow. I believe (but don't know for certain) that with nested page table support at the processor level, you can just safely give x86 hardware-virtualized guests access to their nested page tables, and they can use the same instructions to modify that as they would on native hardware. So you don't need paravirtualization for that. This support has been in hardware since around 2008.

One of the benefits of using paravirtualized drivers alone, instead of an entire paravirtualized boot process, is that you can support OSes where you can write custom drivers but you can't change the boot code. So, for instance, the KVM project has Windows disk and network drivers that use the paravirtualized interface (virtio):

http://www.linux-kvm.org/page/WindowsGuestDrivers

You can continue to use Windows without this support, which will use the slow, emulated disk and network hardware. But if you have the drivers, things will get much faster. This is a best-of-both-worlds approach: you can continue to run any OS (since full virtualization support remains present), but you can switch to the paravirt drivers and get steady-state performance competitive with paravirt-only hypervisors.
Anyone know why the performance difference is so dramatic? My guess was that the difference would go the other way -- that Xen would be more efficient, because it was designed for paravirtualization rather than hardware emulation, and the guest kernels had to be modified to accommodate it.
Their newer format 'opvault' claims to address it as well as authentication - you're probably best off just googling 'opvault' for the various forum and blog posts about it. You can enable opvault in almost all the platform/sync combinations if you download the current v5 beta.
Well, that's generous. You don't have to be specifically investigated by the FBI (just 'related') and the court orders used to make requests can be quite large and in practice are primarily automated. If you look at the sort of processing the NSA is talking about they are discussing large scale sentiment and social media analysis (of the sort that non-related folks must be included). On this line we know that anyone 'three hops away' was considered legally relevant to an investigation. It was shown in the Snowden documents that NSA hacked into backend databases of US corporations to collect data - which gave data access with no warrant. Finally, companies are encouraged to give data to the government as a gift. This gifting of data is not compulsed legally and is outside the scope of (weak) legislation by FREEDOM providing some small limitations on bulk collection requests.
>why on earth

there's your problem, you're living on earth. try living in the cloud. :) (network byte order)
Please forgive my formatting. It seems formatting text on HN is more difficult than using Cassandra.

Cassandra is interesting because you really have a partition key to define a "row" and then a set of columns (cells). When you define your clustering key, you are really defining how your data is stored on disk.

If you had the following table (the columns are meaningless, so just ignore that you wouldn't ever use this dumb table):

table1 (personName, addedtime, color)
where PartitionKey = personName
ClusteringKey = addedtime

and lets say you had the following rows:

personName= "n1", addedtime= "6/16/2015 1:00AM", color = "blue"

personName= "n1", addedtime= "6/16/2015 1:15AM", color = "black"

personName= "n2", addedtime= "6/16/2015 1:15AM", color = "red"

would be stored like:

RowKey = n1

-> name = 6/16/2015 1:00AM, Value = , timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:00AM:addedtime , Value = "6/16/2015 1:00AM", timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:00AM:color, Value = "blue", timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:15AM, Value = , timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:15AM:addedtime , Value = "6/16/2015 1:15AM", timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:15AM:color, Value = "black", timestamp = <some ticks from when the data was written>

RowKey = n2

-> name = 6/16/2015 1:15AM, Value = , timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:15AM:addedtime , Value = "6/16/2015 1:15AM", timestamp = <some ticks from when the data was written>

-> name = 6/16/2015 1:15AM:color, Value = "red", timestamp = <some ticks from when the data was written>

NOTE: The value of timestamp and added time are both stored as ticks, but I was too lazy to convert/calculate real ticks.

Notice how the the column names (denoted by name) is actually the value of the clustering key concatenated with the actual column name.
Also notice that columns are stored first in order of the clustering key, but each column with the same clustering key is also stored in order of its column name.
Also notice that the first column that represents addedTime, doesn't have a value because its value is stored as the column name.

Where in SQL you might expect each set of columns you insert to be a physical row, in Cassandra, you really have a partition and a set of cells which are physically sorted by clustering key and column name.

You can see this yourself if you setup Cassandra and then use cassandra-cli to interact with your data using thrift.
TL;DR communication is so hard
> But buildings? Why? those things don't even move.

They are trying not to slow down the wind, so wind turbines will work well.

:)
>There are other webkit browsers without Chromium's extended libraries such as Surf and Web (Epiphany).

What about Midori (LGPL 2.1)? For some reason it's not available for jessie, but 0.4.3 is available for wheezy, stretch, and sid: https://packages.debian.org/stretch/midori

The latest version on Midori's site is 0.5.9: http://midori-browser.org/download/debian/
Here is a source of LP images that are the same scale as the YouTube video, using a normal microscope.

http://www.cleanlp.com/CleanLPMicroscopePhotos.tpl
No, I'm just pointing out the sticking ads next to content from other people without paying them is a huge part of Google's business model.

By the way, in what way does anyone consent to having google ads show up in search results showing their content? Not having a robots.txt file blocking bots?
This Computer Program Taught Itself to Play – And Beat – Super Mario World
I was specifically referring to the statement "and it DID make them rich". That statement I think is provably false. Depending on how one defines rich of course.

There are many ways to define success. ustwo is a 300+ person design company. Their mobile games could lose money but still be considered a success.
I think Sierpinski's triangle may also be of interest here, which, contrastly, approaches zero surface area: http://en.wikipedia.org/wiki/Sierpinski_triangle
http://www.letters4words.com/jaxy.htm

i.e. ass, poorly implemented, bad
We already have dozens of apps that do that one way or another.

I wish we had a proper standard protocol for doing this by now. Something maybe based on mDNS, avahi, webdav, and a little glue, so we can implement and run this anywhere. And without requiring internet access at all.
When we were running Miniand it was one of our big goals to assist hardware startups interact with factories in south China; we lived in Guangzhou back then and had constant interaction with manufacturers. We successfully manufactured our own dev board (based on an existing board with modifications) but in the end we just didn't make enough money to make it viable for us.

Chinese manufacturers do tend to have room to move on samples and MOQs, I think it's really important for someone considering attempting hardware on the smaller scale have someone in China assist with interacting with the manufacturers. A big issue is the large amount of miscommunication which always seem to happen when western companies try to deal with manufacturers directly.
Tangentially related: I'm a data scientist based in London, and I'm just thinking about becoming a contractor, but I don't see many position. I thought companies, because the strategic knowledge of the position, prefer to have those skills in house... do you think it's true?
For now, just learn the basics (simple html, simple DOM manipulation, simple jQuery, simple CSS, simple Javascript).

Those fancy frameworks are all going to be obsolete in 2 years anyway (i.e. angular 1.0). Besides, you need to know the basics in order to use the fancy frameworks CORRECTLY.

Unfortunately, most employers want you to be an expert already in whatever tools they are using. I know people will object and say they hire for talent and not resume keywords, but that hasn't been my experience as a candidate.

The reason employers want full-stack instead of back-end is that it cuts down on the communication overhead. You can do it all yourself, rather than handing off the front-end bit to other people. I'd rather hand off tricky front-end work to someone who knows it better.

My experience is mostly back-end, but recently I've been doing some simple front-end work. It makes more sense to have separate back-end and front-end specialists, but that isn't the way things are done anymore.

I wrote a video poker practice game in Javascript/jQuery/PHP/C++. It works, and my father is playing it, and he likes it. It isn't fancy modern web style, but it runs and gets the job done. (Javascript/jQuery on the client, with simple CSS. PHP with a shell_exec to C++ to do the calculation of the optimal strategy. The client does an AJAX call to get the next hand.)

Try writing something like minesweeper or a sudoku game in Javascript/CSS for practice.
They're not really "deploy-only" keys, but rather "automation keys".

Personally, I've used them a lot to mirror from my own gitlab server onto github, so having them be read+write was a good thing in my case.

I know a lot more people use them to mirror stuff onto gh as well.
Mastering industry consolidation